691 Stickley Oak Way, Woodstock, GA 30189
External Penetration Testing
What Is External Penetration Testing?
An external penetration test (commonly known as a pentest) is a combination of automated and manual testing designed to assess and test the posture of an organization's perimeter security controls to remote attacks and threat vectors. This simulates the activities of real attackers to identify security holes in perimeter systems that are directly connected to the internet and/or accessible externally by users on the internet - for example websites and email servers.
​
The external penetration test entails the use of industry certified tools and technologies to demonstrate the compromise of your externally facing systems, gain access to sensitive information, discover ways to further infiltrate the network to harvest critical information, test the extent to which an attack can infiltrate the network, and analyze the business impact of a successful attack.
This type of penetration test is aimed at testing from the attackers perspective with no prior access to your systems or networks - to ensure that no threat actor can get into your via your perimeter systems. External Penetration testing is an essential first step in your organization's cybersecurity journey.
​
What you gain from External Penetration Testing
​
- Visibility as to how a remote attacker could compromise your public-facing systems.
-
Insight into how to prioritise your security spend based on actual risks.
-
Understanding as to how an attack might occur providing an opportunity to formulate an incident response plan that is relative to your likely risks.
-
Uplifting of the security capabilities of your IT team through our recommended remediation.
-
Confidence that you are closer to achieving your business’s compliance and regulation requirements.
​
At Bastion-Fort Security, we have experience in using external infrastructure testing methodologies to identify these security flaws that could potentially be exploited by bad threat actors. These include:
​
-
scoping and reconnaissance,
-
vulnerability identification and exploitation,
-
identifying firewall misconfigurations,
-
other external pentest attack techniques.
​
We recommend External Penetration Testing be conducted annually or after any major network changes to perimeter systems and services.
​
​
​
Our Methodology
Bastion-Fort Security has extensive experience with complex architecture designs gained through years of experience working with clients of all sizes, industries and structures. As we are stay updated with hreat activity on a daily basis, we are constantly learning about the latest attack techniques, exploits and security flaws. Our methodology covers:
​
-
Reconnaissance – Our team of security consultants will perform information gathering before any simulated attacks are executed.
-
Vulnerability Detection – Bastion-Fort Security will perform vulnerability detection to discover flaws in systems, networks and applications which can then be leveraged by the consultant.
-
Exploitation – Bastion-Fort Security will try to actively exploit security weaknesses identified in the vulnerability detection phase. To achieve this Pure Security may use publicly available, in-house developed or commercially available exploit kits.
-
Privilege Escalation – After a target has been successfully compromised, Bastion-Fort Security will try to gain a further foothold within the organization, this may involve gaining higher privileges in the system or potentially gaining access to other systems on the internal network. The end goal is to gain complete control of the network.
-
Data Exfiltration – Based on the scope of the project, Bastion-Fort Security may be required to perform data extraction. To achieve this, our security consultant will use a set of tools and techniques in order to extract specific data from the organization’s network.
-
Reporting and Delivery – Bastion-Fort Security will document, in priority order, the issues identified, along with recommendations for every issue identified. These are presented in a clear and meaningful way for both a technical and a business audience.