NTA's external security services
NTA Monitor's RM Vulnerability Test provides a detailed examination of Internet connections and hosted web servers to identify all systems visible from the Internet. All systems found are thoroughly tested for configuration, operating system and software vulnerabilities. All security issues found are detailed in a formal report and recommendations are provided to enable the customer to eliminate or mitigate the risk, thus greatly reducing the likelihood of a successful attack.
NTA Monitor's Web Application Test provides a thorough security assessment of web-based applications, including business-to-business, consumer focussed and remote access systems. The objective is to ensure that the application is securely configured, thus preventing an attacker from gaining access, or a user being exposed, to confidential data, another user's account or the back end database. A key focus is a review of data sanitisation controls, including checks for Cross-Site Scripting and SQL injection vulnerabilities.
The PCI DSS requires that systems handling cardholder data, plus any Internet facing IPs that are adjacent to these systems, be scanned for vulnerabilities. These scans must be performed by a PCI Approved Scanning Vendor (ASV) such as NTA. Please contact us to find out how we can help you to achieve PCI compliance.
The objective of performing the IPSec VPN Security Test is to determine as much information as possible about the configuration and security of the target VPN server and to establish if it is possible to gain access to the network through this device. The VPN client can also be tested to assess the threat presented to internal network by a normal remote user and by someone who has stolen or gained unauthorised access to a client.
NTA's SSL VPN Security Test examines the security of this key remote access system by testing the server from an authenticated and unauthenticated perspective. It is also recommended that the security of the client laptop be reviewed.
NTA's Webmail Security Test examines the Outlook Web Access system for vulnerabilities that that may allow an unauthorised user to access internal mail records, monitor mail traffic or perform a Denial of Service attack against the mail system.
NTA would provide a combination of external and internal testing and auditing in order to assess the security of this system in full. The external test would seek to identify vulnerabilities or misconfigurations that could allow an attacker to steal or destroy information, damage or disable systems or traverse across systems without appropriate credentials. The onsite test and audit would determine if a Citrix connection is secured using best practice techniques.
The Wireless Infrastructure Test identifies, tests and audits any access points located within the customer's physical site, to establish if it is possible to gain access to the network via these devices. The service consists of five modules, allowing for the service to be tailored to individual requirements.
The War Dialling service dials each phone extension within an organisation�s PBX range to identify any numbers that respond as a modem. This allows organisations to discover whether any unauthorised modems have been installed that may provide a back-door entry point into the network. Limited testing of the modems identified is also performed.
The objective of this service is to provide an assessment of the configuration and security of the system and to determine if the corporate voice and data networks are exposed to threats as a result of implementing the VoIP network.
When performing this service, NTA Monitor would follow a non-exploitative philosophy and would seek to cover areas including phone booting protocols, network/switching attacks and VLAN attacks. The servers that provide call set-up and/or routing would also be tested, as well as the firewalls that pass the VoIP traffic.
A security assessment of a BlackBerry deployment would consist of a best practice audit and policy review of the Blackberry Enterprise Server (BES), including checks to see how well such policy is being enforced and a review of the security architecture and topology.
The security review would also involve an examination of a BlackBerry mobile device to determine to what degree user options have been limited in order to maximise security.
It can be useful to assess the security of a standard build laptop in order to assess what information can be gained, such as VPN log on details and information about the internal network, in the event that a laptop was stolen or lost.
Initially, NTA would perform testing from an unauthenticated 'black box' perspective and attempt to bypass or crack the boot encryption and protection mechanisms of the laptop or the Windows authentication. NTA will then examine the security of the laptop from an authenticated 'white box' perspective, having gained access either through the above methods or through using a set of authentication details provided by the custoner.
The objective of the Social Engineering service is to determine what vulnerabilities, such as weak physical or procedural controls, exist that may allow unauthorised access to the target network. Whereas technical vulnerabilities such as insecure software version or weak encryption are sought out by vulnerability testing, this service focuses on identifying weaknesses through social interaction with employees of the organisation.
The IT Health Check Service, or CHECK, was developed to enhance the availability and quality of the IT Health Check services that are provided to government in line with HMG policy. Companies belonging to CHECK are measured against high standards set by CESG. IT Health Checks identify vulnerabilities in IT systems and networks which may compromise the confidentiality, integrity or availability of information held on that IT system.
NTA is a founder member of the CHECK scheme and has continually maintained the highest 'Green' level of accreditation. Please contact NTA to discuss your IT Health Check requirements.