OUR CYBERSECURITY SERVICES

Solutions in software code

Our security audits can be carried out in white-box, grey-box or black-box (pentest) mode. Whenever possible, we recommend the white-box methodology, for its completeness and the quality of its results.

A security audit is an assessment of a system, a process and/or an organisation, in order to visualise the weaknesses as well as the strengths of the associated information system.

Depending on your needs, we can carry out your security audits using the following methodologies: 

• Black-box audit (or pentest, for 'penetration testing'): an audit technique that aims to reproduce a cyber-attack, as close as possible to real conditions, in order to see which flaws could be exploited by malicious actors. 

• White-box audit: no penetration test as such is carried out. The white box audit is so named to emphasise the 'transparency' aspect of this technique: the consultant has all the necessary documentation (configuration documents, network architecture) and thus has an overview of all the elements that make up the organisation.

• The grey box audit: this is a mixture of the white box audit and the black box audit. The consultant has a few pieces of information about the organisation being audited, information that could have been gathered using various social engineering or phishing techniques.

​

​

We base our studies on the relevant standards: 

• ISO 27001/2: for securing an information system;

• ISO 27005 and EBIOS: for enterprise risk management;

• ISO 31010 and NIST 800-30: for infrastructure risk assessment;

• OWASP TOP 10: for risk assessment and application security.

​

​

We use recognised testing tools and customised tools to find vulnerabilities that can be identified in this way. We then supplement these tests, using our know-how and in-house resources, with in-depth analysis to identify problems that would otherwise go undetected.

• Recognised infrastructure vulnerability testing tools: Nessus, Nmap, SSLyze, Vuls, etc.

• Recognised application vulnerability testing tools: Burpsuite, etc.