Security Assessment and Compliance Services

Transcription

1 Security Assessment and Compliance Services

2 Despite the best efforts of IT security teams, hackers and malicious code continue to find their way into corporate networks. Adding to the pressure is the fact that corporate governance and industry legislation have made CEOs personally liable for the security of their corporate information, forcing them to provide evidence of due care and diligence regarding the company network. Legislative and regulatory initiatives include: The Sarbanes-Oxley Act Affects public companies and requires internal assessment of information controls and potential for breaches The Health Insurance Portability and Accountability Act of 1996 (HIPPA) Concerns hospitals, pharmaceutical orientated companies, doctors and health insurance companies The Gramm-Leach-Bliley Financial Services Modernisation Act of 1999 (GLB) Affects financial services companies such as banks, insurance and accounting firms around the protections of consumers personally identifiable financial information

3 Dimension Data can help. We understand the growing security burden and would welcome the opportunity to explore how we could bring our twenty years of experience in addressing security issues to bear in helping you to navigate your way forward. Dimension Data s assessment and compliance services provide insight into your security posture and identify areas of weakness. Our assessment and compliance services include: Vulnerability assessment Penetration testing System security review Security infrastructure study We understand the growing security burden and would welcome the opportunity to explore how we could bring our twenty years of experience in addressing security issues to bear in helping you to navigate your way forward Vulnerability Assessment Dimension Data s assessment team sets out to uncover and understand the vulnerabilities of internal and external systems and applications that could be susceptible to exploitation. The Assessment provides insight into your system and application security levels. The Assessment is not intrusive and is appropriate for critical infrastructures that cannot be subject to severe testing during or outside business hours or where penetration testing is not required. The External Vulnerability Assessment evaluates network infrastructure that is accessible via the internet or from third party networks. These assets may include perimeter routers, firewall, web servers, mail relay servers, proxy servers or any other device on a DMZ. Your systems are assessed from outside your corporate network to determine their level of vulnerability to outside attacks. The Internal Vulnerability Assessment evaluates assets on your local area network. Typically, these devices are protected by corporate firewalls or are not visible from the internet or other third party networks. Oftentimes, the security of these systems is neglected and once they have been compromised, they represent a convenient launching pad for further attacks. We can also perform vulnerability scanning in an authenticated mode, to detect and manage vulnerabilities at a deeper level on the target systems and within the network. Penetration Testing Through our Penetration Testing Service we simulate the actions of a malicious external user exploring the externally accessible infrastructure of your organisation. Throughout the process, the assessment team makes use of commercial and public software and tools. This provides quality assurance and gives you insight into the public toolkits available that may be used in attacks. Through our expertise in various security domains, Dimension Data can address a wide range of potential threat origins: Internet infrastructure Web applications Local area network (via authorised and rogue internal client systems) Trusted third party connections Wireless infrastructure (internal and external) Voice over IP Remote access

4 System Security Review In addition to a Vulnerability Assessment or Penetration Test, Dimension Data offers a System Security Review Service which assesses a system s configuration and security policy compliance. Areas covered in the review: Environment security infrastructure, default configuration Vulnerability management vendor bugs Access control measures authentication, authorisation, segregation of duties Data protection security measures for stored data or data in transit Management local/remote administration Monitoring auditing, audit trail security We assess the targeted systems level of armouring (also known as hardening) and conformity, in line with latest security industry best practice recommendations and standards. Our deliverables include a detailed list of recommended technical improvements and execution guidelines. Security Infrastructure Study We evaluate your infrastructure against industry best practice principles including defence-in-depth, logical segregation between different business flows, corporate network and DMZ, partners and branch offices. The study rates your existing controls against your current and future business requirements and objectives. Consulting Methodology We apply our project consulting methodology to evaluate every potential attack opportunity, using the results of the penetration test or vulnerability assessment. Our technical assessment approach aligns to internationally accepted best practice standards and guides i.e. OSSTMM, NIST and OWASP.

5 The project consulting methodology is built upon the following elements: Inception Assessment strategy Assessment Analysis and report Setting the boundaries Defining the rules The fieldwork Findings Assessment scope Planning Roles and responsibilities System inventory (characteristics, purpose and business criticality) Understanding of the architecture Insight in to policies and procedures Time frame Constraints Tools Limitations Information gathering Network discovery/map Network scanning Sys/App fingerprinting Vulnerability assessment Research Exploitation Weakness analysis Management level reporting with high level action plan Technical reporting with detailed recommendations Presentation

6 Success stories VISA / MasterCard Both VISA and MasterCard proactively developed account data security programmes involving extensive security audits of select merchants, payment of service providers and processors. Dimension Data assisted Visa International with the development of their initial payment card security assessment program, and the expansion of the program throughout Western Europe. European union institutions Dimension Data executed a large Security Assessment project comprising of the following components: Vulnerability Assessment, Penetration Testing, Security Infrastructure Study and System Security Analysis of servers, workstations and network and security devices. Multinational food company Dimension Data was contracted to assess the firewall infrastructure of several sites and executed Audit missions consisting of Penetration Testing services and Firewall rules compliancy assessments against corporate policies. The project involved 25 sites across the world. Payment service provider Dimension Data assisted this payment service provider throughout its Payment Card Industry Standard compliance programme. The project comprised of a quarterly Vulnerability Assessment of the entire external infrastructure and a thorough yearly assessment targeting both technical, managerial and security management aspects. International fashion company Dimension Data assessed the entire telephony infrastructure for this organisation and executed an aggressive dialling project to locate rogue modem connections. Financial institution Dimension Data performed a penetration test on the remote access and VPN infrastructure to validate the security measures of the new infrastructure components prior to production integration. Large Belgian mobile phone operator Dimension Data undertook a vulnerability assessment that encompassed the client s core infrastructure including servers and network equipment. The findings were analysed and consolidated into an action plan with clear and prioritised steps to remediation. In addition, a vulnerability management service provided the client with continual automated vulnerability monitoring and remediation tracking. It was further integrated with security event monitoring software and devices. Global insurance firm For this global banking and insurance firm, Dimension Data deployed an internal Vulnerability Management service covering 250 internal IP addresses. Large university hospital Dimension Data deployed an internal Vulnerability Management solution covering 250 internal IP addresses and assisted with the first infrastructure discovery and vulnerability assessment. International temporary and contract staffing organisation For this world leader in human resource solutions, Dimension Data deployed an internal and external Vulnerability Management service covering 32 external IP addresses and 224 internal IP addresses, across multiple sites in several countries.

7 Why Dimension Data? Dimension Data combines it expertise in security, networking, operating environments and storage technologies with skills in consulting, integration, and managed services, to create customised client solutions. Our track record: More than 5,000 security clients around the world Over 10,000 product implementations In excess of 3,000 consulting engagements worldwide Strong relationships with Microsoft, Cisco, Check Point, RSA Security, McAfee and Nokia Dimension Data s security experts range from technical engineers and security consultants to BSI Lead Auditors. Our certifications include CISSP, CCSA, CCSE, RSA and SANS GIAC. Our consultants have technical experience within networking, security and systems and have a background in design and implementation of high-end infrastructures. Our consultants have technical experience within networking, security and systems and have a background in design and implementation of high-end infrastructures CS / DDCC-0776 / 04/11 Copyright Dimension Data 2011 For further information visit:

8 MIDDLE EAST & AFRICA ASIA AUSTRALIA EUROPE AMERICAS ALGERIA ANGOLA BOTSWANA CONGO DEMOCRATIC REPUBLIC OF THE CONGO GABON GHANA KENYA MADAGASCAR MALAWI MAURITIUS MOROCCO NAMIBIA NIGERIA SAUDI ARABIA SOUTH AFRICA TANZANIA UGANDA UNITED ARAB EMIRATES ZAMBIA CHINA HONG KONG INDIA INDONESIA JAPAN KOREA MALAYSIA NEW ZEALAND PHILIPPINES SINGAPORE TAIWAN THAILAND VIETNAM AUSTRALIAN CAPITAL TERRITORY NEW SOUTH WALES QUEENSLAND SOUTH AUSTRALIA VICTORIA WESTERN AUSTRALIA BELGIUM CZECH REPUBLIC FRANCE GERMANY ITALY LUXEMBOURG NETHERLANDS SPAIN SWITZERLAND UNITED KINGDOM BRAZIL CANADA CHILE MEXICO UNITED STATES For contact details in your region please visit