Risk Reduction Services

White Box Network Penetration Testing

We identify technical, architectural and logical design vulnerabilities that contribute to the risk profile (confidentiality, integrity, and availability) of your organization’s data and information systems. Our process entails a hybrid approach of utilizing both OWASP v4 and PTES (Penetration Testing Execution Standard) guidelines, which results in a robust white box base testing framework that spans over 80+ security testing procedures.

Objectives

Collect, scan and analyze information system configurations in order to generate a prioritized comprehensive list of environment vulnerabilities, weaknesses and risks. These include:
- Network/server/virtualization/storage infrastructure
- Workstations
- Operating systems and mission critical applications
Outline the potential impact and severity of each vulnerability, weakness, and risk including observed deviations from standard information security best practices and principles.
Identify the root causes behind the vulnerabilities, weaknesses, and risks that were identified in the assessment, while conveying how those problems relate to the inherent security posture of your organization.
Provide your organization with a full due diligence report including information such as:
- Vulnerability/weakness/risk details
- Risk mitigation recommendations
- Analysis methods
- Information system statistics
- Network diagrams and more.

Standard Engagement Process

Typical Timeline of Initial Test: Dependent on environment complexity
Scheduling Kickoff: Within 2 weeks after ROE is signed
Remediation Retest Policy: Free within 30 days of initial report delivery

Once the client has financed the project GoVanguard will provide the client with a ROE (Rules of Engagement) document that outlines the scope of the tested client information systems, project assumptions and GoVanguard’s commitment to client’s information system’s Confidentiality, Integrity and Availability (CIA).
White box analysis of client information systems requires that GoVanguard either ships or deliver in-person GoVanguard’s network scanning appliance.
GoVanguard requires certain standard prerequisites to be satisfied before the project is officially started. These prerequisites include:
- Any diagrams and documentation pertinent to network and sever infrastructure.
- A list of all corporate VLANs/subnets (in CIDR notation).
- A list of all point-of-interest infrastructure IP addresses (AD DC’s, Hypervisors, Firewalls, Core Switches…etc.).
- Full read-only access to all configuration files pertaining to any of the following information systems:
  - Network Infrastructure (Firewalls, Switches, Routers, WAPs…etc)
  - Active Directory
  - Hypervisors
  - Servers (Windows and/or Linux)
Once the client has satisfied all the project prerequisites, GoVanguard will perform the white box network penetration testing in a 24×7 format over the course of the predefined project timeline. Special attention is provided to ensure client information system CIA remains unaffected throughout the project. During this time, GoVanguard focuses on assessing the client’s information systems for weaknesses and vulnerabilities by collecting and analyzing corporate network traffic and system configurations.
After the first white box network penetration test is completed, GoVanguard will present the report findings with the client and discuss the mitigation recommendations provided in the report.
GoVanguard will provide the client with 30 days to remediate prioritized risks for their information systems.
After the 30 day remediation period, GoVanguard will perform rescanning/analysis of the same information systems to validate if previous risks were indeed remediated.
GoVanguard will then present and provide the client with a post risk remediation white box network penetration test report.

Sample Reports

Dynamic/Static Code Analysis and Architecture Review

GoVanguard’s Dynamic/Static Code Analysis evaluates both web and non-web applications. Through advanced modeling we detect flaws in your software’s inputs and outputs that cannot be seen through web scanning alone. We utilize several overlapping tools and techniques including data flow analysis, taint analysis, and control flow graphs which require the software source code. The purpose of these techniques is to discover architectural and logical design vulnerabilities within the application.

Objectives

Analyze your organization’s application software source code using many overlapping tools with a team of multiple GoVanguard software security engineers.
Identify vulnerabilities introduced to the application through dependency tree structures.
Map all input and output application data flows.
Generate a prioritized comprehensive list of software vulnerabilities, weaknesses and risks.
Outline the potential impact and severity of each vulnerability, weakness, and risk, including observed deviations from standard information security best practices and principals.
Provide your organization a full due diligence report including information such as:
- Vulnerability/weakness/risk details
- Risk mitigation recommendations
- Analysis methods and tools
- Diagrams of main application functions
- Data flows
- Dependencies and more.
Includes technical risk management recommendations that are mapped to OTGv4 (OWASP The Guide v4) as well as OWASP SAMM (Software Assurance Maturity Model) principles.

White Box Network Penetration Testing

Dynamic/Static Code Analysis and Architecture Review

Interested in Our Services? Let’s Chat!

Our Standard Office Hours

Where to Find Us

Data Privacy Notice