A penetration test determines how well your organization's security policies protect your assets by trying to gain access to your network and information assets in the same way a hacker would. Tests can range from an overview of the security environment to attempted "hacking" with the intent of obtaining investigative information. Our penetration testing will reveal:

• How difficult it is to obtain data from outside of the network
• Which information is at risk
• What measures should be implemented to protect your assets

A penetration test subjects a system to real-world attacks selected and conducted by our security staff. The benefit of a penetration test is to identify the extent to which a system can be compromised before an actual determined attack. Our test results will suggest you where you to need enhance your security better. Only a real penetration test can simulate what would happen if a determined hacker were to attack your organization. ForceOne has rich experience and expertise in encountering possible attacks and exploits used against mission critical assets.

Our Penetration Testing Process

Discovery
ForceOne will perform thorough searches of the various whois databases, scan tools, etc, to obtain as much information as possible about the target organization. These searches often reveal many more Internet connections than the organizations expect. It is also important to leverage Usenet postings and Social Engineering tactics (if in scope) - many organizations are amazed by how willing their employees are to divulge information that is useful to an attacker.

Enumeration
Once specific domain names, networks and systems have been identified through discovery, the penetration tester will gain as much information as possible about each one. The key difference between discovery and enumeration is the level of intrusiveness. Enumeration involves actively trying to obtain user names, network share information and application version information of running services, limited only by agreed-upon rules of engagement and scope.

Vulnerability Mapping
Vulnerability mapping, one of the most important phases of penetration testing, occurs when security practitioners map the profile of the environment to publicly known, or, in some cases, unknown vulnerabilities. ForceOne has a dedicated research department, which is constantly combing the “blackhat” community for new and emerging vulnerabilities. The tester's most critical work is performed during the discovery and enumeration phase.

Exploitation
The exploitation phase begins once the target system's vulnerabilities are mapped. The penetration tester will attempt to gain privileged access to a target system by exploiting the identified vulnerabilities. The key to this phase is manual testing. No automated tool can duplicate the testing of an experienced penetration tester who is skilled in the art.

Reporting
ForceOne works with you to develop a report that will provide clear findings and a prioritized matrix of actions, work efforts, and findings. ForceOne will provide a preliminary draft report to the technical point of contact for the purposes of review and clarification followed by a final report at the conclusion of testing.

Recommendations & Support
ForceOne services will be available for up to one year to provide additional support for findings and recommendations, or any remediation efforts.

Contact ForceOne for additional information or assistance.