Get A Quote

The objective of an external black-box penetration test is to harden the perimeter of your environment (firewall, VPN, website, etc.) as well as any external services that may be exposed to the internet (e.g. cloud infrastructure, DMZ services like email). Typically, this type of test is accompanied with an internal security configuration audit of network security devices protecting your perimeter.

Our Approach

The below gives an overview of some of the areas that will be assessed:
For black-box penetration testing MIST starts with methodologies based on the Penetration Testing Execution Standard (PTES) which can be summarized into the following steps:

Intelligence Gathering: In the first step of a penetration test, MIST looks for as much information about the targets as possible. This includes identification of used devices, services and applications as well as the discovery of valid possible user accounts and other actions.

Vulnerability Analysis: Once all systems and applications are properly identified, MIST performs analysis of found misconfigurations, design flaws, etc.

Exploitation: In this phase, MIST attempts to exploit any weaknesses or vulnerabilities identified in discovered assets that are part of the penetration test scope. MIST will look to manually exploit any weaknesses or vulnerabilities identified in the servers or web application with the objective of breaching it from a black box perspective (i.e. no credentials or knowledge of the systems).

Post-exploitation: After gaining access to a compromised device/application, we attempt to establish full control of it, determine the usefulness of this device/application for next attacks and optionally make lateral movement further into a network.

Reporting: We provide a description of all discovered attack vectors along with their severity (based on complexity, probability, user interaction, etc.) and possible remediation steps.

All testing by MIST is performed by a human using a blend of automated and manual procedures. We do not simply “scan and patch”.

Reporting and Deliverables:

Pen Testing Reports – Following any testing, a full report shall be made available. The report will outline items such as the testing methods used, the findings, any proof-of-concept code for successful exploits, as well as remediation steps and suggestions.

Exploit Proof of Concept Development – In the event of a successful exploit, breach or compromise, MIST shall document the testing methodology used, record all gathered evidence, and develop proof-of-concept exploits for repeatable testing.

Targeted Remediation Retest – Following the penetration testing, there may be one or more areas of weakness that requires reconfiguration, patching or replacement. MIST will retest these areas when they are ready and remediation has been completed. Re-testing is included in this pricing if executed within 90 days of initial testing.

MIST offers penetration testing as a service for PCI-DSS, HIPAA and SOC 2 Audits. Choosing the right pen testing service partner will provide your organization with continuity, lower costs and an expert partner with familiarity of your environment and applications.