Building a Security Testing Business I am often asked, “How did you get started with your security testing business?” “What are some lessons learned?” “What are your current challenges?” I have been asked enough times Read more…
HTTP Response Headers While preparing for a monthly Lunch-and-Learn lesson for a client, I wanted to collect various examples of good, bad, faulty, and missing HTTP response headers. As is typical, I went a little Read more…
MFA Implementation Attacks Most Multi-Factor-Authentication (MFA) implementations do not protect your password from brute forcing or from account level DoS attacks. This article will demonstrate various attacks that exploit weaknesses found in nearly every industry Read more…
Mobile Application Security Testing tests Android and/or iOS apps. It is typical to perform this in conjunction with Web Application Security Testing when the app is interacting with a webservice/API. Testing involves automated and manual evaluations of one or more apps to ensure they provide protection against abuse of your data. We use industry standard tools to carry out automated scans looking for well known vulnerabilities, and we also conduct manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools. This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability). The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure the security of your app is strong, and then provide actionable solutions to help you protect against attack/compromise. For example, we use industry standard tools and techniques to look for well known/unpatched vulnerabilities that allow an attacker to gain access to carry out remote code execution, privilege escalation, circumventing intended controls, gain access to sensitive data, etc. In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine the exposure, should it be breached. The testing is largely centered around the OWASP Mobile Security Testing Guide, but also includes our internal/proprietary methodologies. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.
Sample Pricing
Add-On Services
PEN Consultants’ Cybersecurity Unlimited service gives you full access to our entire range of testing, training, staff augmentation, and consulting services at anytime, on-demand. This allows us to form strong partnerships with our clients, meeting your specific organizational needs and maximizing your return on investment. The following additional terms apply to discounts:Contract Details
Discounts
Additional Discount Terms
When we perform multiple services for you under a single contract, you will receive a discount for each additional service above the core service. Generally, this is a 20% discount. Example: An external network pentest in conjunction with an email based phishing assessment will grant you a 20% discount on the phishing assessment. Add on an internal network pentest, and you will receive a 20% discount on that service as well.
Discounts are always based on how much overlap there is between services.
Web Application Vulnerability Scanning is one of our most simplistic services. It offers valuable testing for common vulnerabilities and identifies weaknesses in your web app.
The basic service will run one or more industry standard vulnerability scanners against your web app and deliver the raw report to you for review. Your development team would then review the findings, determine which are potentially false positives, and remediate the remaining issues.
You can review a sample report here: SampleWebAppVulnerabilityScanReport.pdf
The standard service includes everything in the basic service, and, in addition, each finding is verified and a custom Findings and Recommendations Report is created.
View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report.
In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need:
DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts).
DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.
Client-Side Application Security Testing tests “thick” applications that are run and/or installed on an endpoint (workstation, server, etc.). It is typical to perform this in conjunction with Web Application Security Testing when the application is an “agent” running on the endpoint and interacting with a webservice/API. Testing involves automated and manual evaluations of one or more applications to ensure they provide protection against abuse of your data. We use industry standard tools to carry out automated scans looking for well known vulnerabilities, and we also conduct manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools. This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability). The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure the security of your application is strong, and then provide actionable solutions to help you protect against attack/compromise. For example, we use industry standard tools to scan for and verify well known/unpatched vulnerabilities that allow an attacker to carry out remote code execution, privilege escalation, circumventing intended controls, gain access to sensitive data, etc. In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine the exposure, should it be breached. The testing is largely centered around static code analysis, fuzzing, and manual analysis using our internal/proprietary methodologies. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.
Sample Pricing
Add-On Services
Network Security Testing (AKA Network Penetration Testing) involves both automated and manual evaluation and testing of your network to ensure it provides protection against abuse of your data. We use a combination of automated industry standard scanning tools to look for well known vulnerabilities as well as conduct extensive manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools. This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability). The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure your security configurations are strong, and then provide actionable solutions to help you protect your organization from attack/compromise. Types of common vulnerabilities found during this testing include those that allow an attacker to gain remote access into your environment, escalate privileges, gain access to your most sensitive data, and exfiltrate it from your network. In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine your exposure, should it be breached. The testing is largely centered around the PTES, NIST SP 800-115, and OSSTMM testing guides, but also includes our internal/proprietary methodologies. This is “noisy” and may generate alerts in the monitoring solutions you have deployed. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.
Sample Pricing
Add-On Services
Wireless Security Testing involves the assessment of your Wi-Fi infrastructure and wireless clients to ensure there is adequate protection against eavesdropping and unauthorized access. Because the RF (Radio Frequency) signals typically “leak out” of your building and/or campus, an improperly secured infrastructure makes it easy for an adversary to “sniff” your corporate data and possibly even access your corporate network from your parking lot or outside your fence line. Testing involves performing a wireless site survey, looking for known vulnerabilities, identifying rouge access points, testing various attacks (against the APs and clients), testing isolation controls (especially on guest access APs), examining the configurations of a sample of the wireless clients, reviewing the overall architecture (including physical), etc. Our testing methodology largely centers around the wireless portions of PTES, SANS‘ Wireless Audit Checklists, and DISA’s wireless security checklist, in addition to our internal/proprietary methodologies. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.Sample Pricing
Add-On Services
Red Teaming has overlap with penetration testing and application security testing, but in addition to testing the technical mitigation aspects of your security stance, it also tests the humans and detection capabilities in your organization. Red teaming activities range from stealthy recon and penetration of your defense, to working directly with your blue team/SOC. Red teaming falls into two categories: Adversary Simulation and Technique Simulation. Adversary Simulation This form of red teaming is an objective driven, stealthy, adversarial simulation which attempts to actively circumvent security controls by carrying out exploits and attack vectors that take advantage of a series of discovered vulnerabilities and/or weaknesses in technical controls, human behavior, process and detection gaps, etc. The red team operation often takes output found during the pentest and/or app testing portion of the engagement, physical attacks and/or social engineering, exploits them, then moves as deep into the network as possible, just like an adversary would. The objective(s) can include comprising high-value workstations and servers in your network with a persistent backdoor/RAT, gaining access to and exfiltrating your most valuable data, getting domain admin, gaining write access to source code repos, etc. An overarching goal to the specific goal(s) set forth is to avoid getting caught/seen/detected. Once the objective(s) is achieved, assuming we are not caught in the act, we will “get noisy” so your incident responders will see us. This gives them the opportunity to practice the incident response process, including discovery, containment, eradication and recovery. Adversary Simulation is largely centered around current attacker techniques and campaigns, but also includes the usage of PTES, NIST SP 800-115, and OSSTMM testing guides and our internal/proprietary methodologies. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. Technique Simulation The second category we put red teaming activities into is Technique Simulation, sometimes referred to as “purple teaming”. This type of red teaming gives the best ROI of any security testing service. During this testing, we work closely with your blue team staff while launching individual attacker techniques. We monitor the activities to ensure they are mitigated and/or detected, and if not, help your blue team build the needed capability to do so. This cycle repeats numerous times to cover as many techniques as the engagement scope allows. Parts of this testing use automated processes, while other techniques require manual methodologies. As such, it is common to run the automated processes first and then perform as many of the manual techniques as the engagement scope allows. Technique Simulation and the techniques tested are largely centered around the MITRE ATT&CK framework. Because our Red Teaming services are highly tailored to each client engagement, it is not possible to give sample pricing. The following are some of the key criteria in determining the costs for Adversary Simulation: In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.Sample Pricing
Add-On Services
As email security filters continue to evolve and improve, attackers are moving from email based phishing to other social engineering methods, such as SMS, phone, in-person impersonation, media drops, etc. These non-email based forms of social engineering rarely have the security solutions in place to monitor and block malicious messages and attacks, which is an advantage for the attacker. The Social Engineering Assessment could include everything from the Phishing Assessment service (email based social engineering) but could also include a custom tailored combination of SMS (i.e. smishing), phone (i.e. vishing), social media, mailed letters/packages, in-person impersonation (i.e. physical social engineering), media drops, etc. The details of the assessment are tailored to your specific needs and risk profile. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. Because our Social Engineering Assessment services are highly tailored to each client engagement, it is not possible to give sample pricing. The following are some of the key criteria in determining the costs: In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.Sample Pricing
Add-On Services
74% of data breaches start with an attacker sending a phish email to compromise one or more of your systems (source, 2018 Verizon Data Breach Report). Therefore, it is imperative to understand how your defenses measure up to this common, and probable, attack. Unlike other forms of attack, phishing requires an attacker to both exploit the user (ex. social engineering) and bypass security controls (ex. email filtering) to be successful. PEN Consultants offers Phishing Testing for your organization as part of the Red Teaming Service and Social Engineering Assessment, but we also offer it as a focused and stand alone service, as seen below. Our semi-automated phishing assessment service provides much more than the typical phish simulation offered by other providers. PEN Consultants, like others, mimics the latest phishing themes and techniques used by attackers to gauge your user’s ability to distinguish between legitimate and varying sophistication levels of phish. But, we don’t stop there. We also include malicious payloads and links to our attacker platforms to see if your technical controls mitigate the risks. If we are successful at both, we take it yet another step and enumerate the systems/data the compromised user(s) have access to. By executing all three steps, PEN Consultants is able to demonstrate actual likelihood, impact, and unique risks to our Client. This far surpasses the value of simulation testing performed by most providers. To keep costs low, this is a semi-automated service in which you will provide a list of email addresses, names, and titles for us to target along with technical details of your endpoints and security stack. By eliminating the majority of the recon and testing phases, as compared with a full scope social engineering assessment or red team engagement, and automating the phish deliveries themselves, we can keep expenses substantially lower while maintaining the ability to accurately gauge your risk and the impact of various forms of phishing attacks. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.Sample Pricing
Add-On Services
An organization who wishes to have a certain measure of security will request a one-time testing engagement and may or may not have that repeated on an annual basis. An organization who desires to add an extra level of protection for its data will request an annual testing engagement, followed by a continual quarterly service. One-time intense testing has advantages and disadvantages. The advantage is that the security tester will be completely focused on your site during the testing. The disadvantage is some real-world attacks require many weeks or months to fully perform, so they will not be completed by the end of a one-time engagement. The continual quarterly service has several advantages: 50% discount (per quarter) – requires an initial full-scope engagement
Discount
PEN Consultants was founded specifically to serve the Body of Christ. As we grow, we do not want to lose those roots. As such, we have created a grant program in which individual donors can contribute directly towards the costs of testing services for a particular church.How it works – For Churches
How it works – For Donors
PEN Consultants offers a 10% discount on all services to nonprofits – including, but not limited to, nonprofit schools, churches, charities, humanitarian organizations, etc.. Simply Contact us to get started with the nonprofit discounts. Additionally, we have created a grant program in which individual donors can contribute directly towards the costs of testing services for a particular nonprofit organization. We are pleased to announce, that because of the generosity of a few of our donors, churches who hold to and teach the Bible being God breathed, inerrant, and infallible, and whose beliefs are consistent with the Apostles’ Creed can expect substantial discounts, based on their average weekly attendance: * nonprofit, as defined and approved by IRS, HMRC, etc.How it works – For Nonprofits
How it works – For Donors
For Churches
Donor Sign-up – Register for Notifications
Web Application Security Testing (AKA Web App Penetration Testing) involves automated and manual evaluation and testing of one or more applications to ensure they provide protection against abuse of your data. We use a combination of automated industry standard scanning tools to look for well known vulnerabilities as well as conduct extensive manual testing to find vulnerabilities and attack vectors not otherwise detectable by automated tools. This is more than a simple vulnerability assessment. We actively attempt to circumvent security controls by carrying out exploits that take advantage of discovered vulnerabilities, revealing what an adversary would be able to do. During testing, we look for any method that can violate the CIA Triad security model (confidentiality, integrity, availability). The purpose of testing is to enumerate your exposure (within the given time constraints), identify and verify as many vulnerabilities as possible, ensure your security configurations are strong, and then provide actionable solutions to help you protect your organization from attack/compromise. Types of common vulnerabilities found during this testing include those that allow an attacker to carry out remote code execution, DoS, SQLi, XSS, Directory traversal, privilege escalation, etc. In most cases, we will leverage the discovered vulnerabilities to (1) verify it is exploitable and (2) determine your exposure, should it be breached. The testing is largely centered around the OWASP testing guide, but also includes our internal/proprietary methodologies. This is “noisy” and may generate alerts in the monitoring solutions you have deployed. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.
static and dynamic vulnerability analysis, information gathering through OSInt and public research, configuration management, temp files, logs, network & infrastructure configuration, HTTP methods, HTTP headers (ex. HSTS, CORS, XSS, X-frame, etc.), identity management, user registration & account provisioning process, account enumeration & guessable user accounts, authentication & authorization, brute-force, authentication bypass, privilege escalation, 2FA/MFA, cache weakness, password policy, directory traversal, insecure direct object references, secure session management, session timeout & logout, session fixation, CSRF, session control, puzzling & hijacking, input & data validation, sanitization, & format string attacks, XSS, SQL, command, & other forms of injection, SSRF, file inclusion, buffer, heap, & stack overflow, error handling, cryptography, secure data at rest (ex. local store), in use (ex. IPC) and in transit (ex. SSL/TLS), secure network communications, certificate trusts, protocols, ciphers, protocols, etc., MiTM attacks, risky business functions and logic, file uploads, process timing attacks, reverse engineering, user accessible logs and alerts for authentication history, password resets, account changes, account lockout, etc., DoS, and moreSample Pricing
Add-On Services
Network Vulnerability Scanning is one of our most simplistic services. It offers valuable testing for common vulnerabilities and identifies weaknesses in your network. The basic service will run one or more industry standard vulnerability scanners against your network and deliver the raw report to you for review. Your information technology team would then review the findings, determine which are potentially false positives, and remediate the remaining issues. You can review a sample report here: SampleVulnerabilityScanReport.pdf The standard service includes everything in the basic service, and, in addition, each finding is verified and a custom Findings and Recommendations Report is created. View our Sample Findings and Recommendations Report to see the level of detail PEN Consultants provides in our report. In order to keep our testing prices low, we’ve removed certain services that not every client requests. You only pay for the following services you need: DISCLAIMER: Sample pricing listed is not actual pricing. These dollar amounts are estimates based on the number of hours required for engagements of similar size and assumes white box testing and at least a 60-day lead time.. They are provided to give you a ballpark idea of the cost for the service. The total cost will be based on the estimated number of hours to perform the requested service and our hourly rate. Black box testing, specific complexities, and other non-standard situations will increase costs. Additionally, sample pricing does not include travel or other non-standard expenses (specialized equipment, materials, etc.). Final pricing is determined during the no-obligation scoping phase (before testing starts). DISCLAIMER: Other than Wireless Testing, all testing is remote-only unless otherwise noted. Sample prices and prices quoted are for remote-only and do not include travel. See the On-site Supplemental Testing add-on for more information.Basic Service
Standard Service
Sample Pricing
Add-On Services
© PEN Consultants, LLC 2013 -
