Vulnerability & Penetration Test

Internal & External Penetration Testing

Cyberstone’s internal and external penetration testing services help your customers find areas of weakness in their technical environment. Beyond vulnerability discovery, we will actively attempt to exploit any discovered weaknesses using real-world techniques such as privilege escalation, traffic sniffing, custom scripts, and exploitation toolkits.

The goal of internal/external penetration testing is to answer the question “how easily could a hacker access private data on my systems?”

Cyberstone carries out internal and external penetration testing according to the globally-recognized NIST SP-800 115 standard. Phases of penetration testing are listed below.

1. Establish rules of engagement
2. Attack surface reconnaissance
3. Exploitation
4. Analysis and reporting
5. Closeout meeting

Whether your customer is aiming to comply with a regulation or simply gain a better understand of the risk to their private data, our templated services are trusted and non-disruptive.

Cyberstone’s penetration testing services will help your customers comply with the following regulations.

• PCI Requirement 11.3.1 & 11.3.2
• New York State Department of Financial Services 23 NYCRR 500 §500.05(a)(1)
• Gramm-Leach-Bliley Act §501(b)
• Federal Trade Commission 16 CFR Part 314 §314.4

Policy Development

Information security policies provide organizations with clarity and standardization. They govern how security controls are installed and configured and also tell employees what behaviors are expected and acceptable while interfacing with information systems.

Policies are not static. Over time, corporate objectives may change, company cultures may change, and technology absolutely changes. As such, policy review should be a regular component of all cybersecurity programs.

We help organizations write comprehensive policies to address today’s unique cybersecurity challenges such as bring-your-own-device (BYOD) and the movement of workflows to the cloud.

Cyberstone will:

• Research and analyze the organization to determine policy priority and gaps in the organization’s policy library.
• Create new or modify existing policies.
• Document and deposit new policy in the organization’s policy library.
• Publish new policy to the impacted employees of the organization.

Frequently-requested policies:

• Governing Policy
• Password Policy
• Physical Security
• Backup Policy
• Vulnerability Mgmt
• Acceptable Use
• Incident Response
• Access Control
• Remote Access
• Third-Party Vendor Mgmt

Risk Assessment

Risk assessments are at the heart of every healthy cybersecurity program. They uncover the unique risks facing an organization and tie them to a custom-built risk-reduction roadmap. Risk assessments address what to do to minimize the impact of:

• natural disasters
• technology failures
• ransomware or other malware outbreaks
• sudden loss of key employees
• myriad other potential events or disasters

Cyberstone’s risk assessments provide a comprehensive evaluation of your customers’ information security risks, a mitigation strategy for the identified risks, and a foundation for the risk management process. The risk assessment service is based on the globally-recognized NIST SP800-30 Guide for Conducting Risk Assessments.

Our security engineers will review the information systems and processes of your customer’s business to determine areas of risk including their likelihood and impact.

The risk assessment service is conducted in a highly-structured manner involving the steps below.

1. System Characterization
2. Threat Identification
3. Vulnerability Identification
4. Control Analysis
5. Likelihood Determination
6. Impact Analysis
7. Risk Determination
8. Control Recommendations
9. Results Documentation

The output of the risk assessment is a document that includes risk statements with scored priorities and recommendations for safeguardswhere appropriate. This document will serve as a security plan for initiatives in the coming year and beyond.

Cyberstone’s risk assessment service will bring your customers closer to complying with the following regulations.

• PCI Requirement 12.2
• HIPAA §164.308(a)(1)(ii) (A)
• New York State Department of Financial Services 23 NYCRR 500 §500.09
• Gramm-Leach-Bliley Act §501(b) Federal Trade Commission 16 CFR Part 314 §314.4
• Federal Trade Commission 16 CFR Part 314 §314.4

Security Assessments

Cyberstone is adamant about doing security the right way. We find that organizations are quick to spend money on firewalls, endpoint protection, and other “common” controls. They then try to wrap policy around their technology purchases. Finally, they reach out to a security provider to grade their work. This has to be reversed.

To best secure your clients, a holistic assessment should come before written policy and expenditures on technical controls.

In our security assessments, we’ll ask your customer what gets them up every morning, what their corporate vision is, and what their 5-year and 10-year plans are. From this basic understand of their goals and objectives, we’ll be in a suitable position to discuss their unique risks and vulnerabilities.

Security assessments are fitting for organizations where one or more of the following is true:

• There was a recent breach and prevention of a future one is critical.
• There is a looming audit and stakeholders can’t sleep at night.
• Company leadership is concerned about keeping the lights on from a cybersecurity best-practices perspective.

As part of the assessment, Cyberstone will interview key personnel, catalog existing security policies, procedures, and controls, and examine information technology assets. By following the NIST SP800-115 guideline for information security assessments, Cyberstone will effectively uncover organizational and regulatory gaps.

Cyberstone’s reporting will provide your customer with a roadmap for adhering to industry best practices around cybersecurity. After the assessment, your customer will have a better handle on the effectiveness of existing information security investments. They’ll know where their money is being well-spent and where they may need to pivot.

Most of our security assessments uncover severely lacking or outdated written information security policy. After an assessment closeout meeting, we can help your customer in this area as well.

Vulnerability Assessment

Vulnerability assessments play a critical role in an organization’s ability to defend against security threats. They also help grade the effectiveness of technical controls already in place.

Not all vulnerabilities should be treated the same. Some will need to be addressed immediately while others may be addressed at a later date. Our reporting will give your customer an actionable roadmap for remediation. While other security companies simply run a tool and provide a 400-page report, we spend time ensuring that the results are concise, actionable, and without noise.

Cyberstone will look for areas of weaknesses such as missing patches, outdated firmware, unnecessary open shares, default passwords, incorrect permissions, and rogue devices. We then provide your customer with a prioritized “fix first” remediation report and step them through what needs to be done to close gaps in their defenses.

We follow the globally-recognized NIST SP-800 115 standard when performing vulnerability assessments.

Cyberstone’s vulnerability assessment services will help your customers comply with the following regulations.

• PCI Requirement 11.2.1 & 11.2.2​
• New York State DFS 23 NYCRR 500 §500.05(a)(2)
• Gramm-Leach-Bliley Act §501(b)
• Federal Trade Commission 16 CFR Part 314

Web App Penetration Testing

Web app penetration testing is laser-focused on helping partners secure their customers’ Internet-facing web applications. Cyberstone will evaluate the implementation of security controls for web applications by simulating real-world attacks.

The exploitation phase of web application penetration testing differs from internal/external penetration testing. Cyberstone will specifically attempt the following methods of exploitation: SQL injection, cross-site scripting, user context switching, directory traversal, and cookie handling.

Cyberstone uses the Open Web Application Security Project (OWASP) Top Ten framework as a guide to all of our web application penetration tests. OWASP is an open community meaning it receives input from small and large organizations in just about every vertical market. The community’s goal is to help organizations develop and maintain web applications that can be trusted. The current Top Ten vulnerabilities facing web applications are:

A1 Injection
A2 Broken Authentication and Session Management
A3 Cross-Site Scripting (XSS)
A4 Insecure Direct Object References
A5 Security Misconfiguration
A6 Sensitive Data Exposure
A7 Missing Function Level Access Control
A8 Cross-Site Request Forgery (CSRF)
A9 Using Components with Known Vulnerabilities
A10 Unvalidated Redirects and Forwards

Because Cyberstone cares about keeping your customers safe, we’ll work with them to ensure that a risk mitigation plan is in place prior to any testing efforts.

Our structured approach follows the steps below.

Planning

Defining the scope, rules of engagement, scheduling, communication planning, and acceptance criteria.

Discovery

Information gathering that will be used for the attack. Potential targets, vulnerabilities, and exploits are identified. Discovered assets are compared against known vulnerability databases to aid in penetration testing efforts.

Attack

Exploitation of targets based on discovered information. We’ll use a combination of manual and automated techniques, scripts, and toolkits to circumvent security controls.

Reporting

Documentation of successful exploits and their corresponding vulnerabilities and assets.

After web application penetration testing is complete, a Cyberstone security engineer will consult with your customer on application security. Consulting will cover how to best secure sensitive data on the web application backend database.

Cyberstone’s web application penetration testing service will help you customers comply with the following regulations:

• PCI Requirement 11.3.1
• New York State Department of Financial Services 23 NYCRR 500 §500.05(a)(1)
• Gramm-Leach-Bliley Act §501(b)
• Federal Trade Commission 16 CFR Part 314