Security Assessment

At Cyber Defense Institute, we undertake Security Assessments (Penetration Testing) against Networks, Web Applications, Web Servers, and Cloud Infrastructure searching for hidden security risks and evaluating whether measures in place are sufficient for the threats your organization faces.

Service Lineup

Web Application Vulnerability Assessment

• Our web application vulnerability assessments are conducted by highly skilled security engineers with extensive experience and a deep sense of how best to attack various systems. This is prefaced by accurately understanding the specification of the target system and then attempting various attacks from multiple angles carefully considering the behavior of the server and modifying attack methods response. We promise to deliver in-depth and comprehensive testing that is distinctly different from typical automated (tool-based) or manual services.
• The threat analysis we provide goes beyond assessing just the vulnerability in isolation. By understanding the business logic, intent behind the design, and therefore the real impact of vulnerabilities, analysis of possible attacks and the combined use of vulnerabilities leads to a more realistic vision of the threat posed to your organization. This then enables a greater targeted response for how best to prioritize and remedy any issues identified.

Network Penetration Testing

• Simulated attacks are carried out against external facing segments to uncover vulnerabilities that may lead to the exposure of sensitive information or the compromise of administrator accounts and their privileges. Through this we can reveal those risk areas which may be liable to be attacked, where an intrusion could likely take place and how best to counter this threat.
• Simulated attacks are also carried out from a position inside the internal network against the entirety of the network. This replicates a state where attackers have already gained a foothold inside the network and also makes it possible to model the risks posed by an insider threat.
• Wi-Fi Access Points, and Ethernet ports in meeting rooms open to clients for example, can also be incorporated into the test as entry points into the network. From there testing is carried out to determine whether sensitive information can be obtained or if attacks can be mounted against other users of the organization’s network.

Embedded Device Security Assessment

• Physical device testing is carried out from various attack vectors, including those that require complete disassembly to obtain and analyze firmware analysis or attack the physical communication interfaces. Overlap with Web and Network assessments is common, and so any WebUI or upstream network infrastructure that the device interact with is can also be included in the testing scope.
• Careful understanding of the components and specifications of the device is combined with consideration of attack methodology, where, if necessary, requisite attack tools are procured or built inhouse in order to carry out the testing in the most effective manner.

Control Systems Vulnerability Assessment

• Due to the role of control systems and their prioritization for ‘Availability’, a testing methodology that does not affect operations is often required. We take this into consideration in response to customer needs when undertaking any testing and if necessary, conduct online testing, or test against a simulated version of the system.
  We avoid using general-purpose tools, which tend to affect operations, and proceed with tests based on manual work, keeping detailed records in the case that any problem does arise.
• To prevent leakage of confidential information, everything from restricting access to acquired information to deletion of information after work has been completed is systematized and strictly managed.

Red Teaming

• In accordance with the rules of engagement agreed upon with the client, any and all means of attempting to gain entry and a foothold in the organization’s network that are in scope are utilized. The entire organization itself becomes a target and potential vector that is used to achieve the objectives of the attack, such as obtaining certain credentials or confidential information.
• Example Scenarios
  • Insider Threats and theft of confidential information
  • Attacks by APT groups
  • Risks associated with the use of wireless access points
  • Cyber-attacks targeting various Operation Technology systems