Our general approach during this penetration test was as follows:

1. Reconnaissance
   We attempted to gather as much information as possible about the target. Reconnaissance can take two forms: active and passive. A passive attack is always the best starting point as this would normally defeat intrusion detection systems and other forms of protection, etc., afforded to the network. This would usually involve trying to discover publicly available information by utilizing a web browser and visiting newsgroups etc. An active form would be more intrusive and may show up in audit logs and may take the form of a social engineering type of attack.
2. Enumeration
   We used varied operating system fingerprinting tools to determine what hosts are alive on the network and more importantly what services and operating systems they are running. Research into these services would be carried out to tailor the test to the discovered services.
3. Scanning
   Through the use of vulnerability scanners, all discovered hosts would be tested for vulnerabilities. The result would be analyzed to determine if there are any vulnerabilities that could be exploited to gain access to a target host on a network.
4. Obtaining Access
   Through the use of published exploits or weaknesses found in applications, operating system and services access would then be attempted. This may be done surreptitiously or by more brute force methods.

Throughout the document, vulnerabilities or risks are labeled and categorized as:

• Extreme
  Extreme risk of security controls being compromised with the possibility of catastrophic financial/reputational losses occurring as a result.
• High
  High risk of security controls being compromised with the potential for significant financial/reputational losses occurring as a result.
• Elevated
  Elevated risk of security controls being compromised with the potential for material financial/reputational losses occurring as a result.
• Moderate
  Moderate risk of security controls being compromised with the potential for limited financial/reputational losses occurring as a result.
• Low
  Low risk of security controls being compromised with measurable negative impacts as a result.

Please note that this risk rating system was taken from the Penetration Testing Execution Standard (PTES). For more information, see: http://www.pentest-standard.org/index.php/Reporting.