Infrastructure Pentest

Newer companies may not yet have their network security under control. Conversely, more mature companies often have large and complex networks that quickly become prone to failure. We can help you protect your networks and assets.

What is an Infrastructure Pentest?

An infrastructure penetration test provides your organization with a security analysis of the effectiveness of your internal and external security systems . As the basis for secure applications and communication, the system and network infrastructure must not be neglected. This guidelineapplies to companies of all sizes, especially for critical infrastructures (KRITIS). Advanced knowledge in the area of server operating systems, transport encryption and infrastructure configuration enables our pentesters to perform manual as well as automated scans, evaluate them and initiate appropriate countermeasures.

Advantages

The pentest for infrastructures is planned, performed and evaluated by our specially trained security engineers according to recognized standards.

We protect your networks and assets!
  • We move through the infrastructure with Network Lateral Movement to search for key data and errors step by step.
  • Infrastructure components such as server systems, VPN systems, Active Directory (AD), IoT devices (Internet of Things), WLAN networks and firewalls can be tested.
  • Extensive research ensures that even daily weaknesses can be identified.
We carry out safety analyses based on recognised standards and guidelines.
  • Our processes are adapted to the practical guidelines for pentests of the Federal Office for Information Security (BSI).
  • We have developed a comprehensive final report that provides an optimal insight into our work and its results. Pentests are conducted and evaluated according to the OWASP Testing Guide. Alignment with OSSTMM and PCIDSS is also possible upon request.

Scope

As a general rule, the longer our security engineers examine your infrastructure, the more meaningful the results are. If you have special requirements, we will be happy to make you an individual offer.

  • COLLECTION OF INFORMATION

    Es gibt direkte und indirekte Methoden der Suchmaschinen-Suche und -Aufklärung. Direkte Methoden beziehen sich auf das Durchsuchen der Indizes und der zugehörigen Inhalte aus dem Cache. Indirekte Methoden beziehen sich auf das Sammeln sensibler Design- und Konfigurationsinformationen durch die Suche in Foren, Newsgroups und Ausschreibungen von Websites.

  • FIREWALL ANALYSIS

    Firewall-Regeln und -Richtlinien kontrollieren den Datenverkehr zwischen LAN und Internet. Mit Hilfe dieser Regeln lässt sich das eigene Netzwerk restriktiv gegen äußere Einflüsse abschotten – und das ohne den allgemein benötigten Internetverkehr zu beeinträchtigen. Gleichzeitig können durch fehlerhafte Regeln aber auch neue Schwachstellen entstehen. Daher ist es ratsam, die Regeln kontinuierlich zu überwachen und zu kontrollieren.

  • PATCH MANAGEMENT

    There are direct and indirect methods of search engine search and education. Direct methods refer to searching the indexes and the corresponding content from the cache. Indirect methods refer to the collection of sensitive design and configuration information by searching forums, newsgroups, and website advertisements.

  • VPN ANALYSIS

    Firewall rules and policies control data traffic between the LAN and the Internet. With the help of these rules, the own network can be sealed off restrictively against external influences - and this without affecting the generally required Internet traffic. At the same time, faulty rules can also create new weaknesses. It is therefore advisable to monitor and control the rules continuously.

  • PRIVILEGES ESCALATION

    This is usually due to an error (bug) in the operating system or software. Mostly needed is also program code that performs the escalation. Mostly a privilege escalation is used to get root rights. Such tools (possibly in connection with certain actions) are called exploits.

  • NETWORK MANIPULATION

    An attacker exploits features of the infrastructure to carry out attacks on network objects or to cause a change in the normal flow of information between network objects. Most often, this involves manipulating the routing of messages so that they are directed at an entity of the attacker instead of arriving at their actual destination.

  • Active Directory (AD)

    We use graph theory to uncover the hidden and often unintended relationships within an Active Directory environment. In this way, highly complex attack paths can be identified that would otherwise be very difficult to detect.

  • IOT DEVICES (INTERNET OF THINGS)

    he methods for evaluating security and the hardening measures in the environment of IoT (Internet of Things) devices are by no means exclusive mechanisms that can only be found in this area. Rather, they are the application of various measures at the software, operating system and network level to ensure information security.

Final Report

We have developed a comprehensive reporting format that provides optimal insight into our work and its results. Pentests are conducted and evaluated according to the OWASP Mobile Security Testing Guide.

  • Our report is prepared according to recognized standards and includes a management summary, a technical summary and recommendations for action. The evaluation of the findings is based on the CVSS 3.0 standard.
  • Unser ausführliches Berichtsformat gibt nicht nur Aufschluss darüber, welche Schwachstellen während des Pentests identifiziert wurden, sondern auch welche Angriffsvektoren dabei überprüft wurden. Somit können Sie unsere Arbeit optimal nachvollziehen.
  • Der Abschlussbericht wird individuell erstellt und sowohl als klassisches PDF-Dokument, als auch in einem speziellem HTML-Format ausgeliefert. Im dynamischen HTML-Format können Inhalte und Schwachstellen-Funde gefiltert, sortiert und in andere Formate exportiert werden.
  • In einem gemeinsamen Abschlussgespräch besprechen wir mit Ihnen die Details des Berichts und unterstützen Sie bei Bedarf bei der Behebung der identifizierten Schwachstellen.

Procedure

Pentests carried out by us are an agile process and are carried out in close consultation with the customer.

Kick-Off

The preparation of the pentest takes place in the context of a kick-off meeting with the technical and organizational responsible persons of your company. The framework conditions to be tested are specified, necessary user accounts and access routes are agreed, contact persons and escalation routes are defined and the pentest is discussed in detail together.

Research

Our analysts try to collect as much information as possible. Based on this information, analysis strategies are developed to identify possible attack vectors. These attack vectors are then examined for vulnerabilities in extensive tests.

Exploitation

In this phase, an attempt is made to actively exploit the identified vulnerabilities in order to gain access to the target systems. Depending on the service or technical environment, our pentester writes new exploits or uses existing ones. Potential vulnerabilities can turn out to be false positives. Only verified vulnerabilities are included in the final report and classified according to their criticality.

Report

You will receive a comprehensive final report consisting of a Management Summary and a Technical Report. The criticality of the weak points and recommendations for action are described in detail.

Remediation (Optional)

In this phase, the identified weak points are eliminated by your company. If required, you will be supported by our experienced security engineers.

Nachprüfung (Optional)

After the remediation you have the opportunity to have us carry out a follow-up check. Here we check the effectiveness of your measures and adjust the result report.

Abschlussgespräch (Optional)

In this final discussion, all critical points in the results report are discussed and all final questions clarified.

Curious? Convinced? Interested?

Arrange a non-binding initial meeting with one of our sales representatives. Use the following link to select an appointment:

 Arrange a meeting

Alternatively, you can write us a message. Request a sample report or our service portfolio today. We will be happy to consult you!