Configuration Review
We begin by understanding the organization's Remote Access goals, strategies and control objectives and then review the device security posture to identify how the current logical controls protect critical assets, sensitive data stores, and business-critical interconnections in accordance with the organization’s business and security objectives. The review covers Rule Sets, Policies, Logging and Auditing, and Compliance and delivers a comprehensive Risk Assessment report with remediation advisory.
Passive Control Validation
Our comprehensive configuration review focuses exclusively on evaluating rules and configurations within the context of your specific solution. While configurations are examined, the effectiveness of the implemented controls and rules raises questions. To address this, we leverage the Control Validation exercise, a crucial step in ensuring the Solution's robustness. In this approach, we conduct an in-depth assessment without actively testing the Solution. Instead, we tactfully explore device-contextual techniques to challenge the existing controls, aiming to identify any potential weak points and bypass RA rules configured within.
Active Penetration Testing
Active Penetration Testing involves rigorous, intrusive testing directly against the Solution itself. By subjecting the Solution to deliberate attempts to overwhelm or breach it, we gain valuable insights into its resilience and capacity to withstand attacks, ultimately enhancing its ability to enforce controls effectively.