Services

Most organizations take steps to secure their applications and networks as part of their security policy using penetration tests, which often give a partial picture of their readiness for a real attack by a group of hackers. The real reason for this is that penetration tests are carried out most of the time in a limited scope and resources and, therefore, only present the impact on a particular application or system.

Through the Red Teaming service, we provide our customers with realistic cyber attacks against individuals (if needed), processes, and technologies. Throughout this exercise, the team engages in controlled cyberattacks against the client’s corporate network. In this way, the entire system is tested and the interaction of the security systems is examined.

The aim is the controlled violation of the organization’s systems in order to identify vulnerabilities in its infrastructure, applications, and processes, as well as the lack of awareness of its employees, or incomplete/inactive policies – that could endanger its assets.

Attack levels
Investigations and exercises are carried out on the basis of a predetermined attack profile. There are four levels of attacks in which research and execution are carried out with different resources. Each level has its own limitations and attacking techniques:

• An attacker who only asks for anonymity and needs the cheapest possible attempts to access systems using open-source software. The attacker will look for standard vulnerabilities that can be quickly applied to multiple servers at once.
• A novice hacker has a limited budget to gain access to the networks of the organization in question. The attacker will focus more on a specific target and have a focused target.
• A professional hacker who works alone, but has professional resources and knowledge to develop his own techniques against the organization. Specific attacks are used to achieve the goal, such as the use of Social Engineering attacks.
• The hacker who has been hired. Many hackers are hired by an organization and try to breach the systems. The higher the value of the violation, the more resources are used during the attack.

Common simulations:

• Collection of information against the organization
• Leakage of information from the organization’s corporate network
• Awareness-raising simulations for employees
• Case simulations for the organization’s security team
• Tests for patch management & configure security checks