Category: JDSSecurity

Purple Teaming – A Happy Cyber Security Family

Blog, JDSSecurity, Secure, TestJDS

When considering cyber security, keeping on top of threats is important, and by no means a simple task. As attacks become increasingly sophisticated and harder to detect, our defences need to remain sharp and up-to-date. One approach to improving security that has been gaining popularity is called ‘Purple Teaming’.

In this post, we’ll break down why ‘Purple Teaming’ might be a valuable addition to your ongoing security initiatives.

What is Purple Teaming?

Purple Teaming is essentially about bringing together both sides of the cyber security arena: the Red Team and the Blue Team.

  • Red Teams research and simulate the activities of real-world attackers, including hackers, by probing systems through penetration testing. Using the same tools and techniques as cybercriminals, they help uncover and highlight vulnerabilities before real attackers can exploit them.
  • Blue Teams defend against the attacks of Red Team attack simulations and those of real external attackers. The Blue Team focuses on detecting and responding to threats, often using a SOC or a SEIM platform, and works on strengthening overall defences.

Purple Teaming is a security strategy combining the Red and Blue Teams to form a more holistic view of cyber security. When a Purple Team engagement is initiated, rather than working separately in an adversarial capacity, both the Red and Blue Teams will work together and learn from each other to create a stronger, more cohesive security posture.

What is the effectiveness of Purple Teaming?

One of Purple Teaming’s greatest strengths is that it is an arrangement of cooperation between both the defensive and offensive sides of cyber security. By combining the offence of a Red Team with the defence of a Blue Team, it is possible to develop a stronger and more in-depth security posture.

Within a Purple Team engagement, the Red Team will simulate attacks to identify vulnerabilities or gaps in security, while the Blue Team actively monitors and attempts to defend against any detected attacks. The Purple Team as a whole will use the information that is generated by the attacks, in addition to what is reported by the Red Team, to improve on existing defence strategies, and to develop more effective monitoring, detection, mitigation, and recovery techniques.

Normally Red and Blue Teams work separately, often in an adversarial capacity; however, when operating as a Purple Team, the Red and Blue Teams work together to share knowledge and insights that may otherwise be unknown or not considered. While Red Teams share their latest attack techniques, the Blue Teams offer tips or advice on how they monitor and prevent the attacks, which can allow the Red Team to further develop possible bypass techniques for the Blue Team to work on detecting. This creates a constant cycle of improvement for both teams, and identifies areas where there may be opportunities to upskill.

This type of cooperation not only helps in the identification of new or existing vulnerabilities, but also assists in the development of more effective incident response plans, playbooks, and guidelines, as well as the configuration of monitoring and detection tools, such as a SIEM dashboard or alerts. This level of active communication and improvement helps to stay on top of even the latest threats, and increase the speed of response for any incident that may arise.

Why You May Want to Consider Purple Teaming

Purple Teaming offers a unique combination of offensive and defensive strategies, which can provide numerous benefits across various aspects of your organisation’s cybersecurity efforts. Beyond just improving security posture, this collaborative approach fosters deeper learning, stronger relationships between teams, and greater resilience against evolving threats.

Here are some of the key outcomes you can expect from adopting Purple Teaming:

  • Improved Incident Mitigation, Response, and Recovery:
    By looking at both sides of the cyber security coin, your Blue Team is more able to quickly identify threats and have the knowledge and experience on how to stop them in their tracks. By understanding not only the commonly used, but also the niche attacks, your teams will be better informed to implement procedures that effectively minimise any impact or expedite the required recovery following an incident.
  • Enhanced Threat Intelligence:
    The dynamic nature of Purple Teaming ensures that both offensive and defensive perspectives are considered, helping your teams to keep up-to-date with the latest attack vectors and vulnerabilities, while patching security gaps in real time.
  • Training and Development:
    Teamwork is important. Purple Teaming encourages ongoing learning and skill-sharing between Red and Blue Teams, fostering an environment where information, techniques, and tools are openly exchanged. This cooperation shifts the mindset from an adversarial ‘Us vs Them’ mentality, to that of a unified team working toward the common goal of strengthening security.

To stay ahead of cyber threats, organisations must adopt a proactive and cooperative approach. Purple Teaming offers the perfect blend of offensive and defensive strategies to enhance your security posture, improve response times, and foster collaboration among your cybersecurity teams. By embracing this methodology, your organisation can build a stronger defence while continuously learning and adapting to new threats. Ultimately, the strength of Purple Teaming lies in its ability to drive constant improvement, making it a valuable inclusion in any security strategy.

The Importance of Pen Testing Your Cloud Environment

Blog, JDSSecurity, Secure, TestKelly Cooke

As the uptake of cloud services increases, cybercriminals are more interested than ever in exploiting vulnerabilities to attack cloud services and it’s customers. If your organisation is using cloud services, it’s important to recognise the shared responsibility model where the Cloud Service Provider (CSP) and the client share certain responsibilities, including cybersecurity. The CSP, such as AWS, Google Cloud, or Microsoft Azure, is responsible for securing the underlying services, whereas the client is responsible for the security of any cloud services that are configured and deployed. Therefore, cloud-focused penetration testing can help your organisation to fulfil that responsibility. So what are the benefits of cloud penetration testing, and how does it differ from a standard pen test?

What exactly is cloud penetration testing?

Cloud penetration testing is a simulated attack where offensive security tests are performed to find exploitable security flaws in the cloud-native infrastructure before cybercriminals do. The primary goal of this form of testing is to assess an organisation’s cybersecurity posture within the cloud environment, prevent avoidable breaches in the system, and remain compliant with industry regulations. 

Effective cloud penetration testing involves more than just leveraging an automated scanner. It also employs human skills to examine those flaws, simulate an attack, and determine how the security vulnerabilities in your cloud network could result in actual data compromise. Cloud penetration testing will help organisations learn about the strengths and weaknesses of their cloud-based architecture, consequently safeguarding the company’s data and intellectual properties, finances, and reputation more effectively. 

What’s the difference between cloud penetration testing and traditional penetration testing? 

Although cloud penetration testing applies the principle of traditional on-premise penetration testing, there is a major difference in regard to the approach and environment of testing. This is due to the fact that services in the Cloud are configured and operate differently than in an on-premise infrastructure. Depending on the type of cloud service and the provider, different manual approaches and cloud penetration testing tools may be used. 

Furthermore, the cloud environment comes from a CSP. These providers have unique and specific guidelines when it comes to conducting a pen test on their cloud service, which you must follow. 

Common security vulnerabilities in the Cloud

Some of the most common vulnerabilities that cloud penetration testing can identify include:

  • Misconfigured accounts, access lists, and buckets: Misconfigurations of accounts, access lists, and data containers are the most common vulnerabilities that can lead to a compromise of cloud security. Overly-permissive accounts or containers will violate the principle of least privilege, and therefore potentially result in data disclosure.   
  • Weak authentication, credentials and identity management: Accounts with weak authentication mechanisms allow the attacker to gain a foothold into the cloud system much easier. This compromises all of the information that those accounts can access, and if the least privilege is not strictly implemented, a deeper compromise is inevitable.
  • Data breaches: Another frequent method to compromise the Cloud is harvesting publicly exposed credentials for cloud accounts. An effective cloud penetration test can assist in identifying sensitive information in publicly available repositories, discover the likely repercussions, and provide advice on how to strengthen that aspect of your security posture.
  • Insecure interface and APIs: The attacker often scrapes the cloud infrastructure to identify any weak links that could help them to gain a foothold in the system. An experienced cloud pen tester will explore and identify those insecure entries before the cybercriminals are able to exploit them. 

Why do you need regular cloud penetration testing? 

As cloud services continue to offer new technologies to encourage businesses to move their workload to the Cloud to achieve agility, time and cost efficiency, attackers are also adjusting to changes in the cloud landscape. Therefore, the security risks associated with cloud-based systems and services are evolving rapidly. This stresses the importance of why cloud pen testing should be conducted more frequently than standard on-premise penetration testing. A skilled penetration tester will provide you with useful guidance on how to fix any security flaws found during the test, allowing you to improve your cloud security moving ahead. 

Moving forward with a trusted cloud penetration testing partner

Almost every modern organisation is using cloud services, but the majority lack the tools, methodologies, or experts at hand to conduct a cloud pen test. Partnering with an experienced cloud security provider can bring your cloud platform closer to where it needs to be from a security standpoint.

JDS Security has the experience and expertise to defend your business in the Cloud, with deep and unmatched knowledge of AWS, Azure, and Google Cloud services to help reach your cloud and digital transformation goals securely.

What is the difference between a Vulnerability Scan and a Penetration Test?

Blog, JDSSecurity, Secure, Tech Tips, TestKelly Cooke

Vulnerability Scanning and Penetration Testing are terms that are often interchanged and even confused for the same activity, and while they are similar, they are not the same. So what are the key differences, and how and when should they be carried out?

What is a Vulnerability Scan?

A Vulnerability Scan is performed within your network, systems, services, or applications in the security perimeter concerned. Generally speaking, a Vulnerability Scan is fully automated, providing detailed reports on vulnerabilities found such as out-of-date frameworks and dependencies, publicly known exploits, loopholes, and common configuration issues that could lead to further vulnerabilities.

Typically, these scans are run with tools like Tenable Nessus, Rapid7 Nexpose, and Qualys, among many others, and may be tailored to your requirements.

A Vulnerability Scan is limited to providing a report on raw data and is, for the most part, unable to paint a full picture of where greater issues can arise.

One major difference between using a scanning tool and a human tester is understanding where the pieces of the puzzle can come together, such as chaining low-level vulnerabilities into a high-level critical exploit which may need far more urgent and immediate action than a scan report may suggest.

While often very detailed and including information like CVE details, CVSS scores, and overviews of the vulnerability, etc., there are often false positives presented in even the most finely tuned scans due to the lack of a discerning human eye and experience. Depending on the level of the report, the provided data may still require significant human attention to filter through and further verify, as a scan does not attempt to actively exploit its findings.

What is a Penetration Test?

As suggested by its name, a Penetration Test is a test that attempts to penetrate a system or service from outside of the security perimeter.

A Penetration Test is handled by a human penetration tester and aided by the many tools and techniques available to them, to identify and further exploit any vulnerabilities found on the subject of the test.

Having a human rather than an automated tool may be slower and more expensive on a per-engagement basis, but can provide more accurate results limiting false positives, and providing proof of concept exploitation, experience-driven vulnerability overviews, exploit pivoting, and quality remediation advice with the context of your system or service in mind.

Another advantage of a Penetration Test over a Vulnerability Scan is the ability to research on the fly, find unknown exploits including Zero Days, and find vulnerabilities that may not have been added to the Vulnerability Scanners library yet.

What and When?

While it may seem that a Penetration Test may be the best overall service to take due to its accuracy, there is a time and a place for both services, or even have them work hand in hand.

Where security is concerned, both services are valid but are not providing the complete picture when they are used separately.

Due to the automated nature of a vulnerability scanning tool, it can be set to scan at specified intervals to report changes between two or more points in time, providing a real-time surface view of your systems, network, or other services, and generating a human-friendly report, all whilst running hands-off in the background.

A penetration tester can interpret reports provided by a vulnerability scan and this can supplement a penetration test itself, in many cases helping the human tester speed up the overall engagement by targeting identified points of vulnerability rather than having to manually find them.

Both a Vulnerability Scan and a Penetration Test have their strengths and weaknesses and typically speaking, one’s strength covers the weakness of the other.

It isn’t uncommon for an organization to have a vulnerability scanner conducting day-to-day scans of systems and networks, and periodically have a human penetration tester validate and carry out further tests based on the outputs provided by the scanner. When used together in this way, you can achieve the highest level of security assurance for your organisation.

Fortifying Defense with Offense

Blog, JDSSecurity, Secure, TestKelly Cooke

Detecting and defending against incoming attacks is a key component of a strong blue team, and SIEM capabilities play an important part of the technology stack to achieve this. But, with rapidly evolving cyber threats, it is important to adapt and innovate to stay ahead. Joint activities between red and blue teams, known as purple teaming, allows for easy knowledge sharing and collaboration to enhance defensive capabilities.

Is ‘red teaming’ the same as penetration testing?

Penetration testing is something a red team will do, but the goal of a penetration test is to find as many vulnerabilities as possible, while a red team attack simulation will try to breach the system, access, and exploit as much as possible without being detected. This kind of activity can often include attack points that wouldn’t usually be part of a penetration test, such as social engineering, but are still important for a blue team to detect and prevent.

So, what is ‘purple teaming’?

Purple team exercises have the red and blue teams working closely together, usually in a more focused engagement to provide continuous feedback and knowledge sharing between them. The red team will attempt to exploit vulnerabilities and challenge the blue team’s detection techniques using tools and tactics that are current and used by real-world adversaries. The feedback provided back to the blue team allows them to improve their SIEM capabilities by plugging gaps in detection and enhancing automated and manual response techniques. These activities can highlight additional improvements in overall security posture, training plans and help give organisations insight into future security strategies.

Purple team engagements can have varying timelines, with shorter, more focused engagements, to more long-term engagements where the red team simulates an advanced persistent threat (APT). Regardless of scope, what is important is that the teams are collaborating and working towards the same goal. Generally, the red and blue teams working within an organisation are fairly separate and siloed. Purple teaming gets these teams working together in a more collaborative nature to enhance security capabilities by providing realistic simulations, without impacting budget. Purple team activities can often save an organisation money, as blue teams are able to improve SIEM capabilities more effectively and efficiently than if they were trying to do it on their own.

Overall, these activities can help enhance an organisation’s security posture by opening lines of communication and breaking down barriers, nurturing a more collaborative and integrated culture. Knowledge sharing boosts SIEM capabilities, improving proactivity by closing detection gaps and enhancing automation, which can improve threat hunting and incident response, making security improvements faster and more efficient. Additionally, it allows for more forward-thinking security strategies and long term improvements.

Top Five Actions to Improve Your Cyber Security Posture

Blog, JDSSecurity, Secure, TestKelly Cooke

The current state of Australian security breaches has thrown organisations into chaos and disarray. Australia is currently 5th in the World for cybercrime density, and 11th in the World for the average cost of a data breach ($4.5m). However, most of these breaches could have been avoided had basic cyber security hygiene been implemented.

If implemented correctly, the five items detailed below will give your organisation a fighting chance when, not if, attackers attempt to breach your networks and applications.

1) Know Your Attack Surface

You can’t defend what you don’t know exists! Before you can start defending and monitoring your networks, applications and staff, you must first identify all the assets and areas of risk that make up your overall attack surface. Ensure that you undertake daily discovery scans and conduct a gap analysis of newly discovered assets.

Additionally, it is important to ensure that your asset management system is updated regularly, all newly identified assets are added to your vulnerability management program, and those security assessments are carried out routinely.

It should go without saying that these activities should be undertaken against your Internet-facing and internal, corporate assets.

2) Secure the Network Perimeter AND the Perimeter Endpoints

The saying “the endpoint is the perimeter” has become a marshalling slogan in recent times. Unfortunately, it is quite true.

Gone are the days when the network firewall was the only point of focus for security controls. Client-side attacks are often used to circumvent perimeter controls by targeting end users directly. Endpoint Detection and Response (EDR) security controls are now a ‘must-have’ to defend against these attacks.

On the flip side, attackers continue to relentlessly target web applications and cloud platforms. Next-Generation Firewalls (NGFW) and Web Application Firewalls (WAF) are great security controls to better secure your network perimeter.

It is critical to ensure that your Internet-facing systems are security hardened! This includes implementing Multi-Factor Authentication (MFA) and a SIEM (Security Information and Event Management) to keep a watchful eye over all of your infrastructure systems and applications.

3) Perform Routine and Comprehensive Security Tests

Penetration testing has become a multi-billion-dollar industry. However, most “penetration tests” are nothing more than vulnerability scans in sheep’s clothing. It is important to implement a multi-level security testing program to provide the best insight into the security risks affecting your systems. This includes

  • Daily Vulnerability Scanning.
  • Monthly Social Engineering (Phishing) Campaigns.
  • Quarterly Penetration Testing against your networks, applications, and cloud platforms.
  • Yearly Red and Purple Team assessments.

However, this should only be the beginning. Ensure that you have implemented a robust vulnerability management program so that all findings from these engagements are being addressed and remediated promptly.

It is critical that vulnerability scanning and routine penetration testing should be performed at a minimum, even if you’re on a budget. Oh, and don’t forget to rotate your service provider for these engagements.

Complacency is a killer!

4) Develop and drill your incident response capabilities

“Everybody has a plan until they get punched in the mouth.” – Mike Tyson

All Incident Response (IR) capabilities should always be routinely refined and tested to maintain their effectiveness, in the same way as sharpening a sword. This approach is critical to putting an organisation in the best possible position to combat the next attack threatening the business. This can be best broken down into three pillars; people, process, and technology.

  • People need to be appropriately trained.
  • Processes need to be in place and routinely tested (including policies and IR playbooks).
  • Technology needs to be deployed to ensure the best systems are in place to respond and defend against cyber attacks.

All three pillars should be reviewed and updated every six months to ensure they are still relevant to the business context and aligned with industry-standard best practices. A fantastic way of performing a simulation for your Incident Response capacities is to routinely undertake Purple Teaming assessments. After all, how do you know your sword is sharp unless you use it?

5) Train your Army

An untrained army will lose every battle, every time. Cybersecurity training is often seen as an expenditure as opposed to an asset. A well-trained Blue Team can save an organisation millions of dollars when a security breach occurs.

Cybersecurity training should always be approached from multiple angles.

  • Technical training for all IT Staff, including engineers and analysts.
  • Cyber security awareness training for all staff.
  • Specific awareness training for high-value targets such as CEOs and CFOs.

Remember that while cyber security training is important, it is just as important to put the training to the test by performing in-house drills. There are several budget-friendly alternatives to the big service providers, which can include web-based training providers or even implementing a train-the-trainer style approach. Now, go drill, drill, drill, soldier!

Although the five points above do not account for every approach you can take to harden your company’s security posture, it is a great starting point to ensure you don’t become the next news headline

Manual Security Testing vs Automated Scanning?

Blog, JDSSecurity, Secure, Tech Tips, TestKelly Cooke

The art of penetration testing has evolved over the years. What began with testing arrows on armour, has now become testing tools and techniques on systems and applications. Without a doubt, we are still mostly using manually driven techniques, however this can be slow, cumbersome, and subject to the human element which can result in faults and missed opportunities.

Over the last decade or so, tools to aid and automate security testing have rapidly entered the fray and are increasingly taking the burden off some of the more time-intensive tasks in the cyber security sphere, such as scanning, brute-forcing, or even full-fledged attacks commanded with single line commands. Tools such as BurpSuite, Nmap, SQLMap, Metasploit, and Nessus, among many others, have certainly sped up the discovery and exploitation of vulnerabilities, allowing more in-depth testing within often limited test windows.

Looking at the bounty of tools available to us, you may start to wonder why manual testing is required anymore. Here is a quick rundown on some of the benefits and disadvantages of both, and how using both on engagements, big and small, can be greatly beneficial.

Manual Testing – The Old Reliable

Manual testing, simply put, is the act of using little to no automation for tasks. A great example of this would be the manual exploration of a website while data is being captured by BurpSuite, where the tester can manually analyse the headers and requests as its own task later, rather than immediately after every click.

Manual testing also extends to the exploitation stage of an engagement, where the tester may need to utilise very specific commands or customised scripts to achieve the desired result.

While manual testing can be very meticulous, and provide a detailed and deep understanding of the subject of the test, it can be very time-consuming, possibly taking days longer than an automation-driven test. There are some vulnerabilities that just simply can’t be automated entirely, or are very prone to false positives if automated, and therefore will require further investigation, possibly using more time than if done entirely manually from the beginning.

Some examples of vulnerabilities that require manual testing to correctly identify and safely exploit are:

  • Social Engineering
  • Access Control Violations
  • Password Spraying and Credential Stuffing Attacks
  • SQL Injection
  • Cross-Site Request Forgery (CSRF)

Another advantage of manual testing over automation is the ability to find, and use, newly or not yet discovered zero-day exploits, which can take a significant amount of time to be implemented into commonly used tools.

Automated Testing – The Shiny New Tools

Automated penetration testing is really what is written on the package – it is the process of utilizing automation tools, such as applications, platforms, and scripts, rather than the expertise and efforts of a human tester. It can be significantly cheaper and far more time efficient (which also adds to cost efficiency) than manual testing by one or more human ethical hackers.

Automation tools can perform actions such as content discovery, vulnerability analysis, and brute forcing, in a matter of minutes or seconds, where it could take a manual tester hours or days to get the same results. Automated tools, namely scanning, can be left to run in the background while manual testing is also performed, or set to periodically scan for issues, such as Tenable Nessus keeping an eye on things and providing reports at set intervals or upon request.

When it comes to regular penetration testing, companies factor in cost, and it can be rather expensive to hire human penetration testers for regular tests or as in-house, so it can be more cost-effective to have automated tools do the day-to-day, then infrequently have a human run further tests and analysis.

There is no doubt that automation is the way of the future, and will continuously improve; however, there are many tasks that are best suited to manual testing, either due to the simple inability to automate or due to the hassle of false positives (and false negatives).

Another advantage to automation is consistency, in both its actions and results, and with the reporting at the end. As the scans and processes run are mostly, if not entirely hands-off, there is less room for human error or deviation, and therefore don’t require a highly trained expert to perform the required tasks, which ultimately can save money for the organization. Automation, however, is often unable to fully assess a threat and how it can impact you in context to your application, platform, infrastructure, network, or organisation as a whole, which is something a sufficiently trained human penetration tester can do, and make new actions accordingly. A vulnerability that may be picked up and reported as a low finding by an automation tool, could have much more critical consequences when chained with other low, or even informational, vulnerabilities.

So, what’s better? A manual or automated approach?

Simply put, both manual and automated testing methods have their place, and should always be used in penetration tests of all kinds. The level of detail and effectiveness provided by manual testing is unsurpassed, as well as contextual reporting and risk analysis that simply cannot be provided by even the best automation tools on the market. However, where speed and consistency of tasks are concerned, automation wins without question.

Although both methods can provide you with a satisfactory outcome in terms of vulnerability identification, what is best for your organization will come down to what level of detail and quality your organisation requires, the frequency of the tests, and the cost factor.

Ultimately, a combination of both manual and automated testing is the best way to get the highest quality outcome of a penetration test, with the most efficient use of time and money, to bring you a greater assurance of security and peace of mind that your assets are secure from malicious attack.

Have You Considered “Swinging” With Your Pen Testing Provider?

Blog, JDSSecurity, Secure, TestKelly Cooke

Have you been in a long-term relationship with your existing penetration testing vendor?  

Starting to feel like it’s time to ‘spice things up’ a bit?  

It’s easy to settle into a partnership with a vendor that you’ve got to know, they’ve got to know you along with the more intimate details of your business, and all of the ‘skeletons in your closet’.  It takes time to build that level of trust and knowledge of your organisational context.  

Recently however, there has been a whole lot of whispering behind hands, and new security best practice guidelines being circulated, which suggests that a good cybersecurity strategy should involve regularly changing or rotating your chosen pen testing vendor.  There are a number of reasons to consider the idea of “swinging” with your current pen testing provider.

You Don’t Know What You’re Missing Out On…

Familiarity breeds complacency.  And complacency deprives people of opportunities and brings growth to a standstill.  

If you’re not trying something new, you will always have reasonable doubts that your current vendor might be missing something when it comes to testing methods, skillsets or risk prioritisation. A different pen tester may have slightly different methodologies which could potentially unmask a previously unidentified vulnerability.   They may also report on vulnerabilities in a different way to what you have got used to – and who knows, you might just prefer it that way.

No Pleasure Endures Unseasoned By Variety…

No two pen testing companies are the same.  They come in differing sizes, they come with differing areas of expertise, differing levels of expertise, differing certifications, knowledge of particular industries, the list goes on.  By rotating partnering companies with varying skills, you can take advantage of each vendor’s proclaimed “specialist knowledge” to hedge your risk, and ensure you have the most appropriate pen tester for every engagement.

Rev Up The Relationship With A Little Healthy Competition

Changing up or rotating your pen testing vendors should not become a cut-throat activity, however there are some positive benefits that come with a little healthy competition.  The incoming testing partner will have the motivation and desire to please, they will be going the extra mile to deliver an improved outcome for you.  This, in turn, may drive a boost of creativity and innovation from your existing vendor, who will want to make sure the sparks are still flying, and you still recognise the value that they bring to the relationship.

As with all good relationships, new and existing, being open and transparent about what you’re looking to get out of the partnership is the key to a successful journey.  

At the end of the day, maximising your security posture is the number one goal, and if that means playing the field to see what else is out there, that may ultimately be the best decision for your organisation.  

It doesn’t mean you have to say “Au Revoir” to your long-term pen testing partner. It could simply be time to introduce a fresh perspective into the equation.  

JDS are keen to get in on the action.

What It Means To Be CREST (Intl) Accredited

Blog, JDSSecurity, News, Secure, TestKelly Cooke

Anyone with a computer and an Internet connection can set themselves up as a penetration testing or cyber incident response service provider.  These could include irresponsible organisations that do not have in place policies, processes and procedures to ensure quality of service and protection of client based information.  The individuals employed by these companies may have no demonstrable skill, knowledge or competence in the provision of security testing.

CREST is an International not-for-profit accreditation and certification body that represents and supports the technical information security market. CREST requires a rigorous assessment of business processes, data security and security testing framework to demonstrate a level of assurance that the information security methodologies used can competently and securely provide customers with a robust assessment of their cyber security posture.

As a result, CREST only provides accreditation to highly trusted professional services organisations, and their employees who provide the often sensitive and high-risk penetration testing, cyber incident response, threat intelligence and security operations centre services.

All CREST accredited member companies are required to submit policies, processes and procedures relating to their service provision to provide added assurance for the buying community.  These policies, processes and procedures include:

  • References for certified individuals
  • Assignment preparation and scope processes
  • Assignment execution processes
  • Technical methodology
  • Reporting templates
  • Data storage and Information Sharing policies
  • Post technical delivery methodologies
  • Asset/Information/Document storage, retention and destruction processes

The buying community needs to be in a position where it can procure services from a trusted company with access to demonstrably professional technical security staff.  CREST provides the buying community with a clear indication of the quality of the organisation and the technical capability of staff they employ.

JDS is a proud CREST (Intl) accredited member company who can confidently provide our customers the added reassurance that our services meet the highest professional and security standards.

Five Reasons Why Your Organisation Should Be Penetration Testing

Blog, JDSSecurity, Secure, Tech Tips, TestKelly Cooke

Modern businesses require an advanced approach to security and due diligence.  Having anti-virus software and a firewall is no longer an efficient strategy to prevent highly sophisticated security attacks which can result in irreversible damage to your organisation.

A professional penetration testing service is the best way to identify the strengths, weaknesses and holes in your defences.  Read on to uncover the five best reasons why your organisation needs penetration testing.

1. Protect Your Organisation From Cyber Attacks

Reports of cyber crime within Australia have increased nearly 15% each year since 2019, with the average reported financial loss per successful cybercrime incident being $50,673. Regardless of your organisational size or sector, cyber criminals view every business as a potentially exploitable prospect. The internet is continuously being scanned in search of vulnerable systems.  Carrying out penetration tests will enable you to identify vulnerabilities that are most likely to be exploited, determine what the potential impact could be, and enable you to implement measures to mitigate or eliminate the threat.     

2. Identify and Prioritise Vulnerabilities

Put simply, a pen test will uncover all of the potential threats and vulnerabilities that could damage your organisation’s IT assets.  The resulting report prioritises these vulnerabilities from low to critical, and further categorises them by likelihood and impact.  This gives your team a clear picture of your security posture, and the opportunity to mitigate the greatest threats first before moving on to less risky ones.

3. Stay Compliant With Security Standards and Regulations

Regular penetration testing can help you to comply with security standards and regulations such as ISO 27001 and PCI.  These standards require company managers and system owners to conduct regular penetration tests and security audits to demonstrate ongoing due diligence and maintenance of required security controls. Not only does pen testing identify potential vulnerabilities, ensuring that you are protecting your customers and assets, but it also helps to avoid costly fines and fees connected with non-compliance. 

4. Reduce Financial Losses and Downtime

Recent studies have reported that the average financial impact of a major data breach in Australia is around $3.7million per incident.  This takes into account expenditures on customer data protection programs, regulatory fines, and loss of revenue due to business operability.  System downtime is incredibly costly – the longer your system is down, the more exorbitant the cost.  A penetration test is a proactive solution to highlight and fix your system’s most critical vulnerabilities, and ensure your team are ready to act if your systems were to go down unexpectedly. 

5. Protect Your Reputation and Company Loyalty

Consumers are extremely quick to lose trust in companies and brands, and all it takes is one security breach or data leak to tarnish your reputation.  Customers and partners of your organisation want to know that their private data is safe in your hands, so it is in your best interest to be aware of any vulnerabilities which may put the company’s reputation and reliability in jeopardy.  

This is just a handful of reasons why organisations should carry out regular penetration tests, but there are many more.  Connect with JDS to discuss your pen testing needs and get a full scope of work customised to your requirements.

JDS and the GO Foundation

AppDynamics, Atlassian, Big Picture, JDS People, JDSSecurity, New Relic, News, ServiceNow, SplunkKelly Cooke

The Go Foundation is an inspiring organisation empowering young Indigenous Australians by providing scholarships from primary school through to University.

Co-founded by Adam Goodes and Michael O’Loughlin in 2009, the foundation offers mentoring, leadership, networks and support to GO students on their journey to employment.

JDS is immensely proud to have committed to donating $30k to the GO Foundation over the next three years.

It is an organisation that really resonates, as we recognise the vital importance of ensuring that all Australians have equal opportunity to participate socially, culturally and economically.

Extensive research has revealed that the completion of further education by Indigenous Australians can lead to increased earning capacity, greater employment opportunities, improved health and wellbeing outcomes, and reduced interaction with the justice system. The benefits that can come from Indigenous Australians going further beyond high school with their education can stretch beyond improving and enriching the lives of Indigenous communities – they can benefit everyone.

Positive enabling factors that are likely to increase Indigenous participation in further education include enhancing the quality of school experience for Indigenous students to ensure that culture is recognised, and the aspirations of each student is developed. Additionally, providing access to career advice and guidance, and information on the various choices and pathways available for Indigenous students is linked to increasing the quality of the school experience for Indigenous Australians.

The GO Foundation’s scholarship program provides financial assistance, tools and resources for Indigenous students to ensure their journey through school is rich and rewarding, and a broad range of career options, work experience and paid internships ensures the assistance continues well after the scholarship has ended.    

We hope that by dedicating our long-term support, we are contributing to generational change and opportunities for many students for many years to come.

JDS Security

JDSSecurity, SecureKelly Cooke

Network Penetration Testing

The JDS CREST-certified security team are experts at carrying out safe and controlled network penetration testing to provide a comprehensive security overview of your systems and infrastructure. Using real-world hacking tools and techniques, we will identify vulnerabilities in your systems, and arm you with detailed remediation steps to strengthen your network security and prevent costly cyber incidents.
– External Network (Network Perimeter)
– Internal Network (Assumed Breach)
– Wireless Network
– Virtual Desktop Breakout
– Single Target Host/Device
– Stolen Asset Simulation
– Open-Source Intelligence Gathering

Cloud Penetration Testing

Cloud Security is becoming more critical as organisations migrate sensitive information, systems and applications to Cloud environments. With a focus on platform misconfigurations, cloud storage, insecure coding practices, hosted applications and endpoints, JDS will perform thorough testing on your Cloud platform to mitigate risks and provide security assurance.
– AWS Cloud
– Microsoft Azure Cloud

Offensive Security 365

With a strategic blend of proactive planning and targeted assessments, JDS empowers your organisation to defend against evolving cyber adversaries while maintaining a preemptive stance against potential attacks.  We develop a tailored plan and calendar of security activities to anticipate and mitigate emerging threats and stay one step ahead of attackers.
Read More

Application Penetration Testing

Business-critical applications are vulnerable to exploits of many different forms, including security risks that threaten your systems, and exposure of sensitive data. JDS has extensive experience in testing and analysing both out-of-the-box and custom-built applications for risks and other weaknesses, ensuring your systems and data are kept safe from hackers.
– Web Application
– Mobile Application
– API
– Secure Code Review


Cyber Security Assessments

Whether you require an overview of your security posture or assistance with fortifying your IT assets, JDS offers cyber security assessments and security hardening audits for a wide variety of systems. We perform systematic reviews to identify vulnerabilities posing a risk to your business, determine misconfigurations, and provide a step-by-step remediation strategy aligning with industry best practices.
– Vulnerability Assessment
– Cloud Security Assessment
– System Security Assessment


Tailored Services

While products and services straight off the rack can be valuable, sometimes organisations require a more tailored security solution. JDS can provide security services and assessments for all manner of applications and environments. We work with our customer’s unique operating models, technical demands and compliance regulations, to ensure a more sophisticated cybersecurity landscape, and a more resilient business.


  • CREST (International) Certified Penetration Testing Provider

  • 100% Australian-based pen testing team

  • Over 10 years of experience in penetration testing within Australian Government departments & large enterprise

CREST is a not-for-profit accreditation and certification body that represents and supports the technical information security market.
After being independently assessed to demonstrate proficiency and compliance in the knowledge and delivery of Penetration Testing, JDS Australia has been recognised with Crest (International) accreditation.  
CREST requires a rigorous assessment of business processes, data security, and security testing framework to demonstrate a level of assurance that the information security methodologies used can competently and securely provide customers with a robust assessment of their cyber security posture.
Becoming a CREST accredited member company validates the level of confidence that customers will experience when working with JDS, a highly skilled and trustworthy Australian organisation.

Related Stories

Purple Teaming – A Happy Cyber Security Family

Purple Teaming – A Happy Cyber Security Family

Sep 20, 2024
The Importance of Pen Testing Your Cloud Environment

The Importance of Pen Testing Your Cloud Environment

Mar 3, 2023
What is the difference between a Vulnerability Scan and a Penetration Test?

What is the difference between a Vulnerability Scan and a Penetration Test?

Jan 31, 2023