• Interview key stakeholders
• Review and scan network and systems
• Initiate the scope
• Identify data collection and protected data

Pairwise working with functional team and dev team to understand the application domains and identify groups of adversary.

Combine various tools like: Whois, nslookup, netcraft, nmap, google dorking to spot out network threats and system misconfigurations.

Interview key stakeholders to identify protected data and system architectures

• Understand adversaries and attacks can be performed
• Identify both internal and external threats

By understanding the motivation factors of all adversaries, there are 3 groups identified.

Individual Small Group: Individual and small group adversaries are motivated primarily by profit and notoriety.

• Unlikely to target attack
• Untargeted attacks, may not discriminate

Political Groups: These adversaries are motivated by political gain

• Target attack, may choose specific services and protected data

Organized Crime: These adversaries are motivated by financial gain and other related systemic criminal activities

• Untargeted attacks, may not discriminate
• Target attack, may choose specific services and protected data

• Assess security risk against threats
• Determine attacks with risk assessment
• Design real-world attacks
• Launch attacks
• Gather results
• Demonstrate empirical threats

Identify & assess all risks against threats. Create a risk-level matrix with risk level, its impacts and action items

Design & perform empirical attacks based on the data collected and risk assessment.

Our Attack Anatomies including:

System Compromise: These scenarios are to demonstrate that without ever targeting systems directly an adversary can cause actions within the organization to occur that could harm to the services or data

• Step 1: Construct attacks like: XSS, Buffer Overflow, Brute Force, DDoS
• Step 2: Construct attack payload
• Step 3: Launch the attacks
• Step 4: Log In and Manipulate records

External Attack to manipulate active services

• Step 1: Exploit vulnerabilities in the server to gain control of the web server
• Step 2: Pivot the network to perform scans of the internal network without detection and identify systems on another network segment that appeared vulnerable
• Step 3: Probe the network
• Step 4: Compromise the access

Application Compromise

• Step 1: Exploit vulnerabilities in the application, inputs fields considered
• Step 2:  Construct malware like injecting executable/ malicious code into images, SQL injection,…
• Step 3: Launch the attacks
• Step 4: Compromise the access or perform intended actions

A combination of tools to bring more effectively: Nessus, Nexpose, Exploit-DB, Metasploit, Burp Suite, ZAP ….

• Conduct risk assessment report
• Document results to allow additional policies, procedures.

• Conduct risk assessment report to key stakeholders
• Conduct Security and Bug List Reports
• Document all necessary procedures for handover
• Deliver training to client’s teams for security awareness