[Porto Co., Ltd.] Announcement of the start of new security service “Penetration Testing Service”
*Porto Co., Ltd.*
Press release: August 19, 2024
**
Announcement of start of new security service “Penetration Testing Service” *Porto Co., Ltd. (Headquarters: Chiyoda-ku, Tokyo, President and Representative Director: Kohei Yamazaki) is pleased to announce the launch of a new security service called “Penetration Testing Service.” *
background
Until now, our company has provided high-end plans as diagnostic plans that support various protocols and technical elements using black box testing. Among these, in response to the recent increase in corporate ransomware infections, information leaks, and security incidents, we will begin offering a penetration testing service as a service to visualize safety and reduce the risk of information leaks.
Protection of corporate information assets has become increasingly important these days, and penetration testing is an essential service for discovering system vulnerabilities from an attacker’s perspective and taking preventive measures.
Through this service, we will provide specific support to increase corporate safety and reduce cybersecurity risks.
*Need for penetration testing*
Modern cybersecurity threats are becoming increasingly sophisticated and sophisticated. In order to protect a company’s information assets under such circumstances, in addition to traditional defensive security measures, a new approach from an attacker’s perspective is required.
Our penetration testing discovers vulnerabilities in your systems and networks by simulating techniques used by real attackers. This service enables penetration testing from an attacker’s perspective, allowing businesses to identify potential risks and take appropriate security measures.
Service content
Scoping and requirements definition
Information gathering
Selection of entry point (Initial Access)
Internal reconnaissance (Discovery)
Privilege Escalation
Ensuring sustainability (Persistence)
Lateral Movement
Collection and Exfiltration
Post-processing (Cleanup and Reporting)
Work item example
*Requirements definition*
・Determination of test range
・Identification of the system and network under test
・Setting test scenarios, goals and success criteria
・Legal/contractual agreements (NDA, rules of engagement)
*Information theft*
・Public information (OSINT)
・Internal information collection
*Initial invasion*
・Sending malware
・Exploitation of known vulnerabilities
・Brute force on the management screen, etc.
・Execution of arbitrary commands
*Internal exploration*
・Internal search of the network using BloodHound etc.
*Privilege Escalation*
・Privilege escalation using kernel exploits
・Privilege escalation by exploiting incorrect settings
・Privilege escalation by abusing the privileges possessed by each user *Ensuring sustainability*
・Abuse of startup items
・Installation of backdoor
・Granting privileged privileges to unauthorized users
・Abuse of services
・Abuse of task scheduler
・Theft of authentication information
・Exploitation of weak authentication information
・Beacon installation
*Horizontal expansion*
・Use of remote service
・Attack on management systems such as DCs
*Post-processing*
・Removal of evidence
・Report creation
・Result sharing and feedback
・Re-diagnosis after correction
・Support for test content for a certain period of time
Penetration testing (PT) work flow
Attack scenario (example)
*Reference URL*
Announcement of start of new security service “Penetration Testing Service” https://www.poruto-inc.com/news-archive/news-20240808.html
About Porto Co., Ltd.
Porto Co., Ltd. is a company that supports security measures, focusing on vulnerability diagnosis and penetration testing. Utilizing the latest technology and extensive experience, we offer a variety of services to protect corporate information assets.
Contact information
Porto Co., Ltd.
Phone number: 03-5244-4739
Email address: sales@poruto-inc.com
Website: https://www.poruto-inc.com