Network penetration test

[David A]

Not sure which forum - business or computers or general gassing so here goes:

Am after a reccomendation for a company that can do a network penetration test i.e. dsl lines, web sites, firewalls, routers etc and give a report back. Needs to cover reccomendations for open ports, leftover admin passwords, simple passwords, resistence to attack etc

And if anyone can say what else they should be looking at so I can veryify they are any good !

Anyone been through this and can reccomend an outfit?

Thanks

Dave

[Yugguy]

Ah, I'm trying, I really am. But I can't resist.

[beavisandbutthead]

hehe, hehe, he said penetration, hehe, hehe.

[/beavisandbutthead]

[xiphias]

I've no idea, but open ports is easy.

[url]Shields Up|https://www.grc.com/x/ne.dll?bh0bkyd2[/url] - Recommended for anyone really, check your pc is secure!

[rich1231]

mail me off line, i know some peeps

[David A]

rich1231 said:

mail me off line, i know some peeps

YHM

[si_j]

open ports and difficulty of firewall access is easy, nmap is your friend

nmap -P0 -O -v <host>


hmm i've got a new router so i'll try it on myself and see what it's new rating is

[JamieBeeston]

David A said:

rich1231 said:

mail me off line, i know some peeps

YHM

Ditto, I have staffers that do this

Ballpark, you're looking £750-£1k a day, with time frames from a few days upto a few months depending on the size of your infrastructure!

Generally there should be two meetings before hand. One technical scoping to cost and advices. Second a pre-engagement meeting to discuss timings and the details

What they need to beware of is people who simply run nessus on the network and print out it's report.
Such people are cheap but ineffective, depends if you REALLY want to know what state your networks in, or just want a piece of paper to appear the MD/TD/Board

J

[David A]

JamieBeeston said:

David A said:

rich1231 said:

mail me off line, i know some peeps

YHM

Ditto, I have staffers that do this

Ballpark, you're looking £750-£1k a day, with time frames from a few days upto a few months depending on the size of your infrastructure!

Generally there should be two meetings before hand. One technical scoping to cost and advices. Second a pre-engagement meeting to discuss timings and the details

What they need to beware of is people who simply run nessus on the network and print out it's report.
Such people are cheap but ineffective, depends if you REALLY want to know what state your networks in, or just want a piece of paper to appear the MD/TD/Board

J

Small network, couple of lines in, want to know whats exposed, whats protected and generally get a reccomendation about how secure it is or isn't.

Hence personal reccomendations of those companies you know are good and who don't just run a couple of automated routines and also those who can inteligently discuss the results.

Rich - Thanks will chip you an email in due course.

Dave

[gizard]

www.mwrinfosecurity.com/

[Saabyfox]

Best in the business is www.Trustmatta.com
Social engineering attacks, covert penetration testing, web application security testing, Wireless security, network design etc etc
Used by ALOT of financials...
Let me know if you need to contact them.

[JamieBeeston]

David A said:

Small network, couple of lines in, want to know whats exposed, whats protected and generally get a reccomendation about how secure it is or isn't.

Hence personal reccomendations of those companies you know are good and who don't just run a couple of automated routines and also those who can inteligently discuss the results.

Rich - Thanks will chip you an email in due course.

Dave

My chap is decent, mainly Pen Tests for Larger Corporates, some that literally run into the Months.. He's a 'Certified Ethical Hacker' which always brings a grin to my face

Anyway, you know where I am if you want to explore this further.

GL

J

[aldi]

Tonsko on here does it I think -

www.pistonheads.co.uk/gassing/topic.asp?t=268179&f=95&h=0&hw=penetration+security

[David A]

JamieBeeston said:

David A said:

rich1231 said:

mail me off line, i know some peeps

YHM

Ditto, I have staffers that do this

Ballpark, you're looking £750-£1k a day, with time frames from a few days upto a few months depending on the size of your infrastructure!

Generally there should be two meetings before hand. One technical scoping to cost and advices. Second a pre-engagement meeting to discuss timings and the details

What they need to beware of is people who simply run nessus on the network and print out it's report.
Such people are cheap but ineffective, depends if you REALLY want to know what state your networks in, or just want a piece of paper to appear the MD/TD/Board

J

Small network, couple of lines in, want to know whats exposed, whats protected and generally get a reccomendation about how secure it is or isn't.

Hence personal reccomendations of those companies you know are good and who don't just run a couple of automated routines and also those who can inteligently discuss the results.

Rich - Thanks will chip you an email in due course.

Dave

[UpTheIron]

Dave, are you looking for something that is purely network level, or a more holistic view to cover other security aspects, be they physical locations / access, key systems, overall architecture etc?

I work for a consulting organisation that could probably do everything you require in the space if you want to look beyond straightforward perimeter security.

[David A]

UpTheIron said:

Dave, are you looking for something that is purely network level, or a more holistic view to cover other security aspects, be they physical locations / access, key systems, overall architecture etc?

I work for a consulting organisation that could probably do everything you require in the space if you want to look beyond straightforward perimeter security.

At the mo just network level - in a simple way - can anyone from the outside get in, are we exposed in anyway. As a guide one test I was thinking of was here is a laptop and login, we "pretend" its been stolen and disable the login, vpn etc as per our normal protocols, are we still exposed ?

Not that any of the above has happened - I'm looking for brownie points for being proactive

Cheers

[FunkyGibbon]

we've used NCC in the past