• Vulnerability Assessment
• Penetration Testing
• Difference between vulnerability testing and penetration testing
• VAPT Analysis
• Identify our possible cyber attackers
• Identify factors responsible for cyber crime
• Secure data from hackers and spammers
• Identify high risk vulnerabilities

• Web Vulnerability Testing
• Mobile Vulnerability Testing
• Network Vulnerability Testing
• Social Engineering Testing
• Physical Security Auditing

OWASP TOP 10 Vulnerability

• A1-Injection
• A2-Broken Authentication and Session Management
• A3-Cross-Site Scripting (XSS)
• A4-Insecure Direct Object References
• A5-Security Misconfiguration
• A6-Sensitive Data Exposure
• A7-Missing Function Level Access Control
• A8-Cross-Site Request Forgery (CSRF)
• A9-Using Components with Known Vulnerabilities
• A10-Unvalidated Redirects and Forwards

Mobile OWASP TOP 10 Vulnerability

• M1-Improper Platform Usage
• M2-Insecure Data Storage
• M3-Insecure Communication
• M4-Insecure Authentication
• M5-Insufficient Cryptography
• M6-Insecure Authorization
• M7-Poor Code Quality
• M8-Code Tampering
• M9-Reverse Engineering
• M10-Extraneous Functionality

• HOST DISCOVERY
• Who is Information
• PORT SCANNING
• Banner Grabbing/OS Fingerprinting
• Scan for Vulnerabilities
• Sniffing
• MiTM Attacks
• MiTM Attacks

• Your users are being socially engineered and phished every day!
• They are falling for it, pretty regularly
• Send your users a phishing email with Remote IP that you monitor
• Check which users download the file
• Go further! Send them a script to run; the script pings a web server whose logs you monitor.
• Again, see who executes the file.
• Place this file on a USB thumb drive named ‘Financials’, drop the drive in the cafeteria
• Start a Facebook group… find people on LinkedIn… etc.

• Remedial training needed for employees who respond to phishing!

•  

• Double doors unpinned (pull n’ open)
• Door locks w/ no front plate
• Poorly installed door locks
• Digital door locks with default passcodes, or malfunctioning latch
• Removable floors which extend beyond gateway doors
• Ceilings which don’t run “all the way”
• Are your badge reader door locks fail-safe… or fail-open?
• Circuit breakers outside sensitive areas?
• Safety precautions for pen-test team:
• Buddy system (minimum of 2 testers)
• Have cell phone or radio contact with team members at all times
• Pre-train for safety

Five key stages involved in testing

• Scan Passive and active scanning techniques are used to identify possible targets.
• Analyze Analysis and cross-referencing of vulnerabilities found on the targets.
• Follow up There is no substitute for the experience of a seasoned tester; any findings from the prior stages are manually verified to eliminate false alarms.
• Penetrate During the manual follow up of findings, our test teams may discover vulnerabilities that if exploited, could bring further levels of access. If this is the case, a full risk and business impact analysis is performed and presented to you, so that you can decide if the potential value outweighs the likely risk.
• Report The key to value is a report the business can understand, with practical recommendations of deeply technical issues, analysis of potential root causes and a clear explanation of the risks.

• Project Implementation using the techniques of Security Testing

• FAQs & Interview Preparation