Technical Proposal. In collaboration with Main Contractor. 24 th April 2012 (VER. 1.0) E-SPIN SDN BHD

Transcription

1 Technical Proposal 24 th April 2012 (VER. 1.0) In collaboration with Main Contractor E-SPIN SDN BHD Since 2005 E-SPIN SDN BHD. All Right Reserved.

2 Product Overview & Features Nessus Professional Feed The proposed Nessus vulnerability scanner is the world's most widelydeployed vulnerability and configuration assessment product, with over five million downloads to date. Nessus is rated among the top vulnerability scanners throughout the security industry and is endorsed by professional security organizations. Nessus is supported by a world-renowned research team and has an extensive vulnerability knowledge base that is continually updated. Nessus features include: Agent less auditing Compliance checks Content audits Customized reporting High-speed vulnerability discovery In-depth assessments Patch management integration Scan policy design & execution Nessus vulnerability scanners can be distributed throughout an entire enterprise, inside DMZs and across physically separate networks.

3 Product Overview & Features Nessus Professional Feed Nessus ProfessionalFeed enables user to scan their network, obtain support, updates to their database of vulnerability checks and compliance auditing. Users will be able to receive immediate access to: The newest Tenable Nessus plugins as soon as they are released Manage scheduled scans from the Tenable Nessus web interface for daily, weekly, monthly and other types of audits Perform an unlimited amount of complete PCI DSS compliance audits Perform web application audits of custom and embedded applications to test for cross site scripting, SQL injection and much more Conduct application, router and SQL database configuration audits against CERT, CIS, DISA STIGs, GLBA, HIPAA, NIST SCAP FDCC, NSA and PCI standards Conduct content audits such as adult content, personally identifiable information (credit cards, SSN, etc.) corporate spreadsheets, and much more SCADA vulnerability checks to detect and audit Control System devices Virtual Appliance - access to a download of a Nessus 5 VMware Virtual Appliance, which works with VMware ESX, Server, Workstation and Fusion Support - Access to operational and technical assistance from Tenable's experienced support staff with regards to the deployment and use of their scanners, as well as the writing of audit policies for the compliance checks or content checks

4 Product Overview & Features CoreImpact Pro The proposed CORE Impact Pro is the most comprehensive software solution for assessing and testing security vulnerabilities throughout your organization. In terms of the product itself, Core Impact Pro enables user to conduct exploitation or penetration test on these following things 1. endpoint systems & users 2. mobile devices 3. network devices 4. network systems 5. web applications 6. wireless networks With 15+ years of leading-edge security research and commercial grade development, Core Impact allows users to evaluate your security posture using the same techniques employed by today s cyber-criminals. CORE IMPACT Features 1. Multi-Threat Surface Investigation CORE Impact Pro is the only solution that empowers you to replicate multi-staged attacks that pivot across systems, devices and applications, revealing how chains of exploitable vulnerabilities open paths to your organization s mission-critical systems and data. 2. What-If Attack Analysis Impact Pro empowers you to demonstrate the severity of exposures by not only replicating how an attacker would compromise and interact with vulnerable systems, but also revealing exactly which data would be at risk. 3. Commercial-Grade Exploits Only CORE Impact Pro offers a stable, up-to-date library of commercialgrade exploits and real-world testing capabilities. CORE routinely delivers 30+ new exploits and other updates each month all professionally built and tested by in-house researchers and developers. 4. Actionable Results and Reports Impact offers the industry s most comprehensive vulnerability reports. Confirm exploitable vulnerabilities to plan remediation efforts Gain metrics that illustrate the efficacy of layered defenses Validate compliance with government and industry regulations

5 Product Overview & Features CoreImpact Pro

6 Product Overview & Features CoreImpact Pro

7 Product Overview & Features Acunetix Web Vunerability Scanner The Proposed Web Vulnerability Scanner come with all the features requested by end client, and thus enable end client to perform comprehensive web vulnerability assessment on unlimited websites owned by the end client. 1. Web Vulnerability Scanner ( For vulnerability scanning and penetration testing) The proposed Web Vulnerability Scanner is Acunetix Web Vulnerability Scanner and it comes with the followings functionality in high level for the purpose of Vulnerability Assessment, Penetration Testing, and even as a Hacking Tool. Spider- Crawls your entire website to list the whole website structure and able to provide detailed information on each pages found Scanning- Any vulnerabilities found will be alerted in the Alert Node where it gives information on the vulnerabilities found and recommendation on how to fix the vulnerabilities In-depth checking for SQL Injection, Cross Site Scripting (XSS) and other Vulnerabilities with the innovative AcuSensor Technology (defined as white box scanner/dynamic source code scanner where end user able to detect the stack trace, source code line number, affected SQL query and etc) at lesser false positive. Scan AJAX and Web 2.0 Technologies for Vulnerabilities Port Scanning and Network Alerts Detailed reports enable you to meet Legal and Regulatory Compliance. Few examples of available compliances are PCI, HIPPA, VISA and etc. Analyzes your site against the Google Hacking Database Test password protected areas and web forms with Automatic web form filler Advanced penetration testing tools(designed for web applications) included HTTP Editor - Construct HTTP/HTTPS requests and analyze the web server response. HTTP Sniffer - Intercept, log and modify all HTTP/HTTPS traffic and reveal all data sent by a web application. HTTP Fuzzer - Perform sophisticated fuzzing tests to test web applications input validation and handling of unexpected and invalid random data. Test thousands of input parameters with the easy to use rule builder of the HTTP Fuzzer. Tests that would have taken days to perform manually can now be done in minutes. Script your own custom web vulnerability attacks with the WVS Scripting tool. A scripting SDK documentation is available from the Acunetix website. Blind SQL Injector - An automated database data extraction tool that is ideal for penetration testers who wish to make further tests manually.

8 Product Overview & Features Acunetix Web Vunerability Scanner Figure shows Acusensor Functionality Figure shows SQL Injection reported by Acusensor Technology

9 Product Overview & Features Acunetix Web Vunerability Scanner Figure on the left shows the website structure after the spider crawls the website Figure on the right shows the Alert Node and information about the Vulnerability Figure on the left shows the SQL Injection vulnerability

10 Product Overview & Features Acunetix Web Vunerability Scanner Figure above shows the Penetration Tools available for advanced hacking

11 Product Overview & Features Netsparkeer Web App The proposed Netsparker is a web application security scanner, notably the only False-positive-free web application security scanner. With a simple and easy usage, a user just run a scan at the website and it will automatically discover the flaws that could make the website dangerously exposed. Besides that, the proposed Netsparker has an intuitive user interface and a quick-start scanning procedure that will enable user to test the web app in seconds. The friendly interface is a notable kind to ease the usage for users. Netsparker Features 1. Full support for AJAX and JavaScript-based applications User can rely on comprehensive security scanning, regardless of the choice of technology 2. False-Positive Free This means that user do not need a PHD in security testing to verify any vulnerabilities that it finds. 3. Build-in Exploitation Engine To positively confirm vulnerabilities, hence user is free to spend time eliminating threats, not proving them. 4. Post Exploitation Feature Takes automated exploitation to the next level, revealing additional insight into the security infrastructure 5. Integrated Exploitation Feature Can manually exploit identified vulnerabilities directly from within Netsparker, Able to see the real impact of an attack just by clicking a button.

12 Product Overview & Features Netsparkeer Web App Netsparker now uses a built-in HTTP macro recorder to faithfully capture every step of even the most complex login sequence. And, for sign-on sequences that require some special runtime action, like CAPTCHA input or the assignment of dynamic token values, we ve added a user scripting interface that promises a solution to even the most complex challenge. Whilst developing our scripting support for authentication, we realized that there are many other aspects of Netsparker s operation that could also benefit from userdefined customization. So, we implemented extensibility in the most open and flexible way possible, enabling Netsparker to expose a scriptable interface to virtually any aspect of the scanning process. Netsparker now provides detailed real-time feedback about the scan in progress and even lets you modify its runtime settings in mid-session. The scan summary dashboard provides at-a-glance information about the active scan session, including a graphical summary of the detected issues and details of the current action in progress on each of Netsparker s active threads. During a scan, you may also modify key scan session settings, including the number of concurrent HTTP connections, the selection of security tests that will be used for attacking and the use of custom request cookies. Changes entered via the dashboard take effect immediately

13 Product Overview & Features Acunetix Web Vunerability Scanner Netsparker s report template suite has been extended to include a powerful new analysis capability: comparison reporting. This allows the current scan session to be compared against one or more historic scan sessions, enabling a graphical summary of the evolution of an application s security status. It also includes a detailed vulnerability list, showing how the status of individual issues has progressed over time. Expression Language Injection MyFaces Stack Trace Disclosure. Mongrel Server Version Disclosure. Password over GET. WebLogic Detection. Elmah.axd Detection. OpenSSL vulnerabilities. PHP vulnerabilities. Netsparker now attacks more injection points, such as HTTP headers, paths and unusual injection points in the URL. This was previously available only for Cross-site Scripting Security Tests. Now coverage has been increased and new injection points added for all required security tests. Boolean SQL Injection performance improved by decreasing the number of required requests. More edge cases for MySQL in Boolean SQL Injections is now covered. HTTP Header Injection checks improved, now bypasses more blacklists. Local File Inclusion (LFI) checks improved for FreeBSD / OSX systems. Added new checks for MySQL Error Based SQL Injections. Extra blacklist bypass checks added to Frame Injection / Open Redirection checks. Windows Internal Path Leakage checks improved. LFI engine improved to cover more edge cases. Protocol based XSS attacks significantly improved.

14 Product Overview & Features Acunetix Web Vunerability Scanner Improved Search: The search feature in Netsparker s HTTP response pane now includes a preemptive look-up feature (incremental search), enabling search results to be highlighted as you type. Improved Encoding Panel: Netsparker s built-in encoding tool has been revamped, enhancing its usability with a new intuitive layout and the addition of buttons for quick copy / paste operations. Netsparker s runtime data files are now stored in a more structured directory tree within the user s Documents directory, enabling easier access to user-customizable files and more coherent storage of scan results. Netsparker now stores its scan session data in a single compact file, enabling it to be safely archived and allowing scan results to be easily passed between coworkers. Netsparker s application settings dialog now allows the definition of custom rules for applying arbitrary values to form parameters or excluding specific named HTTP parameters from being attacked. For maximum flexibility, parameters may be identified using Regex / wildcard patterns and ignored parameters may be applied selectively, according to the HTTP request method.

15 Technical Details Maintenance and Support E-SPIN Local Vendor Support offers 24x7 support for end customer. This package includes unlimited phone calls, s, remote assistance, and SMS. In addition to that, it has on-site coverage for end customer as well(up to 6 times per subscription year) Training E-SPIN training in an important element to equipped users with the relevant product knowledge and technical know how. Therefore E-SPIN offers customized training up to 5 Man Days course, catered for 5 pax. For more information regarding the training, please refer to the training handout attached.