These operations are performed with various advanced intrusion tests on your organization's infrastructure, subjecting your facilities to actual cyber and physical intrusion attacks with a previously agreed scope.
This type of activity provides a clear and realistic diagnosis of the security status of your company after testing all of your protection measures in order to detect possible security breaches in terms of infrastructure as well as in terms of operations and procedures. Subsequently, we will propose any necessary improvements in the company's security framework or in the training of its defence team.
Service details
In this type of activity we step directly into the shoes of an attacker by pretending to be members of a criminal group. In addition to fulfilling the phases of a professional ethical hacking, we carry out intrusion tests at the highest level thereby trying to gain access to cyber, physical and/or human assets, depending on the scope requested by the client.
Once we have gained access to the organization’s assets at the cyber level, we try to execute privilege escalation, lateral movements between machines, by installing our own malware evading systems (AV/IDS/IPS/LGFW/EDR, etc.) in order to control the compromised machines from a remote “Command&Control” (C2) server, exfiltrate sensitive information, obtain credentials and eliminate fingerprints, among other actions; exactly as a criminal group would.
These tests are vital for the identification and exploitation of vulnerabilities that can compromise your organization’s assets, and are a necessity today because:
- Companies are not aware of their risk level and degree of exposure to these types of attacks.
- Security inspections and verifications are often not as effective as they should be.
- Companies are not conscious of their real capacity to detect and respond to this type of incidents.
This type of operation includes an intense and in-depth audit of all performed actions, reflected in two reports: one technical and the other executive. They include the different phases of passive/active reconnaissance, malware used for exploitation, all the Tactics Techniques and Procedures (TTPs) executed, persistence, privilege escalation, target enumeration, lateral movements, data identification and exfiltration of sensitive information, domain privilege, credential dump, fingerprint elimination, and finally the relevant recommendations so that the client can share them with their SOC “Blue Team” and thus improve their tactics for detecting attacks on their company or organization.
The types of exercises to be carried out include, depending on the aims: Modern Adversary, Breach&Attack Simulation and Breach&Attack Detection.
