toukan.dev

product

Pentest Honduras

Cybersecurity and pentesting in HondurasCybersecurity and pentesting in Honduras

What it is

A system has doors. The internet, a remote vendor, a shared account, a privilege nobody revoked.

Pentesting is walking those doors with a signature, then writing down what could be done and how it closes.

The chain

  1. 01System

    What is running. It has a name.

  2. 02Surface

    How you reach it. Internet, vendor, account, privilege.

  3. 03Signature

    Who authorizes the touch. No signature, no test.

  4. 04Path

    A real path is walked. A port is not a list.

  5. 05Finding

    What could be done with that.

  6. 06Report

    System, finding, fix. For the person who has to defend it.

If a link is missing, there is no test. There is a document.

A reading first

Before you request scope. Nothing is sent. It shows what you can already stand behind.

Can you name the systems that would be in scope?
Is there one person who can sign that they may be touched?
Do you know how those systems are reached?

Internet, VPN, remote vendor, shared accounts, privilege.

Does the last report name what was in and what was out?
If a finding appears, who changes the system?
For you
You. The person who has to walk evidence to a committee, an audit, or CNBS. A supervised bank or cooperative. Sometimes a network that was asked for a scoped pentest.
Your problem
They asked for evidence. Last year's PDF has no scope. CNBS rules already exist. You still need a test you can authorize and a report you can defend.CNBS Circular 025/2022, Art. 24, requires security assessments and intrusion tests run by third parties. IT testing itself does not count. Internal audit will ask.
The product
An authorized test. A report a committee, audit, or CNBS can stand behind. Findings written for ISO 27001, PCI DSS, or CNBS if that is the evidence they asked for.Third-party intrusion test, as CNBS Circular 025/2022 Art. 24 requires. Scope written before we start. A Spanish report a committee, audit or CNBS can read, each finding with its fix.

You receive

Scope
Named systems. Named owner. What is in and what is out, in writing, before anyone touches anything.
Authorization
Signature first. No signature, no test. You decide when it starts.
Test
Real paths: privileged access, internet exposure, shared accounts, vendor remote access.
Report
System, finding, what can be done with it, how to close it. Written for the person who has to defend it.

How it runs

  1. 01You write the institution, the systems, and what the evidence is for.
  2. 02We agree scope and authorization. If it does not fit, we say so.
  3. 03We run the test in a closed window.
  4. 04We deliver the report. Each finding has a fix your team can make.

This is not

  • A dashboard.
  • An unauthorized scan to "show value".
  • The ISO 27001 or PCI DSS certificate. The certifier signs that.
  • A transformation program. This is a product: a test and a report.
  • A bench of 200 engineers. This is not nearshore.
  • A firewall. This is not the box, and not a 24/7 SOC.

Start

Write the institution, systems in scope, and whether this is for a committee, CNBS, ISO 27001, or PCI DSS.

[ Request scope ][ Book 30 min to define scope ][email protected]