|
Security Audits
Security audits can be categorized in terms of the
object investigated, the focus and the methodology applied.
Conceptual/organizational security audits
Conceptual/organizational security audits normally use a checklist- or questionaire-based
approach, with security vulnerabilities and loopholes being identified
using a combination of interviews, examination of documentation,
workshops and gap analyses. Conceptual/organizational
security audits in line with BSI Standard 100-1 to 4 (successor of IT GSHB) or ISO/IEC 270xx
and e.g. SOX and Basel II compliance tests fall into this category.
Technical security audits
Technical security audits use specialized programs such as port
and security scanners, test malware and debuggers. Because there
are different, and sometimes misleading, designations for technical
security audits, we use the following terminology (for detailed
information, please click on the test name in the chart and take the tables on this site into account):
|
|
|
|
|
| Looking for software-based (OS and applications) vulnerabilities |
• |
• |
• |
- |
| Looking for design-based vulnerabilities |
- |
- |
• |
• |
| Unprivileged tests (without knowledge of valid access credentials) |
• |
• |
• |
• |
| Priviledged tests (without knowledge of valid access credentials) |
- |
- |
• |
• |
| Automated search for vulnerabilities |
• |
• |
• |
• |
| Manual search for vulnerabilities |
- |
• |
• |
• |
| Use of multiple tools with similar functionality |
- |
• |
• |
• |
| Non-intrusive verification of vulnerabilities |
• |
• |
• |
• |
| Intrusive verification of vulnerabilities |
- |
• |
• |
• |
| Specific modification of test object (e.g. user accounts, database content, file system content, etc.) |
- |
- |
- |
• |
| Recommendation of technical measures |
• |
• |
• |
• |
| Recommendation of organizational measures |
- |
• |
• |
- |
| Documentation |
• |
• |
• |
• |
Caption: '•' = fulfilled, '-' = not fulfilled
|
|
|
|
|
| OSSTMM compliance (method, conduction of test, and documentation) |
- |
o |
o |
o |
| Conceptual tests and tasks |
- |
- |
o |
- |
| Footprinting (research in the Internet) |
o |
o |
o |
o |
| Social Engineering |
- |
o |
o |
o |
| Development of Exploits |
- |
o |
o |
o |
| Post Exploitation |
- |
- |
- |
o |
| Denial-of-Service (DoS) tests |
o |
o |
o |
o |
| VPN Deep Inspection |
o |
o |
o |
o |
| System Audit |
o |
o |
o |
- |
| Network Traffic Audit |
- |
o |
o |
- |
| Firewall Ruleset Audit |
o |
o |
o |
- |
| Wireless Network Audit (War Driving) |
o |
o |
o |
o |
| War Dialing |
o |
o |
o |
o |
| Protocol Tunneling Test (test trojan-based) |
o |
o |
o |
- |
| Project presentation (incl. discussion of final report) |
o |
o |
o |
o |
| Discussion of final report |
o |
o |
o |
o |
| Retest |
o |
o |
o |
o |
Caption: 'o' = option, '-' = not available
Our experts offer security audits for individual applications
or systems as well as wired (e.g. Internet, DMZ and LAN/WAN)
and wireless networks (e.g. WLAN, Bluetooth, GSM/UMTS and infrared).
OneConsult is ISECOM Licensed Auditor (ILA), Platinum Level and ISECOM Partner
(Accredited Trainer), guaranteeing that the tests will be thorough and
professional and that documentation of the results will be informative
and comprehensive.
Further useful information on technical security
audits can be found here.
If you're interested in OneConsult and you'd like
a no-obligation consultation or more information, please contact
us.
Further information
|
