IT infrastructure
IT infrastructure testing
IT infrastructure testing refers to the investigation of software systems and IT landscapes at network level from the perspective of a malicious actor.
The simulation of malicious activities to identify vulnerabilities is carried out via the public Internet or from a company’s internal network and includes, for example, the investigation of network components (e.g. servers, routers or firewalls), network protocols and network services (e.g. Active Directory, SSH, SNMP, IMAP) or remote maintenance and network access (e.g. VPN access) as well as protective measures at network level (e.g. network segmentation).
Why penetration testing?
Due to the ongoing digitalization of business processes in particular, more and more business-critical areas are accessible via the public internet. Adequate protection against malicious attackers is therefore important in order to avoid potential technical and financial damage (e.g. due to data loss, restriction of availability).
With the help of IT infrastructure testing, vulnerabilities within a network can be identified by simulating malicious activities in order to determine existing security risks for applications and their users. By recommending specific measures to eliminate identified vulnerabilities, the software quality in the area of IT security can be increased and adequate protection against successful attacks can be guaranteed.
In general, security tests can be used to check the following protection goals [1] according to the German Federal Office for Information Security (BSI):
Goal
The aim of the test activities generally consists of the following three points:
General test methodology
Our test methodology in IT infrastructure testing is based on the implementation concept for penetration tests and the IT baseline protection compendium of the BSI and the procedure of the Penetration Execution Standard (PTES). The specific test activities are adapted according to the agreed customer objective and the technical conditions.
Next Steps
Once the study has been completed, there are various starting points for effectively continuing the previous analysis. A selection of sensible options can be put together individually during the consultation depending on the customer’s objective, wishes and results.