CMT - Infrastructure Configuration Management Testing

The basic principle of infrastructure configuration management testing is the idea that the misconfiguration of the application infrastructure (web, db, smtp, etc.. servers) can lead to intrusions upon the web application. In other words, even if the web application is extremely secure -  misconfiguration of the  infrastructure can lead to a potential breach.  So how do we assess and manage this problem? A thorough examination  of the entire infrastructure must take place. The examination should identify the different elements that make up the infrastructure and how these elements interact with the web application. Information on the infrastructure must be either given to us by the application developers (the best way) or retrieved through various information gathering methods.  Once the infrastructure information is received, penetration testing can be done through different tools to find exploits.