Security Testing Services: We Pinpoint Your IT Security Weaknesses Before Hackers Do

Vulnerability assessment

The security testing team detects and prioritizes security weaknesses in your IT infrastructure components and provides customers with further recommendations on how to mitigate them. They evaluate the protection level in your IT environment both with automated scanning tools and manually.

Penetration testing

Security testing engineers check the protection of your entire IT infrastructure or applications to find and try to exploit security vulnerabilities, and define the measures to mitigate them.

When conducting penetration testing, the security team ranks the detected vulnerabilities according to the following classifications depending on the object under test:

• Web Application Security Consortium (WASC) Threat Classification.
• Open Web Application Security Project (OWASP) Testing Guide.
• OWASP Top 10 Application Security Risks.
• OWASP Top 10 Mobile Risks.
• Common Vulnerability Scoring System (CVSS).

Taking into account your particular needs and applying both automated (via scanning tools) and manual testing methods, ScienceSoft’s security testing team carries out penetration testing according to one of the three models:

• Black box penetration testing. ScienceSoft’s security testing team imitates the actions of real hackers having no access to your database structures, source code, architecture and network diagrams, and other information that is not available publicly. They try to find and further help you eliminate your system vulnerabilities exploitable ‘from the outside’.
• Gray box penetration testing. With some information on your IT infrastructure or application design and architecture, ScienceSoft’s security testing team focuses on the objects to be tested without the need to spend time to define their architecture and location.
• White box penetration testing. With admin rights and access to server configurations, IT infrastructure architecture documentation, etc., ScienceSoft’s security testing team checks the IT infrastructure or its particular component(s) for the weaknesses seen ‘from the inside’. This way, ScienceSoft’s security testing specialists can thoroughly assess the security of the configurations of your IT infrastructure components.

Security code review

ScienceSoft’s security testing team combines manual checks with automated tests to verify your applications’ code security. ScienceSoft’s security engineers strive to identify encryption, buffer overflow, XSS vulnerabilities, and other security weaknesses possibly overlooked in the development phase and provide you with actionable recommendations to close the security gaps in your application code.

Infrastructure security audit

The security team performs an end-to-end check of your IT environment to find security vulnerabilities in:

• Security policies and procedures.
• Security monitoring tools.
• Physical access control.
• Configuration management.
• Version control and user practices.

Compliance testing

ScienceSoft’s security testing experts conduct automated scanning and manual security analysis of your IT environment for you to ensure the compliance with PCI DSS, HIPAA, and other industry-specific security regulations and standards. We also help you to mitigate compliance gaps, if any, and implement the missing security policies. Finally, we provide you with an attestation letter on the basis of compliance testing results.