toukan.dev

product

Pentest El Salvador

Cybersecurity and pentesting in El SalvadorCybersecurity and pentesting in El Salvador

What it is

A system has doors. The internet, a remote vendor, a shared account, a privilege nobody revoked.

Pentesting is walking those doors with a signature, then writing down what could be done and how it closes.

The chain

  1. 01System

    What is running. It has a name.

  2. 02Surface

    How you reach it. Internet, vendor, account, privilege.

  3. 03Signature

    Who authorizes the touch. No signature, no test.

  4. 04Path

    A real path is walked. A port is not a list.

  5. 05Finding

    What could be done with that.

  6. 06Report

    System, finding, fix. For the person who has to defend it.

If a link is missing, there is no test. There is a document.

A reading first

Before you request scope. Nothing is sent. It shows what you can already stand behind.

Can you name the systems that would be in scope?
Is there one person who can sign that they may be touched?
Do you know how those systems are reached?

Internet, VPN, remote vendor, shared accounts, privilege.

Does the last report name what was in and what was out?
If a finding appears, who changes the system?
For you
You. The person who has to show evidence next to the Ley de Ciberseguridad or ACE. A bank or operator. We are not ACE. We are the vendor that delivers a scoped test.
Your problem
ACE and the law changed what you have to be able to show. The purchase is evidence, not a transformation program. The last PDF has no owner and no scope.NRP-23 requires vulnerability and intrusion tests at least once a year and after changes. NRP-32 requires closing every gap, not only critical ones. Last year's report does not cover what changed.
The product
An authorized test. A report a compliance lead can put next to an ACE conversation. ISO 27001 and PCI DSS when that is the evidence.Annual vulnerability and intrusion test for NRP-23 and NRP-32. Agreed scope, a report internal audit can review, and a gap list to close all of them.

You receive

Scope
Named systems. Named owner. What is in and what is out, in writing, before anyone touches anything.
Authorization
Signature first. No signature, no test. You decide when it starts.
Test
Real paths: privileged access, internet exposure, shared accounts, vendor remote access.
Report
System, finding, what can be done with it, how to close it. Written for the person who has to defend it.

How it runs

  1. 01You write the institution, the systems, and what the evidence is for.
  2. 02We agree scope and authorization. If it does not fit, we say so.
  3. 03We run the test in a closed window.
  4. 04We deliver the report. Each finding has a fix your team can make.

This is not

  • A dashboard.
  • An unauthorized scan to "show value".
  • The ISO 27001 or PCI DSS certificate. The certifier signs that.
  • A transformation program. This is a product: a test and a report.
  • A bench of 200 engineers. This is not nearshore.
  • ACE. We are not the state. We are the vendor that delivers the test.

Start

Write the institution, systems, and whether this is for the Ley de Ciberseguridad, ACE, ISO 27001, or PCI DSS.

[ Request scope ][ Book 30 min: NRP-23 / NRP-32 scope ][email protected]