Ensuring that your IT infrastructure is fully secured against potential cyberattack is an ongoing challenge
for any organization, but even more so for large enterprises with perhaps thousands of employees, hundredsof information systems, and multiple locations worldwide.
Penetration testing is a practical demonstration of possible attack scenarios where a malicious actor may
attempt to bypass security controls in your corporate network to obtain high privileges in important systems.

Kaspersky’s Penetration Testing gives youa greater understanding of security flaws inyour infrastructure, revealing vulnerabilities,
analyzing the possible consequencesof different forms of attack, evaluating
the effectiveness of your current security
measures and suggesting remedial actions
and improvements.

Penetration Testing Services

Penetration Testing from Kaspersky helps you and your organization to:• Identify the weakest points in your network, so you can make fully informed
decisions about where best to focus your attention and budget in order to mitigate
future risk.
• Avoid financial, operational and reputational losses caused by cyber-attacks
by preventing these attacks from ever happening through proactively detecting andfixing vulnerabilities.
• Comply with government, industry or internal corporate standards that require
this form of security assessment (for example Payment Card Industry Data Security
Standard (PCI DSS)).

Service Scope and Options

Depending on your needs and your IT infrastructure, you may choose to employ any
or all of these Services:• External penetration testing: Security assessment conducted through the Internet
by an ‘attacker’ with no preliminary knowledge of your system.
• Internal penetration testing: Scenarios based on an internal attacker, such as a visitor
with only physical access to your offices or a contractor with limited systems access.
• Social engineering testing: An assessment of security awareness among yourpersonnel by emulating social engineering attacks, such as phishing, pseudo-malicious
links in emails, suspicious attachments, etc.
• Wireless networks security assessment: Our experts will visit your site and analyze
WiFi security controls.
You can include any part of your IT infrastructure into the scope of penetration testing,but we strongly recommend you consider the whole network or its largest segments, astest results are always more worthwhile when our experts are working under the same
conditions as a potential intruder.

Penetration Testing Results

The Service is designed to reveal security
shortcomings which could be exploited to gain
unauthorized access to critical network
components. These could include:• Vulnerable network architecture,
insufficient network protection• Vulnerabilities leading to network
traffic interception and redirection• Insufficient authentication andauthorization in different services• Weak user credentials• Configuration flaws, including excessiveuser privileges• Vulnerabilities caused by errors inapplication code (code injections,path traversal, client-sidevulnerabilities, etc.)• Vulnerabilities caused by usage ofoutdated hardware and software
versions without latest security
updates• Information disclosure
Results are given in a final report including
detailed technical information on the testingprocess, results, vulnerabilities revealed andrecommendations for remediation, as well as
an executive summary outlining test results
and illustrating attack vectors. Videos andpresentations for your technical team or top
management can also be provided
if required.

Cyber Threats News: www.securelist.com
IT Security News: business.kaspersky.com
IT Security for SMB: kaspersky.com/business
IT Security for Enterprise: kaspersky.com/enterprisewww.kaspersky.com
2019 AO Kaspersky Lab. All rights reserved.
Registered trademarks and service marks are the propertyof their respective owners.

About kaspersky’s Approach
to Penetration Testing

While penetration testing emulates genuine hacker attacks, these tests are tightlycontrolled; performed by Kaspersky security experts with full regard to your systems’
confidentiality, integrity and availability, and in strict adherence to international
standards and best practices including:• Penetration Testing Execution Standard (PTES)• NIST Special Publications 800-115 Technical Guide to Information Security Testingand Assessment• Open Source Security Testing Methodology Manual (OSSTMM)• Information Systems Security Assessment Framework (ISSAF)• Web Application Security Consortium (WASC) Threat Classification• Open Web Application Security Project (OWASP) Testing Guide• Common Vulnerability Scoring System (CVSS)
Project team members are experienced professionals with a deep, current practicalknowledge of this field, acknowledged as security advisors by industry leaders including
Oracle, Google, Apple, Microsoft, Facebook, PayPal, Siemens and SAP.

Delivery Options

Depending on the type of security assessment service, your systems specifics andworking practices, security assessment services can be provided remotely or onsite.
Most services can be performed remotely, and internal penetration testing can evenbe performed through VPN access, while some services (like wireless networks securityassessment) require an onsite presence.

We are proven. We are independent. We aretransparent. We are committed to building a safer
world, where technology improves our lives. Whichis why we secure it, so everyone everywhere has theendless opportunities it brings. Bring on cybersecurity
for a safer tommorow.
Know more at kaspersky.com/transparency