Coast and Lowcountry
Penetration testing in Charleston and Savannah
Testers work within an agreed scope to reach further into systems than the design intends, for businesses from Charleston to Savannah.
Confirming vulnerabilities
Real problems confirmed by manual testing
Scanners list possible problems, and a configuration score shows a control is switched on, not that it holds. Penetration testing services confirm which problems are real by attempting them.
- 1
Scanners list possible problems
A scanner lists possible problems, while a penetration test reaches further into the systems.
- 2
Testers attempt them within scope
Manual testing attempts to exploit potential vulnerabilities within an agreed scope, distinguishing real risk from theoretical flaws.
- 3
Findings confirmed by hand
Findings are confirmed by hand, as a person attempts them to confirm which are real.
Small issues combined into larger routes
Minor misconfigurations look harmless alone. Hand testing chains them together into one larger route, demonstrating how an initial foothold leads to broader access across your network and cloud.
Reasons for penetration testing
Typical reasons for testing include a deadline to produce evidence, a recent migration, a new application or office, or a cloud tenant that has grown over time.
Requirement
Engagement type
Starting points. Scoping settles the final list.
Building a clear scope
Scoping settles what is in bounds, how much the tester is told in advance, and when testing runs. Engagements are sized by number of people in five bands.
Engagement type
Tester knowledge
Business size
- In bounds
- Tester starts with
- Size band
- Timing
- Set in scoping
Process from scope to closure
Testing moves through a defined sequence, ensuring findings are verified and remediation is confirmed in writing.
- Summary
- Hand testing confirmed one external vulnerability, one cloud misconfiguration, and one internal flaw. Remediation steps are provided for your environment.
- Do first
- Disable the exposed administration panel immediately to prevent unauthorized access.
Exposed administration interface High
- Did
- Scanned external IP addresses and found a login portal.
- Came back
- Portal responded to default administrator credentials.
- Fix
- Restrict administration portal access to internal IP addresses only.
- Retest
- Closed Retest confirmed the portal is unreachable from the internet.
Overly broad guest permissions Medium
- Did
- Reviewed identity and access rules in the cloud tenant.
- Came back
- Guest accounts possessed read access to all directory objects.
- Fix
- Modify guest user settings to restrict directory read access.
- Retest
- Closed Retest confirmed guests cannot read directory objects.
Unsecured file share Low
- Did
- Browsed local network shares from a standard user workstation.
- Came back
- Found a legacy file share granting read access to everyone.
- Fix
- Remove the open share or restrict access to specific groups.
- Retest
- Closed Retest confirmed the share is no longer accessible.
Closing the loop
Remediation written for your environment
Remediation work can be done by the same people who ran the test, or the guidance is given to be applied separately. Microsoft Defender and Microsoft Sentinel record changes from a test on the Azure estate in the same timeline.
- 1
Plain-language summary
Written reports open with a plain-language summary and precise instructions on what to do first.
- 2
Environment-specific fixes
Remediation guidance is written specifically for the environment where the finding was discovered.
- 3
Written closure
Remediated findings are retested, and the closure is confirmed in writing for your records.
Questions about testing
- What is a pen test, and how does it differ from a scan?
Scanners list possible problems. A penetration test involves a person working within an agreed scope to reach further into systems than the design intends, confirming which problems are real by attempting them.
- Which engagement types exist?
Four engagement types are offered: external and internal network, cloud configuration review, web application and API, and phishing and social engineering.
- What does scoping settle?
Scoping settles what is in bounds, how much the tester is told in advance, and when testing runs. Pricing and timing are settled during scoping, so please call.
- What does the report contain?
Reports open with a plain-language summary and what to do first. Each finding is written with what was done, what came back, its severity, and remediation written for the environment.
- Do you also fix what is found?
Remediation work can be done by the same people who ran the test, or the guidance is given to be applied separately.
- Can a business that is not an existing client ask for a test?
Penetration testing is a normal way to start with CloudCentric. Engagements are not limited to existing clients.
- Will a test satisfy a rule or standard?
Testing can produce evidence for requirements like PCI DSS, HIPAA, FTC Safeguards, and CMMC. Businesses confirm what applies to them with their acquiring bank, assessor, insurer or counsel.
Start your scoping process
Book a walkthrough or call to discuss your testing requirements.