Network & Application Layer Penetration Testing

Find your security weaknesses before they do.

A Network and Application Layer Penetration Test simulates a real-world attack against your network infrastructure and information systems to identify vulnerabilities and risks which may impact the confidentiality, integrity or availability of your data. It’s imperative to conduct a penetration test regularly if your environment is processing and storing sensitive data (like payment card data or protected health information) and those same systems have access to the Internet. In fact, if your business is subject to compliance mandates like the PCI DSS, penetration testing is likely required.

Unlike a vulnerability assessment or automated vulnerability scan, security engineers performing penetration testing actively try to uncover vulnerabilities and then exploit them in order to breach your systems or obtain access to sensitive data. This manual, hands-on approach allows the tester to intelligently probe and launch attacks from a variety of vectors and under a variety of conditions within the environment. As a result, your organization can gain full visibility and understanding of how malicious entities may be attacking your systems and to what extent they are at risk.

Verify your security and meet compliance requirements with a penetration test.

Engagements are tailored to your needs.

The penetration testing engagement begins with an agreement between you and ControlScan on the scope of testing to be conducted, including the target environment and the various approaches to be taken.

Depending upon your business’s needs, the penetration test can be performed from one or both of the following perspectives:

• An External Penetration Test adopts the approach of an anonymous attacker somewhere out on the Internet looking to breach your perimeter defenses and gain access to your environment.
• An Internal Penetration Test shows you the risks posed to your information systems by an insider (e.g., an employee or contractor) or an attacker that has already breached your perimeter.

Both types of testing provide valuable insights into your organization’s risk exposure, but from different perspectives.

During the engagement, our security testers perform reconnaissance of in-scope systems to identify services and functions which may be vulnerable, followed by a discovery of vulnerabilities affecting in-scope targets and then finally attempt to exploit those vulnerabilities in order to compromise the exposed systems. All of this is done with your knowledge and permission.

Upon completion, a formal report is prepared detailing the findings uncovered by the testing process. The tester that conducted the exercise walks you through the report in detail, ensuring you understand the weak points and gaps discovered and have a strategy for strengthening them. Most clients remediate the findings and then engage ControlScan to retest and verify the target environment is secure.

“We have partnered with ControlScan for the past two years for assistance with our PCI validation. ControlScan has always been professional, timely and knowledgeable [while helping us determine] the best way to validate our environment. Our projects have been well communicated, executed and followed up on through completion; the team has always been open to questions and easy to work with.”   — Hielan Management

Maintaining a secure network infrastructure and application environment is the best reason to undergo Network & Application Layer Penetration Testing, but there are other great reasons, too:

• Network Penetration Testing satisfies Requirement 11.3 of the Payment Card Industry Data Security Standard (PCI DSS) when performed against your cardholder data environment.
• Network Penetration Testing is also an optimal solution for safeguarding your protected health information (PHI), helping you to address your HIPAA and HITECH requirements.