Cyber Security Support Packages

Pentest application is a cyber security testing method in which the contribution of penetration test experts is intense, and therefore more critical findings can be detected. As the vulnerability scanning is a process in which cyber security scanning tool is used intensively, it can often be effective in detecting obvious vulnerabilities. The vulnerability scanning gives information only about the existence of vulnerabilities; however, penetration test is the testing of infiltration attempts to the system using the apertures found. Since the penetration testing includes not only the vulnerabilities but also the testing of the system's logical errors, it also produces outputs that vulnerability scanning software cannot detect.

Penetration testing is carried out to enable companies and institutions to learn whether their systems are safe by testing their systems from an attacker's point of view. During penetration testing, the cyber security experts perform an infiltration simulation. They carry out various attack methods to infiltrate the system like a cyber attacker.

All the attempts made by the expert in the penetration test to seize the system by using the possible security vulnerabilities on the system are the steps of this process. Testing first starts with the detection of services that allow possible access to the system. Then, the process continues with the identification of these services and the manufacturers providing the service. Following the determination of the existing versions of the services and the manufacturers providing these, possible vulnerabilities are investigated and an opportunity to infiltrate is identified. The final step is to test logging into the system using the vulnerability found.

• Network Penetration Test
• Web Application Penetration Test
• Mobile Application Penetration Test
• Static Code Analysis
• Social Engineering Test
• DDoS Test

• External Testing: External tests target the organization's servers and devices (such as DNS, e-mail, web servers, and firewall devices) that can be accessed via the internet. The aim is to see the attacks and attack scenarios that an attacker from outside the organization can do.
• Internal Testing: Internal tests aim to see the results that can be obtained by an attacker who has gained access to the corporate network. This access can be provided either with an anonymous user or a staff account.
• Blind Testing: In the blind testing approach, only the name of the organization is given to the test team. This type of testing allows the cyber security team to monitor and evaluate readiness in a real cyberattack.
• Double Blind Testing: In the double blind testing approach, the organization's cyber security team is unaware of the penetration testing. Therefore, they do not have the opportunity to make a preliminary preparation; in this way, the readiness of the team for a real scenario can be evaluated.
• Targeted Testing: In targeted testing, the pentest and the cyber security teams proceed together. The cyber security team observes the test activities and the attacker’s perspective. Thus, targeted testing provides valuable training for cyber security teams.
• Black Box Testing: Black box testing is the same as blind testing. In this type of testing, no technical information is shared with the test team. For application pentests, it is the name given to the tests made with an anonymous user profile.
• White Box Testing: In white box testing, the test team is provided with technical information about the target network or application. Shared information may include IP addresses, network infrastructure schemes, available servers and services, and application source code information.
• Gray Box Testing: Limited information is shared with the testing team at some level between black box and white box testing. For application pentests, gray box testing means accessing the application with an ordinary user account.

In order to prevent possible problems in the systems, penetration tests are carried out to detect the problem before attackers. With penetration test processes;

• Concrete Evaluation: Process and infrastructure-based problems can be put forward concretely.
• Quick Gains: Knowledge about the weakness that can be fixed easily on time is obtained.
• Timely Risk Mitigation: It is the criterion for measuring the effectiveness of the cyber security management system.
• Key Performance Indicator: Knowledge about the risks that cannot be eliminated immediately but whose effects can be reduced is obtained.

It is the detection of security vulnerabilities by examining the source codes of a compilable application project. In the context of application penetration tests, we can also consider static code analysis as white box testing.

It is the process of applying penetration testing techniques that are used to detect security vulnerabilities in web applications.

Web application security is all the activities carried out to protect web services and applications in order to prevent attempts to infiltrate the system by taking advantage of security vulnerabilities in the code of the applications or the services used.

Mobile application tests are software testing activities that are carried out to check whether mobile applications or mobile websites developed for different platforms run smoothly and as desired.