Security Testing and Assessment

Firmus offers vulnerabilities assessment and penetration testing services; mimics an attacker intent on accessing your organization's customer data, financial records and other sensitive information. We target a point of entry via your network or application infrastructure's "weakest link", which may be visible to employees and partners in addition to external hackers. We then determine the business impact of gaining access to your network and its resources.

For each engagement, we work with you to define the attack profiles most appropriate for your organization. Like many of our customers, you can also benefit from regular, ongoing penetration testing services - especially after network or application updates.

Firmus offers comprehensive network security penetration testing to secure your information assets from attackers both inside and outside your network based on the Open Source Security Testing Methodology Manual (OSSTMM) from The Institute for Security and Open Methodologies (ISECOM). A critical complement to vulnerability scanning; penetration testing proves the extent to which vulnerabilities can be exploited.

Anticipate external attacks

External testing services replicate the kinds of access an intruder could achieve from outside your network, identifying actual attack paths that must be eliminated and providing you with a remediation plan. We not only target servers, but also perform client-side attacks to exploit vulnerabilities found on employee workstations.

Identify security threats from the inside out

Internal testing services emulate the type of access a person with network privileges could obtain via weaknesses in internal systems. Launching attacks from any network location, we utilize low-security workstations to gain control over other workstations with increasing levels of access. We then attempt to escalate our privileges to those of a system administrator with access to sensitive or confidential data.

We perform Web Application penetration testing using The Open Web Application Security Project (OWASP) methodology and standard to exploit your application either via authorized access or by compromising access control mechanisms.

We conduct many tests and include (but not limited to);

Security configuration and setup review evaluates the security of your company’s critical servers & network devices, the backbone of your technology infrastructure. Such Assessment are critical because they allow FIRMUS to identify system mis-configurations that may not be detected through traditional network assessment.

During this activity, Specific network devices and operating system platforms will be reviewed against Security Configuration Baselines such as the CIS Consensus Benchmarks (www.cisecurity.org) to determine configuration weaknesses that could ultimately lead to security compromise.