Black box
testing
We do not have information from your systems, we attack using the same techniques and methods of attack that a hacker would use.
We think as a hacker, then use SAST, DAST and RAST techniques and tools to improve the quality and security of your applications.
Why run performance tests?
Black box
White box
testing
We do a thorough review of the system, with detailed information about the environment, including source code, configuration files...
Grey box
testing
We combine black box and white box testing, we have some information about the systems and we use it in some cases.
How do we do it?
Web Application Auditing
It seeks for vulnerabilities in the most exposed part of the company to the Internet, the web application. Thanks to this type of auditing, it is possible to know the security status of the web environment in production and, therefore, the probability of suffering an attack that partially or completely violates the information hosted and the services offered. This type of auditing is perfectly integrated within SecDevOps, or can be carried out independently of the development.
Wireless Auditing
Its mission is to verify that it is not possible to breach the company's wireless network. On the one hand, to check whether it is possible for an external attacker to gain access to the internal network and, on the other hand, to check whether an internal employee can set up his own access (via mobile devices, for instance), creating a tunnel by passing the security restrictions implemented in the network.
Targeted Attack Simulation - RED TEAM
We collect public information about your infrastructure, services, systems and personnel to analyse your vulnerabilities and conduct a targeted attack with offensive customised tools, with the ultimate goal of infiltrating your organisation and stealing information undetected.
Incident response - BLUE TEAM
The incident response team carries out an initial assessment of the threat and monitors it with the aim of containing it in order to reduce the risk. Once contained, the risk is mitigated until a definitive solution is found that ensures business continuity in the shortest possible time.
Why do security tests?
False sense of security
Ignorance of flaws due to misconfigurations does not mean that they do not exist or have not yet been breached. Look beyond the firewall, the infrastructure configuration should be treated as if it were code, and should be tested with each deployment to ensure that no security holes have been introduced.
Compliance with regulations
Investing in security tests is investing in your calmness and the integrity of your data and your customers. You are obliged to comply with increasingly stringent security regulations set by governments and regulators. Ignorance of them does not mean that they do not apply.
FALSA SENSACIÓN DE SEGURIDAD
El desconocimiento de fallos debido a configuraciones erróneas no significa que éstos no existan o que todavía no hayan sido vulnerados. Investiga más allá del firewall, la configuración de la infraestructura debe ser tratada como si fuera código, y debe ser probada con cada despliegue para asegurar que no se han introducido agujeros de seguridad.