Information Security Professional Services

The Internal Penetration Assessment service attempts to identify, and exploit, vulnerabilities from the perspective of an anonymous malicious user, or an insider threat, positioned on an internal information systems network within the organization. Shamar Information Security LLC performs this service using a grey-box testing approach typically relying on limited information provided by the organization. A black-box or full on white-box approach is available upon request.

The External Penetration Assessment service takes the perspective of a malicious user attempting to breach or bypass the information security controls between two (2) information system networks. This is commonly performed from the perspective of a malicious user on the Internet trying to bypass perimeter security controls to breach an organization’s internal information systems and network(s). Shamar Information Security LLC performs this service using a grey-box testing approach typically relying on limited system and network information provided by the organization. A black-box or full white-box approach is available upon request.

For the scenario-based Penetration Assessment, we will work with you to develop a customized penetration testing scope and set of assessment parameters based on the number of scenarios against which your organization would like us to test. This type of assessment typically has a more narrow focus, or goal than our typical penetration assessments. The following list highlights example use cases for this type of service:

• Mergers and Acquisitions

• Assumed breach

• Hardened environment breakout

• Privilege escalation focused

• Lateral movement focused

• External Penetration Assessment with Social Engineering

• Internal Penetration Assessment with Social Engineering

• Detection avoidance

Our Web Application Penetration Assessment provides your organization with a thorough, deep-dive examination of your company’s web application against industry best practices and follows our proprietary application security testing methodology. This type of assessment focuses on using automation to supplement a manual testing heavy to identify and attempt to exploit vulnerabilities with a web application and its infrastructure. As such this assessment requires a bit more time to complete when compared to the Web Application Vulnerability Assessment service offering.

The Web Application Vulnerability Assessment is a slightly shorter engagement than the Web Application Penetration Assessment and focuses more on vulnerability identification through automated testing. Manual testing is used for finding validation and false positive analysis only and little to no vulnerability exploitation is provided. This type of assessment provides a cost effective option for organizations that want to bridge the gap between Dynamic Application Security Testing (DAST) and a full blown Web Application Penetration Assessment. Like the Web Application Penetration Assessment this testing is performed with and without application user credentials and follows our application security testing methodology.

The API Penetration Assessment service focuses solely on examining an organization’s API against Application Security best practices using our application security testing methodology. Shamar Information Security LLC performs this assessment from a white-box, full disclosure approach using customer provided API documentation and sample requests and responses. This assessment uses automation to supplement a thorough manual heavy testing approach.

Binary analysis is a passion of ours and we apply that love to our Desktop Application Penetration Assessment service offering. We examine all aspects of the desktop application against application security best practices to identify and attempt to exploit vulnerabilities associated with memory interaction, file system interaction, web application interaction, network interactions, input validation, missing or insufficient compile-time protections, etc. Each desktop application is different and we customize this service offering to provide a thorough and cost effective solution.

Mobile Application Penetration Assessments are more complex to perform than most organizations may realize due to the specialized requirements needed to set up an effective testing environment. We take care of that stress for you and have been doing so for the majority of our career staying up to date on mobile security and mobile risk trends. Our assessments are designed to perform a thorough examination of mobile applications and their interaction with the mobile device, any APIs used for mobile application communication, and API infrastructure supporting the mobile application APIs. We attempt to identify and exploit vulnerabilities in iOS and Android mobile applications that your organization develops. Our testing approach follows our application security methodology and additionally employs analysis and comparison against the OWASP Mobile Top 10 and the OWASP Mobile Application Secureity Verification Standard (MASVS).