Internal Security Assessment

Our consulting services, are helping Rediff India to securely serve their websites to their 95 Million Users.

To get more information on Security Brigade's Professional Services, Contact Us.

Introduction

Security Brigade's Internal Security Assessment Service (ISA) is a comprehensive inside-out assessment of an organization's IT infrastructure. With a unique combination of in-house research and development coupled with out-of-box thinking, we carry out technical audits and best-practice reviews against the IT infrastructure and configurations.

Upon completion of the testing an organization should have a solid understanding of their gaps from an overall security management perspective.

Advanced Security Analysis identifies unknown vulnerabilities in applications and networks before they are exploited.
Customer Specific reports with clearly outlined responsibilities and detailed remediation steps including device specific commands/patches and source-code examples.
In-depth Assessment of your organization's key operational infrastructure.
Prevent Loss of customer information, trust and organizational reputation.
Proactively Identifies your Business Exposure to tomorrow's risks by identifying security issues before it impacts your business.

Some of Our Unique Value Propositions
Experience Average 8 years of industry experience per consultant.	Free Re-Testing Ensures the detected vulnerabilities are correctly patched.
Customized Reports Designed to help developers understand issues for the long-term.	Hybrid Approach Unique combination of manual and proprietary automated processes.
Identifying the "True Impact" Get a real-world perspective on your threat assessment.	Enhanced Remediation Solutions specific to your operational and development environments.

Approach

At Security Brigade, all engagements are carried out by experienced consultants that utilize a combination of in-house developed, commercial and open-source tools to deliver maximum value. Our methodology is aligned to industry best-practices and aim to not just meet, but go well beyond regulatory and compliance requirements.

Our Approach

Our Internal Security Assessment methodology is an in-depth process that has been built through experience and thorough understanding of customer requirements.

[+] Read More

Pre-Assessment Analysis
Information Gathering
Policy and Procedure Gap Analysis
Social Engineering
Threat Profiling & Risk Identification
Network Vulnerability Assessment
System Vulnerability Assessment
Wireless Vulnerability Assessment
Exploit Research & Development

Exploitation
Privilege Escalation
Retaining Access
Network Propagation
Engagement Analysis
Mitigation Strategies
Report Generation
Support

Technical Experience

Security Brigade has had the privilege of working with a large number of customers with varied operational environments. As a result, our consultants have broad technical experience and some of the environments we have worked with are listed below.

[+] Read More

Operating Systems: Windows Server 2000, 2003, 2008, Redhat Linux, Sun Solaris, HP-UX, IBM AIX, Open VMS, Novell Netware, Open Enterprise Server, Suse Linux, IBM OS/2, Win NT, SCO Unix, SCO OpenServer, IRIX, FreeBSD, OpenBSD, NetBSD, OpenSolaris.

Databases: Oracle, SQL Server, IBM DB2, MySQL, PostgreSQL, Sybase, Access, SAP DB, Interbase, Ingres, Informix.

Firewalls: Cisco PIX/ASA, Checkpoint, Netscreen, Watchguard, Sonicwall, Fortigate, Web Application Firewalls.

Intrusion Detection Systems: ISS RealSecure, Cisco Secure, Dragon IDS, Fortinet, Snort, Sourcefire, Checkpoint RealSecure.

Network Devices: Routers, Firewalls, Switches, IDS/IPS, Load Balancers, Layer 7 Switches.

VoIP Devices: VoIP Routers, IP Phones, PSTN Gateways, ISDN Gateways, PBX Gateways, VoIP Switches, SIP Phones, H.323 Gateways.

Wireless Devices: Wireless Access Points, Wireless Routers, Wireless Bridges, Wireless Switches and Controllers, Wireless IPS, Wireless Client Devices.

Applications: ASP, .NET, PHP, Ruby, Perl, Python, C#, Java, C/C++, Delphi.

Web Servers: IIS, Apache, Tomcat, Netscape Enterprise, Caucho Resin Server, IBM HTTP Server, Lotus Domino HTTP Service, JRun, lighthttpd, Oracle HTTP Server, Sun Web Server, WebLogic.

Messaging Servers: Microsoft Exchange, Sendmail, Qmail, Lotus Domino, Blackberry Enterprise Server.

Others: Microsoft Sharepoint, SAP, Active Directory, ISA Proxy, Squid Proxy.

Mobile Devices: PDAs, Blackberies, Notebook Computers, Netbooks, Pocket PCs, Smart Phones, Tablet PCs, Microsoft Mobile Servers, Blackberry BES/MDS Servers.

SAP Systems: SAP R/2, R/3, BOBJ, APO, AFS, BW, BI, CCM, CC, CI, EBP, EL, EP, XI, etc.

In-House Tools for Internal Security Assessment

One of our core strengths has been our ability to adapt to challenging customer environments and requirements. We have been able to consistently meet these challenges through a strong process of research and development. Some of the many tools we have developed over the years are given below.

[+] Read More

sdFinder - Identifies internal hosts on non-contiguous IP ranges. It allows us to detect sensitive information about our clients commercial, intranet and extranet networks.

webDiscovery - Identifies as many applications as possible on Client web-servers. The applications discovered through webDiscovery allow us to provide a superior web application security testing service than competitive services and products. It allows us to increase the scope of the audit and cover more areas that could be attacked by malicious users; that would not be covered by a traditional audit.

networkMapper - Network Mapper uses proprietary technology to be able to identify alternative network routes to bypass security mechanisms such as IDS/IPS/Firewall etc. It allows our experts to bypass existing security implementations and gain direct access to the systems behind them.

webTester - Utilizes our Benchmark Development System to ensure that we can identify maximum vulnerabilities in applications through automated mechanisms. Along with flaws that are known, it uses in-house research to test for vulnerabilities that are not in the public domain. It allows us to automate the process of identifying and testing known and unknown vulnerabilities in web-applications and strike a cost-effective time to effort ratio.

VA Framework - Integrated solution developed by our security experts that have an expertise in the vulnerability assessment domain. It allows us to integrate the manual and automated testing processes with commercial and open-source software. Our Integrated Reporting Engine allows us to cross-reference information from all the different components and generate a report based on our Client's requirements.

PT Framework - Integrated solution developed by our security experts that have an expertise in the penetration testing domain. It allows us to integrate the manual and automated testing processes with commercial and open-source software. Our Integrated Reporting Engine allows us to cross-reference information from all the different components and generate a report based on our Client's requirements.

webSpider - Uses advanced HTML, Java Script, Ajax, Flash and XML parsing engines to identify and map as much of the client applications as possible. This not only assists our automated webTester engine, but also assists in carrying out the manual testing process in an efficient manner. It allows us to attain a cost-effective balance between thorough testing and time required.

sapScan - Security and Configuration Assistant for SAP Security Audits.

riskReview - General Risk Assessment Tool.

erpInterrogate - ERP Security and Configuration Assessment and Control Tool.

Windows Batch Scripts - Windows batch scripts to automate routine server hardening functions and processes.

Linux Bash Scripts - Linux Bash scripts to automate routine server hardening functions and processes.

Oracle Security Assessment Scripts - Oracle Security Assessment Scripts to automate routine hardening functions and processes.

MSSQL Security Assessment Scripts - MSSQL Security Assessment Scripts to automate routine hardening functions and processes.

Internal Vulnerability Database - Automated vulnerability database that is updated every 15 minutes from over 100 public and 20 private feeds.

SQL Explorer: identifies vulnerabilities in and retrieves data from MSSQL, MySQL, Oracle, PostgreSQL, MS Access etc database servers.

Case-Studies

Internal Security Audit for a Government Organization

Security Brigade conducted an Internal Security Audit for a Government Body with over 100 Employees based out of Ireland, UK. This case study highlights the solution implemented to meet the Client's key business goals while encompassing their ISO 27001 policies and procedures.

Download PDF

Internal Security Assessment for one of the Largest Chemical Companies

Security Brigade conducted an Internal Security Audit for one of the Largest Chemical Companies with over 5,000 Employees based around the world. This case study highlights the solution implemented to meet the Client's key business goals while encompassing their ISO 27001 policies and procedures.

Download PDF

Internal Security Assessment for a leading Managed IT Hosting Services Provider

Security Brigade conducted an Internal Security Audit for a leading Managed IT Hosting Services Provider with over 10,000 Customers. This case study highlights the solution implemented to meet the Client's key business goals while helping them ensure that the policies and procedures put in-place by them were thoroughly implemented and tamper-proof.

Download PDF

Deliverables

Security Brigade's reporting process is industry-unique and aims to deliver maximum value to your organization and the administrations / developers directly interacting with the security audit. Each report is customer-specific and contains detailed information, proof of concepts, source code examples and configuration details with the aim of educating your IT teams for the long-term. The following are some of the deliverables you will receive on completion of a Internal Security Assessment.

Executive Presentation Provides a holistic overview of the entire engagement, detailing the issues from an impact and business risk perspective. The presentation is aimed at helping senior management quantify risks and take an informed decision while aligning security with business objectives. Download PDF
Executive Report Provides a high-level summary of the systems and networks covered, vulnerabilities discovered and the recommendations made to mitigate the threats identified through the engagement. Download PDF
Technical Report Provides comprehensive information about all the threats discovered on the systems and networks. It will include proof-of-concepts, technical explanations, remediation recommendations, screenshots, exploits, etc. Download PDF
Project Summary Report Provides a detailed summary of the engagement, the vulnerabilities identified, recommendations made and current status of the identified issues. Download PDF
Excel Vulnerability Tracker Simple and comprehensive vulnerability tracker aimed at helping the IT asset owner keep track of the vulnerabilities, remediation status, action items, etc. Download PDF