Vulnerability Assessment and Penetration Testing (VAPT)
Independent IT vulnerability testing and certification by CERT-IN empanelled service provider
Doing business online has always been a risk. It's a world of unforeseen traps, with vulnerabilities and threats manifesting themselves in the least expected place, at the least expected hour.
But today, it's time you felt safe again. As part of the managed security suite, we offer you the ability to continuously monitor and manage your security network and systems without locking you into any upfront investment.
Introducing VAPT
Automated VAPT (Vulnerability assessment and penetration testing) is an on-demand solution, which makes it convenient to run tests over the Internet anywhere, anytime. It is a hybrid solution which blends automated testing with security expert analysis. This blended model provides the best quality test coverage while accelerating the test time. The unique technology identifies all possible attack vectors.
Using this solution, organizations are conducting comprehensive, regular penetration tests in a cost-effective manner and easily manage compliance requirements like PCI, SOX, ISO27001, HIPAA etc.
Its artificial intelligence based technology can simulate human hackers to find all possible attack paths by which attackers can compromise any application or networks. VAPT can also detect attack paths, which are otherwise missed out in traditional testing while suggesting suitable remedies.
CCCAS+ adopts a comprehensive approach, inclusive of re-testing to certify customer infrastructure for technical gaps. The process starts with a first level audit, followed by a comprehensive report and recommendation to customer. Once the customer team closes the gaps, CCAS+/CCS partner does a re-testing to determine closure of the gaps.
Security Audit Process
Automated testing – Proprietary, open-source & commercial tools
Information gathering modules identify the application environment, frameworks, dependencies and platforms.
Internal intelligence engine selects ideal tools for the target, which includes proprietary, open-source and commercial tools.
Data from various tools is collected, streamlined, cross-referenced and stored into the internal testing database.
Manual Testing – Application mapping and logic testing
Applications are divided into core modules and functional areas.
Each module is thoroughly analyzed and reverse engineered to identify files, folders and parameters.
Data flow between components is mapped along with their logical relationships.
Expert consultants create test cases based on business concerns, pain areas and potential abuse scenarios.
Integration – Data correlation and cross-referencing
Data from automated and manual testing is cross-referenced and correlated to establish a final list of issues.
Data is referenced from public & private sources to build rich issue profiles.
Expert auditors analyze the data and extract any key details that may not have been picked up automatically.
Reporting – Custom developed with detailed fix information
Experts manually document details, descriptions, proof of concepts and references specific to your applications.
Source code and configuration fixes for each issue are provided specific to your environment.
Step by step POCs and fix information helps your teams understand issues.