PENETRATION TESTPenetration Testing

Service Overview

Cyber risks facing businesses have become increasingly diverse and sophisticated. As organizations improve operational efficiency and advance digital transformation (DX), the threat of cyberattacks continues to grow. Effective system security is essential in this environment. Nevertheless, many organizations continue to operate with vulnerabilities that could be exploited by external attackers, potentially leading to serious incidents such as major data breaches and system outages.

Infosec Advisory Co., Ltd. (Infosec Advisory) provides penetration testing services that use real-world attack techniques to evaluate system security. Our independent testing enables organizations to assess the security of their information assets and identify and remediate potential risks at an early stage.

What is Penetration Testing?

Penetration testing evaluates the effectiveness of security controls protecting IT infrastructure. While a vulnerability assessment broadly identifies system vulnerabilities, a penetration test evaluates defenses against specific attack scenarios targeting selected information assets, such as confidential or personal information.

Purpose of Penetration Testing

Unlike a vulnerability assessment, penetration testing attacks a system from an adversary's perspective using defined scenarios to determine the actual harm that could occur.

Identifying Vulnerabilities	By simulating attacks against the system based on defined scenarios, we identify specific latent vulnerabilities and assess the feasibility of attacks against the system.
Prioritizing Security Risks	We evaluate the vulnerabilities and security risks identified during testing to determine which issues require priority remediation.
Verifying the Effectiveness of Security Controls	We assess how effectively existing security controls withstand attacks and recommend improvements and remediation priorities as needed.
Improving Employee Security Awareness	Understanding real-world intrusion risks raises employee security awareness and helps strengthen the organization's overall security posture.

Who needs Penetration Testing?

Infosec Advisory recommends conducting penetration testing in the following situations.

Benefits of Penetration Testing

Penetration testing conducted by Infosec Advisory provides the following benefits.

Reduced Risk of Data Breaches	Drawing on our extensive penetration testing experience, independently researched incident cases, and threat intelligence, we identify potential attack paths in advance and minimize the risk of data leakage.
Stronger Regulatory Compliance	Implement security measures aligned with applicable national regulations and industry standards.
Employee Education	Combining testing with employee education, interviews, and advanced social-engineering exercises can reduce incident response costs and help prevent damage to corporate trust and reputation.
Stronger Defenses Against Cyberattacks	Testing systems through simulated attacks based on diverse scenarios helps establish a security posture capable of addressing the latest threats.

Types of Penetration Testing We Provide

Infosec Advisory can perform a wide variety of penetration testing activities, including the following.

Network Vulnerability Assessment	Assess intrusion paths and risks across external and internal networks.
Web Application Testing	Evaluate web application vulnerabilities, including SQL injection and cross-site scripting (XSS), using a variety of attack scenarios.
Mobile Application Testing	Examine security risks in mobile applications and evaluate application-specific threats.
Client-Side Testing	Assess the security of desktop applications and endpoint environments.
Cloud Security Assessment	Assess cloud service security configurations and access controls to verify that appropriate settings are in place.

Penetration Testing Process

1. Preliminary Review	We conduct interviews and preliminary research based on your system environment and security maturity to determine the scope and priority areas of the penetration test. At this stage, we confirm the systems to be tested, the network architecture, and any required access permissions, preparing for efficient and effective testing.
2. Attack Scenario Development	We develop realistic attack scenarios based on the characteristics of your systems and current industry trends. Detailed scenarios consider potential intrusion paths, the data an attacker might target, and the potential financial impact.
3. Test Execution	Using real-world attack techniques, we conduct penetration testing based on the scenarios developed. We apply a multifaceted approach—including external intrusion, internal network attacks, and web application vulnerability testing—to identify potential risks.
4. Results and Remediation Recommendations	We analyze the test results, evaluate the severity of identified vulnerabilities and risks, and recommend specific remediation measures. The report includes details of each vulnerability, practical steps to prevent recurrence, and long-term measures to minimize risk.
5. Follow-Up	We verify the implementation status of recommended improvements and provide retesting or additional advice as needed. Because vulnerability assessments and penetration tests should be conducted regularly, Infosec Advisory supports continual security improvement.

Deliverables

At the conclusion of the penetration test, we provide a comprehensive report and recommendations to help you effectively remediate the vulnerabilities identified.

• List of Identified Vulnerabilities and Remediation Plan
  We provide a list of identified system vulnerabilities, classified according to their exploitability and potential impact on your systems and business, together with a remediation plan.
• List of System Changes Made During Testing
  The test protocol documents the equipment and tools used, the areas examined, and the issues identified. It also includes actionable recommendations for resolving the security issues discovered.

The report provides an overall rating and remediation priorities based on assessment criteria such as those below.

Overall Rating

Grade	Assessment Criteria
A	No vulnerabilities were identified. Alternatively, only findings that are not realistically likely to have an impact at present were identified. Security controls are considered robust.
B	Vulnerabilities with only minor impact were identified, such as issues that require complex conditions to exploit or disclose information that could assist an attacker. A reasonable level of security controls is considered to be in place.
C	Numerous vulnerabilities or vulnerabilities that could cause significant harm if exploited by someone with a degree of technical expertise were identified. Planned remediation is required.
D	Vulnerabilities that could result in serious harm were identified, including data breaches or the alteration of critical information. Immediate remediation is required.

Vulnerability Severity Ratings

Severity	Required Action	Assessment Criteria
Low	Monitoring is required	Findings that disclose information useful to an attacker, such as version or system information, or vulnerabilities that are not currently practical to exploit and would not cause significant harm on their own. Items that are not currently vulnerabilities but should be reviewed to determine whether security measures are needed based on system and operational requirements, such as apparently unnecessary open ports or files.
Medium	Remediation is required within approximately six months	Vulnerabilities that are not easy to exploit due to technical or environmental constraints but could cause significant harm in the hands of someone with a degree of expertise, including theft or alteration of personal or confidential information, unauthorized system use, or system disruption. Vulnerabilities that may cause harm when combined with other weaknesses or whose exploitation is constrained, but which do not independently and immediately enable the theft or alteration of personal or confidential information, unauthorized system use, or system disruption.
High	Prompt remediation is required	Vulnerabilities that can be exploited easily from the internet using simple techniques and could result in serious harm, such as the large-scale theft of personal or confidential information.

Web Application Vulnerability Assessment
Rating Scale

Rating	Description
Informational	Provided for informational purposes only.
Low	Exploitation of this vulnerability generally has a limited impact.
Medium	Exploitation of this vulnerability generally has a moderate impact.
High	Exploitation of this vulnerability generally has a significant impact.

Penetration Testing Rating Scale

Rating	Description
None	No actions could be performed on the target host or service using either administrator or standard-user privileges, and no information outside the service could be obtained.
Caution	Information outside the service could be obtained from the target host or service; however, no actions could be performed using administrator or standard-user privileges.
Warning	Information within the service could be obtained from the target host or service; however, no actions could be performed using administrator or standard-user privileges.
Critical	Actions could be performed on the target host or service using standard-user privileges, but not administrator privileges.
Emergency	Actions could be performed on the target host or service using administrator privileges.