BlackBerry External Infrastructure Penetration Testing Service

Transcription

1 BlackBerry External Infrastructure Penetration Testing Service This document includes all attached Annexes, is provided for informational purposes only, and does not in itself constitute a binding legal document. BlackBerry assumes no responsibility for any typographical, technical or other inaccuracies in this document. BlackBerry reserves the right to periodically change information that is contained in this document; however, BlackBerry makes no commitment to provide any such changes, updates, enhancements or other additions to this document to you in a timely manner or at all.

2 Introduction An External Infrastructure penetration test checks the entire exterior of a client infrastructure (i.e. anything that connects to the internet), using a variety of attack methods. The purpose of the test is to learn more about the External Infrastructure security status, and gain intelligence into mitigating potential threats before harm is done. External Infrastructure assessments help provide assurance that a network is safe from external threats as breaches of external networks can result in significant loss of data. External Infrastructure security testing should be part of any organizations risk assessment phase prior to changing or launching any new live services. BlackBerry can provide scheduled monthly External Infrastructure penetration testing services to a client to ensure their entire exterior is secure on an ongoing basis. Pre-Requisites The following pre-requisites are required from the client Confirmation of the target IP addresses Written permission from hosting company to perform the testing (if not hosted by the client) Point of Contact details Deliverables In-depth report, broken down into 3 main parts Management Summary Technical Overview Detailed Technical Findings Highlighting the vulnerabilities Type of RISK The EFFECT of that RISK Full details on how to fix ALL vulnerabilities Estimate of working hours required to FIX any RISKS itentified

3 Scope of Work - External In Depth Penetration Testing In depth penetration testing of firewalls and all identifiable services. Testing will be performed over the internet from BlackBerry offices. Method will be Black Box and testing is not intended to cause any interruption to services. Testing will begin with fingerprinting the IT infrastructure and services followed by manual exploitation with a full review of the results by a senior Team Leader. What What BlackBerry Test Incident Response BlackBerry can run through specific scenario-based incidents when testing in order to simulate a potential security incident. This activity can be used by the client to identify any issues within their incident response procedures Elements of BlackBerry s testing will also reflect real-life exercises undertaken by attackers, allowing the organisation s ability to respond to potential incidents to be reviewed. Configuration The configuration of all identified external-facing services will be reviewed from a black-box perspective. This intends to identify any potential vulnerability within each service s configuration or the underlying software used to present them. Compliance Checking BlackBerry can perform penetration testing on a regular basis according to the Organization compliance requirements and risk appetite. Other testing can be chosen by the organization from a list of BlackBerry other services, which include IT Forensics. These ongoing and other tests are not included and are available at an additional charge. Access Control Identified services which implement authentication mechanisms will be reviewed to ensure that the solutions in use adhere to best practice recommendations. Password controls, including password complexity/strength, multi-factor authentication and brute-force resilience of authentication mechanisms, will also be reviewed. Firewalls Network scanning and fingerprinting techniques will be used to identify the presence of security solutions, including firewalls, within the network under assessment. These exercises will be used to identify any potential misconfiguration in such solutions which increase the attack surface of an organisation s external assets. Intrusion Detection BlackBerry will inform the organization when testing is undertaken to enable incident identification. BlackBerry can provide details of traffic sources to allow testing activity to be specifically tracked. Network Obfuscation Network scanning and fingerprinting techniques will be used to attempt to identify the software in use by hosts/services. This activity is also used to identify whether suitable controls, such as NAT, are in use. Patch Management Services will be reviewed in attempts to identify that the underlying software, including the operating system of the hosting assets, is suitably patched.

4 Reporting On conclusion of the testing, the results will be fully analysed by a BlackBerry senior tester, and a full report will be prepared for the client which will set out the scope of the test and the methodology used. Vulnerabilities are rated Critical High Medium Low The test team findings will be represented in three sections Management Overview A plain English description of discovered vulnerabilities and their potential business impact, with an easy to understand diagram showing vulnerabilities. Technical Overview A section for technical managers which aims to assist in the prioritization of patching and resolving any issues found. Full Technical This section of the report is intended for technical personnel and will include full details of all vulnerabilities found, how they were exploited and a route map with detailed fixes for remediation where appropriate. Alongside the final report, BlackBerry willproduce an Excel spreadsheet listing the vulnerabilities found so you can track remediation more easily. The report will give the tested target a rating of either CRITICAL, HIGH, MEDIUM OR LOW RISK. Deliverable Acceptance Criteria Interim deliverables will be completed and presented to the Customer for review at regular intervals throughout the project. The Customer will review, and either accept, or document specific corrective items in writing, within 3 business days. In the absence of any comments, deliverables produced by BlackBerry will be deemed accepted after 3 business days.

5 Limitations, Exclusions and Additional Customer Responsibilities a. Additional Professional Services offerings may be purchased as add-ons, otherwise additional consulting work not specifically contained in this Program Description is out of scope. b. If Customer Prerequisites and other Customer tasks are not completed in a timely manner as agreed to with the BlackBerry Project Manager and the work contemplated by this Program Description is delayed by greater than two (2) weeks or ten (10) business days, or if the work must be rescheduled by the Customer, BlackBerry reserves the right at its sole discretion to terminate the engagement without refund, or to charge the Customer for additional resources at BlackBerry s current daily rate of $2500 USD for the delay period. c. Customer must ensure that Customer Project Team Members are assigned and available to meet for project Kick Off at project start date. d. The Customer must provide BlackBerry Representatives with information and resources to successfully execute the project. This can include, without limitation, providing access and credentials to systems, completing installation prerequisites, providing project resources, and attendance in planning, execution, or training meetings. e. Customer will ensure resources are available in a timely manner to undertake tasks for which the Customer is responsible. f. Customer must ensure that Customer has necessary escalation and communication channels to resolve any project blockers in a timely manner, including project dependencies on third parties and Customer s other vendors, suppliers, and consultants. g. If BlackBerry Professional Services personnel travel to a Customer location for the delivery of this engagement, there will be additional Travel and Expense costs. These Travel and Expense costs can be paid for prior to the engagement, or at BlackBerry s actual cost, at engagement completion. h. Customer will provide BlackBerry s assigned Program Manager with confirmation of receipt and acceptance of the services rendered on a weekly basis and promptly following the completion of the project. All services shall be deemed to be delivered, and on no account shall BlackBerry be obligated under to deliver further services beyond sixty (60) days after the date specified on the services order form. i. BlackBerry may subcontract all or a portion of the services and/or have the services performed by one of its affiliates.

6 BlackBerry Professional Services BlackBerry Professional Services offers additional consulting and educational offerings. To learn more about these offerings, please go to: Note: The services described in this Program Description are subject to the terms and conditions of the Business Services by BlackBerry Terms found at: There are no warranties, express or implied, with respect to content of this document, amd all information provided herein is provided As Is. Except as expressly agreed to by BlackBerry in an agreement between BlackBerry and you for services, in no event shall BlackBerry or any of its Shareholder, Affiliates, Directors, Officers, E,ployes, Agents or Suppliers, be liable to any Party for any direct, indirect, special or consequential, punitive or exemplary damages for any use of this document, including without limitation, reliance on the information presented, lost profits, lost data, or business interruption, arising in contract, tort, strict liablility or otherwise, even if BlackBerry was expressly advised of the possiblility of such damages About BlackBerry BlackBerry is securing a connected world, delivering innovative solutions across the entire mobile ecosystem and beyond. We secure the world s most sensitive data across all end points from cars to smartphones making the mobile-first enterprise vision a reality. Founded in 1984 and based in Waterloo, Ontario, BlackBerry operates offices in North America, Europe, Middle East and Africa, Asia Pacific and Latin America. The Company trades under the ticker symbols BB on the Toronto Stock Exchange and BBRY on the NASDAQ. For more information, visit BlackBerry Corporation 6700 Koll Center Parkway, #200 Pleasanton, California USA BlackBerry Limited 2200 University Ave. E Waterloo, Ontario Canada N2K 0A7 BlackBerry UK Limited 200 Bath Road Slough, Berkshire United Kingdom SL1 3XE BlackBerry Singapore Pte. Limited The Synergy Building, 2nd Floor 1 International Business Park Singapore Tel: (925) Fax: (925) Tel: (519) Fax: (519) Tel: +44 (0) Fax: +44 (0) Tel: BlackBerry Limited. All rights reserved. The BlackBerry and BlackBerry families of related marks, images and symbols are the exclusive properties of BlackBerry Limited. BlackBerry, Always On, Always Connected, the envelope in motion symbol and the BlackBerry logo are registered with the U.S. Patent and Trademark Office and may be pending or registered in other countries. All other brands, product names, company names, trademarks and service marks are the properties of their respective owners. The handheld and/or associated software are protected by copyright, international treaties and various patents, including one or more of the following U.S. patents: 6,278,442; 6,271,605; 6,219,694; 6,075,470; 6,073,318; D,445,428; D,433,460; D,416,256. Other patents are registered or pending in various countries around the world.