Nederlands
The external corporate network can provide hackers access to your internal network
Protect your corporate network from potential threats. Our external network pentest is designed to identify vulnerabilities that hackers could exploit to gain access to your internal systems. Don't overlook the risk posed by old, forgotten domains that remain accessible online; they could serve as a backdoor to sensitive data.
How much of your company's data is vulnerable online? And can you ensure that unused data won't be leveraged to breach your applications and systems? The truth may surprise you. Even a forgotten host or web application could serve as an entry point for malicious actors. With our external network pentest, you can assess the security of all your publicly available company data. Let us alleviate your concerns by thoroughly examining your network and empowering you to take proactive measures against potential threats.
Additionally, consider our onsite pentest to assess the security of your internal network. Our experienced security expert will visit your location to conduct a comprehensive examination of potential vulnerabilities and security risks within your internal network. This hands-on approach enables you to implement targeted measures to safeguard your systems against potential threats. Trust our expertise to secure your company, one step at a time, with an internal network pentest.
The primary objective of a corporate network pentest is to gather information relevant to the organization's network and underlying services. This includes utilizing open-source intelligence gathered from social networks, email addresses, search engines, and document metadata. Additionally, the test may include an optional social engineering attack setup.
What does a company network pentest entail?
- Identification of domains and IP addresses associated with or connected to the organization.
- Discovery and examination of IT systems and services.
- Exploration of potential attack vectors for hackers.
- Open-source investigation into additional, often unstructured, online business information accessible to hackers (e.g., indexed by search engines and present on websites).
What deliverables can you anticipate?
- Insights into weak links and vulnerabilities within the IT infrastructure.
- Awareness of readily available information to a potential attacker/hacker.
- Overview of online accessibility of business systems and services.
- Identification of any publicly accessible hosts and servers that should not be exposed.
Passive Network Surface Mapping
Utilizing open-source intelligence (OSINT) techniques and tools, we can map your organization's Internet-connected networks and services without directly sending requests to the targeted network, or with minimal standard requests. OSINT involves extracting intelligence from publicly available sources.
This approach allows an attacker to conduct a thorough analysis of your network infrastructure and technologies without triggering any alarms. Consequently, you may remain unaware that your network has been probed.
Host and Domain Identification
Identifying all known hosts associated with an organization enables us to delve deeper into the network for additional systems and hosts. Upon further examination of all identified IP addresses (ASN), we may uncover other relevant hosts within the network. Discovering related domains can expand our scope to reveal more hosts.
While a single web server presents potential attack points with its open services (such as SSH, HTTP, RDP), discovering all virtual hosts running on the server reveals additional potential attack surfaces. This includes web applications running on any of the virtual hosts, further broadening the scope of potential vulnerabilities.
Cloud Infrastructure Pentesting
As cloud technologies continue to gain momentum, conducting pentests on cloud infrastructure becomes increasingly critical. This involves evaluating the security of cloud platforms like Amazon Web Services (AWS), Microsoft Azure, Google Cloud Platform (GCP), among others.
During a cloud infrastructure pentest, various elements of the cloud environment undergo scrutiny to uncover potential vulnerabilities and security concerns. Here are key areas examined during such tests:
- Cloud Configuration: Scrutinizing the setup of the cloud environment to ensure adherence to security and compliance standards. This encompasses reviewing access controls, security groups, network configurations, and other parameters to ensure correct configuration and prevent unintended access to sensitive data.
- Identity and Access Management: Assessing the methods for identity and access management within the cloud environment, including testing user authentication, permissions, and user account management. This also entails evaluating the implementation of multi-factor authentication (MFA) and restricting privileges to necessary levels.
- Data Encryption: Evaluating the encryption protocols employed for data transmission and storage within the cloud environment. This includes monitoring the usage of encryption technologies and assessing measures to safeguard sensitive data from unauthorized access.
- Logging and Monitoring: Reviewing the logging and monitoring functionalities of the cloud environment to identify and report suspicious activities. This involves monitoring the utilization of logging tools, establishing alerts for suspicious behavior, and reviewing incident response procedures.
- Resilience and Recovery: Assessing the resilience and recovery capabilities of the cloud infrastructure in the event of security incidents or disruptions. This includes testing backup and recovery protocols, failover mechanisms, and overall resilience of the cloud infrastructure.