2024-308-E-IT Dept-Trustedsec-Penetration testing and cybersecurity consulting

Browse Search

Orange County North Carolina TrustedSec Confidential 7 Technical Assessments 1.3.1 Penetration Testing Execution Standard (PTES) Phases TrustedSec uses the Penetration Testing Execution Standard (PTES), a standard that has gained wide adoption within the security community, as a methodical way to approach Penetration Testing. PTES defines a penetration test as the ability to attack an organization as an adversary, with a goal of affecting a company’s potential to generate revenue. Additionally, TrustedSec also utilizes the NIST SP800-115, Technical Guide to Information Security Testing and Assessment, as a framework for security testing. Pre-Engagement Interaction The pre-engagement interaction phase will focus heavily on understanding Orange County North Carolina's purpose for the penetration test and expected outcomes during the assessment. This is a foundational meeting for establishing the criteria, expectations, and delivery times for the assessment. As part of this assessment, formal points of contact and escalation points will be determined. Intelligence Gathering During this phase, TrustedSec will perform reconnaissance of Orange County North Carolina and identify any Open Source Intelligence (OSINT) that may be applicable for attacking the organization. This information will help in identifying the most impactful point of entry into the organization or infrastructure. Intelligence Gathering relies heavily upon understanding the organization and how it performs business on a broad scale. As an attacker, using this information is highly beneficial for profiling how the attack will occur. Threat Modeling Using the information obtained from the Intelligence Gathering phase, TrustedSec will begin to profile Orange County North Carolina and identify the best route of entry. Threat Modeling uses a solid understanding of a client’s environment to profile the best way into the organization. Simple probing will be used during this phase to identify protection mechanisms, versions, and other non-obtrusive aspects to understand how the infrastructure is designed. Vulnerability Analysis The vulnerability analysis phase focuses heavily on taking the information from the Threat Modeling phase and determining the best route into the organization. During a penetration test, TrustedSec acts as the attacker and finding the easiest route into the organization is the top priority. Understanding how the business functions and what systems are in place in those areas is highly important to the assessment. During this phase, the best attack vectors are selected. DocuSign Envelope ID: AFDC1276-5BF5-4129-B1DC-BCD00B65C8BC