Our approach includes the following phases:
Information-Gathering
The information-gathering phase of a wireless network penetration test from DeepSeas RED consists of network enumeration, identifying the SSIDs (network names) in scope and in range of your Wi-Fi network. Information-gathering efforts result in a compiled list of metadata and raw output from automated tools to obtain as much information about the wireless network’s makeup as possible. This step is designed to collectively map the in-scope environment and prepare for threat identification and modeling.Threat Modeling
With the information collected during the information-gathering phase, security testing transitions to threat modeling where assets are identified and categorized into threat categories.Vulnerability Analysis
The vulnerability analysis phase in a wireless penetration test involves reviewing, documenting, and analyzing vulnerabilities discovered as a result of information-gathering and threat-modeling phases. This includes the analysis of output from the various security tools and manual testing techniques leveraged in the previous steps. Vulnerability analysis will include making a plan for exploitation and gathering exploits.Exploitation
The exploitation phase of a wireless penetration test by DeepSeas RED involves establishing access to the wireless network and potentially your internal network through the bypassing of security controls and exploitation of vulnerabilities to determine their real-world risk. In a wireless penetration test, this also involves assessing the following potential areas of risk:- Rogue access point detection – We will work with your team to validate any alerting mechanisms you have or may need to detect unauthorized access points in your environment correctly.
- Encryption key and password strength – Your DeepSeas RED crew will help your team gauge the strength and complexity of your wireless keys and their ability to be “brute force” or dictionary cracked.
- Radio frequency (RF) signal leakage – Working with your team, we can identify areas of signal bleed-over or weak access areas internally within your organization.
- Network segmentation – Like a miniature internal network penetration test, your DeepSeas RED crew will identify any weak areas between your wireless environments and physical networks that may need to be addressed.
- Egress filtering – By doing a packet-level examination, your team of expert pen testers from DeepSeas can help your organization identify any specific protocols or ports that establish outward connections from within your wireless environment.
- Captive portal testing – If your organization uses captive portals as a part of your wireless infrastructure, your DeepSeas RED crew will conduct basic testing against your application to ensure its integrity and security.
