Pentest Systems
Protect your network & IT systems
What are entry points for attackers?
Whether it is about network components, servers or workstations, the security of all IT system components is one of the most important components of corporate security and, among other things, contributes significantly to protection against ransomware attacks. Usually, we differentiate between an internal and an external pentest: Internal tests simulate an attack by a hacker who has already gained access to the internal network, e.g. through unauthorized physical access or social engineering. External tests simulate an attack via the internet in which hackers attempt to access your IT systems.
Vulnerabilities in external IT systems accessible from the internet are a common initial entry point. Through vulnerabilities in the internal IT system, attackers may be able to infiltrate the corporate network and spread further. Thus, sensitive data is often stolen or manipulated, and other users in the network are targeted. Loss of confidentiality, integrity and availability of information are common consequences of a successful attack.
Our system pentest is an effective security measure to comprehensively analyze your systems for these and other vulnerabilities.
Common vulnerabilities include:
- Insecurely configured services
- Lack of or insufficient authentication mechanisms
- Unauthorized access to information and functionalities
What is our approach to System Pentests?
Our pentests are conducted according to a standardized approach, which is enhanced by specific aspects for system pentests:
Our security analysts rely on a combination of standardized tools, the usd HeroLab Toolchain and manual tests for system-level pentests. Our in-house development Icebreaker Platform assumes a central role by enabling a fast and reliable initial analysis of systems. Our security analysts base their manual analysis on these findings and analyze all identified services and ports. Known ports are analyzed comprehensively based on best practices and through specialized testing methods. Unknown ports (for example your in-house development) are analyzed on system level to identify possible attack vectors.
What checks are included in System Pentests?
These checks are included pentests on the network and operating system levels:
- Identification of all accessible IT systems including system services using host and service discovery
- Automated check of all accessible system services using a state-of-the-art vulnerability scanner
- Manual testing of system services for logic vulnerabilities or checking for the possibility of combining different identified vulnerabilities
- Search for publicly known vulnerabilities
- Exploitation of identified vulnerabilities using available or customized exploits (by arrangement)
- Manual verification of the system service encryption (SSL/TLS)
- Interacting with system services (e.g. via command line or other script languages) to identify misconfigurations or vulnerabilities
- Further checks by arrangement
If desired, we can analyze your IT systems with our Pentest:Workstation to detect a possible local privilege escalation. This scenario simulates an attacker who has already compromised server systems (e.g. by exploiting existing vulnerabilities) or client work stations (e.g. via phishing). We analyze the consequences of a successfull attack and the subsequent risk for your IT infrastructure’s security.
Are your systems protected against attackers?
We are happy to discuss your options for analyzing your systems by our security analysts. Feel free to contact us.
