Penetration Testing

Do Your Systems Have Exploitable Weakness or Vulnerabilities?

Today’s security threats, both digital and physical are more sophisticated than ever and are ever evolving. Our focus is to keep you and your customers secure. NephōSec® works to ensure your financial services remain compliant for your banking clients. Our experts in GLBA Controls Assessment, ISPVA (Internet Security, Penetration, and Vulnerability Assessment) services and Cloud migration, will keep your IT systems, applications, and Cloud Infrastructure secure.

Let NephōSec® partner with you to take care of your IT security, while you focus on your customers financial success.

Comprehensive protection starts by ensuring your policies, procedures, and security practices drive the right behaviors and outcomes required to ensure your systems and data remain secure.

NephōSec® offers a full suite of assessment services to address all your cyber security needs.

Penetration Testing Process

Policy Review and Adherence

Institutions should have a mature information security policy that is broad &
encompasses the required security standards for the complexity of the institution

- A comprehensive document that details the security posture, risk appetite,
  & generally includes a business impact analysis of their core operating systems

Incident response, mobile use, Disaster Recovery (DR)/Business Continuity Plan
(BCP), & annual risk assessment

Audit & Examination

Review of the general operations & structure of the IT organization

- Meeting the need, & mitigating any organizational gaps that are found

Corrective Action Plan (CAP) review

- Review of the outstanding audit & exam findings to make sure the institution is properly managing the audit findings & recommendations

External Penetration Testing

Penetration testing that extends to the external network, online banking, mobile banking, & other internet-facing environments.

Simulates a real attack from the perspective of an internet-based external attacker targeting the institution.

Auditing Wi-Fi networks at remote locations

Internal Controls Testing

Testing anything past the firewall

- The IPS/IDS, HIPS, NIDS, & hardware security devices

Disable the firewalls or AV for a period of time & test second level systems from inside

Test password complexity & administration

Look at GPO policies & make recommendations based on best practices and established company policies regarding IT systems

Social Engineering Testing

Phishing tests with email & mobile communications

Full campaigns that can be run against an institution & chart the results in real-time

Join the Discussion

Talk to Us