© 2013 TraceSecurity. All rights reserved. t r a c e s e c u r i t y . c o m

D A T A S H E E T

Finding and Fixing your vulnerabilities – ahead oF the bad guys

Conducting a penetration test will allow you to discover the vulnerabilities in your IT infrastructure and correct them before they can be exploited by hackers and other hostile forces. One of the oldest and most trusted methods for assessing security risks is penetration testing. Penetration testing is designed to simulate a real-world attack using the tools and techniques employed by actual hackers. It provides realistic examples of how a real hacker could compromise sensitive data.

the ComplianCe overview

If your organization is subject to IT security mandates such as FDIC, GLBA, HIPAA, HITECH, NCUA, OCC, and PCI DSS, you must take measures to prevent unauthorized disclosure, misuse, alteration, or destruction of confidential information, including Non-Public Personal Information (NPPI). This requires you to know your risks and mitigate them with a combination of practices, procedures, and controls.

To ensure the security of your internal networks, best practices recommend that you perform internal and external penetration tests in addition to regular security assessments.

the traCeseCurity penetration testing overview

Our expert security analysts conduct internal and external penetration tests as separate services. Designed to evaluate the effectiveness of your existing security measures, these tests mimic the action of an actual attacker exploiting weaknesses in network security without the usual dangers. The internal penetration test examines internal IT systems for any weakness that could be used to disrupt the confidentiality, availability, or integrity of the network. The external penetration test examines external IT systems in the same manner.

Penetration tests are different from vulnerability assessments because they exploit vulnerabilities to determine what information is actually exposed. TraceSecurity can perform this testing onsite or remote.

TraceSecurity’s penetration tests follow documented best practices for security testing methodology including:

Test results are provided in an extensive report containing:

Options:

• Scoping and rules of engagement

• Analysis and identification of attack vectors

• Exploit testing and penetration attacking

• Immediate notification of critical risks

• Penetration test methodology

• Executive summary

• Business and technical risks and recommendations

• Exploitation results listed by risk and areas of concern

• Details and exposure of vulnerabilities

• On-demand network vulnerability scanning

• Extensive information gathering (for External Penetration Testing), including public record search, Web presence analysis, email harvesting, DNS interrogation and Whois

• Retest: following completion of the initial penetration test, analysts will conduct retesting of initial findings to determine remediation strategies

• On-demand report generation for executives and technical staff

Penetration Testing

© 2013 TraceSecurity. All rights reserved. t r a c e s e c u r i t y . c o m

D A T A S H E E T

to learn more about tracesecurity, call 877-275-3009 or visit www.tracesecurity.com

• Security Assessment

• Risk Assessment

• IT Security Audit

• Penetration Testing

• Social Engineering

• Web Application Testing

• Wireless Assessment

• Security Training

your single sourCe For a Full range oF it grC inFormation seCurity serviCes

The complex and constantly evolving nature of IT GRC (governance, risk and compliance) requires a range of experience and expertise that is nearly impossible for most companies to maintain internally. TraceSecurity’s comprehensive suite of information security services is the answer. Our seasoned experts help enhance your security posture, reduce risk, facilitate compliance, and improve operational efficiency. To provide maximum effectiveness, the TraceSecurity information security services listed can be delivered in combination with TraceCSO, our integrated cloud-based IT GRC management platform.

Penetration Testing

GRC Simplified... Finally.