Penetration Tests put the resilience of an industrial system to a potential cyber attacks to the test, exploiting the existing vulnerabilities in the infrastructure.

Penetration Testing is part of a broader Cyber Security Risk Assessment process on an industrial control system.

This is why our service is based on the pillars of the IEC 62443 standard, from which we adopt the systematic method to manage cyber risk on industrial devices.

Our offer is structured on a complete range of consulting services according to the security lifecycle approach in conformity with the IEC 62443 standard requirements, which is structured into three macro-phases of work:

• • Assessment
  • Implementation
  • Maintenance

Penetration Testing falls under the assessment stage downstream of the vulnerability assessment. Once the most critical parts of the OT network have been identified via the Vulnerability Assessment, we conduct Penetration Tests in white-box, grey-box, and black-box mode, using various methods and specific tools for the industrial field.

The Penetration Testing campaign is defined in a detailed plan that considers the relevance and criticality of each vulnerability found in the assessment stage in order to provide an accurate specification of real threats that affect the system.

In addition to testing the resilience of an industrial control system, the order of these targeted actions allows for the accurate evaluation of the priority of work, which is to be taken into account in the subsequent implementation of the most suitable measures to protect industrial devices.