What we can do for you
Our typical service offerings include:
Application security
We test Internet facing and internal applications for vulnerabilities that could adversely impact your business
Mobile security
We test mobile applications, supporting API's and corporate mobile security policies for vulnerabilities and misconfigurations that would put your business and your users at risk
Infrastructure
We test infrastructure underpinning your applications and business operations including laptops, servers, kiosks and network devices for misconfigurations and vulnerabilities
Goal orientated testing
We attempt to evade your preventative and detective controls to demonstrate pre-agreed scenarios such as stealing intellectual property, customer information or gaining access to critical application systems
Wireless security
We test wireless server and client configurations and identify rogue access points inside your organisation perimeter
Phishing
We assess susceptibility to external phishing attacks, a common method used by criminals to breach your perimeter defences
Physical security
We assess the physical security controls around your sites such as RFID based access control systems and test if we can circumvent them
Check up
We perform a broad security check up that may identify areas of interest warranting closer inspection
What we test for
We look for vulnerabilities and issues such as:
Authentication
Can we bypass the login mechanisms to gain unauthorised access to hosts, applications or data?
Authorisation
Can we access data of functions that should be reserved for another user?
Transmission security
Can sensitive data sent across the network be intercepted by a third party?
Input validation
How does your application handle malformed or malicious input? Can we bypass controls through specially crafted attacks?
Business logic
Can we circumvent the intended use, workflow or business processes of your application in ways that adversely affect your organisation?
Information disclosure
Do your systems inadvertently disclose sensitive information?
Misconfigurations
Are there misconfigurations of oversights that would allow an attacker to obtain sensitive information or gain a foothold in to your organisation?
Vulnerable libraries
Are you using software components, libraries, modules or plugins that have publicly known exploitable vulnerabilities?
