Securing Systems
You should never take a system — whether operating system, web server, application server, or web application — "off the shelf", but configure it appropriately and secure it additionally.
For some of these questions, we have configurations in use at several clients that have proven themselves in practice over time — which benefits you.
We can support you as follows:
- Security measures such as centralized, secure logging, detection of intrusion attempts
- SIEM configuration
- Configuring transport encryption (TLS/SSL) in a contemporary manner
- Securing web applications using a WAF (ModSecurity, etc.) and/or fail2ban
- Securing legacy environments using a reverse proxy
- Hardening involved server applications (Apache, Tomcat, JBoss, nginx, IIS, ...) as well as databases
- System hardening of kernel and services under Linux, manually according to benchmarks like CIS, including Unix permissions, SELinux, AppArmor
For comprehensive security, we offer vendor-independent consulting in the field of Web Application Firewalls (WAF). Here it is crucial to find the appropriate configuration for the respective environment and integrate it as smoothly as possible into operations and development.
Regarding encryption, it is worth mentioning that Dirk Wetter has published one of the best encryption testers as open-source software, demonstrating extraordinary expertise. (Development takes place on github).
Computer Forensics / Digital Forensics
A computer forensic analysis aims to find digital traces on a computer system, analyze them, and — where required — prepare them as admissible evidence. In addition to damage assessment, information on the identity of the attacker (external or internal) and the timing is important.
Depending on skill level, available tools, and financial resources, system manipulation can range from simple to very complex. Any device with a CPU and memory can be in the crosshairs of a compromise: servers, desktops, laptops, routers, mobile phones, and much more.
Our Support
We identify the cause, entry vector, time, and perpetrator for server (preferably) and desktop/laptop systems. In our own laboratory, we have a range of analysis methods available that provide a precise picture of who did what, when, and possibly where. Without destroying evidence or creating gaps in the chain of custody.