GoVanguard
  • Company
    • About
    • Why the Name GoVanguard?
    • Company Differentiators
    • Contact Us
    • Blog
  • Solutions
    • Continuous Risk Management
  • Services
    • Attack Simulation
      • Red Teaming and Black Box Network Penetration Testing
      • Social Engineering and Physical Penetration Testing
    • Risk Reduction
      • White Box Network Penetration Testing
      • Dynamic/Static Code Analysis and Architecture Review
    • Threat Management
      • Threat Intelligence
      • Incident Response and Threat Hunting
      • Security Operations Center (SOC) Services
    • Compliance and Strategy
      • Compliance and Risk Gap Assessments
      • Consulting Services
  • Research
    • Open Source Projects
      • Legion – Pentesting Framework
      • pyShodan – Python Library for Shodan.io API
      • pyDradis3 – Python Library for Dradis API
      • InfoSec Encyclopedia
      • Developers Guide to HIPAA
      • Other Tools/Scripts/Documents
    • Threat Center
      • Information Security News
      • Latest Data Breaches
      • Regulatory News
  • Partners
    • Partner Program
    • Referral Program
  • Search
  • Menu

Risk Reduction Services

You are here: Home1 / Risk Reduction Services

White Box Network Penetration Testing

We identify technical, architectural and logical design vulnerabilities that contribute to the risk profile (confidentiality, integrity, and availability) of your organization’s data and information systems. Our process entails a hybrid approach of utilizing both OWASP v4 and PTES (Penetration Testing Execution Standard) guidelines, which results in a robust white box base testing framework that spans over 80+ security testing procedures.

Objectives
  • Collect, scan and analyze information system configurations in order to generate a prioritized comprehensive list of environment vulnerabilities, weaknesses and risks. These include:
    • Network/server/virtualization/storage infrastructure
    • Workstations
    • Operating systems and mission critical applications
  • Outline the potential impact and severity of each vulnerability, weakness, and risk including observed deviations from standard information security best practices and principles.
  • Identify the root causes behind the vulnerabilities, weaknesses, and risks that were identified in the assessment, while conveying how those problems relate to the inherent security posture of your organization.
  • Provide your organization with a full due diligence report including information such as:
    • Vulnerability/weakness/risk details
    • Risk mitigation recommendations
    • Analysis methods
    • Information system statistics
    • Network diagrams and more.
Standard Engagement Process

Typical Timeline of Initial Test: Dependent on environment complexity
Scheduling Kickoff: Within 2 weeks after ROE is signed
Remediation Retest Policy: Free within 30 days of initial report delivery

  • Once the client has financed the project GoVanguard will provide the client with a ROE (Rules of Engagement) document that outlines the scope of the tested client information systems, project assumptions and GoVanguard’s commitment to client’s information system’s Confidentiality, Integrity and Availability (CIA).
  • White box analysis of client information systems requires that GoVanguard either ships or deliver in-person GoVanguard’s network scanning appliance.
  • GoVanguard requires certain standard prerequisites to be satisfied before the project is officially started. These prerequisites include:
    • Any diagrams and documentation pertinent to network and sever infrastructure.
    • A list of all corporate VLANs/subnets (in CIDR notation).
    • A list of all point-of-interest infrastructure IP addresses (AD DC’s, Hypervisors, Firewalls, Core Switches…etc.).
    • Full read-only access to all configuration files pertaining to any of the following information systems:
      • Network Infrastructure (Firewalls, Switches, Routers, WAPs…etc)
      • Active Directory
      • Hypervisors
      • Servers (Windows and/or Linux)
  • Once the client has satisfied all the project prerequisites, GoVanguard will perform the white box network penetration testing in a 24×7 format over the course of the predefined project timeline. Special attention is provided to ensure client information system CIA remains unaffected throughout the project. During this time, GoVanguard focuses on assessing the client’s information systems for weaknesses and vulnerabilities by collecting and analyzing corporate network traffic and system configurations.
  • After the first white box network penetration test is completed, GoVanguard will present the report findings with the client and discuss the mitigation recommendations provided in the report.
  • GoVanguard will provide the client with 30 days to remediate prioritized risks for their information systems.
  • After the 30 day remediation period, GoVanguard will perform rescanning/analysis of the same information systems to validate if previous risks were indeed remediated.
  • GoVanguard will then present and provide the client with a post risk remediation white box network penetration test report.
Sample Reports
  • PTES White Box Network Penetration Testing Report

Dynamic/Static Code Analysis and Architecture Review

GoVanguard’s Dynamic/Static Code Analysis evaluates both web and non-web applications. Through advanced modeling we detect flaws in your software’s inputs and outputs that cannot be seen through web scanning alone. We utilize several overlapping tools and techniques including data flow analysis, taint analysis, and control flow graphs which require the software source code. The purpose of these techniques is to discover architectural and logical design vulnerabilities within the application.

Objectives
  • Analyze your organization’s application software source code using many overlapping tools with a team of multiple GoVanguard software security engineers.
  • Identify vulnerabilities introduced to the application through dependency tree structures.
  • Map all input and output application data flows.
  • Generate a prioritized comprehensive list of software vulnerabilities, weaknesses and risks.
  • Outline the potential impact and severity of each vulnerability, weakness, and risk, including observed deviations from standard information security best practices and principals.
  • Provide your organization a full due diligence report including information such as:
    • Vulnerability/weakness/risk details
    • Risk mitigation recommendations
    • Analysis methods and tools
    • Diagrams of main application functions
    • Data flows
    • Dependencies and more.
  • Includes technical risk management recommendations that are mapped to OTGv4 (OWASP The Guide v4) as well as OWASP SAMM (Software Assurance Maturity Model) principles.

Interested in Our Services? Let’s Chat!

Friendly Note: We respect privacy. We will never sell/share your information to anyone or hassle you with unsolicted sales emails. Please see our Privacy Policy for more information.

1 + 7 = ?

Our Standard Office Hours

Monday – Friday: 8:00AM – 5:00PM EDT
Saturday – Sunday: Closed

Where to Find Us

205 Rockingham Row, Princeton, NJ 08540
315 West 36th Street, New York, NY 10018
(212) 696-0500
hello@govanguard.com
PGP: E2377E15B0E76B8E

Data Privacy Notice

  • – General Data Privacy Policy
  • – Data Privacy Opt-out
© Copyright - GoVanguard
  • LinkedIn
  • Twitter
  • Facebook
  • Instagram
Scroll to top