Efficient GRC Solutions and PCI Automation for Seamless Compliance

Personal Information*

Application Penetration Testing

Please Note:

If the site is hosted by a 3rd Party Supplier, it would be your responsibility to obtain permission before testing begins. At some point CyberSigma will need to use some low level login credentials for application and website testing. For confidentiality reasons we will ask for these to be text/emailed to us when required. If an Intrusion Prevention System (IPS), Web Application Firewall (WAF) or Active Intrusion Detection System is present, exclusion for the IP Addresses associated with testing may be required.

External Infrastructure Penetration Testing

Internal Infrastructure Penetration Testing

Wireless Penetration Testing

Voice over IP Penetration Testing

Enterprise Access Penetration Testing (Tests from a Citrix-like environment)

Firewall Ruleset Review

The goal of firewall rules review is to verify the efficacy of your filtering policy by ensuring that the firewall configuration and rule set meet business and compliance requirements by verifying that actual configurations and traffic actually flowing through the firewalls matches approved configurations and traffic that is approved to flow through the firewalls.

Code Review

Source code auditing is the most comprehensive service that can be applied to a given application: it can exhaustively detect the vulnerabilities affecting an application by reviewing the source code.

Configuration Review - Build Review

Performed following a white box approach, the configuration audits make it possible to compare the security level of a given environment with the state of the art, with all the necessary points of view (access to equipment configurations, interviews with teams in charge of the platforms, provision of documentation, etc.).

Social Engineering

Red Team

Red team engagements use real attacking tactics applied to your infrastructure. It is a life-size exercise that aims to find a way to infiltrate your internal network in order to extract real data, all this avoiding detection. The purpose of this service is to reveal how effective your organisation's defences are against a real attack but also to test security at several levels of your organisation. The tests will be carried out remotely, but can also need to be done from your premises.

Name
Email
Contact No.
Organisation Name

Type Of Assessment
Project Goals
Timelines
Compliance Reason
Is CESG / CHECK testing required? (UK only)	YesNo
Website / Application Penetration Testing
What is/are the URL(s) and function (brief explanation) of each application?
What is/are the Sub Domain(s)?
Number of Static Pages
Number of Dynamic Pages
Is there a login function?	YesNo
Would you like to test authenticated parts of your application (for instance, an account management feature)?	YesNo
If required for the quotation process would you be willing to provide some low level credentials?	YesNo
Are there any areas of functionality that are specifically out of scope?	YesNo
Is testing to be performed on site or remotely?	OnSiteRemote
What is the nature of the environment that we will be testing?
Are card payments taken and stored on-site or is this controlled by a third party?
IP Address if testing the associated infrastructure. Please specify if these addresses are belonging to you own infrastructure of if it is hosted externally
Type of application

Number of servers (including virtual machines)
Number of Physical sites:
Number of desktops (a minimum of 10% is tested unless requested otherwise)
Are all Physical sites accessible from a single network location?	Yes	No
Are the desktops built from a standard image?	Yes	No

Names of Wireless SSID(s)
Number of locations sites to test
Will enumeration of rogue access points be necessary?	Yes	No

What constructor do you use for your Infrastructure?
Number of locations sites to test
Would you like to test your IP phone?	Yes	No
Would you like to test the security of your server infrastructure (Call manager, SIP proxy, etc.)?	Yes	No

Cybersigma Consulting Services

Vulnerability Assessment and Penetration Testing(VAPT) Form