External Network Testing

An external network assessment will target systems that usually reside in the company’s demilitarised zone (DMZ).
Typical systems include web, mail and database servers, firewalls and routers. The testing will be conducted remotely
over the Internet and will primarily discover weaknesses and vulnerabilities that are available to the general public.

External Application Testing

This type of testing is also conducted from the internet however; this assessment type will concentrate on web based
applications. This assessment will aim to discover vulnerabilities at the application layer. Common discoveries include
Cross Site Scripting (XSS), SQL injection (SQLi) and Verbose Error leakage.

Internal Network Testing

Internal network assessments will usually discover a large number of vulnerabilities compared to external testing, partly
due to reduced boundary protection and the fact that the internal systems are thought to be less prone to attack. Typical
systems reviewed include core servers, user workstations, printers, routers, firewalls and switches. The purpose of this
type of assessment is to simulate an insider threat, be it by an employee or a contractor and will determine how secure,
or insecure, a network is from the core out.

Workstation User Testing

Network owners regularly deploy policies and restrictions to ensure users cannot compromise a system from within. We
can assess the security of user systems (workstations / laptops) and confirm if a user can bypass network restrictions
to gain access to unauthorised areas. Examples include restricted storage areas or unmonitored access to the Internet
bypassing Company security measures.

Laptop / PDA Testing

Laptops / PDAs carry extra risk to a company as they are by their very nature used outside the office and the likelihood
of them being lost or stolen is higher. If this were to happen, the consequences could be significant. An assessment of a
laptop / PDA device will provide detailed information on the likelihood of information being extracted which could severely
damage a company and its reputation.

Company Boundary Testing

The majority of organisations secure their perimeter by deploying single or multi-layered firewalls and other security

devices including IDS, VPN and content filtering. Total Network Security offer a comprehensive firewall review
providing guidance on discovered rules. Controlled external testing can determine if an Intrusion Detection System (IDS)
triggers correctly and advise if this can be bypassed or be used to complete a Denial of Service (DoS) attack on internal
administrative staff. We also review content filtering systems to determine allowed file types and attempt to bypass these
security measures to pass unauthorised file types into the network environment.