Penetration testing
Test the area in scope.
Offsecure tests a defined area the way an attacker would use it. Web applications, networks, and cloud. The work names its method up front, and it does not end at a list of findings.
Penetration testing simulates a malicious attacker against an agreed area, so the organization can see the weakness and how to close it. Qualified testers run the assessment against the frameworks the engagement is built on.
Why it is commissioned
The test is there to find the issue before someone else uses it, and to leave the team with a way to fix it.
Frameworks
The method follows recognized frameworks. OWASP, NIST, and OSSTMM, applied to the area under test, whether that is an application, a network, or cloud infrastructure.
The testers
The people who run these tests have years across industries. Many hold OSCP, OSCE, CISSP, and CREST. An engagement draws on the qualifications the work needs.
Fitted to the estate
The scope is this environment. On premises, cloud, or hybrid, and sized to the organization in front of it.
After the report
The result is not a list left on a desk. The testers work with the IT and security teams on remediation and on the change that keeps the same weakness from returning.
Where it is taken
Each area can be booked on its own.
Application security
Web applications, APIs, and mobile apps, tested to OWASP. The findings include injection, cross-site scripting, and weak authentication, with the fix for each.
Network security
Internal and external networks. Firewall configuration, segmentation, and the paths that would allow unauthorized access, a breach, or ransomware.
Cloud security
Configuration review and a cloud penetration test on AWS, Azure, GCP, and the other platforms in use, including the compliance questions those accounts raise.
The quality of delivery of service was adequate. Every step of the process was understandable and results were achieved without difficulties.
Jonathon Prescott (CTO)