Infrastructure Penetration Testing Services

Integralis Infrastructure Penetration Testing services help you identify how known and unknown vulnerabilities can be exploited by unauthorised intruders. As a result you can gain a higher level of confidence that your location and data is secure and that you are in compliance with security mandates and industry standards.

We use the latest tools and technology to test your:

• Wired and wireless networks as well as unified communications including Voice over IP (VoIP)
• Key systems
• Applications
• Internet connections.

Our flexible approach covers on-site and off-site testing and detailed manual analysis, correlation, and prioritisation of results by our expert security consultants. The resulting comprehensive report addresses vulnerabilities from both a technical and business perspective and details recommended and prioritised remediation efforts.

The Integralis Infrastructure Penetration Testing service is a combination of manual and automated testing. Manual testing provides intelligent analysis that is not available with a fully automated scan. Services are available to address: both Internet-facing and internally-accessible infrastructure; and both non-aggressive testing, designed to identify, but not exploit, potential vulnerabilities, and aggressive testing, designed to identify vulnerabilities and leverage them to determine further issues.

The Internet-facing service encompasses the following:

• In-depth testing of all Internet available services, this will allow the customer to ensure that the appropriate versions and patches are applied to applications, a frequent source of hacking exploitation.
• Unexpected or overly permissive visibility of hosts, allowing the customer to ensure full control over the Internet facing network infrastructure.
• Identification of unexpected use of the network, such as IRC and Peer-to-Peer (P2P) networks, which can act as a source of information for attacks including social engineering.
• Identification of information leakage regarding the internal servers and the networks they may be connected to.

The service is run in a number of stages by Integralis consultants. Each stage tests deeper into the network infrastructure and higher in the OSI model towards, where appropriate, the final test examining the application data. We follow procedures that are based on the well-respected OSSTMM Open Source Security Testing Methodology Manual (www.osstmm.org).

We also strongly recommend the Infrastructure Penetration Testing service for critical internal systems, such as database servers, RAS access points, application servers and intranet web servers that are not visible from the Internet. The service identifies vulnerabilities that exist through misconfiguration as well as those present in commercially released operating systems or applications that may be exploited to gain unauthorised access. The service operates most effectively in a ‘white box’ model with the client identifying the systems that are to be closely examined prior to the start of the work.