Penetration Testing Services
有时候进攻是最好的防守. 当您的组织使用LBMC信息安全进行渗透测试时, 你会在网络攻击者之前发现你的防御漏洞. 你的渗透测试者最好能找到弱点，而不是你的对手.
LBMC信息安全是田纳西州最大的信息安全实践之一. We have practical experience and credentials to adeptly perform penetration testing on your networks, systems, 以及许多遵从性标准所要求的应用程序, 包括支付卡行业数据安全标准(PCI DSS). 渗透检测可能是侵入性的, 但我们经验丰富的专家知道如何列举安全漏洞, 识别和验证潜在的攻击载体, exploit vulnerabilities, and determine your environment’s susceptibility to attack in a way that preserves the integrity of your production systems. 这使我们成为国内顶尖的渗透测试公司之一.
外部渗透测试服务
This assessment determines the security posture of your Internet-facing systems and provides recommendations to improve the existing security measures in place by assuming the perspective of a hacker. 我们使用工具和技术来展示漏洞, performing the assessment “from the outside” and attempting to gain information or identify weaknesses with no prior knowledge of the environment.
内部网络渗透测试服务
使用一种备受推崇的测试方法, our internal penetration testing process identifies any specific areas of weakness that can be exploited to obtain unauthorized access. Our process involves connecting to an active network port from within the internal network without any network authentication credentials. This provides the ability to analyze the network from the perspective of an attacker who has already gained access to your internal network through some means of physical exploitation. Analyzing the network in this way provides clients with a comprehensive picture of security risks within their private IT environment. 而许多组织则专注于保护他们的周边安全, the internal network often still has unaddressed weaknesses that could be leveraged by an attacker who has gained a foothold or a malicious insider. LBMC信息安全的方法为您提供了这些风险的清晰画面.
Wireless Network Security Testing
无线网络已经成为大多数企业网络环境的重要组成部分, 但它们有自己独特的风险，应该纳入安全评估. LBMC将评估您的无线网络的安全性, 包括渗透测试和建筑设计评审, to attempt to access sensitive information and/or leverage a wireless connection to gain access to your private network environment.
Social Engineering
用假冒网站发送假邮件, 假扮成试图获取敏感信息的来电者, 把u盘丢在办公室里, we use a variety of techniques to gauge your company’s susceptibility to these common attack techniques. This process helps expose practices that create vulnerabilities and helps determine the vigilance and awareness of your personnel. Our service offerings are:
- Email Phishing-制作一个定制的电子邮件信息，其中包括一个假冒网站的链接. 然后，我们将把它发送到您的组织提供的指定邮件列表.
- Phone Testing—Posing as IT or other authorized users and ask for credentials or call the help desk and attempt to get a password reset.
- USB Drops—Dropping USB sticks around public areas of facilities to get users to insert them into their computer.
- Physical Testing—Evaluating your company’s physical security controls in place to protect your network and IT assets. 从携带到办公室的身份证件克隆，我们提供了广泛的选择.
Web-Application Testing
Using tools and techniques that an attacker with no prior knowledge of the environment would likely use, we attempt to gain information and identify weaknesses through dynamic application security testing that could be exploited by an attacker.
To do this, our team will evaluate the security of your web application by “interacting” with it from the Internet. 德甲竞猜平台测试范围将包括手动和自动智能模糊, access controls, application logic, authentication, and session management. This manual and automated testing will be performed using commercial and/or open-source web application tools coupled with our testing team’s extensive experience in hunting and exploiting application security weaknesses across all industries. In an effort to increase code coverage and to appropriately model particular threats common to many applications, 德甲竞猜平台攻击模拟可以从两个不同的角度进行:
- 无法访问，模拟Internet上的任何人(未经身份验证)
- 基本或有限的终端用户访问(经过身份验证)
This approach provides you with a clear picture of any security weaknesses that exist in the applications, 以及被利用的可能性.
移动应用程序安全评估
The objective of the mobile application security assessment is to evaluate the security of the in-scope applications by searching for vulnerabilities that could be exploited by an attacker. This assessment will determine the security posture of the mobile application and provide recommendations for improving its overall security. 我们将审查iOS和Android版本.
LBMC Information Security will evaluate the security by “interacting” with it from our own mobile devices, 模拟公众对应用程序的访问. 德甲竞猜平台测试范围将包括手动和自动智能模糊, access controls, application logic, authentication, and session management. This manual and automated testing will be performed using commercial and/or open-source web application tools coupled with our testing team’s extensive experience in hunting and exploiting application security weaknesses across all industries.
Purple Teaming
Purple-teaming is a coordinated effort between a red team (penetration testing) and a blue team (network defense) with the common goal of ensuring an organization’s controls are working effectively and as expected. 通常情况下，红蓝两队的努力是分开的. The red team works hard to get into the network, and the blue team implements controls to secure it. 但是，如果没有紫色团队，这两个团队很少合作. 每个团队都在做各自的工作，但每个人都朝着不同的目标努力. 蓝队的目标是保护网络, 红队的目标就是让它妥协.
By adopting a common goal, 团队不再只是识别漏洞并基于假设工作. Instead, they’re testing controls in real-time and simulating the type of attack scenario likely to occur if an organization is attacked.
Our team will leverage its extensive penetration testing and incident response experience to work with your organization in selecting the appropriate controls to test, determining the expected outcome, 然后设计合适的方法进行攻击仿真. Security controls for external perimeters, cloud environments, and internal controls will be tested.
Purple Teaming examples:
- IPS/IDS Functionality
- Geo-Blocking
- Network Access Control (NAC)
- Events/Alerts on Recon Activity
- Endpoint Controls
- Alert Handling
- OWA/0365 Mailbox Compromises
- Ransomware
- Password Attacks
- C2 Communications
- Privilege Escalation
- Lateral Movement
- Egress filtering
- Data Exfiltration
- DLP
