2024-308-E-IT Dept-Trustedsec-Penetration testing and cybersecurity consulting

Browse Search

Orange County North Carolina TrustedSec Confidential 8 Exploitation The Exploitation phase is a precision-strike against a target where there is a high confidence level that the attack will be successful. This phase highlights the ability to circumvent the controls in place, and to gain access to unauthorized systems, facilities, or information. Under no circumstances will TrustedSec perform denial-of-service (DoS) activities. Regarding exploitation that has the potential to cause loss of availability, TrustedSec will communicate these activities prior to running any system-limiting attacks. As necessary, an agreement can be negotiated to run off-hours, or perform a manual validation of the exposure. TrustedSec conducts all exploitation activities with a high degree of caution prior to executing these forms of attack. Post-Exploitation In this phase, TrustedSec will locate key systems, sensitive data, and additional exposures to showcase maximum impact to the organization. The goal of this phase is to identify critical or confidential information, with the likelihood of further exploitation and potential exposure of that information during an attack. Often, one single exposure, or a series of vulnerabilities chained together, allow for TrustedSec to breach the perimeter defenses (or internal systems) and further compromise systems, based on the information obtained from the compromise. All of this is accomplished while avoiding detection and evading common preventative technologies (such as end point protections, application whitelisting, next generation firewalls, etc.). During the Post-Exploitation phase, TrustedSec will attempt to identify intellectual property, personally identifiable information (PII), and regulated data. Sensitive systems will be targeted, as well as users with elevated privileges, in order to gain a higher degree of control within the network environment. Reporting The Reporting phase is by far the most important aspect of any testing activities. The ability to effectively communicate how the attacks were successful, and most importantly, how to mitigate them moving forward, is paramount. TrustedSec spends a great deal of time and effort on this phase of the engagement. Each report is unique to the client and focuses heavily on understanding the exposure, ways to reproduce the vulnerability, and the recommended mitigation steps. TrustedSec organizes vulnerabilities into two categories: strategic and technical. Technical Findings are simply the exposure (the exploit, vulnerability, etc.) and the suggested remediation steps. Strategic Recommendations are systemic exposures identified during the assessment that may indicate security program deficiencies. If solely Technical Findings DocuSign Envelope ID: AFDC1276-5BF5-4129-B1DC-BCD00B65C8BC