The SecureState Profiling Team are well known and highly regarded as experts in Penetration Testing. Our approach follows industry accepted testing methodologies such as PTES, NIST 800-115 and OSSTMM. By following these methodologies, our clients can accurately replicate the testing SecureState has performed in their own environment to accurately mitigate identified vulnerabilities. The SecureState Profiling Team also helps identify strategic “root cause” issues through our Penetration Tests. Our Risk Management Team is uniquely positioned to work closely with the Profiling Team in order to assist clients with mitigating these strategic “root cause” issues.

Phase I – Pre-engagement Interactions:

In this phase, SecureState works with the client to establish the rules of engagement as well as the scope and exchange contact information for both parties. SecureState provides a detailed Project Charter which contains information on scope and everything that will be required to conduct the testing. The Project Charter is discussed during the kickoff call prior to the beginning of the engagement.

Phase II – Vulnerability Analysis:

SecureState will use the external ASV vulnerability scan results provided by the client to conduct this Vulnerability Analysis.

The ASV vulnerability scan results provide SecureState with not only vulnerability information, but also the exposed ports and services. SecureState will assess open ports and services from the scans to look for potential targets, such as accessible HTTP, Telnet, RDP, and other ports that allow remote access or web server functionality.

Vulnerability scanners are notorious for outputting numerous false positives that are not applicable to a given environment. SecureState consultants manually review scanner outputs to ensure verified vulnerabilities are applicable to only your PCI environment.

Phase III – Web Application Black Box Testing:

During PCI Attack and Penetration Testing, SecureState uses a limited Black Box level approach to test web applications that have been encountered. A Black-Box test design treats the system as a “black-box,” so it does not explicitly use knowledge of the internal structure. Black Box test design is usually described as focusing on testing functional requirements. Black Box testing will also help to identify many of the OWASP Top Ten vulnerabilities that are common to web applications. All tests will be made against the identified web applications. This phase meets the PCI-DSS requirement for application layer testing.

Phase IV – Exploitation:

First, SecureState will manually validate the results from the scan. Next, all identified vulnerabilities will be assessed as to the likelihood of exploitation. Communication will be made with the client’s Project Lead prior to any type of intrusive activity that could potentially impact network performance or system stability. Any high or critical risk exploit will also be communicated to the client upon discovery in order to initiate corrective actions.

Phase V – Locate Card Holder Data:

Once vulnerabilities have been exploited, SecureState will use any access obtained to locate card holder data. During this phase, we will also utilize multiple vulnerabilities and attack vectors to achieve a greater attack. This is called the SecureState Vulnerability Linkage Theory (VLT) and is provided to clients through visual representation in our report. Communication will be made with the client’s Project Lead once the card holder data is accessed so that corrective action may be implemented.

Phase VI – Post Exploitation:

The Post Exploitation Phase includes pillaging, penetrating further into the network, documentation and erasing any footsteps we may have left behind.

Phase VII – Reporting:

As part of the deliverable, SecureState provides a report which contains a short, graphical summary aimed at senior management; a narrative body which details major findings, and a detailed findings section aimed at the technical staff. SecureState also provides a closing call and high level executive presentation to summarize the penetration test as well as provide an opportunity to ask questions about the engagement.

SecureState:

• Uses a team based approach for all Penetration Tests
• Utilizes proprietary Vulnerability Linkage Theory (VLT) to achieve a greater attack
• Demonstrates proprietary tools to Clients during Penetration Testing
• Publishes our own Exploits, Zero Days and Tools to the Information Security Community
• Profiling Team members are known as experts in Penetration Testing worldwide
• Profiling Team members are frequent speakers at National and world-wide security and hacking conferences, such as DEFCON, Black Hat, OWASP AppSec, SANS, ShmooCon, THOTCON, DerbyCon, ToorCon and more
• Conducts all external Penetration Tests from our state-of-the-art hacking facility in SecureState’s world headquarters; a DOD cleared facility
• Has the capability to perform secure remote Internal Penetration Tests using the latest Penetration Testing technology
• Provides a secure two-factor authentication web portal for access to Penetration Test results
• Follows industry standard testing methodologies, vulnerability rating systems and uses real attack data collected by SecureState through years of assessments to compare your company to your industry peers from a security perspective

• So i just had a PCI Gap Assesment done
• Avoid-Becoming-a-Statistic
• Reassess your PCI Scope Virtual Terminals
• Importance of Letting the Penetration Tester Test
• Penetration Testing Choose Wisely for IT Security
• Visa Introduces (TIP) for Merchants

• External Attack & Penetration
• PCI Internal Attack & Penetration

• PCI External Attack and Penetration