Process-Based Security Testing in a Carrier Environment

Size: px
Start display at page:

Download "Process-Based Security Testing in a Carrier Environment"

Transcription

1 Process-Based Security Testing in a Carrier Environment Sven Weizenegger, Heikki Kortti

2 Introduction Sven Weizenegger T-Systems Lead of Security Testing and Senior Consultant Heikki Kortti Codenomicon Senior Security Specialist Sven Weizenegger, Heikki Kortti

3 Motivation Security Testing is not about Information Security It s about Business Security Robustness Testing is an integral part of Security Testing Robustness Testing is an integral part of Quality Assurance Robustness Testing is one of few modules for ISMS Sven Weizenegger, Heikki Kortti

4 Modern Security Testing Traditional security testing Vulnerability scanning Penetration testing / Ad-hoc hacking Security auditing Process improvements Secure Development Lifecycle (in its various incarnations) Methods for raising awareness Source code auditing and IDE integrated tools Robustness testing / fuzzing From known vulnerabilities to beating zero-days Sven Weizenegger, Heikki Kortti

5 From Ad-Hoc Hacking to Process-Based Security Testing Ad-hoc is only useful for short term projects Most ad-hoc testers have no QA background Ad-Hoc testers are not involved in every possible step of a development process Ad-Hoc testers are not involved in the operating phase Result: the scope/view is very limited Process-based security testing needs full management attention to change processes The result is much more better in a mid- and long-term view Sven Weizenegger, Heikki Kortti

6 Key Drivers, Goals and Challenges for Effective Security Testing Why is proactive security testing of equipment and networks is important for a carrier? Vendor/product comparisons Risk analysis and mitigation Decreased costs after deployment Challenges Shortage of security resources and expertise Wide variety of devices, protocols and interfaces Patch management after deployment Production systems are highly availability-critical Goal: Make sure your networks and systems are robust Sven Weizenegger, Heikki Kortti

7 Technological Demands for Test Tools in an Enterprise Context Software or hardware? Ease of use Availability Scalability Portability Coverage Performance Efficiency Reporting Reproducibility Sven Weizenegger, Heikki Kortti

8 Fuzzing as an Integral Part of a Modern Security Testing Process Fuzzing is an industry-proven, low-cost way of finding most bugs and reliability problems quickly Robustness testing: Deterministic, automated, modelbased fuzzing with ready-made test suites Most salient uses for robustness testing in a carrier environment: Product comparisons Acceptance testing Pre-deployment testing Can still be done post-deployment Risk analysis and mitigation Testing high availability systems and failover scenarios Sven Weizenegger, Heikki Kortti

9 Relationship of Security and Reliability in the Management Release Process Most Management Releases Processes are completely functional-testing orientated One main reason for initiate the process is a security incident Completely re-active, must changed into a pro-active strategy Only process orientated security testing ensures reliability Sven Weizenegger, Heikki Kortti

10 Problems with Executing Tests Remotely Across Sites Active security testing can be highly disruptive Typical results: crashes, reboots, slowdowns Production systems must remain available When tests are executed across networks, intermediate devices and networks may also be disrupted Proxies Firewalls Routers Example: Tunneling test traffic across an MPLS backbone Sven Weizenegger, Heikki Kortti

11 Designing Lab Infrastructure for a Distributed, Multi-Site Testing Process Setup of 64bit based Machines 8 CPUs, still upgradable 8 Network Interfaces, still upgradable Placed in every Lab with remote access No Fuzzing traffic goes over productive systems Sven Weizenegger, Heikki Kortti

12 Asset Classification and Testing Priorization Identity relevant assets Prioritization of tests Define a technical security testing framework Schedule timeframe Sven Weizenegger, Heikki Kortti

13 Asset Classification and Testing Priorization Definition of Testcases Example: GBS Requirements Example: IP Fuzzing

14 Metrics When has enough testing been done? What coverage metrics are useful for security testing? Attack surface coverage Input space coverage Priorization Time (or money) is never on the side of the security tester Any and all ways to decrease testing time and increase test coverage are absolutely essential Sven Weizenegger, Heikki Kortti

15 Sharing Results Across the Organization Test results need to be accessible and understandable to all interested parties Standard formats: XML, CSV, HTML, PDF Reporting for all levels in the organization Technical people need accurate data for analysis and remediation (including upstream reporting) Management wants to know summaries of test results, achieved coverage, and used resources Results must be archivable Collaboration is essential! Sven Weizenegger, Heikki Kortti

16 Future Challenges, Lessons Learned Rollout of security testing process across the organization Training personnel in tools & processes Process-based security testing can be integrated to a larger ISMS / ISO initiative Designing and deploying an ISMS in a large organization can take a while Priorization of testing, allocating proper resources, planning test infrastructure is all-important Awareness is usually the biggest challenge: understanding what security and security testing really are is extremely difficult! Sven Weizenegger, Heikki Kortti

17 Questions? Please send feedback & questions to: Thanks for listening! Sven Weizenegger, Heikki Kortti

Security Controls What Works. Southside Virginia Community College: Security Awareness

Security Controls What Works. Southside Virginia Community College: Security Awareness Security Controls What Works Southside Virginia Community College: Security Awareness Session Overview Identification of Information Security Drivers Identification of Regulations and Acts Introduction

More information

Application Security in the Software Development Lifecycle

Application Security in the Software Development Lifecycle Application Security in the Software Development Lifecycle Issues, Challenges and Solutions www.quotium.com 1/15 Table of Contents EXECUTIVE SUMMARY... 3 INTRODUCTION... 4 IMPACT OF SECURITY BREACHES TO

More information

with Managing RSA the Lifecycle of Key Manager RSA Streamlining Security Operations Data Loss Prevention Solutions RSA Solution Brief

with Managing RSA the Lifecycle of Key Manager RSA Streamlining Security Operations Data Loss Prevention Solutions RSA Solution Brief RSA Solution Brief Streamlining Security Operations with Managing RSA the Lifecycle of Data Loss Prevention and Encryption RSA envision Keys with Solutions RSA Key Manager RSA Solution Brief 1 Who is asking

More information

PLUMgrid Toolbox: Tools to Install, Operate and Monitor Your Virtual Network Infrastructure

PLUMgrid Toolbox: Tools to Install, Operate and Monitor Your Virtual Network Infrastructure Toolbox: Tools to Install, Operate and Monitor Your Virtual Network Infrastructure Introduction The concept of Virtual Networking Infrastructure (VNI) is disrupting the networking space and is enabling

More information

Four Top Emagined Security Services

Four Top Emagined Security Services Four Top Emagined Security Services. www.emagined.com Emagined Security offers a variety of Security Services designed to support growing security needs. This brochure highlights four key Emagined Security

More information

WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION

WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION WHITE PAPER AUTOMATED, REAL-TIME RISK ANALYSIS AND REMEDIATION Table of Contents Executive Summary...3 Vulnerability Scanners Alone Are Not Enough...3 Real-Time Change Configuration Notification is the

More information

THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols

THE TOP 4 CONTROLS. www.tripwire.com/20criticalcontrols THE TOP 4 CONTROLS www.tripwire.com/20criticalcontrols THE TOP 20 CRITICAL SECURITY CONTROLS ARE RATED IN SEVERITY BY THE NSA FROM VERY HIGH DOWN TO LOW. IN THIS MINI-GUIDE, WE RE GOING TO LOOK AT THE

More information

Vulnerability management lifecycle: defining vulnerability management

Vulnerability management lifecycle: defining vulnerability management Framework for building a vulnerability management lifecycle program http://searchsecurity.techtarget.com/magazinecontent/framework-for-building-avulnerability-management-lifecycle-program August 2011 By

More information

Managed Services. Business Intelligence Solutions

Managed Services. Business Intelligence Solutions Managed Services Business Intelligence Solutions Business Intelligence Solutions provides an array of strategic technology services for life science companies and healthcare providers. Our Managed Services

More information

Accelerating Software Security With HP. Rob Roy Federal CTO HP Software

Accelerating Software Security With HP. Rob Roy Federal CTO HP Software Accelerating Software Security With HP Rob Roy Federal CTO HP Software If we were in a cyberwar today, the United States would lose. Mike McConnell Former DNI, NSA. Head of Booz Allen Hamilton National

More information

Security-as-a-Service (Sec-aaS) Framework. Service Introduction

Security-as-a-Service (Sec-aaS) Framework. Service Introduction Security-as-a-Service (Sec-aaS) Framework Service Introduction Need of Information Security Program In current high-tech environment, we are getting more dependent on information systems. This dependency

More information

Vulnerability Management

Vulnerability Management Vulnerability Management Buyer s Guide Buyer s Guide 01 Introduction 02 Key Components 03 Other Considerations About Rapid7 01 INTRODUCTION Exploiting weaknesses in browsers, operating systems and other

More information

ensuring security the way how we do it

ensuring security the way how we do it ensuring security the way how we do it HUSTEF, 2015.11.18 Attila Tóth 1 Nokia Solutions and Networks 2014 Disclaimer The ideas, processes, tools are presented from a practitioner s point of view working

More information

Benefits of Test Automation for Agile Testing

Benefits of Test Automation for Agile Testing Benefits of Test Automation for Agile Testing Manu GV 1, Namratha M 2, Pradeep 3 1 Technical Lead-Testing Calsoft Labs, Bangalore, India 2 Assistant Professor, BMSCE, Bangalore, India 3 Software Engineer,

More information

IBM Rational AppScan: Application security and risk management

IBM Rational AppScan: Application security and risk management IBM Software Security November 2011 IBM Rational AppScan: Application security and risk management Identify, prioritize, track and remediate critical security vulnerabilities and compliance demands 2 IBM

More information

i Network, Inc Technology Solutions, Products & Services Providing the right information, to the right customer, at the right time.

i Network, Inc Technology Solutions, Products & Services Providing the right information, to the right customer, at the right time. Technology Solutions, Products & Services Providing the right information, to the right customer, at the right time. 2 Barry Brueseke (619) 401 7334 www.inetwork west.com 4/3/2014 IEEE Cyber Security Workshop

More information

7 Homeland. ty Grant Program HOMELAND SECURITY GRANT PROGRAM. Fiscal Year 2008

7 Homeland. ty Grant Program HOMELAND SECURITY GRANT PROGRAM. Fiscal Year 2008 U.S. D EPARTMENT OF H OMELAND S ECURITY 7 Homeland Fiscal Year 2008 HOMELAND SECURITY GRANT PROGRAM ty Grant Program SUPPLEMENTAL RESOURCE: CYBER SECURITY GUIDANCE uidelines and Application Kit (October

More information

BitDefender Security for Exchange

BitDefender Security for Exchange Quick Start Guide Copyright 2011 BitDefender 1. About This Guide This guide will help you install and get started with BitDefender Security for Exchange. For detailed instructions, please refer to the

More information

Managed Service Plans

Managed Service Plans Managed Service Plans www.linkedtech.com 989.837.3060 989.832.2802 fax Managed Information Technology Services System downtime, viruses, spy ware, losses of productivity Are the computer systems you rely

More information

Closing the Vulnerability Gap of Third- Party Patching

Closing the Vulnerability Gap of Third- Party Patching SOLUTION BRIEF: THIRD-PARTY PATCH MANAGEMENT........................................ Closing the Vulnerability Gap of Third- Party Patching Who should read this paper IT Managers who are trying to manage

More information

Network Configuration Management

Network Configuration Management Network Configuration Management Contents Abstract Best Practices for Configuration Management What is Configuration Management? FCAPS Configuration Management Operational Issues IT Infrastructure Library

More information

How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP

How to start a software security initiative within your organization: a maturity based and metrics driven approach OWASP How to start a software security initiative within your organization: a maturity based and metrics driven approach Marco Morana OWASP Lead/ TISO Citigroup OWASP Application Security For E-Government Copyright

More information

How PatchLink Meets the Top 10 Requirements for Enterprise Patch and Vulnerability Management. White Paper Sept. 2006

How PatchLink Meets the Top 10 Requirements for Enterprise Patch and Vulnerability Management. White Paper Sept. 2006 How PatchLink Meets the Top 10 Requirements for Enterprise Patch and Vulnerability Management White Paper Sept. 2006 Introduction It happens, five, ten, twenty times a month: A hardware or software vendor

More information

SANS Top 20 Critical Controls for Effective Cyber Defense

SANS Top 20 Critical Controls for Effective Cyber Defense WHITEPAPER SANS Top 20 Critical Controls for Cyber Defense SANS Top 20 Critical Controls for Effective Cyber Defense JANUARY 2014 SANS Top 20 Critical Controls for Effective Cyber Defense Summary In a

More information

Prevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management

Prevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management Prevent cyber attacks. SEE what you are missing. See Your Network MAP. Prevent Cyber Attacks. Driven by the need to support evolving business objectives, enterprise IT infrastructures have grown increasingly

More information

Cisco Advanced Services for Network Security

Cisco Advanced Services for Network Security Data Sheet Cisco Advanced Services for Network Security IP Communications networking the convergence of data, voice, and video onto a single network offers opportunities for reducing communication costs

More information

WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK

WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK WHITE PAPER ON SECURITY TESTING IN TELECOM NETWORK DATE OF RELEASE: 27 th July 2012 Table of Contents 1. Introduction... 2 2. Need for securing Telecom Networks... 3 3. Security Assessment Techniques...

More information

<cloud> Secure Hosting Services

<cloud> Secure Hosting Services Global Resources... Local Knowledge Figtree offers the functionality of Figtree Systems Software without the upfront infrastructure investment. It is the preferred deployment solution for organisations

More information

BEST PRACTICES. Systems Management. www.kaspersky.com

BEST PRACTICES. Systems Management. www.kaspersky.com BEST PRACTICES www.kaspersky.com 2 YOUR GUIDE TO SYSTEMS MANAGEMENT BEST PRACTICES. Enhance security and manage complexity using centralized IT management tools. Unpatched vulnerabilities in popular applications

More information

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 616 Securing Windows Infrastructure. Make The Difference CAST.

EC-Council CAST CENTER FOR ADVANCED SECURITY TRAINING. CAST 616 Securing Windows Infrastructure. Make The Difference CAST. CENTER FOR ADVANCED SECURITY TRAINING 616 Securing Windows Infrastructure Make The Difference About Center of Advanced Security Training () The rapidly evolving information security landscape now requires

More information

Prevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management

Prevent cyber attacks. SEE. what you are missing. Netw rk Infrastructure Security Management Prevent cyber attacks. SEE what you are missing. See Your Network MAPS. Prevent cyber attacks. [RedSeal] is meeting our expectations and is playing an integral role as it feeds right into our overall risk

More information

NERC Cyber Security. Compliance Consulting. Services. HCL Governance, Risk & Compliance Practice

NERC Cyber Security. Compliance Consulting. Services. HCL Governance, Risk & Compliance Practice NERC Cyber Security Compliance Consulting Services HCL Governance, Risk & Compliance Practice Overview The North American Electric Reliability Corporation (NERC) is a nonprofit corporation designed to

More information

INFORMATION SECURITY TRAINING CATALOG (2015)

INFORMATION SECURITY TRAINING CATALOG (2015) INFORMATICS AND INFORMATION SECURITY RESEARCH CENTER CYBER SECURITY INSTITUTE INFORMATION SECURITY TRAINING CATALOG (2015) Revision 3.0 2015 TÜBİTAK BİLGEM SGE Siber Güvenlik Enstitüsü P.K. 74, Gebze,

More information

MSP End User. Version 3.0. Technical Solution Guide

MSP End User. Version 3.0. Technical Solution Guide MSP End User Version 3.0 Technical Solution Guide N-Compass Remote Networking Monitoring Architecture How Does N-Compass Help Small & Medium Businesses? Proactive IT management The ability to do predictive

More information

Security Management. Keeping the IT Security Administrator Busy

Security Management. Keeping the IT Security Administrator Busy Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching

More information

How To Test For Security On A Network Without Being Hacked

How To Test For Security On A Network Without Being Hacked A Simple Guide to Successful Penetration Testing Table of Contents Penetration Testing, Simplified. Scanning is Not Testing. Test Well. Test Often. Pen Test to Avoid a Mess. Six-phase Methodology. A Few

More information

PCI-DSS Penetration Testing

PCI-DSS Penetration Testing PCI-DSS Penetration Testing Adam Goslin, Co-Founder High Bit Security May 10, 2011 About High Bit Security High Bit helps companies obtain or maintain their PCI compliance (Level 1 through Level 4 compliance)

More information

Why should I care about PDF application security?

Why should I care about PDF application security? Why should I care about PDF application security? What you need to know to minimize your risk Table of contents 1: Program crashes present an opportunity for attack 2: Look for software that fully uses

More information

GETTING THE MOST FROM THE CLOUD. A White Paper presented by

GETTING THE MOST FROM THE CLOUD. A White Paper presented by GETTING THE MOST FROM THE CLOUD A White Paper presented by Why Move to the Cloud? CLOUD COMPUTING the latest evolution of IT services delivery is a scenario under which common business applications are

More information

Configuring Advanced Windows Server 2012 Services

Configuring Advanced Windows Server 2012 Services Course 20412D: Configuring Advanced Windows Server 2012 Services Course Details Course Outline Module 1: Implementing Advanced Network Services In this module students will be able to configure advanced

More information

Guideline on Auditing and Log Management

Guideline on Auditing and Log Management CMSGu2012-05 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Auditing and Log Management National Computer Board Mauritius

More information

Acano solution. Security Considerations. August 2015 76-1026-01-E

Acano solution. Security Considerations. August 2015 76-1026-01-E Acano solution Security Considerations August 2015 76-1026-01-E Contents Contents 1 Introduction... 3 2 Acano Secure Development Lifecycle... 3 3 Acano Security Points... 4 Acano solution: Security Consideration

More information

Using Skybox Solutions to Achieve PCI Compliance

Using Skybox Solutions to Achieve PCI Compliance Using Skybox Solutions to Achieve PCI Compliance Achieve Efficient and Effective PCI Compliance by Automating Many Required Controls and Processes Skybox Security whitepaper August 2011 1 Executive Summary

More information

Using Skybox Solutions to Ensure PCI Compliance. Achieve efficient and effective PCI compliance by automating many required controls and processes

Using Skybox Solutions to Ensure PCI Compliance. Achieve efficient and effective PCI compliance by automating many required controls and processes Using Skybox Solutions to Ensure PCI Compliance Achieve efficient and effective PCI compliance by automating many required controls and processes WHITEPAPER Executive Summary The Payment Card Industry

More information

Integrating Web Application Security into the IT Curriculum

Integrating Web Application Security into the IT Curriculum Integrating Web Application Security into the IT Curriculum James Walden Northern Kentucky University Topics 1. 2. 3. 4. Why should we teach web application security? What material do we need to cover?

More information

How To Ensure The C.E.A.S.A

How To Ensure The C.E.A.S.A APPENDI 3 TO SCHEDULE 3.3 TO THE COMPREHENSIVE INFRASTRUCTURE AGREEMENT APPENDI 3 TO SCHEDULE 3.3 TO THE COMPREHENSIVE INFRASTRUCTURE AGREEMENT TUGeneral TUSecurity TURequirements TUDesign TUIntegration

More information

Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping

Larry Wilson Version 1.0 November, 2013. University Cyber-security Program Critical Asset Mapping Larry Wilson Version 1.0 November, 2013 University Cyber-security Program Critical Asset Mapping Part 3 - Cyber-Security Controls Mapping Cyber-security Controls mapped to Critical Asset Groups CSC Control

More information

Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD

Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD Vulnerability Management in Software: Before Patch Tuesday KYMBERLEE PRICE BUGCROWD whoami? Senior Director of a Red Team PSIRT Case Manager Data Analyst Internet Crime Investigator Security Evangelist

More information

State of Oregon. State of Oregon 1

State of Oregon. State of Oregon 1 State of Oregon State of Oregon 1 Table of Contents 1. Introduction...1 2. Information Asset Management...2 3. Communication Operations...7 3.3 Workstation Management... 7 3.9 Log management... 11 4. Information

More information

Introduction Jim Rowland, Senior System Architect and Project Manager Daly

Introduction Jim Rowland, Senior System Architect and Project Manager Daly Introduction Jim Rowland, Senior System Architect and Project Manager Daly Stepping Up to Enterprise Vulnerability Management Keren Cummins, Director, Federal and MidAtlantic Markets ncircle Presentation

More information

ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001

ETHICAL HACKING 010101010101APPLICATIO 00100101010WIRELESS110 00NETWORK1100011000 101001010101011APPLICATION0 1100011010MOBILE0001010 10101MOBILE0001 001011 1100010110 0010110001 010110001 0110001011000 011000101100 010101010101APPLICATIO 0 010WIRELESS110001 10100MOBILE00010100111010 0010NETW110001100001 10101APPLICATION00010 00100101010WIRELESS110

More information

MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014

MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014 MONITORING AND VULNERABILITY MANAGEMENT PCI COMPLIANCE JUNE 2014 COMPLIANCE SCHEDULE REQUIREMENT PERIOD DESCRIPTION REQUIREMENT PERIOD DESCRIPTION 8.5.6 As Needed 11.1 Monthly 1.3 Quarterly 1.1.6 Semi-Annually

More information

NetAid Services NETENRICH. Service at a Glance. IT as a Service Offering from NetEnrich. Delivering IT as a Service

NetAid Services NETENRICH. Service at a Glance. IT as a Service Offering from NetEnrich. Delivering IT as a Service Service at a Glance The NetAid service focus goes beyond mere monitoring of network infrastructure to preventative maintenance and proactive intervention. This could be a solution for IT managers who want

More information

HEAT DSM 2015.2 Release Overview. Andreas Fuchs Product Management November 16th, 2015

HEAT DSM 2015.2 Release Overview. Andreas Fuchs Product Management November 16th, 2015 HEAT DSM 2015.2 Release Overview Andreas Fuchs Product Management November 16th, 2015 HEAT DSM 2015.2 Highlights HEAT Discovery Integration Patch Management Enhancements HEAT PatchLink Integration HEAT

More information

CH ENSA EC-Council Network Security Administrator Detailed Course Outline

CH ENSA EC-Council Network Security Administrator Detailed Course Outline CH ENSA EC-Council Network Security Administrator Detailed Course Outline Summary Duration Vendor Audience 5 Days hands-on training EC-Council Security Professionals Level Technology Category Advance Ethical

More information

Operationalizing Application Security & Compliance

Operationalizing Application Security & Compliance IBM Software Group Operationalizing Application Security & Compliance 2007 IBM Corporation What is the cost of a defect? 80% of development costs are spent identifying and correcting defects! During the

More information

8 Steps for Network Security Protection

8 Steps for Network Security Protection 8 Steps for Network Security Protection cognoscape.com 8 Steps for Network Security Protection Many small and medium sized businesses make the mistake of thinking they won t be the target of hackers because

More information

Patch Management. Module 13. 2012 VMware Inc. All rights reserved

Patch Management. Module 13. 2012 VMware Inc. All rights reserved Patch Management Module 13 You Are Here Course Introduction Introduction to Virtualization Creating Virtual Machines VMware vcenter Server Configuring and Managing Virtual Networks Configuring and Managing

More information

Cisco Unified Communications Remote Management Services

Cisco Unified Communications Remote Management Services Cisco Unified Communications Remote Management Services What You Will Learn Our remote, high-visibility, co-management approach gives you complete ownership and control of your converged network. Cisco

More information

HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security

HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security HP Fortify Application Security Lucas v. Stockhausen PreSales Manager HP Fortify EMEA lvonstockhausen@hp.com +49 1520 1898430 Enterprise Security The problem Cyber attackers are targeting applications

More information

8 Steps For Network Security Protection

8 Steps For Network Security Protection 8 Steps For Network Security Protection 8 Steps For Network Security Protection Many small and medium sized businesses make the mistake of thinking they won t be the target of hackers because of their

More information

ECRC Privacy and Security Subcommittee, DTC and TIF-S Recommendations for Five Central Security Program Initiatives

ECRC Privacy and Security Subcommittee, DTC and TIF-S Recommendations for Five Central Security Program Initiatives ECRC Privacy and Security Subcommittee, DTC and TIF-S Recommendations for Five Central Security Program Initiatives ECRC Subcommittee Web Application Vulnerability Scanning DTC (6/1/0) TIF (23/3/0) All

More information

Critical Controls for Cyber Security. www.infogistic.com

Critical Controls for Cyber Security. www.infogistic.com Critical Controls for Cyber Security www.infogistic.com Understanding Risk Asset Threat Vulnerability Managing Risks Systematic Approach for Managing Risks Identify, characterize threats Assess the vulnerability

More information

Cloud A Practitioner Prakat Solutions

Cloud A Practitioner Prakat Solutions Demystifying the Cloud A Practitioner s Perspective Prakat Solutions Contents Introductions Impacts of Cloud Adoption Other Side of the Cloud Key Business Drivers Testing, Continuous Integration and Production

More information

NEXPOSE ENTERPRISE METASPLOIT PRO. Effective Vulnerability Management and validation. March 2015

NEXPOSE ENTERPRISE METASPLOIT PRO. Effective Vulnerability Management and validation. March 2015 NEXPOSE ENTERPRISE METASPLOIT PRO Effective Vulnerability Management and validation March 2015 KEY SECURITY CHALLENGES Common Challenges Organizations Experience Key Security Challenges Visibility gaps

More information

Adobe Systems Incorporated

Adobe Systems Incorporated Adobe Connect 9.2 Page 1 of 8 Adobe Systems Incorporated Adobe Connect 9.2 Hosted Solution June 20 th 2014 Adobe Connect 9.2 Page 2 of 8 Table of Contents Engagement Overview... 3 About Connect 9.2...

More information

SCOPING QUESTIONNAIRE FOR PENETRATION TESTING

SCOPING QUESTIONNAIRE FOR PENETRATION TESTING SCOPING QUESTIONNAIRE FOR PENETRATION TESTING PathMaker Group adheres to the OSSTMM penetration testing methodology and code of ethics regarding this level and classification of test. The analysts performing

More information

SINGLE COURSE. 136 Total Hours. After completing this course, students will be able to:

SINGLE COURSE. 136 Total Hours. After completing this course, students will be able to: NH204-1314 Designing and Implementing Server Infrastructure 136 Total Hours COURSE TITLE: Designing and Implementing Server Infrastructure COURSE OVERVIEW: After completing this course, students will be

More information

Autodesk PLM 360 Security Whitepaper

Autodesk PLM 360 Security Whitepaper Autodesk PLM 360 Autodesk PLM 360 Security Whitepaper May 1, 2015 trust.autodesk.com Contents Introduction... 1 Document Purpose... 1 Cloud Operations... 1 High Availability... 1 Physical Infrastructure

More information

Software Development: The Next Security Frontier

Software Development: The Next Security Frontier James E. Molini, CISSP, CSSLP Microsoft Member, (ISC)² Advisory Board of the Americas jmolini@microsoft.com http://www.codeguard.org/blog Software Development: The Next Security Frontier De-perimiterization

More information

CounselorMax and ORS Managed Hosting RFP 15-NW-0016

CounselorMax and ORS Managed Hosting RFP 15-NW-0016 CounselorMax and ORS Managed Hosting RFP 15-NW-0016 Posting Date 4/22/2015 Proposal submission deadline 5/15/2015, 5:00 PM ET Purpose of the RFP NeighborWorks America has a requirement for managed hosting

More information

Guideline on Vulnerability and Patch Management

Guideline on Vulnerability and Patch Management CMSGu2014-03 Mauritian Computer Emergency Response Team CERT-MU SECURITY GUIDELINE 2011-02 Enhancing Cyber Security in Mauritius Guideline on Vulnerability and Patch Management National Computer Board

More information

Certified Information Systems Auditor (CISA)

Certified Information Systems Auditor (CISA) Certified Information Systems Auditor (CISA) Course Introduction Course Introduction Module 01 - The Process of Auditing Information Systems Lesson 1: Management of the Audit Function Organization of the

More information

Cohesion Managed Services

Cohesion Managed Services Cohesion It is s objective to deliver, through its Cohesion managed & hosted services portfolio, the kind of business cohesion that IT managers dream of, but never imagine they can afford. The services

More information

Integrating Application Security into the Mobile Software Development Lifecycle. WhiteHat Security Paper

Integrating Application Security into the Mobile Software Development Lifecycle. WhiteHat Security Paper Integrating Application Security into the Mobile Software Development Lifecycle WhiteHat Security Paper Keeping pace with the growth of mobile According to the November 2015 edition of the Ericsson Mobility

More information

Managing and Maintaining Windows Server 2008 Servers

Managing and Maintaining Windows Server 2008 Servers Managing and Maintaining Windows Server 2008 Servers Course Number: 6430A Length: 5 Day(s) Certification Exam There are no exams associated with this course. Course Overview This five day instructor led

More information

Scalability in Log Management

Scalability in Log Management Whitepaper Scalability in Log Management Research 010-021609-02 ArcSight, Inc. 5 Results Way, Cupertino, CA 95014, USA www.arcsight.com info@arcsight.com Corporate Headquarters: 1-888-415-ARST EMEA Headquarters:

More information

state of south dakota Bureau of Information & Telecommunications Provide a Reliable, Secure & Modern Infrastructure services well-designed innovative

state of south dakota Bureau of Information & Telecommunications Provide a Reliable, Secure & Modern Infrastructure services well-designed innovative Strategic Plan 2015-2017 state of south dakota Bureau of Information & Telecommunications 1GOAL ONE: Provide a Reliable, Secure & Modern Infrastructure services security technology assets well-designed

More information

See all, manage all is the new mantra at the corporate workplace today.

See all, manage all is the new mantra at the corporate workplace today. See all, manage all is the new mantra at the corporate workplace today. 1) Do you want to schedule backups, software updates using just one consistent automation platform? 2) Do you want a product that

More information

Der Weg, wie die Verantwortung getragen werden kann!

Der Weg, wie die Verantwortung getragen werden kann! Managed Security Services Der Weg, wie die Verantwortung getragen werden kann! Christoph Altherr System Engineer Security 2008 Cisco Systems, Inc. All rights reserved. Cisco Public 1 Agenda Enterprise

More information

Application Performance Management

Application Performance Management Application Performance Management Intelligence for an Optimized WAN xo.com Application Performance Management Intelligence for an Optimized WAN Contents Abstract 3 Introduction 3 Business Drivers for

More information

A Strategic Approach to Web Application Security The importance of a secure software development lifecycle

A Strategic Approach to Web Application Security The importance of a secure software development lifecycle A Strategic Approach to Web Application Security The importance of a secure software development lifecycle Rachna Goel Technical Lead Enterprise Technology Web application security is clearly the new frontier

More information

PATCH MANAGEMENT. February 2008. The Government of the Hong Kong Special Administrative Region

PATCH MANAGEMENT. February 2008. The Government of the Hong Kong Special Administrative Region PATCH MANAGEMENT February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

More information

MANAGED FIREWALL SERVICE. Service definition

MANAGED FIREWALL SERVICE. Service definition MANAGED FIREWALL SERVICE Service definition Page 1 of 4 Version 1.2 (03/02/2015) NSMS Managed Firewalls Service Definition Understanding of a firewall service The function of any firewall service is to

More information

Peach Fuzzer Platform

Peach Fuzzer Platform Fuzzing is a software testing technique that introduces invalid, malformed, or random data to parts of a computer system, such as files, network packets, environment variables, or memory. How the tested

More information

A 123Together.com White Paper. Microsoft Exchange Server: To Outsource Or Not To Outsource The affordable way to bring Exchange to your company.

A 123Together.com White Paper. Microsoft Exchange Server: To Outsource Or Not To Outsource The affordable way to bring Exchange to your company. Microsoft Exchange Server: To Outsource Or Not To Outsource The affordable way to bring Exchange to your company. Table of Contents Introduc on... 3 Microso Exchange Server Delivers Value Your Company

More information

The Protection Mission a constant endeavor

The Protection Mission a constant endeavor a constant endeavor The IT Protection Mission a constant endeavor As businesses become more and more dependent on IT, IT must face a higher bar for preparedness Cyber preparedness is the process of ensuring

More information

Managing Vulnerabilities for PCI Compliance White Paper. Christopher S. Harper Managing Director, Agio Security Services

Managing Vulnerabilities for PCI Compliance White Paper. Christopher S. Harper Managing Director, Agio Security Services Managing Vulnerabilities for PCI Compliance White Paper Christopher S. Harper Managing Director, Agio Security Services PCI STRATEGY Settling on a PCI vulnerability management strategy is sometimes a difficult

More information

Cloud Security Specialist Certification Self-Study Kit Bundle

Cloud Security Specialist Certification Self-Study Kit Bundle Cloud Security Specialist Certification Bundle CloudSchool.com CLOUD CERTIFIED Technology Professional This certification bundle provides you with the self-study materials you need to prepare for the exams

More information

HP Application Security Center

HP Application Security Center HP Application Security Center Web application security across the application lifecycle Solution brief HP Application Security Center helps security professionals, quality assurance (QA) specialists and

More information

I D C A N A L Y S T C O N N E C T I O N

I D C A N A L Y S T C O N N E C T I O N I D C A N A L Y S T C O N N E C T I O N Robert Westervelt Research Manager, Security Products T h e R o l e a nd Value of Continuous Security M o nitoring August 2015 Continuous security monitoring (CSM)

More information

ESKISP6055.01 Manage security testing

ESKISP6055.01 Manage security testing Overview This standard covers the competencies concerning with managing security testing activities. Including managing resources activities and deliverables. This includes planning, conducting and reporting

More information

Learn Ethical Hacking, Become a Pentester

Learn Ethical Hacking, Become a Pentester Learn Ethical Hacking, Become a Pentester Course Syllabus & Certification Program DOCUMENT CLASSIFICATION: PUBLIC Copyrighted Material No part of this publication, in whole or in part, may be reproduced,

More information

Application Code Development Standards

Application Code Development Standards Application Code Development Standards Overview This document is intended to provide guidance to campus system owners and software developers regarding secure software engineering practices. These standards

More information

ISS X-Force. IBM Global Services. Angel NIKOLOV Country Manager BG, CZ, HU, RO and SK IBM Internet Security Systems

ISS X-Force. IBM Global Services. Angel NIKOLOV Country Manager BG, CZ, HU, RO and SK IBM Internet Security Systems IBM Global Services ISS X-Force Angel NIKOLOV Country Manager BG, CZ, HU, RO and SK IBM Internet Security Systems Internet Security Systems, an IBM Company Security Market Overview Companies face sophisticated

More information

CORE Security and the Payment Card Industry Data Security Standard (PCI DSS)

CORE Security and the Payment Card Industry Data Security Standard (PCI DSS) CORE Security and the Payment Card Industry Data Security Standard (PCI DSS) Addressing the PCI DSS with Predictive Security Intelligence Solutions from CORE Security CORE Security +1 617.399-6980 info@coresecurity.com

More information

10 BenefIts. that only an Integrated platform security solution can BrIng

10 BenefIts. that only an Integrated platform security solution can BrIng If It s not KaspersKy endpoint security for BusIness, It s not an endpoint protection platform 10 BenefIts that only an Integrated platform security solution can BrIng Kaspersky Lab s Global IT Security

More information

IT INFRASTRUCTURE MANAGEMENT SERVICE ADDING POWER TO YOUR NETWORKS

IT INFRASTRUCTURE MANAGEMENT SERVICE ADDING POWER TO YOUR NETWORKS IT INFRASTRUCTURE MANAGEMENT SERVICE ADDING POWER TO YOUR NETWORKS IT INFRASTRUCTURE MANAGEMENT SERVICES Nortech Remote management IT security Services provide around clock remote Management, real time

More information