Built around your environment.
Blackcube Solutions works with you to define the applications, services or systems that need review. A configuration assessment can be useful after a deployment, when responsibilities change, or when you want to understand whether settings still fit the way your business operates. The exact platforms and depth of review are confirmed during scoping.
What we assess.
The specific checks depend on your systems and the agreed scope. Areas we can discuss include:
Default and inherited settings
Review relevant defaults and inherited configuration to identify settings that may no longer suit the system’s intended use.
Unnecessary access
Examine selected permissions and access arrangements for opportunities to limit exposure to the people and systems that need it.
Service exposure
Look at enabled functions and interfaces within the scope, including whether they need to remain available.
Hardening opportunities
Explain practical changes that could improve the assessed configuration, together with dependencies and operational considerations.
When this assessment can help.
- After deploying a system or changing the people responsible for its administration.
- When inherited permissions, defaults or enabled services need to be checked against current business needs.
- When you want documented hardening opportunities for an agreed platform without assuming a full penetration test is required.
Clear scope. Useful conclusions.
A configuration review examines the settings and access arrangements made available for the agreed systems. It is distinct from investigating how a weakness might be used during a penetration test. Platform coverage, the configuration material needed and any unavailable settings are established during scoping; review access is not authorisation to change live systems.
Before testing begins.
Tell us which systems you want reviewed, who administers them and what concerns prompted the assessment. We agree on suitable read access or configuration material, excluded settings and how sensitive information will be handled. Review access does not imply permission to change live settings.
Findings you can work with.
Receive a written account of the settings reviewed, identified weaknesses and suggested improvements. Recommendations help your system owners decide what to change and how to plan those changes. Implementation and any follow-up verification are discussed separately.
From findings to improvements.
System owners decide which recommendations to implement, taking account of dependencies and operational needs. Record the reason for any settings that must remain and assign an owner to planned changes. A follow-up review can examine selected revised settings; implementation and broader verification are separate arrangements.
Common questions.
Is a configuration review the same as penetration testing?
They answer related but different questions. A configuration review examines settings and access arrangements. Penetration testing investigates how weaknesses may be used in an agreed environment. The two can complement each other where both are in scope.
Will you change our live configuration?
The review produces findings and recommendations. Changes to live settings require a separate agreement with the relevant system owners and are not implied by permission to review configuration.