locuz.com Professional Services Security Audit Services

locuz.com

Security Audit Services

Today’s Security Landscape

“Today, over 80% of attacks against a company’s network come at the ‘Application Layer’ not the Network or System layer.”

Immunity against security threats is becoming one of the leading challenges for Enterprise

community. The race to “go online” and develop competitive services are enabling enterprise communities to launch web applications rapidly with less attention to security risk’s making the sites vulnerable. Interestingly many corporate sites are vulnerable to hackers in touch of a button. Locuz follows complete, established and highly effective methodology to help organizations across various verticals address the vulnerabilities and improve their security posture.

Today's security challenges require a fresh look at connectivity and its related security from a fundamental, architectural, perspective.

Locuz is

CERT-In empanelled

IT Security Auditor

Internal and external threat environment not improving

Attacks becoming more targeted and financially motivated

Attacks becoming more sophisticated, targeting applications as well as networks Organized criminal gangs taking over from teenage hackers and "script kiddies" Base II, Sarbanes-Oxiey, HIPAA, SEC, PCI

DSS etc…

Shareholder Value Brand and Reputation

Dynamic Threat Environment

Regulations / Compliance

Security Services Framework

Our security services comprises of processes and technologies that provide secure access to your business applications and new endpoints.

Security Services Portfolio

BUSINESS GOALS & OBJECTIVES

VISIBILITY CONTROL Identity & Access Mgmt Active Monitoring Corelation & Analysis Isolation & Remediation Policy Enforceme nt

CONFIDENTIALITY INTEGRITY AVAILABILITY

SECURITY POLICY Risk Assessment Security Operations Hardening Infrastructure & Network Security

Governance, Risk & Compliance

Cloud Security

BCP

Identity & Access Management / Single Sign-On

Security Information & Event Management (SIEM)

Mobile Security

Security Posture Assessment (VA / PT) Security Operations Center (SOC)

Data Loss Prevention (DLP)

Security Audit Methodology

We indeed integrate the best security testing practices of the industry conforming to Information Security compliance standards and our commitment to ensure the highest possible confidentiality. Every activity is performed only after identifying the complete architecture of the network and its complexity.

The steps followed in the Audit process are given below:

Preparation: Identifying critical areas to perform the audit

Scanning: Understand the organizational processes, complexity and technical

configurations of the Infrastructure

Enumeration: Collection of network resources and understand the active connections to

systems and direct queries

Vulnerability Analysis: Understand the vulnerabilities and impact on information such as

web applications variables, etc…

Documentation: Documentation of information and provide scanned reports on the

vulnerabilities and impact.

1

Field tested methodologies based on standards and proven frameworks Strategic Technology Alliances with Security Vendors

End-to-End Security Consulting, Deployment & Management SOC Service Provider

Value Proposition

CERT-In Empaneled Auditor

Best of class Certified Ethical Hackers & Security Specialists

Combination of State-of-the-art tools Insightful Reports

Deep Domain knowledge (Industry Regulations, Compliance needs etc)

What we do?

Vulnerability Assessment & Penetration Testing

Vulnerability Assessment Penetration Testing

Testing Scope Scans for all potential

network vulnerabilities. Identifies vulnerabilities and determines if they can actually be exploited. Vulnerability Relevance Categorizes vulnerabilities

based on standardized, theoretical information - not customized to the tested network.

Tests vulnerabilities on specific network resources, enabling prioritization of remediation efforts. Usefulness of Test Results Provides false positives,

identifying vulnerabilities that cannot be exploited.

Exploits vulnerabilities, identifying only those that pose actual threats to network resources. Network Connection

Testing Does not address connections between network components.

Exploits trust relationships between network

components to demonstrate actual attack paths.

Remediation Assistance Delivers long lists of vulnerabilities, limiting remediation options to widespread patching.

Assesses the potential risks of specific vulnerabilities, allowing users to patch only what is necessary and to test the effectiveness of patches and other mitigation

strategies, such as intrusion prevention.

Testing of Other Security

Investments Does not simulate attacks to test IDS, IPS or other security technologies.

Launches real-world attacks to determine if other security investments are functioning properly.

Security Risk Assessment Only identifies missing patches, making it impossible to truly assess security risks.

Safely mimics the actions of a hackers and worms,

providing risk evaluations based on tangible network threats.

Web Application Testing

Test Category Test Types Web App Testing

Authentication

Brute Force Yes Insufficient Authentication Yes Weak Password Recovery Validation Yes Authorization

Credential/Session Prediction Yes Insufficient Authorization Yes Insufficient Session Expiration Yes Session Fixation In-depth Logical Attacks

Abuse of Functionality In-depth Denial of Service Yes Insufficient Anti-Automation Yes Insufficient Process Validation Yes Client- Side Attacks

Content Spoofing Yes Cross Site Scripting In-depth CGI Scripting Extensive, Including

application specific

Command Execution

Buffer Overflow Yes Format String In-depth LDAP Injection Yes OS Commanding Yes SQL Injection In-depth SSI injection Yes Information Disclosure

Directory Indexing Yes Path Traversal Yes Predictable Resource Location Yes Information Leakage In-depth

System Vulnerability Check

ICMP Checks Yes Windows NT Checks Yes TCP & UDP Port Tests Yes Stealth testing Yes DNS Spoofing Yes RPC testing Yes Initial Sequence Number Prediction Yes FTP abuse checks Yes SMTP relay checks (spam) Yes LDAP checks Yes SNMP checks Yes DNS and bind checks Yes SMB/ NetBIOS checks Yes NFS checks Yes NIS checks Yes WHOIS checks Yes Domain checks Yes Spoofing checks Yes

locuz.com

About Locuz

Locuz is an IT Infrastructure Solutions and Services company focused on helping enterprises transform their businesses thru innovative and optimal use of technology. Our strong team of specialists, help address the challenge of deploying & managing complex IT Infrastructure in the face of rapid technological change.

Apart from providing a wide range of advisory, implementation & managed IT services, Locuz has built innovative platforms in the area of Hybrid Cloud Orchestration, High Performance Computing & Software Asset Analytics. These products have been successfully deployed in leading enterprises and we are helping customers extract greater RoI from their IT Infrastructure assets & investments.

Security Audit Services