Penetests

Penetration testing is a practical study of the security of an IT system. The audit consists in conducting a controlled attack on the IT infrastructure, thanks to which the client receives a real assessment of the infrastructure security condition, indicating security gaps that can be used to compromise the security.

The service provides the Client with knowledge about the level of system security, including the analysis of detected security gaps. The knowledge and experience of our experts allows us to precisely formulate technical recommendations, allowing for the removal of threats and optimization of security implementation costs.

Our services are a configurable package (tests of WiFi networks, OT / SCADA automation systems, web applications, critical infrastructure, etc.) of penetration tests for those companies that really want to know if they are safe. The testing goes beyond the standard methodology, based only on automated tools, using OSINT, Dark Web violation data, social engineering techniques, and extensive knowledge to exploit vulnerabilities at the application and network layers.

For each of the above-mentioned groups, there is a separate tab presenting the register with information on individual assets. Each asset has its own metric, or as it is commonly used in property management methodologies – a passport. The passport allows you to describe a number of features that relate to it, from the name, category, manufacturer, location, responsible for operation, to the warranty or service. The system also enables the description of planned actions or events related to this component (e.g. service dates, inspection, validation, etc.).

Types of tests

• black box – with zero knowledge of the system, to the greatest extent reflects the actual knowledge of the potential attacker and the course of the attack itself,
• gray box – a compromise between the black box and the white box, containing elements of both approaches, e.g. using user accounts with different permissions,
• white box – with full knowledge of the tested system, with full access to project documentation, source code, configuration of network devices, etc.