Penetration testing

How the penetration testing service helps

Evaluate your readiness against real-world attacks

During penetration testing, our experts mimic real-world attacks by looking for ways to circumvent your security systems and data using common tools and techniques.

We then provide a comprehensive report, helping you to determine:

• Where your vulnerabilities lie – including how well your systems tolerate real-world attacks, and how successfully you detect and respond to them
• What impact these vulnerabilities may have – and how likely they are to be exploited
• What actions you can take to improve your security posture

Conduct varying tests according to your needs and budget

Because this is a flexible service, we offer varying scope and depth of penetration testing, making the service cost-effective for you. Our service could range from a straightforward evaluation of your external networks, to many hours of involved on-site manual testing.

Alternatively, you may simply be looking to have the security of an individual system or application tested before it is deployed, or you may be interested in the wider security of your network.

Either way, we can adapt our testing schedules to suit you.

Before testing begins, we can advise you on the level of service you are likely to need.

Why use Jisc?

• We offer a very competitive member-only rate compared to commercial equivalents
• Our expertise lies in testing the applications and systems our members use consistently such as VLEs and student and parent portals; the platforms and services only found in education and research 
• We feed back our threat findings to the sector, for the benefit of the whole community
• We also feed back our findings to software vendors so remediation can take place quickly and fixes can be rolled out across the whole sector
• In collaboration with the SOC and CSIRT teams who manage security across the Janet Network, our sector specific threat intelligence is always current and industry leading
• We understand the security challenges facing education and research, from the annual influx of new students, to networks across different campuses, devolved IT departments and legacy systems and software 
• Our security experts can offer workshops as part of an engagement upskill your internal staff to and enhance your testing and security capability for the future

What information would you need to provide?

Different forms of penetration testing mean you need to provide different levels of information about your systems. These include:

• White box testing – where you provide full network information
• Grey box testing – where you allow the attacker user-level privileges
• Black box testing – where you provide no privileged information

Typically you will be required to provide information such as IP ranges, domains, URLs of applications, key systems and applications, and IP addresses and systems that should be avoided.

Further information

To find out more about the penetration testing service, contact your relationship manager or email professional.cyberservices@jisc.ac.uk.