Efficient GRC Solutions and PCI Automation for Seamless Compliance

Personal Information*

Name:*
Email:*
Contact No.*
Organisation Name:*

Application Penetration Testing

Please Note:

If the site is hosted by a 3rd Party Supplier, it would be your responsibility to obtain permission before testing begins. At some point CyberSigma will need to use some low level login credentials for application and website testing. For confidentiality reasons we will ask for these to be text/emailed to us when required. If an Intrusion Prevention System (IPS), Web Application Firewall (WAF) or Active Intrusion Detection System is present, exclusion for the IP Addresses associated with testing may be required.

External Infrastructure Penetration Testing

Please add all external facing IP address ranges here Please specify if these ranges are belonging to you own infrastructure of if it is hosted externally
Please state how many of these external facing IP addresses are LIVE
Please describe the main functionalities of every server hosted on this perimeter (VPN, web-service, etc.)

Internal Infrastructure Penetration Testing

Number of servers (including virtual machines)
Number of Physical sites:
Number of desktops (a minimum of 10% is tested unless requested otherwise)
Are all Physical sites accessible from a single network location?	Yes	No
Are the desktops built from a standard image?	Yes	No

Wireless Penetration Testing

Names of Wireless SSID(s)
Number of locations sites to test
Will enumeration of rogue access points be necessary?	Yes	No

Voice over IP Penetration Testing

What constructor do you use for your Infrastructure?
Number of locations sites to test
Would you like to test your IP phone?	Yes	No
Would you like to test the security of your server infrastructure (Call manager, SIP proxy, etc.)?	Yes	No

Enterprise Access Penetration Testing (Tests from a Citrix-like environment)

Type of access
Can credentials be provided?	Yes	No

Is the Enterprise access farm hosted in your infrastructure or externally?	Yes	No

Firewall Ruleset Review

The goal of firewall rules review is to verify the efficacy of your filtering policy by ensuring that the firewall configuration and rule set meet business and compliance requirements by verifying that actual configurations and traffic actually flowing through the firewalls matches approved configurations and traffic that is approved to flow through the firewalls.

Firewall Vendor
Number of firewall rule sets to be reviewed
How many rules are in place for each firewall?
Will they be reviewed on site or offsite?	Onsite	Remote

Can documents (network diagrams, information about your filtering policy) be provided?	Yes	No

Code Review

Source code auditing is the most comprehensive service that can be applied to a given application: it can exhaustively detect the vulnerabilities affecting an application by reviewing the source code.

Number of lines of Code
Code Language
Third Party / Open Source components
Would there be a test environment available?				OnsiteRemote
Would the design documents be available?				Yes No

Configuration Review - Build Review

Performed following a white box approach, the configuration audits make it possible to compare the security level of a given environment with the state of the art, with all the necessary points of view (access to equipment configurations, interviews with teams in charge of the platforms, provision of documentation, etc.).

Type and amount of equipment/build to audit
Are you able to export and send the configuration or do you need a consultant to do the audit on a live system ?	Yes No
Would there be a test environment available?	Yes No
Are there specific guidelines you want the consultant to use?
Would design documents / specifications be available?	Yes No

Social Engineering

Would you want to test social engineering scenarios through phishing simulation?	Onsite	Remote

Would the design documents be available?	Yes	No
Would you want to test your employee awareness through physical intrusion simulation?	Yes	No

Would you want to test your employee awareness through phone calls simulation?	Yes	No
Number of people to target

Red Team

Red team engagements use real attacking tactics applied to your infrastructure. It is a life-size exercise that aims to find a way to infiltrate your internal network in order to extract real data, all this avoiding detection. The purpose of this service is to reveal how effective your organisation's defences are against a real attack but also to test security at several levels of your organisation. The tests will be carried out remotely, but can also need to be done from your premises.

Size (number of people) and type of the organisation you wish to be assessed
Method you wish to be used (multiple can be selected)

VA Scans (Vulnerability Assessment)

Firewall Vendor
Please state if all machines are hosted externally	Yes No
How many web applications do you need to scan?
Please state if all applications are hosted externally	Yes No
Other Requirements
Additional Notes

Type Of Assessment
Project Goals
Timelines
Compliance Reason
Is CESG / CHECK testing required? (UK only)	YesNo
Website / Application Penetration Testing
What is/are the URL(s) and function (brief explanation) of each application?
What is/are the Sub Domain(s)?
Number of Static Pages
Number of Dynamic Pages
Is there a login function?	YesNo
Would you like to test authenticated parts of your application (for instance, an account management feature)?	YesNo
If required for the quotation process would you be willing to provide some low level credentials?	YesNo
Are there any areas of functionality that are specifically out of scope?	YesNo
Is testing to be performed on site or remotely?	OnSiteRemote
What is the nature of the environment that we will be testing?
Are card payments taken and stored on-site or is this controlled by a third party?
IP Address if testing the associated infrastructure. Please specify if these addresses are belonging to you own infrastructure of if it is hosted externally
Type of application

Cybersigma Consulting Services

Vulnerability Assessment and Penetration Testing(VAPT) Form