Infrastructure & cloud.

A look at the infrastructure as it is now: what is exposed, what nothing is inspecting, what nothing is recording, and where updates happen when somebody remembers rather than on a schedule. What comes back is a short list in the order things should be fixed, not an inventory.

• what is exposed, and what nothing is inspecting
• who connected and when — or that nothing recorded it
• a fix order, not a 200-page inventory

Segmentation is one of the most commonly abandoned security projects, because separating things properly tends to break what people use every day: printers disappear from the list, screen sharing stops working, and within a fortnight it is quietly reversed. We separate the network into distinct segments with traffic between them denied unless there is a reason for it — then make the daily things work across those boundaries deliberately and narrowly.

• traffic between segments denied unless there is a reason
• printing, scanning and screen sharing still work
• a redundant pair rather than one device on its own
• every event sent to central logging

Most companies already collect the evidence of a break-in without anyone reading it, so we watch it instead and act when something is wrong. Monitoring and responding are two different jobs: monitoring runs continuously, and when something is wrong a person acts on it with enough context to decide rather than leaving a queue to triage later.

• 24/7 coverage
• threat detection & containment
• sla-backed response

Real attempts against your apps, cloud and network in the way someone hostile would, followed by a list of what actually worked, worst first. Delivered to published methodology — PTES, NIST SP 800-115, OWASP WSTG and OWASP Wireless — and re-tested once the fixes are in.

• apps, cloud and network
• findings engineers can use
• re-test after fixes