Services / Security analysis
AnalysisWe map infrastructure security and the order of work
We map infrastructure security from four views. We start from your systems: what is public, who talks to whom, which gaps are known, and which signals sit on the hosts. Then we collect from the edge, the network, the scan, and the machines. We leave a risk map and an order of work. Layer deployment and on-call are a separate security service, scoped from that report.
How it fits together
From four views to one risk map
First we understand the systems and the data. On that basis we join the edge, the network, the scan, and the hosts. Cloudflare, ntopng, OpenVAS, and Wazuh are what we use for that collection. The result is a map and a backlog.
- The result is a map and a backlog. Wazuh deployment and 24/7 on-call are scoped separately.
- A compliance audit maps that state to ISO, SOC 2, or DORA. Analysis first says what is there.
We map what is public, before we enter the network
Analysis starts at the edge. DNS, certificates, WAF, Access, and whether origin still listens on a public address. Cloudflare Security Analytics shows bot score, rules, and the request log. From that we know what is actually visible from the internet.
Surface
Hostname, ports, panels, API. A list of what should be public. The rest behind Access or VPN.
Internet traffic
Bot score, a scan, a flood, login attempts. Whether the edge stops the mass, or passes it to origin.
Identity
Grafana, cloud, and staging through SSO. A panel on a password on the internet is a finding.
Gap
Origin beside Cloudflare, a stale DNS record, an open admin port. That is exposure, with an owner on the map.
We watch traffic that leaves the known profile
ntopng classifies flows, applications, and hosts. Analysis compares an ordinary day with a deviation: a new destination, a scan, large egress, traffic between machines that should not talk. With this picture a gap scan says what can be attacked, and whether someone already walks the network.
Profile
Who talks to whom, which protocols, which volume. A baseline, from more than a one-off dump.
Deviation
A new ASN, unusual DNS, a connection outside the known set of services, a jump in volume.
Segmentation
Whether staging sees production, whether the database is reachable from a laptop, whether the jump host is the only path.
Correlation
A flow is lined up with a host alert and with the edge. One event, three views.
We weigh known gaps with exposure
OpenVAS gives a list of known gaps. Analysis weights them together with exposure and data. A public application and a card dataset before a host with no internet traffic. The result enters the risk map, next to traffic and host signals.
Scope
Hosts, panels, databases, staging, and production. A separate policy for what is visible from the internet.
Priority
CVSS together with traffic and data. A critical gap on a host with no exposure sits below a medium on origin.
Authentication
A scan after login shows real package versions. Without that the report guesses.
Next step
A remediation queue with an owner is already hardening or audit. Analysis says where to start.
We read signals that are already on the machines
If agents already run, we look at alerts, FIM, and SCA. If not, we still write down which logs exist and which are missing. Analysis does not deploy a SIEM. It shows whether an incident can be seen today, or reconstructed after the fact from a few files.
Coverage
Which hosts have an agent or a log. Production and the jump host before a test machine.
SCA and FIM
Drift against CIS, a file change outside the window. Material for configuration risk.
Alerts
Noise versus an event that needs a response. A missing playbook is a finding, the same as a missing log.
Audit trail
Whether we can say who, when, and from which source. Log retention and access enter the map too.
How we work
From the client systems to an order of work
We start from critical systems and data. Then we collect from the edge, the network, the scan, and hosts. We leave a report and a decision on what to deploy. Layer deployment and on-call are a separate scope.
- Scope We check systems, data, who signs, and what is out of scope. That gives the collection plan.
- Collection We collect surface, traffic, a gap scan, logs, and configuration. Four views, one map.
- Report We write risk, exposure, order, a justification for the board, and a list for engineering.
- Decision We recommend hardening, a compliance audit, or on-call, according to what came out.
Questions
Analysis scope and split of work
How is analysis different from a compliance audit?
Analysis describes the state: what is exposed, what the traffic is, which gaps are known, which signals are visible on hosts. An audit maps that state to ISO 27001, SOC 2, DORA, or KNF controls and leaves a backlog for certification. Analysis is often the first step, the audit the second.
Is this a penetration test?
No. A penetration test composes several gaps into one attack scenario, usually less often and with more depth. Analysis uses a scan of known gaps, traffic, and logs. It gives a map and an order for today. The test says how those gaps can be used together.
Do we already need Cloudflare, ntopng, OpenVAS, and Wazuh?
No. If the tools are there, we use them. If not, we still write down the surface, the logs that exist, and a scan we can run in scope. A missing tool is part of the picture. It does not block the analysis.
What remains after the analysis?
A risk map, an order of work, and a recommendation for the next service: security and hardening, audit, or administration. Layer deployment and on-call are scoped separately, on the basis of that report.
Talk
We will discuss the analysis scope and critical systems
On that basis we will prepare a scope: a risk map and an order of work.
Contact us