It is a type of scanning applied to the devices in the internal network structure of the institution in order to prevent the attackers from accessing the internal network and preventing possible cyber attacks. The main of these devices in the network are server, clients and other network elements. It can be done by providing on-site service to the institution to be scanned or by remote access connections with VPN.

It is the process of scanning for vulnerabilities arising from systems such as operating systems, software, drivers and device configurations run on servers and clients within the organization’s network. It is checked whether there are unauthorized attempts to the network, and these situations are reported. The tests applied here are carried out over the internet and there is no reason to stop the system. In this context, there are three different types of tests:

Black Box Test: These are the tests carried out on security systems without any permission and without giving any detailed information about the systems except the scope.

White Box Test: These are the tests that will be carried out by allowing IP addresses to test over security systems and providing detailed information about the systems.

Gray Box Test: This type of test refers to a mix of black box and white box tests. In general, it is tried to determine what users with limited authority can do on the system.

It is the detection of vulnerabilities with different user profiles of web applications within the scope of the institution, testing and analysis with manual methods, and reporting of findings and solutions.

It is the testing of all information systems that can affect the performance and accessibility of the application in question, as a result of applying a number of user behaviors determined within the scope, depending on a real scenario, on web applications that organizations use or are in the process of using.

It is the detection of vulnerabilities with different user profiles of mobile applications within the scope of the organization, testing with manual methods, analysis, reporting of findings and solution suggestions. If requested, a re-verification test can also be performed after you have closed the security gaps.

Tests are carried out against all types of DDoS attacks that may come to your institution over the internet, and your systems are monitored against possible DDoS attacks, and their status is reported. To prevent DDoS attacks, open source and commercial products should be used and the necessary infrastructure should be established.

In case the vulnerability is analyzed, suitable products tested by us are recommended and work is started on eliminating the gap.

These are the attacks organized by the attackers to obtain the information they want by using various persuasion and deception methods by taking advantage of human vulnerabilities. The lack of information security awareness of the personnel in the institution prepares the ground for these attacks. Attackers often use these methods by phone, e-mail, etc. through non-face-to-face communication channels. In order to detect such vulnerabilities, an attack scenario simulation is carried out in the institution and the situations are reported.

Firewall-style products in the institution are tested within the scope of Firewall Tests and their configurations are examined. The greatest blocking against possible attacks and malware is expected from firewalls. After the analysis on the tested hardware and software, critical vulnerabilities and incorrect configuration steps are detected in the firewall. The detected results are reported.

By using content filtering, you can protect yourself from harmful content on your internet network. Input rules for scanned websites are checked, and the extent to which the determined rules prevent harmful content is tested. Obtained results are reported.

Within the scope of DNS Service Tests, possible attacks that may occur over DNS such as DNS Hijacking, which allows changes to be made in the area where name servers are defined on the host, or DNS Spoofing, which will lead to wrong IP addresses being misdirected, are detected. The results are reported.

It is a type of test that covers vulnerability scanning in e-mail clients and web e-mail systems. Email protocol services may not always provide control and protection for Spam or Spoofing. All incoming e-mails from within the institution and from outside the institution, all e-mails sent from within the institution and their tightening are checked.

Wireless networks; may contain risks arising from the protocols it supports and user ignorance. Attackers can listen to traffic due to vulnerabilities on the network and even use password cracking methods for the encryption protocols used. Discovery and analysis are made on the wireless networks of the institution for such attacks. These discoveries are made with the scanning tools we use and the situations are reported.

A search is made on the database used to record the properties of the configuration items and the relationships of the configuration items. It is determined whether there is an error in the database configuration against possible attacks to the database. Procedures, table structures and database designs are also studied. Results are reported together with recommendations.

It is the job of identifying and reporting structural and logical errors that may create vulnerabilities by examining source codes with an automatic tool and manual observation.

• Domain configuration tests
• End-user computer Intrusion Security Audit
• SCADA security tests
• Virtualization systems tests
•