The SecureState Profiling Team are well known and highly regarded as experts in Penetration Testing. Our approach follows industry accepted testing methodologies such as PTES, NIST 800-115, OWASP and OSSTMM.By following these methodologies, our clients can accurately replicate the testing SecureState has performed in their own environment to accurately mitigate identified vulnerabilities. The SecureState Profiling Team also helps identify strategic “root cause” issues through our Penetration Tests. Our Risk Management Team is uniquely positioned to work closely with the Profiling Team in order to assist clients with mitigating these strategic “root cause” issues.

Phase I – Pre-engagement Interactions:

In this phase, SecureState works with the client to establish the rules of engagement and scope. We also exchange contact information of both parties as well. Next, we provide a detailed Project Charter which contains information regarding scope and everything that will be required to conduct the testing. The Project Charter is discussed on the kickoff call prior to the beginning of the engagement.

Phase II – Information Gathering:

SecureState gathers the URL that is in scope and determines what type of web application vulnerability scan needs to be conducted. Depending on the design and complexity of the web site, a manually assisted or fully automated scan will be conducted.

Phase III – Vulnerability Scanning:

In the case of a manually assisted vulnerability scan, SecureState will navigate the web site and use an active web application vulnerability scanner on each page of the application. In the case of a fully automated scan, SecureState will configure the vulnerability scanner to automatically scan the website. Upon the clients request, this scan can be scheduled to be performed off hours or during maintenance windows if applicable. SecureState only uses the best open source and commercial web application security vulnerability scanners such as Burp Suite’s Active Scan, w3af, SkipFish and Acunetix.

Phase IV – Manual Validation:

Upon completion of the vulnerability scanning phase, SecureState will manually validate all High and Extreme vulnerabilities discovered. For example, if SQL Injection is found, SecureState will determine if the vulnerability is exploitable. In addition, any Extreme findings confirmed will be immediately communicated to the client.

Phase V – Reporting:

As part of the deliverable, SecureState provides a report which contains a short graphical summary aimed at senior management. Additionally, a narrative body which details major findings and a detailed findings section aimed at technical staff is provided. SecureState also provides a closing call and high level executive presentation to summarize the penetration test, as well as provide an opportunity to ask questions about the engagement.

• SecureState uses a team based approach for all Web Application Security Assessments
• Utilizes proprietary Vulnerability Linkage Theory (VLT) to achieve a greater attack
• Demonstrates proprietary tools to Clients during on site Web Application Security Assessments
• Publishes our own Exploits, Zero Days and Tools to the Information Security Community
• Profiling Team members are known as experts in Web Application Security Assessments worldwide
• Contributed significantly to OWASP’s Web Application Testing Guide project
• Profiling Team members are frequent speakers at national and world-wide security and hacking conferences such as DEFCON, Black Hat, OWASP AppSec, SANS, ShmooCon, THOTCON, DerbyCon, ToorCon and more
• Conducts all external Web Application Security Assessments from our state-of-the-art hacking war room in SecureState’s world headquarters, a DOD cleared facility
• Provides a secure two-factor authentication web portal for access to Web Application Security Assessment results
• Follows industry standard testing methodologies, vulnerability rating systems and uses real attack data collected by SecureState through years of assessments to compare your company to your industry peers from a security perspective

• XFS 101: Cross-Frame Scripting Explained
• Information Security Assessments You’ve Never Had
• WebApps Training with Dave Kennedy
• Let’s Go with the Web Application Scan…
• But My Web Application Uses SSL

• Grey Box Web Application Security Assessment
• White Box Web Application Security Assessment
• Web Application Security Developer Training