Penetration Testing Services

Organisations often have one or more mobile applications that provide services to employees and clients which interac with large amounts of sensitive data. Unlike web applications, mobile applications also run some of their logic in the local mobile device, which provides additional opportunities for an attacker to find and exploit vulnerabilities.

A typical mobile application penetration test would involve static and dynamic analysis. Static analysis will involve decompiling the packages and analysing security issues such as, outdated third party libraries, deprecated functions and anti-tampering measures. A dynamic analysis will then take place where the flow or logic of the application will be assessed, including authentication and authorisation controls, data storage, and the ability to intercept sensitive data.

A&O IT Group’s expert consultants will utilise industry-standard frameworks such as the OWASP Mobile Security Testing Guide (MSTG) to ensure good assessment coverage of all aspects of the mobile application.

Find out more

API endpoint utilising standards such as REST, SOAP, and GraphQL, among others, are routinely utilised to provide data that will be consumed by all kinds of applications (including web and mobile). Vulnerabilities in the implementation of such endpoints can lead to data leakage and in extreme cases, even remote code execution and complete system compromise.

An API security assessment will investigate all of the relevant endpoints, how they process data, and attempt to identify any design, configuration, or implementation issues that could lead to exploits such as unauthorised data exfiltration or the bypassing of authentication and authorisation controls.

A&O IT Group’s security consultants will use industry best practices and their own years of experience to thoroughly test API endpoints, identifying weaknesses and providing remediation advice.

Countless devices are exposed on both internal and public networks every day, and with specialised search engines, malicious actors can easily search for badly configured devices that can offer a way into the network of an organisation.

An external network and infrastructure penetration test will assess the online footprint of an organisation to determine if there are any insecure or outdated services exposed, including publicly accessible management interfaces. During this assessment, all relevant information will be gathered and the risk to the business will be determined. An internal network penetration may follow an external penetration test where initial access has been gained or be conducted as a separate assessment where initial access is assumed. Consultants will identify vulnerabilities with devices on the network and attempt to ethically exploit these vulnerabilities – according to the agreed scope - to move laterally and escalate privilege within the environment.

A&O IT Group’s CREST accredited consultants are experienced in all types of network and infrastructure penetration tests and will provide concise advice to enable you to understand and improve your overall security posture.

An attacker breaking into your premises is increasingly more likely to leave something behind than they are to steal something. The cyber resilience of your business is dependent on the physical security of your premises. Imagine what an attacker could achieve with unrestricted and undetected access to your offices, warehouses, or plant. Organisations ignore physical security at their peril.

A physical penetration test can be completed as an isolated assessment but would also normally form a key part of any Red Team engagement and may also include a Social Engineering element. Experts will attempt to reach sensitive areas without being detected using techniques to bypass security guards, cameras, physical and digital access controls, and other security measures.

A&O IT Group’s experienced team of physical security consultants work globally with organisations of all shapes and sizes to identify physical vulnerabilities and improve their overall security posture.

Find out more

Wireless networks are deployed in most companies to provide connectivity for mobile devices and in some cases as an alternative to costly structured cabling. However, if not properly configured, wireless networks could provide an attacker with unauthorised access to sensitive devices.

A wireless security assessment would take into consideration how the network and appropriate security controls have been implemented including authentication, network segmentation providing isolation between different environments, client isolation and that other configuration has been implemented securely.

A&O IT Group’s security consultants can assess and advise if the wireless networks of an organisation are implemented securely and provide remediation advice if any vulnerabilities are found during the assessment.

The human element remains one of the weakest links of any security strategy. It is therefore important to understand the security exposure of an organisation and identify areas where new processes or training may need to be put in place.

A social engineering assessment is highly bespoke and could include tailored phishing campaigns, spear phishing, phone calls, and in-person attempts to bypass local security personnel, among others. It is important to understand exactly what the needs of the organisation are and plan accordingly. Social Engineering can be a vital component of Physical Security Assessments and Red Team engagements.

A&O IT Group’s security consultants will utilise their extensive social engineering experience to identify weaknesses in policy, procedure or user awareness training that can expose the organisation to undue risk.

Find out more