Network Security Assessment
Our personnel assist our clients by determining the scope and frequency of network vulnerabilities, and accordingly, perform network and host (internal and external) network vulnerability assessments.
Our Network Vulnerability Assessment (VA) services are grouped into three categories of services:
- Periodic network VA as a service: Our clients often request that we perform a one time or periodic network VA to verify the strength of their network security profile. Industry best practices suggest that you periodically rotate vendors for a more comprehensive VA.
- Deployment of network VA solutions: We help our clients select and configure the most suitable network VA solution and manage it on their behalf or transfer day-to-day operation to their staff.
- Compliance Reporting for network VA: We provide a network VA that supports your compliance obligations. Accordingly, we leverage our eGRC compliance reporting solutions that supports more than 500 regulatory compliance reports. Specifically, we provide reports that support:
- Payment Card Industry (PCI) Data Security Standards
- Personal Health Information Protection Act (PHIPA)
- Federal Information Protection Act (FIPA)
- U.S. Federal Information Security Management Act (FISMA)
- Federal Desktop Core Configuration (FDCC) requirements
Scope of Network VA Services:
As part of our network VA we typically cover the following areas:
- Network Topology Risk Assessment: Discover and assess the risk of network topology and zones including: Public, Operational, Restricted, and Highly Restricted zones.
- Discover Network Assets: As part of the network VA, our personnel help you discover network assets, including network nodes, firewalls, IPSs, IDSs, routers and switches, servers, databases, applications.
- Discover Network Asset Vulnerabilities: Utilizing an array of commercial and open source tools, we probe each network asset for potential vulnerabilities. To complete our network VA, we deploy host configuration review.
- Verify Vulnerabilities (or Penetration Testing): With management approval, we verify identified network vulnerabilities by actively trying to leverage it for further network penetration and subversion of existing controls.
- Network Security Configuration Assessment: We review the device configuration for potential network vulnerabilities. Our personnel utilize a set of automated tools and manual techniques to review such vulnerabilities.
- Reporting: Our reporting process is designed to inform executives, management groups, and technical teams, compliance and audit departments. We carefully explain each vulnerability, its respective exposure, and discoverability. Our personnel also provide pragmatic prioritization and recommendations. When deemed appropriate, our team will provide a trend report to demonstrate the status of network VA over a designated period of time.
Our business partners and resources: