Kaspersky
Penetration TestingEnsuring that your IT infrastructure is fully secured against potential cyberattack is an ongoing challenge forany organization, but even more so for large enterprises with perhaps thousands of employees, hundredsof information systems, and multiple locations worldwide.
Penetration testing is a practical demonstration of possible attack scenarios where a malicious
actor may attempt to bypass security controls in your corporate network to obtain high privileges
in important systems.

What is Kaspersky Penetration Testing?
The service helps you and your organization to:
Kaspersky’s Penetration
Testing gives you a greater
understanding of security flaws
in your infrastructure, revealingvulnerabilities, analyzing
the possible consequencesof different forms of attack,evaluating the effectiveness of
your current security measuresand suggesting remedialactions and improvements.

•Identify the weakest points in your network, so you can make fully
informed decisions about where best to focus your attention and budget
in order to mitigate future risk.

•Avoid financial, operational and reputational losses caused by cyberattacks by preventing these attacks from ever happening throughproactively detecting and fixing vulnerabilities.

Service Scope and Options
Depending on your needs and your IT infrastructure, you may choose to employ any or all of these services:

External penetration testing:Internal penetration testing:

Security assessment conducted through theInternet by an ‘attacker’ with no preliminary
knowledge of your system.

Scenarios based on an internal attacker, such asa visitor with only physical access to your offices
or a contractor with limited systems access.

You can include any part of your IT infrastructure into the scope of penetration testing, but we strongly recommend you
consider the whole network or its largest segments, as test results are always more worthwhile when our experts areworking under the same conditions as a potential intruder.

About Kaspersky’s Approach
to Penetration Testing
Penetration Testing
Results
The Service is designed toreveal security shortcomings
which could be exploited to gain
unauthorized access to critical
network components. Thesecould include:

While penetration testing emulates genuine hacker attacks, these tests aretightly controlled; performed by Kaspersky security experts with full regard to
your systems’ confidentiality, integrity and availability, and in strict adherence tointernational standards and best practices including:•Penetration Testing Execution Standard (PTES)•NIST Special Publications 800-115 Technical Guide to Information Security
Testing and Assessment•

Open Source Security Testing Methodology Manual (OSSTMM)•Information Systems Security Assessment Framework (ISSAF)•Web Application Security Consortium (WASC) Threat Classification•Open Web Application Security Project (OWASP) Web Security TestingGuide• Configuration flaws, includingexcessive user privileges•

Common Vulnerability Scoring System (CVSS)• Vulnerabilities caused byerrors in application code
(code injections, path traversal,client-side vulnerabilities, etc.)

Project team members are experienced professionals with a deep, current
practical knowledge of this field, acknowledged as security advisors by industry
leaders including Oracle, Google, Apple, Microsoft, Facebook, PayPal, Siemens
and SAP.

• Vulnerable networkarchitecture, insufficient
network protection• Vulnerabilities leading tonetwork traffic interception
and redirection• Insufficient authentication
and authorization in different
services• Weak user credentials• Vulnerabilities caused byusage of outdated hardware
and software versions without
latest security updates• Information disclosure
Results are given in a final report
including detailed technicalinformation on the testingprocess, results, vulnerabilities
revealed and recommendations
for remediation, as well as an
executive summary outlining
test results and illustrating
attack vectors. Videos andpresentations for your technicalteam or top management canalso be provided if required.

Delivery Options
Depending on the type of security assessment service, your systems specifics
and working practices, security assessment services can be provided remotely
or onsite. Most services can be performed remotely, and internal penetration
testing can even be performed through VPN access, while some services (likewireless networks security assessment) require an onsite presence.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com© 2024 AO Kaspersky Lab.
Registered trademarks and service marks
are the property of their respective owners.

#kaspersky#bringonthefuture