Tremendous technology developments in the last years revolutionized the business, but also introduced new risks. Every application is vulnerable and no system is impenetrable. It is no longer enough to deploy products and merely hope that their security level is sufficient to protect against malicious attackers. It is also not good enough to implement or integrate security modules and assume the end product to be secure.
Our infrastructure testing can be described as a simulation that adopts the real attacker technique to compromise your system. Our testing methodology is a highly creative, out-of-the-box engagement, and often results in new vulnerabilities being discovered. We combine both manual and automatic approach to obtain comprehensive results.
Infrastructure testing will consists of two areas, external and internal. The objects are included in the infrastructure testing are network testing; includes wired and wireless, server environment testing, work environment (workstations), network security devices, other fragile devices such as network printers.
Since most protocols are well defined and have standard modes of interaction, network-layer testing is more suitable for automated testing. This makes automation the first logical step in a network-layer test. Because of such standardization, tools may be used to quickly identify a service, the version of the software, test for common misconfigurations, and even identify vulnerabilities. Automated tests can be performed much faster than could be expected of a human. However, simply running an automated tool does not satisfy the penetration testing requirement. Automated tools cannot interpret vulnerabilities, misconfiguration, or even the services exposed to assess the true risk to the environment. The automated tool only serves as a baseline indication of the potential attack surface of the environment. Therefore, using the documentation provided by the organization during the pre-engagement, we will:
The use of exploitation tools sometime adversely affects the application, database, system, network, or other tools. To reduce the impact of the exploitation, we always explain and ask for approval if we want to exploit the vulnerabilities found. Use of exploitation against vulnerability will depends on a lot of things (e.g. likelihood, impact, attacker skill, etc), if there is no proof of concept against such vulnerability, we will make the closest approach to verify the vulnerability.
Approach to research on new vulnerabilities (zero-day) has always been an interesting challenge, the expected result is the discovery of vulnerability that has never been found before.
People is one of the weakest chain in information security aspect (people, process, technology). People assessment must be included in testing scope regarding to security assessment. This kind of testing have no standard method, but still has a base line of testing as follow: