The Y-Security service lines are divided into Attack Simulations, Penetration Tests and Security Trainings
Our Attack Simulations service (often known as Adversary Emulation or Adversary Simulation) is split into RED TEAM, THREAT SIMULATION and BESPOKE SCENARIO SIMULATION.
The Red Team exercise is a goal-based adversarial activity that is performed from the perspective of an attacker with no or little knowledge of the target. The exercise is designed to verify if current technical, physical or process-based security controls and procedures are resistant to a targeted cyber attack.
TIBER
TIBER is the European framework for threat intelligence-based ethical red-teaming. TIBER-EU assessments mimic the tactics, techniques and procedures of real-life attackers, based on bespoke threat intelligence.
SIMULATED ATTACK
A simulated attack follows defined tactics, techniques and procedures on an entity’s critical functions (CFs) and underlying systems in a defined scope.
THREAT INTELLIGENCE
We research existing and new threat scenarios to develop a Red Team test plan. This plan includes all the tactics, techniques and procedures to identify the most vulnerable links and potential threat actors.
Threat Simulation exercises are a threat based targeted attack against your organization. Y-Security mimics the behavior of an Advanced Persistent Threat (APT) actor to verify if current technical, physical or process-based security controls and procedures are resistant to a targeted cyber attack.
A ransomware simulation or APT group simulation targets a specific threat of a company – like TrickBot or APT41 (WICKED PANDA). We simulate known threat actors and their behavior to provide insights into the resilience of our clients’ systems.
The Bespoke Scenario Emulation exercise is a goal-based adversarial activity against your organization. The exercise is a combination of Penetration Tests and Red Team activities. Our focus is set on pre-defined goals and less on bypassing internal security controls or remaining undetected from the IT team.
PURPLE TEAM
Purple teaming is the joined approach of bringing attackers (Red Team) and defenders (Blue Team) together, to build sophisticated attack scenarios and detection mechanisms.
PLAYBOOK EXERCISE
Playbook (also known as tabletop) exercises are challenge based, role-driven and used for risk evaluation. They enable stakeholders to trial decisions made in a cyber incident scenario while operating in a safe environment.
Our Penetration Testing Service (Pentest) is split into APPLICATION, INFRASTRUCTURE, TAILORED and CONFIGURATION.
Our Application targeted Penetration Tests are manual security assessments of pre-defined assets and aim to identify technical vulnerabilities that can be exploited by potential threat actors. You gain insights into the security posture of your application, how vulnerabilities are used by a threat actor and how to remediate those to strengthen the overall security posture of your application.
WEB
Web applications or web services are the most common applications these days. We align our methodology to the OWASP Penetration Testing Guide and further methodologies.
MOBILE
Every operating system has its own pitfalls when it comes to a secure application design. This does not exclude iOS and Android. We manually test mobile application as well as used server components.
THICK CLIENT
Thick Clients are often written in .NET or Java, but we also have experience in analyzing closed-source binaries. We align to our known methodology where possible, but often more work is required upfront to analyze the communication protocol between client and server.
Our Infrastructure targeted Penetration Tests are manual security assessments of pre-defined assets and aim to identify technical vulnerabilities that can be exploited by potential threat actors. You gain insights into the security posture of your infrastructure, how vulnerabilities are used by a threat actor and how to remediate those to strengthen the overall security posture of your infrastructure.
EXTERNAL / INTERNAL
We test your internal and external infrastructure for exposed services and evaluate their exploit potential via manual and half-automated tests.
ICS / SCADA
While the ICS / SCADA service has a lot in common with our methodology for infrastructure tests – our approach is more careful. A special focus is set on applications to honor this type of network.
WiFi / WLAN
Our WiFi service allows to enumerate your corporate WiFi configuration for known implementation and security weaknesses.
Our Tailored Penetration Tests are manual security assessments of pre-defined assets and aim to identify technical vulnerabilities that can be exploited by potential threat actors. This approach is intended for assets that do not fall under our other service lines and where a customized methodology is needed. You gain insights into the security posture of your assets, how vulnerabilities are used by a threat actor and how to remediate those to strengthen the overall security posture of your assets.
PHISHING
We verify your employees’ phishing awareness with sample messages or we can trial more advanced phishing scenarios like “Microsoft Teams invite”, “Two-Factor Restore” or SMS Phishing with an E-Mail follow up.
BREAKOUT
When providing access to your corporate network, this is often provided via a special layer of defense, like Citrix (VDI). We can test the hardening settings to proof, if a breakout out of the restricted environment is possible.
SOCIAL ENGINEERING
When focusing too much on the technical security, the physical access security is often forgotten. With our social engineering service we can proof if physical access to a defined resource is possible.
Your Service
In our tailored service we provide services that fit to your needs. Often, services are not frequent enough to be listed here, but still can be performed. This includes services like Research, Product Evaluation, Protocol Analysis, Hardware security and embedded device / firmware vulnerability audits. Feel free to speak to us, when unsure about the service that you would like to see us breaking.
Our Configuration audits are manual security assessments of pre-defined assets and aim to identify configuration vulnerabilities that can be exploited by potential threat actors. You gain insights into the security posture of your asset, how misconfigurations are used by a threat actor and how to remediate those to strengthen the overall security posture of your asset.
GOLDEN IMAGE
A golden image allows a company to run the same configuration on all installed endpoints. That allows us to audit a single configuration and provide input for many systems in your network.
SECURE CONFIGURATION
We do not only attack network components like Switches and Firewalls, we can also review their configurations and rules for potential pitfalls that are only exploitable under certain circumstances.
CLOUD
We review the configuration of your Azure, AWS instances or your Git (and other) CI for vulnerabilities and provide assurance that they are configured according to security best practice.
Our Security Trainings are divided into RED TEAM, Penetration Test and Tailored.
Get ready for our instructor-led Red Team trainings. Explore how Attack Simulations are performed and where the benefits are in having a good understanding of how threat actors act to gain access to crucial assets, information in your organization and bypass security controls. Learn up-to-date real world attacks in a hands-on way from our experienced consultants who performed Attack Simulations and Penetration Tests for years and remain on top of threat actors.
Red Team 101
In our Red Team 101 course you’ll start from an external attacker’s perspective and work your way up into an organization’s network to access high value asset and ultimately compromise the full active directory.
Red Team 102
Our Red Team 102 training focus on how sophisticated threat actor bypass security defenses, chain up vulnerabilities and perform lateral movement around the network without getting caught by the defense team.
Our Threat Simulation exercise is a threat based targeted attack against your organization. Y-Security mimics the behavior of an Advanced Persistent Threat (APT) actor to verify if current technical, physical or process-based security controls and procedures are resistant to a targeted cyber attack. After the simulation you have insights how resistant your organization is against the behavior of an APT actor and how to increase defensive mechanisms and capabilities to prevent a targeted cyber-attack.
Pentest 101
In our Pentest 101 course attendees learn how vulnerabilities in web applications and infrastructure components are identified and exploited to compromise the security state.
Pentest 102
Our Pentest 102 training focus on performing more sophisticated attacks against applications. Attendees learn to build customized tools for pentesting applications and writing own tools to test unknown protocols and network services.
Get ready for your completely tailored training, presentation or workshop. With our training courses about Red Team and Penetration Test we have built a good base which fits for most who want to start in Offensive Security or want to level-up their existing skillset.
PHISHING AWARENESS
We provide training courses for all member of staff to increase the general security awareness of your team – for example, by explaining how attackers perform phishing campaigns.
TABLETOP EXERCISES
You might have experienced a breach or some form of hacktivism? Did your emergency plan worked as expected? Let us challenge your measures by exploring potential breaches at your table.
MOBILE APPLICATION
While mobile applications are very common – testing for security vulnerabilities within those is often still challenging – our course can support your team to get up to speed and provide the testing skills required.
Your Training
In our tailored training we provide any training or workshop that fits to your (security) needs. For example, we have trained in-house and our clients in the past by providing Reverse Engineering & Exploitation trainings. We have created private capture the flag events as a team challenge and provided hands-on privilege escalation and breakout training and many more. Feel free to speak to us, when unsure about the training that you would like to see us delivering to your team.