Network Security Services

Update: February 15th, 2010

We protect your information from being exposed by identifying the potential breaches before hackers can exploit them and gain access. Your assets are your employees, information stored across systems, and business infrastructure. These assets are vulnerable to threats such as social engineering, viruses, warms, human errors, back doors, software bugs, and unauthorized access.

2Secure Corp provides networking and security consultation services which include risk and vulnerability assessments.  In addition, we deliver  state of the art security products such as Astaro All-In-One UTM’s, Profense web application firewall, Unitrends Backup & Recovery solutions, and Database Activity Monitoring host base Software installation, which all help monitor and  proactively prevent any unauthorized access. This comprehensive approach enables organizations to operate securely in today’s changing environment, while ensuring an optimal performing environment for their organization.

Introduction

Based on our experience from past customers it is recommended to perform a full security analysis that will include Internal and external perimeters. Full analysis will provide a complete and current security posture of the organization. 

Internal vs. External 

An External audit will simulate an attacker coming from the Internet (see diagram). This penetration testing will include three main ways into a given system: (1) open services on servers. (2) Network devices such as routers, and Firewalls. (3) Find weakness within Web Application retrieving sensitive information by using SQL-injections and other methods. Within each method we search for human-errors in the design and/or implementation, and/or user miss-configurations that can pose potential weaknesses. These weaknesses can be later exploited to deface website, upload files, obtaining access to user’s mailbox and obtaining administrative rights. 

An Internal audit will simulate and attacker that has a foot hold in the internal perimeter (see diagram). This penetration testing will include three main ways into a given system: (1) open services on servers and workstations. (2) Find and locate systems defaults, security updates and etc. (3) Find databases that may have sensitive information due to vulnerabilities, updates, miss-configuration and more. 

Work Scope – Penetration overview

  1. Network checks: The first step is to gather and examine some key information about the target, such as the Operation System, services, and level of protection in order to gain a better understanding of the potential threats to the systems. Once this has been completed we will assemble a catalogue of services and matching exploitable vulnerabilities to use in order to get access into the target(s). 
  2. Web application checks: The first step is to gather and examine some key information about the application by enumerating its content, functionality, logic, level of protection, and how it behaves. Much of this functionality will be easy to identify, but some of it may be hidden, and may require additional manual analysis guesswork, and experience in order to discover. Having assembled a catalogue of the application’s functionality, the principle task is to closely examine every aspect of its behavior, its core security mechanism, and the technologies being employed (on both server and client). This will enable us to identify the key attack surface that the application exposes and hence the most interesting areas on which to target subsequent probing to find exploitable vulnerabilities.

Assessment Diagram

Assessments Diagram

Deliveries

  1. Managers summary
  2. Technical summary accompanied by a detailed report with all potential holes and how to mitigate them.
  3. Redesign a secure infrastructure which is efficient and cost effective in order to reduce cost of ownership.

 Costs  

Test Type Description Cost
*Full analysis Total of 8 days:  3 days for network analysis, 3 days for web application analysis, and 2 days for writing the detailed report. This will Includes all below items.  QOUTE
Network Analysis Total of 4 days: 3 days for scan, and one day for writing the detailed report. Manual and automatic scans will include:

  1. Servers and Workstations Operation System
  2. Network Devices: Firewall, Switches, Routers 
  3. Database(s) presence and vulnerabilities 
  4. Physical  inspection of main server and workstation 
  5. Physical inspection of network devices: Firewall(s), switch, and router. 
 QOUTE
Web Application Analysis Total of 4 days: 3 days for testing, and one day for writing the detailed report. Manual and automatic scans will include:

  1. Core Defense Mechanisms 
  2. Web Application Technologies 
  3. Mapping the Application 
  4. Bypassing Client-Side Controls 
  5. Attaching Authentication 
  6. Attacking Session Management 
  7. Attacking Access Controls 
  8. Injecting Code
  9. Exploiting Path Traversal
  10. Attacking Application Logic
  11. Exploiting Information Disclosure
  12. Attacking the Web Server
 QOUTE
**Disaster Recovery(DR) and Business Continuity Plan(BCP) Total of 2 days: 1 day for gathering required information and 1 day writing the report. Manual and automatic scans will include:

  1. Procedures
  2. Backup policy
  3. Restore Policy
  4. UPS presence and configuration
  5. Mapping Critical Applications
 QOUTE
** Security Policies Total of 2 Days: 1 day for gathering required information and 1 day writing the report. This will include

  1. Drive Shares Policy
  2. File permissions
  3. User Rights Policy
  4. User Account Passwords Policy
  5. Adding or removing user account policy
  6. Servers and Workstation hardening policy
 QOUTE

*Recommended analysis
**Optional

We use specifically designed software to measure all risks on all systems across your organization. 2Secure Corp will show you which system has the highest risk, and what controls should be implemented. Our security experts check and analyze the following:

1. Access controls
2. Audit and monitoring
3. Enforce security policies
4. Vulnerability assessment

After our initial analysis, our experts will answer the following questions:

a. What are the inherent risks of every system? For example a specific system is crucial to the continual and efficient operation of the organization – however, it still presents a potential risk. Whereas, another system may be crucial, or not crucial, at all. Other inherent risks include sensitive data, the level of control exercised by the organization over the technological components and system users.

b. What levels of control are implemented throughout the organization? For example: what is the level of security is protecting the main device? What is the up-to-date information technology management policy?

c. What levels of controls are implemented throughout each system in the organization? For example: if a system is crucial to the organization’s operation, then a recovery policy will be put into operation in the event of a fatal crash.

  • Let us analyze and assess your systems any potential breaches before someone else does!
  • Just provide us with some basic information and we’ll run a free scan to uncover the hidden risks to your system.

We help in the following:

  • Network vulnerability assessments including servers, workstations and communication devices
  • Network vulnerability assessments including web applications, web servers and more
  • Wireless networks vulnerability assessments
  • Hardening wireless connections
  • Hardening Microsoft® Windows Active Directory
  • Hardening Microsoft® Windows – all versions
  • Hardening Microsoft® Exchange – all versions
  • Hardening Microsoft® IIS – all versions
  • Hardening Novell® Netware® 3.xx / 4.xx / 5.xx /6.xx
  • Installing and configuring Firewalls i.e: CheckPoint, and Astaro
  • Spam and virus protection on the corporate gateways
  • Auditing USB devices connected to the corporate PC’s
  • Secured networking design & implementation
  • Spam & virus removal
  • Secured Internet communications
  • Secured e-mail systems
  • Backup & recovery systems
  • Database Activity Monitoring

Questions?

  1. (required)
  2. (required)
  3. (valid email required)
  4. (valid email required)
  24. Captcha
 

Comments are closed.