Our Approach and
Methodology
The SecureState Profiling Team are well known and highly regarded as
experts in Penetration Testing. Our approach follows industry accepted
testing methodologies such as
PTES,
NIST 800-115,
OWASP and OSSTMM. By following these methodologies, our clients can accurately
replicate the testing SecureState has performed in their own environment
to accurately mitigate identified vulnerabilities. The SecureState
Profiling Team also helps identify strategic “root cause” issues through
our Penetration Tests. Our Risk Management Team is uniquely positioned
to work closely with the Profiling Team in order to assist clients with
mitigating these strategic “root cause” issues.
Phase I – Pre-engagement Interactions:
In this phase SecureState works with the client to establish the
rules of engagement as well as the scope and exchange contact
information for both parties. SecureState provides a detailed Project
Charter which contains information on scope and everything that will be
required to conduct the testing. The Project Charter is discussed during
the kickoff call prior to the beginning of the engagement.
Phase II – Information Gathering:
SecureState determines what programming language the application is
coded in and if it is a web application or fat client desktop
application. SecureState can assess both types of applications using
static binary analysis. To start the static analysis, we require the
compiled binaries of the application being testing. If possible, the
client should also provide SecureState the source code of the
application. Once these two steps are completed, the compiled binaries
are uploaded to Veracode via their secure web portal. No source code is
ever uploaded to Veracode.
Phase III – Review of Findings:
Once results are returned from Veracode, our Team Members review all
findings for false positives and ensures each piece of the application
has been through the Vercode process. This also includes all third party
libraries and components if they were provided during the Veracode
analysis.
Phase IV – Validation:
SecureState manually reviews the findings by validating extreme and
high findings either through manual techniques or by reviewing the
source code if provided by the client. This phase requires that the
client provide SecureState with access to the web application and any
necessary credentials. In the case of a fat client desktop application,
SecureState only needs the source code to review.
Phase V – Reporting:
SecureState provides a comprehensive report detailing where in the
application flaws and vulnerabilities exist (including line numbers and
URIs) as well as how we verified that these vulnerabilities truly exist.
As part of the deliverable, SecureState provides a report which
contains a short graphical summary aimed at senior management, a
narrative body which details major findings, and a detailed findings
section aimed at technical staff. SecureState also provides a closing
call and high level executive presentation to summarize the penetration
test; as well as provide an opportunity to ask questions about the
engagement.