Our Infrastructure targeted Penetration Tests are manual security assessments of pre-defined assets and aim to identify technical vulnerabilities that can be exploited by potential threat actors. You gain insights into the security posture of your infrastructure, how vulnerabilities are used by a threat actor and how to remediate those to strengthen the overall security posture of your infrastructure.

With our team’s experience we deliver a wide range of standard attacks against infrastructure components, but also identify vulnerabilities in complex networks and systems interacting with each other. No two penetration tests are alike and we take our time in each exercise to identify the network’s attack surface. This includes system specific technology and derived vulnerabilities of the technology as well as system specific workflows. Gathered information about the network is used during the Penetration Test to combine identified vulnerabilities and chain them to show potential attack paths a threat actor can take.

We also use our largely manual approach for Penetration Tests which includes deep inspection of content and functionality. Our methodology completes industry standards such as the OWASP testing guide, the Mitre Att&ck framework and where applicable the CIS benchmarks for the in-use technology. This is supplemented by our novel research and gathered knowledge of performed Penetration Tests and Attack Simulations for our clients. Vulnerabilities chains are highlighted to expose the full potential a threat actor has when the assets are attacked.

Y-Security’s methodology includes the below categories for External Infrastructure tests and is extended when conducting other kind of infrastructure assessments such as Internal Infrastructure assessments, ICS/SCADA assessments or WLAN assessments:

• Active Reconnaissance & Network Mapping
• Passive Reconnaissance
• Automated Vulnerability Assessment
• Manual Vulnerability Verification & Exploitation
• Targeted Service Testing

The technical exercise is completed with a detailed report including summaries for the executive and technical management together with a detailed description of each identified vulnerability and in-depth guidance how they can be reproduced. Each description includes a recommendation for remediation and references to further sources such as Common Weakness Enumeration (CWE), OWASP Web Security Testing Guide and a rating such as the Common Vulnerability Scoring System (CVSS).

We also carry out Red Team exercises where we develop a unique targeted attack plan specific to your organization by combining our experience, known threats to your organization’s branch of industry and threats your organization faced.

Are you interested in testing your resilience?

Our Tailored Penetration Tests are manual security assessments of pre-defined assets and aim to identify technical vulnerabilities that can be exploited by potential threat actors. This approach is intended for assets that do not fall under our other service lines and where a customized methodology is needed. You gain insights into the security posture of your assets, how vulnerabilities are used by a threat actor and how to remediate those to strengthen the overall security posture of your assets.

With our team’s experience we deliver a wide range of standard attacks against applications, infrastructure components, systems and non-digital assets. Our clients also required us to perform sophisticated attacks against bespoke assets and thats why we build Tailored Penetration Tests. No two penetration tests are alike and we take our time in each exercise to identify the best methodology and approach for our clients to fit with their requirements and add our long-term threat experience.

Tailored exercises typically require us to use a largely manual approach to Penetration Tests including deep inspection of content and functionality. Our methodology completes industry standards such as the OWASP testing guide, the Mitre Att&ck framework and where applicable the CIS benchmarks for the in-use technology. This is supplemented by our novel research and gathered knowledge of performed Penetration Tests and Attack Simulations for our clients. Vulnerabilities chains are highlighted to expose the full potential a threat actor has when the assets are attacked.

Methodologies created as part of our Tailored approach include a variety of different scenarios and components including but not limited to:

• Phishing/Vishing/Smishing Awareness Assessments
• KIOSK / Application / Desktop / Environment Breakout
• Embedded Devices / IoT
• Protocol Analysis
• Research
• Social Engineering

Reports for our Tailored exercises can be customized, but typically include summaries for the executive and technical management together with a detailed description of each identified vulnerability and in-depth guidance how they can be reproduced. Each description includes a recommendation for remediation and references to further sources such as Common Weakness Enumeration (CWE), OWASP Web Security Testing Guide and a rating such as the Common Vulnerability Scoring System (CVSS).

We also carry out Red Team exercises where we develop a unique targeted attack plan specific to your organization by combining our experience, known threats to your organization’s branch of industry and threats your organization faced.

Are you interested in testing your resilience?

Our Configuration audits are manual security assessments of pre-defined assets and aim to identify configuration vulnerabilities that can be exploited by potential threat actors. You gain insights into the security posture of your asset, how misconfigurations are used by a threat actor and how to remediate those to strengthen the overall security posture of your asset.

With our team’s experience we have insights into a wide range of technologies including operating systems, software solutions and devices. We combine our methodologies of Penetration Test exercises and Attack Simulations exercises to advise on security best practice configurations to strengthen the overall security posture of your asset.

Even with Configuration reviews we use a largely manual approach including detailed inspection of content and functionality. Our methodology completes industry standards such as the OWASP testing guide, the Mitre Att&ck framework and where applicable the CIS benchmarks for the in-use technology. This is supplemented by our novel research and gathered knowledge of performed Penetration Tests and Attack Simulations for our clients. Vulnerabilities chains are highlighted to expose the full potential a threat actor has when the assets are attacked.

Y-Security’s methodology includes the below categories for Configuration audits of a Operating System and is extended with asset specific configuration checks when conducting the audit:

• Boot Configuration
• Access and Authentication
• Network Configuration
• File System Analysis
• Service Configuration
• Logging and Auditing
• Software and Patch Analysis

After the assessment you receive a detailed report including summaries for the executive and technical management together with a detailed description of each identified vulnerability and in-depth guidance how they can be reproduced. Each description includes a recommendation for remediation and references to further sources such as Common Weakness Enumeration (CWE), OWASP Web Security Testing Guide and a rating such as the Common Vulnerability Scoring System (CVSS).

We also carry out Red Team exercises where we develop a unique targeted attack plan specific to your organization by combining our experience, known threats to your organization’s branch of industry and threats your organization faced.

Are you interested in testing your resilience?