Penetration Testing Overview

Attackers often exploit the gap between the principles of sound defensive security design and real-world implementation or maintenance. Examples of this include lead time between announcement of a vulnerability and actual implementation of a patch; well-intentioned policies which have no enforcement mechanism (especially those intended to restrict risky human actions); failure to apply hardened configurations or other industry-leading practices to the entire enterprise; failure to understand complex interaction between multiple defensive tools, or with normal system operations that have security implications.

Penetration testing starts from the identification and assessment of vulnerabilities that can be identified in the enterprise. It complements this by designing and executing tests that demonstrate specifically how an adversary can either subvert the organization's security goals (e.g., the protection of specific Intellectual Property) or achieve specific adversarial objectives (e.g., establishment of a covert Command and Control infrastructure). The result provides deeper insight, through demonstration, into the business risks of various vulnerabilities.

URU has comprehensive solutions to provide penetration tests that are tailored to meet the specific needs of our customer. Every assessment that we perform includes the following:

Testing of defensive capabilities

Successful defense requires a comprehensive program of technical defenses, good policy and governance, and appropriate action by people. In a complex environment where technology is constantly evolving, and new attacker tradecraft appears regularly, regular penetration testing is an effective means to identify gaps in defensive controls  and to assess their readiness.

Effective results through collaboration

Penetration tests are intended to replicate the capabilities of advanced threat agents in order to identify vulnerabilities and provide deeper insight, through demonstration, into the business risks of various vulnerabilities. One of the biggest challenges to effective penetration testing is often time; real world threats are not on an hourly clock and can take their time to be thorough. URU bridges this gap where possible by leveraging all possible sources of threat intel to steer testing efforts to the most opportune and relevant targets. This includes results of other security assessment activities as well as close collaboration with customer stakeholders. As a result, URU can deliver tests that have enhanced depth-of-coverage while still maintaining efficient testing timeframes

Detailed reporting

In addition to standard vulnerability reporting and analysis, URU penetration tests also include overall testing narratives where exploit paths are explained in detail, highlighting combinations of control failures or opportunities for improvement. This provides valuable insight and highlights how multiple vulnerabilities may be leveraged in tandem by would-be attackers in order to effect a serious breach of security.