DIVE INTO OUR VULNERABILITY ANALYSIS SERVICES

This service is an off-site, non-exploitative test of up to 100 individual internal Internet Protocol (IP) addresses or nodes owned or controlled by your organization. To perform this service, you must designate the IP addresses you wish to be tested, and we will perform testing using our toolkit of automated testing solutions.

The IT security industry has not yet developed consistent or standardized terms for describing the specific characteristics of penetration tests or vulnerability assessments. In many settings, the terms ‘penetration test’ and ‘vulnerability assessment’ may be used interchangeably, while in other settings a ‘penetration test’ may refer to more in-depth testing that seeks to actively exploit detected vulnerabilities in order to compromise (or demonstrate the ability to compromise) specific systems or assets. When we describe our testing as non-exploitative, we are referring to the fact that we will report on detected vulnerabilities or weaknesses but we will not attempt to actively exploit these findings. Within the context of this service, the terms penetration test and external vulnerability assessment are generally synonymous while internal vulnerability assessment refers to testing focused on devices ‘behind’ the firewall or logically located so that they are not directly Internet-facing.

Our toolkit is constantly reviewed to ensure we are able to meet the challenges presented by a continuously evolving security environment. Representative tools we have used include Metasploit, Nessus, & Retina. The tool(s) selected for your engagement may vary based on our perception of the appropriate tool necessary to properly assess your environment. As a rule, we only utilize subscription-based tools in order to ensure we are using tools with updated definition files to facilitate testing for recently emerged exploits or vulnerabilities.

We will work with your administrative personnel to determine the most effective manner in which to perform the internal vulnerability assessment. Generally, your test can be performed through allowing Superior a temporary Virtual Private Network (VPN) connection into your internal network. We will require domain-level administrative credentials in order to perform the test and we will require you to setup a dedicated account for this purpose. All testing is originated through use of a dedicated Virtual Machine (VM), which will be the only device that fully authenticates to your network. We do not re-use VMs for testing and each test will be conducted using a ‘new’ VM instance created from a clean template. We strongly recommend our clients enable any necessary logging and adopt practices to ensure our administrative and VPN accounts are terminated or disabled after the completion of our testing.

Your test will be performed by direct employees of Nix-Dev. We will not utilize 3rd party contractors to perform any of our testing without providing prior notice to you and, unless otherwise stated, all testing will be performed by our direct employees.

We can generally perform your internal vulnerability assessment within one to two weeks after we have a signed engagement letter. If your circumstances require an expedited test, please don’t hesitate to contact us as we can often create availability in our schedule for you.

We issue a formal report for all of our review services. This report will include an overview of the findings from our test (management report), as well as any recommendations regarding remediation. A copy of the full testing results will be included as an appendix to our report. We issue all of our reports in electronic format (PDF) via our proprietary secure website or via secure e-mail. Report turnaround time generally requires one to two weeks in order to process the report through our internal quality control function