Systems and equipment audits
Have you run penetration tests and are still not sure if the security of a particular server or other application platform is sufficient?
While penetration testing puts us in the role of a potential attacker, technical security audits approach the element under examination more in the role of a system administrator and implementer of recommended measures to improve its security.
When checking the settings of individual systems, we use the knowledge and experience of our security and system specialists, manufacturers' recommendations for hardening the systems, etc. We describe all the identified deficiencies in detail in the audit report. We describe the risks of these vulnerabilities and, of course, suggestions for their elimination (or risk minimization).
Within the scope of technical audits, we provide the following services:
Audit of the configuration of active network elements
One of the riskiest places in the network, which is associated with a large number of unauthorized intrusions, are the active network elements. When analysing them, we mainly focus on the areas of static table settings on active network elements, NAT - address translation settings, network monitoring, administrative interface security, etc.
Audit of operating system configuration on the servers
The audit of operating systems (OS) configuration on the servers is performed using system resources and specialized tools. The audit is carried out by security specialists for each platform.
Windows system scanning is aimed at, for example, assessing password policy settings (password policy), audit policy, active directory, etc. UNIX operating systems are checked in particular in terms of configuration and security of services (/etc/conf/), etc.
Audit of firewall and IDS/IPS configuration
The analysis is carried out by firewall specialists who, from the position of an administrator, analyse the configuration of these key security features.
For firewalls, both the application security itself and the defined rules can be fully audited.
The result of the IDS/IPS analysis is primarily an assessment of the suitability of the client's system settings and possible suggestions for their optimization.
Security audit of special systems, applications and services
Audit of selected applications in terms of reliability, configuration, integrity, authentication and data confidentiality. This includes, for example, audits of application servers, database servers, web servers and many other applications and services, which may include areas such as security of critical data flows, application errors, the possibility of application abuse, application stability, implementation of encryption, PKI, etc.
Other specialized audits and tests (according to individual client requirements)
- PCI-DSS and PA-DSS compliant audits.
- Specialized in-depth audits, where the type of audited device and its location and connection to other IT infrastructure are taken into account. They are not handled as a single audit, but as an audit of the entire infrastructure itself.
- Topology and infrastructure audits - review of the network or cloud topology in operation in terms of security of third party access, partners, employees, proposed DMZ departments and security of core systems, etc.
- Manufacturers' recommendations on the hardening of audited HW, OS and SW.
- Recommendations of the Internet Engineering Task Force (IETF) - an organization that issues RFCs, known as Internet standards.
- NIST recommendations (e.g. NIST SP 800-44 Guidelines on Securing Public Web Servers).
- CIS Benchmarks audits.
- CVE - Common Vulnerabilities and Exposures - standardized dictionary of common vulnerabilities and threats.
- Common Criteria (ISO/IEC 15408) - standard for assessing the level of security of systems, etc.
- We have over 30 years of experience in the field of security in both the Czech and Slovak Republics.
- We have a qualified team of certified auditors and administrators with experience gained from dozens of audits per year.
- We use commercial, free and proprietary tools and scripts for data collection and subsequent analysis.
- Evaluating the company's ICT security level and defining real risks in the context of the expected impact on the business.
- We perform audits in accordance with PCI-DSS and PA-DSS standards.
Our penetration tests identified and remediated vulnerabilities within the company Konica Minolta
Raising cybersecurity awareness at Broker Consulting
Security of clients and employees of ČSOB has been improved not only through penetration tests
Audits and sophisticated penetration tests for vulnerability identification for Škoda Auto
At T-Mobile, we performed security tests and audits
At Deutsche Telekom (T-Systems), we cover the areas of cyber security.
Cyber security training services for dozens of OTE employees
Implementation of penetration tests to improve the security of ING
Implementation of security audits and penetration tests for ČEZ
- Increasing cyber security at the Hradec Králové University Hospital
You May Also Like
- Robust multi-level user and data protection of Military Hospital Olomouc
- BUDVAR systematically increases its cyber security
- Kofola has cybersecurity under control
- Data of CENTROPOL ENERGY customers and employees is safe thanks to the DLP system
- The first four companies adopt the new name Aricoma
- Complete management of the corporate IT of MORAVIA PROPAG
- Modern and secure IT infrastructure with operational services for Arkance Systems CZ
- We have joined the EDIH NORTHEAST BOHEMIA consortium’s digitalization project
- Faster and safer login to computers and applications at the Jihlava Hospital
- Companies in KKCG's technology pillar are changing. Qinshift to be spun off from Aricoma
- Security and remote management of thousands of commissioners' mobile devices for Census 2021
- AC Identity - Identity Management for the city of České Budějovice
DO NOT HESITATE TO
Are you interested in more information or an offer for your specific situation?