This page serves as gfxtm’s framework. It defines the technical terms used in our gfxtm’s Assessment Spreadsheet, our testing logic, and the transparency of our results.

And gfxtm’s Assessment Guide explains how to enter data, how the sheets are structured, and how results are interpreted.

Assessment

Communication Protocol

For further information regarding our technical assessment standards or to request a full methodology guide, please contact gfxtm via our established professional channels:

Whatsapp | linkedin | line

Secure & Confidential Data Exchange To maintain strict end-to-end encryption (E2EE) for confidential project details, technical IP, or sensitive network architecture, please initiate contact via:

Signal | Telegram

Do not transmit unencrypted spreadsheets or system architecture diagrams via standard email. Please use the secure channels listed above for all confidential documentation.

I. Infrastructure Inventory (User Input)

The “Hardware Baseline” is the foundation of the audit. Accurate data here ensures the security scope is correctly defined.

Machine Name & ID

  • Definition: The unique network hostname or internal system identification.
  • Requirement: Please identify the Brand/Model (e.g., Dell PowerEdge, Raspberry Pi) or core specs (CPU/RAM/Storage) for custom builds.

Network Profile

  • Definition: The logical configuration of the asset’s connection.
  • Scope: Includes IP assignment (Static/DHCP), DNS, Gateway, Subnet, and interface type (Fiber/Ethernet/Wi-Fi).

Protocols & Hardware Identifiers

  • Standard IT: Uses MAC Address for Ethernet/Wi-Fi.
  • Home Automation (HA): Uses EUI-64 (Zigbee), UUID (Matter), or BD_ADDR (Bluetooth).
  • Logic: We track the physical “fingerprint” of the radio chip to ensure security persists even if the network assigns a new IP.

II. VAPT (Vulnerability & Penetration Testing)

Expert analysis of the “Attack Surface” using a multi-round probing methodology.

Port Scanner & Patch Audit

  • Process: A minimum of 2 rounds of testing.
  • Logic: We identify open logical ports and cross-reference OS versions against known vendor security advisories (CVEs).
  • Purpose: To close unnecessary entry points and ensure critical security patches are active.

CVSS Score (Severity Rating)

The Common Vulnerability Scoring System (CVSS) is the global industry standard for assessing risk.

  • None (0.0): No security impact.
  • Low (0.1 – 3.9): Minor risk; usually requires local physical access.
  • Medium (4.0 – 6.9): Significant risk; patching required in the next maintenance cycle.
  • High (7.0 – 8.9): Serious threat; exploit is likely possible with remote tools.
  • Critical (9.0 – 10.0): Immediate threat; high probability of remote compromise or data loss.

III. IAM (Identity & Access Management)

Auditing who can enter your systems and what they are permitted to do once inside.

Principal Identity & Auth Method

  • Identity: The unique username, email, or service account name.
  • Method: The mechanism used for entry: Password-only, Token, 2FA, or Biometrics (FaceID/Fingerprint).

MFA Bypass & Access Abuse

  • MFA Bypass: A technical attempt to force or trick the system into skipping the Second Factor (2FA/MFA) during login.
  • Brute Force: Testing the system’s “Counter-Measures” (e.g., account lockouts) after multiple failed login attempts.

Privilege Escalation (Low-to-High)

  • Audit Logic: We test if a standard user (“Low Level Admin”) can increase their own permissions to “Upper Admin” via system flaws or misconfigurations.

Random Access (Service‑Dependent Memory Access Test)

  • Definition: Attempts to access memory or protected system areas through exposed services or misconfigured daemons.
  • Audit Logic: This test is only applicable when the system exposes interfaces that allow indirect memory interaction.
  • Purpose: To identify unintended access paths that bypass normal authentication flows.

IV. DRP (Disaster Recovery Planning)

Ensuring “Business Continuity” by following the industry-standard 3-2-1 Backup Rule.

The 3-Media Strategy

We audit three distinct layers of data redundancy:

  1. 1st Media: Local, high-speed recovery (e.g., NAS/Internal Drive).
  2. 2nd Media: On-site secondary hardware (e.g., External SSD/Tape).
  3. Remote: Off-site cloud or encrypted remote storage (e.g., S3/Off-site Server).

Test Recovery

  • Logic: A backup is considered a failure if it has not been tested.
  • Validation: We record the result of the most recent “Restore Test” to prove the data is actually usable in a crisis.

V. HA & HAH (Automation & Healthcare)

Auditing the reliability, interference, and privacy of “Smart” and “Medical” environments.

Signal Integrity (LQI / RSSI)

  • Definition: Measurement of radio strength (Link Quality) for wireless sensors.
  • Criticality: Essential for Healthcare (HAH) to ensure “Fall Detection” or “Heart Monitors” remain connected.

Safety Logic

  • Definition: The “If-This-Then-That” behavioral rules of the home.
  • Transparency: Defines exactly what triggers an alarm if a security boundary is crossed.

Telemetry Audit (Egress)

  • Definition: Analysis of “What is sent to the internet.”
  • Logic: Identifying if a device is leaking private data (telemetry) to external clouds without the user’s consent.