Methodology & Practice 13 min read

The Suisse Guard Methodology: Auditing Attack Surfaces Using Adversary Tools

To defend an organization effectively, one must look at it through the eyes of real adversaries. Here is how Suisse Guard evaluates external perimeters across 12 distinct domains combining proprietary AI tools and certified human analysis.

Author: Areg Arakelyan
Current as of:
Audit standard: ISO/IEC 27001

Core Principles

  • 12 Audit Domains: Perimeter, firewalls, remote access (VPN/MFA), darknet credential leaks, databases, OWASP web security, DNS, encryption, cloud & M365, email security (SPF/DMARC), supply chain, and Swiss compliance.
  • No Artificial Scoping: We audit everything an attacker can discover from the public internet—including forgotten staging servers and legacy supplier portals.
  • Mandatory Verification Audit: Every engagement includes re-testing to confirm all critical issues are resolved before certification.

1. Overcoming the Limitations of Traditional Scoping

Traditional pentests suffer from a fundamental blind spot: scopes are rigidly agreed weeks in advance based on customer-supplied IP lists. Attackers, however, ignore scope documents. They specifically target unlisted assets: marketing shadow-IT, temporary pandemic VPN portals, or unpatched SharePoint instances.

2. The 12 Comprehensive Audit Domains

  1. External Perimeter & Open Ports: Full inventory of exposed services and ports across public IP blocks.
  2. Firewall & Network Rules: Detection of overly permissive rules exposing sensitive protocols (RDP, SSH, database engines) to the public internet.
  3. Remote Access & Authentication: Rigorous evaluation of VPN endpoints and enforcement of Multi-Factor Authentication.
  4. Darknet Monitoring: Continuous checks for leaked corporate credentials on criminal underground forums.
  5. Databases & Cloud Storage: Identification of public AWS S3 buckets or open Azure Blob containers.
  6. Web Applications (OWASP Top 10): In-depth examination of SQL injections, XSS, and authentication bypasses.
  7. DNS Hygiene: Auditing zone transfer misconfigurations and dangling records vulnerable to Subdomain Takeover.
  8. TLS Cryptography: Deprecation of legacy protocols (SSLv3, TLS 1.0/1.1) and certificate management.
  9. Cloud & Microsoft 365: Review of Entra ID Conditional Access, tenant settings, and public SharePoint links.
  10. Email Security & Spoofing: Enforcement of SPF, DKIM, and DMARC with strict reject policies (p=reject).
  11. Supply Chain & Vendor Access: Auditing remote connectivity granted to third-party maintenance providers.
  12. Swiss Regulatory Compliance: Aligning data protection measures with revised FADP and ISA requirements.
Areg Arakelyan

Areg Arakelyan

Lead Security Analyst, Suisse IT GmbH. Specialist in adversary simulation, attack surface assessment, and hardening of Swiss healthcare, local government, and enterprises.