The SecureState Profiling Team are well known and highly regarded as experts in Penetration Testing. Our approach follows industry accepted testing methodologies such as PTES, NIST 800-115, OWASP and OSSTMM. By following these methodologies, our clients can accurately replicate the testing SecureState has performed in their own environment to accurately mitigate identified vulnerabilities. The SecureState Profiling Team also helps identify strategic “root cause” issues through our Penetration Tests. Our Risk Management Team is uniquely positioned to work closely with the Profiling Team in order to assist clients with mitigating these strategic “root cause” issues.

Phase I – Pre-engagement Interactions:

In this phase, SecureState works with the client to establish the rules of engagement, as well as the scope; and exchange contact information for both parties. We provide a detailed Project Charter which contains information on scope and everything that will be required to conduct the testing. The Project Charter is discussed during the kickoff call prior to the beginning of the engagement.

Phase II – Reconnaissance:

Wireless access points in scope are probed using specialized tools to identify them as client property. APs are then selected for analysis, and as much information as possible is gathered regarding the targets; including default configurations and enabled encryption level. These findings are then reviewed to ensure they meet PCI DSS standards.

Phase III – Rogue Access Point Detection:

Using specialized tools, SecureState drives around the client’s property in scope to determine the location of rogue access points. Additionally, we conduct this detection while walking through any facilities that are in scope. Once rogue access points are identified, SecureState notifies client personnel to take action on the suspected rogue access points. SecureState can find rogue access points up to several feet of accuracy.

Phase IV – Reporting:

As part of the deliverable, SecureState provides a report which contains a short graphical summary aimed at senior management, a narrative body which details major findings as well as a detailed findings section aimed ta technical staff. SecureState also provides a closing call and high level executive presentation to summarize the penetration test; as well as provide an opportunity to ask questions about the engagement.

• Demonstrates our tools to clients during PCI Wireless Security Assessments
• Publishes our own Exploits, Zero Days and Tools to the Information Security Community
• Profiling Team members are known as experts in Wireless Security worldwide
• Profiling Team members are frequent speakers at National and world-wide security and hacking conferences such as DEFCON, Black Hat, OWASP AppSec, SANS, ShmooCon, THOTCON, DerbyCon, ToorCon and more
• Provides a secure two-factor authentication web portal for access to PCI Wireless Assessment results
• Follows industry standard testing methodologies and vulnerability rating systems

• PCI DSS and Penetration Testing
• Passing the PCI Buck
• Questioning PCI DSS 66A Web-Application Firewall Does Not Equal Security
• Another Reminder on Security PCI and PII Zappos Breached
• OS X Lion Captive Portal Hijacking Attack

• Wireless Attack & Penetration
• PCI Internal Attack & Penetration
• PCI External Attack & Penetration