Vulnerability Assessment and Penetration Testing Services

Our approach includes both. Automated testing identifies vulnerabilities while manual process helps measure extent of exploitation of the vulnerabilities. WATI helps you find security flaws using manual techniques for web application penetration testing and network security testing.

Vulnerability scan is a great first step. There is lot more to pen testing than mere vulnerability scan. Vulnerability scans help identify the breaches, while the Penetration testing helps assess extent of exploitation possible for hacker.

WATI’s consultants are all certified in one or more of the following:

• Certified Ethical Hacker – CEH
• Licensed Pen Tester – LPT
• Offensive Security Certified Professional – OSCP
• Certified Penetration Testing Engineer – CPTE
• Certified Red Team Professional – CRTP
• Certified Information Systems Security Professional – CISSP
• Certified Information System Auditor – CISA
• Certified Information Systems Manager – CISM
• GIAC Web Application Penetration Tester – GWAP
• Computer Hacking Forensic Investigator – CHFI
• Certified Wireless Network Administrator – CWNA
• CompTIA Security+

Yes, penetration testing satisfies many regulatory compliances like PCI DSS, FISMA, HIPAA, SOC2, NIST, ISO etc. The penetration testing would have to be comprehensive, including:

• Network & Systems
• Wi-Fi and Firewall
• Web, Mobile and inhouse Applications
• 3rd Party vendors and SaaS vendors’ applications
• Cloud
• IOT

Black-box testing: This closely mimics real-world hackers trying to find breaches with no prior knowledge of the application, coding or environment. This is the absolute minimum to be included in any Penetration testing.

White-box testing: In this process the examiner will have through knowledge & access to the source code, internal construction, design & implementation so that they can detect the vulnerability faster than Black-box.

Gray-box testing: Combination of white-box and Black-box testing process where examiners are given some details of the application or environment to find vulnerabilities and find extent of exploitation possible.

Red Team: They play as a real time attacker & try to inject the virus to break the code. The resources involved in this are bound by strict non-disclosure and employment agreements, in addition to clearing some level of background screening. Red Team exercises usually exceed injecting virus, and comprises of anything that is hypothetically doable to gain access to a organization, some cases it might be a virus, some cases it even might be a lock picking, or simply break open the gates.

Blue Team: They are experts in protecting the systems from virus (or) breaching the code. They continually try to harden security around the company’s data systems and networks – even when no testing is leading along. They also develop protection for the vulnerabilities exposed by the Red Team.

Purple Team: It’s the same team that carry out both Red Team and Blue Team activities.

Softwares carry vulnerabilities. When those vulnerabilities are not published by the software owners, they are called zero-day vulnerabilities. When hackers take the advantage of zero-day vulnerabilities to exploit, it’s called zero-day exploit.

It’s advisable to perform on production system. Time of the test can be carefully chosen to ensure least number of users are affected (Friday evenings, or Saturday early mornings, etc). For organizations that have robust Devops implementation, Pen testing can also be done on pre-production environments. We typically ask clients decide as they know their users best.

It completely depends on the Cybersecurity service provider you choose. With a provider like WATI where all consultants are certified and have years of experience, you will not experience any loss or damage. Many clients tend to do testing in a pre-prod environment for critical assets that are included in the scope.

Cloud services, by themselves, do not guarantee top level security, unless the environments are meticulously architected for high security. If you are using cloud and SaaS services, its best for you to conduct vulnerability assessment. When a cloud server is compromised, it most likely compromises far higher number of users and entities, hence the audit is far more important.

We will work with a model that suits your needs best. We give priority to the clients’ inputs on their preference, constraints, environment and the priorities. We can offer T&M rates per-hour, or fixed-price quotes for VAPT services per application, or per IP for Network. Repeat scan within 12-month periods will see a drastic reduction ion price for subsequent scans. We also offer managed services on continuous basis for clients that need dedicated team of pen testers with various skills, for a fixed monthly fee for the length of the engagement.