The cooperation between Emmaüs and Toreon turned out to be a win/win for both of them. “As an organisation we were looking for a partnership and we found it with Toreon. The clear and honest communication ensured that we delivered what had been agreed and even more. Toreon looked beyond a one-off action and their service is still an added value for us” concludes Marc.

We started the assessment with a discovery scan of the entire public IP range. This first step was a black box approach to identify the systems and services exposed to the Internet.

Next, we organised an intermediate meeting to compare our list with the existing list of assets managed by Emmaüs, so we could discover any malicious devices and/or services and detect services that were unintentionally exposed to the Internet.

We then scanned the detected systems and services for known vulnerabilities and verified all findings manually. This was necessary to rule out biased results. During this validation, we also conducted a series of service-specific tests such as SSL certificate security and non-intrusive testing. This allowed us to test the security level of the detected services in production.

Finally, we conducted an online leak test to identify potentially dangerous data online. We looked for hacked accounts in the business domain and performed several checks on potentially malicious information that was accessible to the public online”.