Have you ever wondered how hackers see your external network? What is visible from the outside? Can they find vulnerable points? The answer to these questions is an external vulnerability assessment with a black-box approach.

In an external vulnerability assessment, the black-box approach means that the system is assessed without any prior knowledge; the test relies only on what the target system returns.

Our first step is usually network reconnaissance: we map the network based on information available on the internet. Whois records, domain registrations, forums and free databases form the basis of the search.

The next step is to find the network entry points and identify the services running on them. It is essential here to identify version numbers and detect any default installations.

The result of the external vulnerability assessment is an inventory: a thorough list of the vulnerabilities of the external hosts. An important part of our reports is our recommendations on how to fix, or at least mitigate, the vulnerabilities found.

We recommend carrying out external vulnerability assessments on a regular basis, at least once a year. You may also want to consider an assessment when installing a new firewall, VPN or other network device. We always verify findings manually after using automated tools, to obtain a more accurate picture of the network.

The black-box approach is not only useful in external vulnerability assessments; it also works well for web applications and mobile applications.

Sometimes it is a good idea to complement the external vulnerability assessment with a penetration test, in which we not only map but also exploit the vulnerabilities found and attempt to compromise the systems. We only perform a penetration test if the contract allows it.

Although we do our best to avoid causing downtime, these tests may overload poorly configured systems or cause other problems in their operation. This is why we do not charge extra for testing at night or at weekends, so our clients can choose the time of day or week when the test is performed.