Network security
The network, tested.
Offsecure tests the network by walking the path an attacker would take, from reconnaissance through post-exploitation. The method follows the Penetration Testing Execution Standard, and goes past it where the network requires a technique of its own.
A network penetration test finds the weaknesses in the infrastructure and shows how far they go. The testers exploit what they find, so the organization sees the depth of the path, not only the name of the flaw.
What the test covers
Internal and external. The view from outside the perimeter, and the view from a foothold already inside.
Exploitation
Domain and local privilege escalation, lateral movement, and post-exploitation. The test shows how far an attacker could go, rather than stopping at the first finding.
Reconnaissance
The network is mapped, the assets that matter are identified, and the information an attacker would gather is gathered first.
Configuration
Topology and configuration, including Active Directory, reviewed for the weakness an attacker would use.
Both sides
External tests and internal tests, so the posture is not judged from a single direction.
What is handed over
The engagement stays in contact while it is open, and it does not end when the report is sent.
- The full chain. Reconnaissance through post-exploitation, external and internal, with the weaknesses that chain was able to use.
- Communication. Progress, findings, and anything critical are passed during the test. Questions are answered while the work is open.
- The report. Vulnerabilities, the method used to exploit them, and the remediation. Written for a technical reader and for an executive reader.
- The hardening. Guidance past the single patch. The process and the defensive change that make the same path harder next time.
- After the engagement. Support while the fixes are made, and a view of what should be tested again.
