Penetration Testing Services in the UK

Penetration Testing – Core Service

Arcanum will assess the required web applications. Scope is determined based on number of dynamic pages, unique input fields, and user roles. Arcanum will test the security of the in-scope web application(s), and how they impact both the applications themselves and the underlying infrastructure.

A number of areas are considered in web application assessment, including:

• Authentication and authorisation
• Session management
• Data validation
• Encryption of sensitive data
• Security of the presentation tier

A thorough analysis is conducted against Arcanum’s application assessment checklist to ensure completeness and consistency of application testing.  Arcanum places emphasis on understanding the business threats and identifying flaws in the logic of the application that could be used to realise those threats, using manual testing techniques.

Penetration Testing – Core Service

Arcanum can test web services built on REST, SOAP, or GraphQL technologies.

Arcanum takes a mainly manual approach to web services testing, with our methodology based on OWASP’s testing frameworks, expanded with our extensive experience of web services testing. At a high level, web services assessments cover the following broad areas:

• Authentication Analysis
• Session Handling Analysis
• Authentication and Authorisation Controls Analysis
• Data Handling, Storage, and Encryption Analysis
• Information Disclosure Analysis
• Input Validation and Sanitisation Analysis
• Web Services Logic Analysis
• Server Configuration Analysis
• Bespoke Client Analysis

Penetration Testing – Core Service

Network discovery and enumeration will be conducted on the selected IP range(s) to identify active hosts and devices. A detailed security assessment of the discovered devices will be conducted from the internet using a range of tools and techniques by our experienced consultants.

This includes:

• Up to 10 IPs per day.
• Passive information gathering of publicly available data such as in DNS and WHOIS registries.
• Active vulnerability scanning of identified services.
• Active testing of associated Internet services such as DNS; and
• Active testing of exposed firewalls, routers, and other filtering devices included in the target range.

Identified vulnerabilities will then be manually verified to determine the actual impact and likelihood of exploitation, and an appropriate severity rating assigned based on the context.

Penetration Testing – Core Service

Internal Infrastructure Assessment of all networked devices. This assessment needs to be carried out at the customer site.

• Network discovery and enumeration will be conducted on the selected networks to identify active hosts and devices.
• A detailed security assessment of the discovered devices will be conducted from the internal network using a range of tools and techniques by our experienced consultants.
• This includes active vulnerability scanning of identified services. Identified vulnerabilities will then be manually verified to determine the actual impact and likelihood of exploitation, and an appropriate severity rating assigned based on the context.

Penetration Testing – Core Service

Arcanum can assess Android and iOS mobile applications.

We focus primarily on two main areas during mobile application assessments:

• Client Side – analysis of the client application with a focus on how it stores and processes sensitive data on the device, as well as the security configuration options of the app itself.
• Server Side – analysis of the authentication, authorisation, and session management controls, as well as data validation and how sensitive data is handled.

Penetration Testing – Core Service

Cloud configuration review of the target cloud platform.

Arcanum will conduct a build and configuration review of the in-scope Cloud Estate in line with Centre for Internet Security (CIS) hardening benchmarks and vendor recommendations. Commonly assessed cloud services include:

• Azure Configuration.
• AWS Configuration.
• Google Cloud Configuration.
• MS365 Configuration.
• Intune MDM Configuration.

Arcanum can review additional cloud platforms on request.

Penetration Testing – Core Service

Devices including routers, firewalls, switches, and VPNs should have their configurations reviewed for security vulnerabilities.

Arcanum will conduct a build and configuration review of the in-scope device(s) in line with Center for Internet Security (CIS) hardening benchmarks and vendor recommendations.

Penetration Testing – Core Service

Arcanum will conduct a build and configuration review of the in-scope device(s) in line with Center for Internet Security (CIS) hardening benchmarks and vendor recommendations. This review usually includes a combination of automated and manual review techniques.

Penetration Testing – Core Service

Where clients have particular security concerns regarding a system Arcanum can perform a scenario-based assessment. This is a tailored approach which focuses on answering specific questions about the security of a system. Some common scenarios are:

• Can user A access user B’s data?
• Can the security checks around X function be bypassed?
• Is it possible to access data on network B from network A?
• What systems and data could someone with a stolen company laptop access?

Penetration Testing – Core Service

Physical security assessment of the customer’s premises.

Due to the often used ‘Defence in Depth’ approach to security, the Physical Security Assessment will assess the effectiveness of the various layers of physical security features from the outside in, dependent upon customer requirements. Security features that can be assessed include, but are not limited to:

• Perimeter fence.
• External and internal gates, doors, and locks.
• Unofficial/unrecognised entry points and entry methods.
• Site security personnel.
• CCTV systems.
• Security Lighting.
• Access Control measures. 
• Security Standard Operating Procedures (SOPs).
• Site security posture and general security awareness.
• Key handling and security cabinets.
• Access to sensitive areas.
• Security feature configuration.

In addition, we can investigate whether any security vulnerabilities can be found from publicly accessible websites.

Penetration Testing – Core Service

Clients who are looking to determine their staff’s susceptibility to social engineering attacks, Arcanum is capable of performing a variety of these assessments, such as phishing (email based) and vishing (call based). Social engineering is a common attack performed by sophisticated threat groups in an attempt to gain internal access to an organisation’s network, as such Arcanum can perform similar attacks in order to provide insight into how successful such attempts might be; this includes: 

• Varying levels of sophistication ranging from “low-effort, wide net” style engagements which target thousands of users across many hosts and domains; to sophisticated targeted engagements against a handful of employees with tailored attacks.
• Phishing can be specified against the entire organisation, select departments, or a random selection of staff depending on needs
• As part of phishing, Arcanum can create phishing websites designed to securely collect any data entered, such as usernames and passwords – a common attack used by external threats attempting to gain a foothold in an organisations network.
• Arcanum can perform vishing against users and attempt to have them disclose confidential or sensitive information or otherwise engage with a phishing domain previously set up
• Techniques such as domain and number spoofing can be employed to give the appearance of more genuine or expected contacts, such as changing number during a vishing attempt to appear to come from the same county/city as the organisation’s office
• Statistical analysis and review to determine which users/departments were more or less likely to interact with an attacker as well as the general trends regarding how many users clicked or interacted with any created phishing sites.

Penetration Testing – Core Service

Suitable for systems which are undergoing ongoing development, continuous security testing involves a comprehensive penetration test initially, followed by regular testing throughout the year of the system’s changes to ensure that security vulnerabilities are identified as soon as possible in the development lifecycle.

Our can consultants come in at the end of each sprint (or the appropriate point if other development methodologies to Agile are in use) and conduct a penetration test of the features which have been added or changed over the course of the sprint. This has a number of advantages including:

• Time & Cost Savings
• Developer education & awareness
• Overall security improvements – issues get identified before they even hit production environments
• Easier to digest reporting – we can log issues straight into your bug tracker rather than writing standalone reports which you then convert into issues

We still recommend that a comprehensive annual test is conducted of the system as a whole, but would expect less issues to be identified in the annual test than without continuous testing.

Penetration Testing – Core Service

Clients often require testing which doesn’t fall neatly into a standard service line. This doesn’t mean that we can’t help to assess the security vulnerabilities within the system, merely that Arcanum’s skilled consultants will need to work alongside the client to formulate the scope of work and gain an in-depth understanding of the testing requirements.

Penetration Testing – Other Services

We can also provide a number of other services, including:

• Thick Client Assessments
• Code Reviews
• Security Awareness Training
• Writing Secure Configuration Documentation
• OT/ICS Security Assessments
• Breakout Assessments
• WiFi Assessments

These assessments tend to follow a more bespoke approach based on client requirements.