IT Infrastructure Security: Effective Protection for IT Systems & Networks

Port & Vulnerability Scans

The aim of the vulnerability scans is the detection of generally known current vulnerabilities on the systems and components.

Identification of Services  

A port scan is carried out in order to identify which services are available on a system. Moreover, the method can be used to determine which versions of the services (software) are being used. To this end, relevant active scanning techniques are applied. The aim is to identify insecure services (e.g., clear text services/protocols or outdated versions) as well as unknown services or those which are not absolutely essential for operation (lack of hardening). In addition, the results can be used for more advanced (manual) attacks.

In addition to the automated analysis and attack techniques, manually conducted investigations and verifications are always performed. For this purpose, our IT security experts always use the latest attack techniques from the hacker and security scene, as well as tools and scripts developed by ourselves.

Identification of Systems

This testing methodology provides for tool-based (ARP) scans within a network segment (broadcast domain). The aim of the scans is the detection of all systems and components of a network segment – and therefore internally / in your network (host discovery) – in order to identify, for example, unknown or undocumented systems (“shadow IT”). The detection of systems can, however, also be performed against systems / network areas which are accessible from the Internet, e.g. against a certain IP range of your company.

Passive Reading of Network Traffic

In network sniffing, the network traffic within a network segment is passively read. The network traffic is logged and then subjected to an automated vulnerability analysis and manual verification. With the help of this method it is possible, for example, to recognize the use of plain text protocols or outdated protocols and software.

Within the scope of this module, the firewall rules are reviewed. The aim is to use the most restrictive firewall rules possible based on secure protocols. The main steps involved in this process are as follows: check of the principle of minimality, detection of conflicting, expired, unnecessary or unused rules, identification of rules that are too broadly formulated (e.g. “any rules”), check of the stored services and protocols (e.g. use of clear text protocols).

We check your available WLANs for vulnerabilities and carry out further attacks as required, including e.g.:

• Identification of WLAN access points and clients (SSIDs, MAC addresses, encryption algorithms, etc.)

• Inspection of the outer boundaries of your site (fencing) in order to determine the WLANs that are accessible from outside

• Manual tests and active penetration attempts on the air interface depending on the respective security level by means of special tools (DoS attacks, MitM attacks, fake access point attacks, etc.)

This testing methodology provides for manual configuration analyses of systems and components with the support of the persons in charge. The test essentially involves a security-related analysis and evaluation of the technical measures taken for system hardening and therefore the configurations carried out at the system and application level. The above includes, for example, the following points:

• Determination of the update/patch status (patch management)

• Review of Group Directives according to Microsoft's best practices (Windows systems)

• Review of the installed software and services

• Random check of the file system, e.g. check for plain text passwords in configuration files

• Review of stored groups and users, as well as their authorizations

• Analysis of the network services and firewall settings

• and much more.

The analysis is performed according to the white box approach or from the perspective of an internal attacker who has already gained access to a system. This testing methodology can often be combined with interviews of the corresponding individuals/administrators.

This testing methodology provides for a review of your documentation. Operating and system documents that describe the behavior and properties of the systems and components are reviewed as part of the investigation. This includes, for example, documentation of the architecture, use and administration, installation, configuration and maintenance instructions, backup and security concepts. The aim is, among other things, to check the plausibility, comprehensibility and up-to-dateness of the documents and to make suggestions for improvement.