Contact Us
Contact Us
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Subscribe to our newsletter
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Network Penetration Testing

Given the advancements in TacticsTechniques, and Procedures (TTP), organisations must evaluate people, processes and the technology in use to avoid potential loss of Confidentiality, Integrity and Availability of their data.

Find out more
Get a FREE 30 min consultation

Are you happy for Defendza to keep you informed on the latest developments in cyber security (attack reports, guidance, DIY articles)? Of course you can unsubscribe at any time. Please see our privacy policy

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Portfolio

Network Segregation Review

Network segregation process ensures restrictions are in place to avoid unnecessary exposure of systems within particular networks.

Device Audit

Whether it is your device operator, manufacturer or service provider, secure device configuration is an important element in ensuring the security of components responsible for data transport. 

Server Build Review

An unhardened or weakly configured server could provide an easy route to a complete network compromise or unauthorised access to sensitive data

Active Directory Review

Domain controllers are the heartbeat of your network. Remote compromises could be directly impact your brand position, leading to reputational and/or legal implications.

Wireless Penetration Testing

We simulate various threat scenarios that an attacker may use against your wireless network that could lead to an organisation wide breach

Firewall Configuration and Rules Review

A firewall is the first line of defence against online attacks, making it a critical part of your network security strategy.

IT Health Check (ITHC)

Whether you are a council, NHS trust or a corporate business, Defendza offers organisation-wide cyber health checks to help you assess your technical security controls across the perimeter, wireless, internal and external environments.

External Network Penetration Testing

Network level services exposed to the Internet, if exploited, could allow easy entry to a threat actor within your network. 

Internal Penetration Testing

Our consultants would review the security posture of your internal network, targeting user workstations and business-critical servers

Security Assurance

Infrastructure security assurance is a fundamental step for any organisation looking to assess their security culture. Our assessments ensure that these exercises act as not only an assurance exercise, but also a knowledge sharing session for the in-house team to learn how to identify and mitigate the weaknesses.

Given the advancements in Tactics, Techniques, and Procedures (TTP), organisations must evaluate people, processes and the technology in use to avoid potential loss of Confidentiality, Integrity and Availability of their data.

We have a dedicated security assessments FAQ section. Read it here.

Service Offering Insights

Why choose us?

  • Extensive sector-based experience
  • Focus on service quality, insight, and client business
  • Thorough analysis and reporting to cater management and technical audience
  • Our proposals are customer centric, no fixed sales packages offered
  • Aftercare support includes debrief and help with the remediation plan

Our qualifications

Defendza as a business, as well as its consultants, are equipped with some of the best-known certifications, accreditations and qualifications globally. These include CREST, GCloud 11 Framework, ISO quality management certifications for the business and our consultants are Ex Check Team Leaders/CCT Infrastructure (2012, 2015) and Web Applications (2009,2012,2015), OSCP (Offensive Security Certified Professional), CREA (Certified Reverse Engineering Analyst), CREA (Certified Binary Auditing Expert), CISSP (Certified Information Security Systems Professional), SANS GSEC & GCIH Silver (Hacker Techniques and Incident Handling), CCNA (Cisco Certified Network Associate), CEH (Certified Ethical Hacker). 

Key benefits

Conducting regular penetration assessment offers the following benefits:

  • Assess your security controls and approach towards cyberattack preparedness
  • Manage your network based risks in a structured and organised manner.
  • Evidence of compliance with ever changing regulatory/certification requirements.
  • Assess your corporate security culture including passwords, patching, and auditing, logging and information storage practices.
  • Assuring your supply chain (suppliers, vendors) that you take the security of your data seriously.
  • Protect your client loyalty and brand image by demonstrating security adherence.

Different types of Infrastructure Assessments

Defendza Ltd is an accredited CREST penetration testing service provider. This ensures we adhere to high technical standards and code of conduct in place by CREST. 

  • Internal Infrastructure Security
  • IT Security Health Checks
  • Active Directory Review
  • Cloud Infrastructure Security
  • External Infrastructure Security
  • Vulnerability Assessments
  • Network Segregation (VLAN Security) Assessments

For more details, please click on the services listed on the top of this page.

Reasons for Network and Infrastructure Related Assessments

Given the advancements in Tactics, Techniques, and Procedures (TTP), organisations must evaluate people, processes and the technology in use to avoid potential loss of Confidentiality, Integrity and Availability of their data. The best way is to seek validation from an  independent third-party organisation such as Defendza to identify gaps in the current security controls across the estate or specific assets, such as devices in use. With this assessment, you should not only get a picture of your current situation, but also help and knowledge sharing to address the identified risks.

Discuss your primary concerns with us today.
Call Us Now

Our Approach

Our infrastructure security assessment services are based on the extensive methodology we have developed over years of experience working across different sectors and enables us to deliver the right returns on your investment. We approach infrastructure security assessments at the highest level, as follows:

Step. 1
Scoping and Customer Insight

When you decide to give us the go-ahead, our very first step is to gain insight into your motivation, so that we can advise on your real concerns. The comprehensive process we go through to understand this determines the vision for the project. At the technical level, this includes assets to be included, their fragility and importance to the environment. 

01

Step. 2
Discovery

In this phase, we profile the target, i.e. a network, a server, or a device. This is a non-intrusive exercise and involves activities like analysing the network, understanding the different assets and services, operating systems, programs in use, and anything related to network layout. This is a fundamental step and helps to prepare for the next stage of finalising targets and finding weaknesses.

02

Step. 3
Vulnerability Analysis

The prioritised list of targets is scanned for vulnerabilities. This assessment involves checking both published as well as undocumented vulnerabilities against the target assets.  We sift through the scan results for false positives. The manual assessment ensures that only verified vulnerabilities are focused upon.

03

Step. 4
Attack & Exploit

Using an open-source, commercial, and custom scripts, vulnerabilities that would cause no network or host level impact are targeted for exploitation. The objective here is to find higher-level privileges to achieve the highest possible access on a system. This system is then used as a base for further lateral movement in order to attempt to compromise the entire network, domain, or the agreed target. Based on the scope of the project, this access can be maintained for days to achieve further objectives or considered a completion of the assessment.

04

Step. 5
Credential Harvesting

This is one of the lowest hanging fruits for a threat actor searching for lateral movement. Our real life experience has taught us to live by this 'must have' rule in our methodology. Defendza searches the customer's network for valid credentials that are stored in text-readable formats or any alternative forms of insecure encryption.

05

Step. 6
Privilege Escalation

The first level of access achieved from the "low-hanging" fruits found in previous phases does not allow full access to the underlying target. An attacker may not perform desired tasks for further activities such as password hashes retrieval, adding privileged users or tasks. Privilege escalation techniques are attempted by exploiting a bug, design flaw or configuration oversight in an operating system, or software/application to gain elevated access. This allows our security experts to perform elevated tasks that are key for lateral movement to infiltrate into the target network. 

06

Step. 7
Password Analysis

This phase involves performing password cracking and statistical analysis of the passwords. Conducting password analysis would provide you an indicator of the password culture within the organisation. A list of top used passwords and nature of these passwords, password reuse, privileged accounts and password policies are included during the review. Using our database of leaked passwords and the hardware specialised for password analysis, our consultants will be happy to give you an in-depth review of the password strength based on the hashes supplied.

07

Step. 8
Reporting

The assessment-execution phase is followed by the analysis & reporting. Defendza performs analysis on the testing output, evaluates the risk impact and likelihood of exploitation in realistic scenarios before providing action plans to remediate the identified risks. All our reports address business as well as the technical audience with supporting raw data, including mitigation measures at strategic and tactical levels. 

08

Step. 9
Communication & Debrief

We take customer communication as seriously as reporting or assessment execution. We engage with customers during all stages, and ensure that customer contacts are up to date in the language they understand. Post engagement, a free debrief is conducted to help the customers understand the weaknesses and prepare a mitigation plan.

09

Resources

Tips

Cyber Security Guidance for Online Retailers (SMEs)

Defendza's checklist-based guidance online retailers especially SMEs to provide with an overview of both basic and advanced cybersecurity measures they should implement. Overall, the guide will enable organizations to improve their cybersecurity posture, reduce security risks, avoid vulnerabilities, and enhance their resilience.

Read the Blog
Tips

Cyber Security for SMEs - Practical Approach

Defendza, a cyber security firm specialising in cyber security consulting and managed services, offers a five-point quick help cheat sheet that would help SME’s tackle the most common cyber-attacks. 

Read the Blog
Tips

Quick Guide - How to secure APIs.

Defendza, a cyber security firm specialising in cyber security consulting and managed services, offers a six-point quick help that would help SME’s tackle the most common cyber-attacks. 

Read the Blog