Infrastructure Security
Protection for Digital Networks
Networks form the foundation for digital communication and the general exchange of data. They vary widely in size and complexity, presenting operators with challenges in optimizing performance and security—and, consequently, in complying with legal and internal corporate requirements.
Entire industrial sectors base their business models on the availability and reliability of digital communication networks. For companies, a security incident on the network—such as a disruption or even a total outage—has serious consequences: damage to reputation and financial losses, potentially leading to insolvency.
Scope of Services
We examine networks and network protocols for security risks and potential vulnerabilities. From smaller, internal corporate networks to interconnected locations of internationally operating companies, all the way to the infrastructure of the Internet itself, we cover all network architectures. The services and their protocols we examine are equally diverse: email, LAN, wireless LAN, VPN (Virtual Private Networks), remote maintenance, name resolution, and routing are just a few examples.
Target Audience
- We support operators of networks, data centers, and other network infrastructures in identifying and minimizing security risks.
- For software developers, we identify current and emerging security threats and provide recommendations for remediation. In this way, we contribute to enhancing overall security.
Securing Network Structures
Many attacks on corporate IT infrastructures are facilitated or even made possible by the design characteristics of the affected network structures. This applies to networks in traditional office environments as well as to data centers, networked industrial production environments, and so on. Not only are network segmentation and perimeter security (firewalls) important here, but also the authentication strategy and seemingly internal interfaces such as wireless LAN access points.
We help you secure your networks with these services:
- Basic analysis of the security level of your network infrastructure
- Review of network access points, authentication methods, and wireless LAN infrastructures
- Support in the development, evaluation, and optimization of network architecture concepts
Security Optimization of Internal Network Services
Network services such as file storage, email, and other communication services, as well as networked business-specific applications, are often attractive targets for attackers, including in the context of complex, long-term cyber infiltrations known as APTs (Advanced Persistent Threats). This also applies to central servers used for user authentication within the service infrastructure (e.g., domain controllers). By properly selecting, configuring, and securing the associated communication protocols, the risk of successful attacks on a company’s most critical service infrastructure can be significantly reduced.
To secure your internal network services, we offer:
- A comprehensive technical and organizational security analysis of your service infrastructure
- An assessment of the services and protocols you use to ensure they are protected against “pass-the-hash” and other serious attacks, including those potentially facilitated by APTs
- Consulting and support in selecting and securely configuring services and protocols
Securing Name Resolution Services
The Domain Name System (DNS) is used for name resolution on the Internet and in local networks. Security considerations were not taken into account in the original protocol design, which resulted in a wide attack surface. This is reflected in the ingenious exploitation of the protocol (and its inherent weaknesses) for various attack vectors against potential victims.
The DNSSEC security extension counteracts this, but factors such as the complexity of setup and operation hinder its widespread adoption.
We support you in securing your DNS services by:
- Testing DNS services for vulnerabilities
- Implementing DNSSEC
- Security audits of relevant configurations
Security Measures for Routing
Since the early days of the Internet, the Border Gateway Protocol (BGP) has been used for routing. BGP has prevailed over all alternative protocols and remains the only option to this day. It is crucial for the smooth operation of the Internet. In recent years, disruptions affecting BGP have led to widespread outages across parts of the Internet. In such incidents, it has proven extremely difficult to determine whether the cause was a configuration error or an actual security incident. Secure protocols and architectures, such as the Resource Public Key Infrastructure (RPKI), effectively prevent both scenarios and ensure trouble-free network operation.
Our services include:
- Identification of external dependencies
- Support for the implementation of RPKI
- Security review of relevant configurations
Identifying Cyber Attacks and Minimizing Damage
More and more companies are falling victim to cyberattacks, often with serious consequences. In cases of suspected attacks—for example, when the first signs of a potential attack are detected—immediate action must be taken. The goal here is to verify the attack and, if necessary, identify its type and scope, implement appropriate measures, and thereby minimize damage in a targeted manner. Subsequently, it is advisable to secure the affected infrastructure against further attacks of a similar nature.
We offer you:
- A rapid technical investigation of IT systems potentially affected by attacks
- If necessary, implementation of appropriate immediate measures to mitigate damage
- Support in securing the IT infrastructure against further attacks
