We regulary perform penetration tests as part of ISO 27001 certifications. The ISO 27001 standard is the international standard that describes the best practices for an ISMS (information security management system). Its Annex A lists control objectives and controls aligned with ISO27002 to be performend, where ISO27002 provides more detailled information.
In chapter "A.18.2 Information security reviews" - basically last but not least - the standard requires companies to perform "Technical compliance reviews". In the ISO27002' implementations guidance for this control you are going to find performing penetration testing to be a solution to fullfill this control.
Since 2013 our certified penetration tester team conduct pentests for IT infrastructures, web applications and mobile APPs (iOS / Android) and using a structured approach based on all relevant publications. As a service provider evaluate the identified and exploited vulnerabilities based on the associated business risk and compiling it into a report that contains a summary for the IT management and the technical details of the vulnerabilities identified. After you fix the vulnerabilities, we usually perform a retest without any additional charge.
Pentests use the same tools and techniques that real attackers would use to break into a system. It includes the use of security tools and carrying out manual tests to uncover vulnerabilities. Thus is it not a automatic vulnerability assessment. On the contrary, as a service provider for penetration testing we are using the same tools and techniques that real attackers would use to break into a system. But while a real attacker only needs to find and exploit one vulnerability, a penetration tester checks all relevant attack vectors.
Having a structured approach is one of the most important factors to achive this in order to provide a professional pentesting service. Our approach is based on the OSSTMM specifications as well as the OWASP Testing Guide / OWASP Top 10 and, if requested by the client, also complies with the requirements of the PCI DSS.
Pentests are always a compromise between effort and cost. Successful pentests offer a good balance between these criteria to facilitate the testing of all relevant attacks and attack vectors. The cost of such a test always depends on the time the penetration tester spends and on the extent and complexity of the IT system or web applications. While a penetration test for a small application takes only som days, it can take several weeks for a large network or complex application.
Binding offers require prior information about the systems and applications that are to be examined. It is important that we get an initial impression of the target. For web applications, for example, test access can be helpful. Any additional information, e.g. the framework etc., can make it easier for us to draft a suitable offer for you. If you need us to pentest an IT system, we will need the corresponding network addresses in advance. In this particular case, we will first perform a non-invasive network scan to get a first look at your network. We will provide a detailed offer once we can estimate the effort required.
binsec GmbH is your security service provider for penetration testing. Get in touch with us for your "ISO 27001 Certification" pentest offer!