EdgeTeam offers a number of security tests to help you validate that the correct controls are in place.
While the technical security of devices and applications that support the organization’s business is a must, without proper physical security controls in place, it may all be for naught.
The EdgeTeam team has developed a physical security control checklist of over 32 physical security controls within 8 core physical domains using ISO and NIST standards to ensure that best practice security controls are implemented to ensure not only the security of sensitive assets, but also the security of the organization and its employees. The EdgeTeam consultants review controls based on best practices as well as their experience performing physical penetration tests.
A Physical Security and Compliance Gap Analysis identifies gaps in an organization’s physical security controls. This service reviews the different aspects of the physical security controls based on ISO and NIST security controls.
Workstations, servers, and network devices comprise the foundational technology of an organization’s critical assets and data stores. EdgeTeam has created security service offerings that will examine these devices to determine what level of vulnerability and threat they may pose to your environment.
While testing for technical vulnerabilities is an integral part of an organization’s information security program, all too often this task is performed on an annual basis, thus creating risk level gaps in the security of devices and other critical network infrastructure components within the organization. To address this issue, EdgeTeam, using its proven methodologies, will create a customized vulnerability management program to test the organization’s assets on an ongoing basis. This customized vulnerability management program helps increase threat awareness and process enforcement to the overall security posture of the organization.
External and Internal Vulnerability Assessments
External and Internal Vulnerability Assessments examine devices and systems that make up the foundation of the infrastructure for vulnerabilities. The vulnerability assessment will provide the organization with the discovery, analysis, and controlled exploitation of security vulnerabilities that are accessible from external and internal sources. Identified vulnerabilities are validated through both manual and automated processes to eliminate false positive findings.
Wireless Network Assessments
Wireless Network Assessments provide a comprehensive analysis of security vulnerabilities and threat exposures introduced into the target environment through the use of wireless networking. This service can target technology and implementation vulnerabilities, as well as user security awareness.
Comprehensive Security Configuration Reviews
This service examines system and network device configuration settings and their adherence to vendor-recommended best practices and/or compliance requirements (such as PCI and HIPAA).
Network Security Architecture and Design Reviews
Architecture and Design Reviews develop a comprehensive listing of the organization’s technical and strategic security requirements, such as network design, environment assets, and remote access, and determines if gaps exist with the solution’s design.
Remote Management Assessments
Remote Management Assessment discovers, analyzes, and categorizes all dial-up and remote management solutions in the organization and then evaluates security configurations, as well as the authentication mechanisms in place (if any) for security vulnerabilities that may increase the threat posture to the organization.
Incident Response, Forensics, and Malware Analysis
An Incident Response, Forensics, and Malware Analysis assists clients in addressing and managing the aftermath of a security breach or attack (also known as an incident). The goal is to handle the situation in a way that limits damage to our clients and reduces recovery time and costs.
Solution-specific Reviews
This service examines solution-specific installations and their configuration settings with regard to adherence to vendor-recommended best practices and/or compliance requirements (such as PCI and HIPAA). Solution-specific reviews may include:
Applications facilitate the delivery or processing of an organization’s critical business data and assets. Be it a packaged third-party or a custom in-house application, traditional security controls such as a firewall or network segmentation are not effective at protecting these applications against a targeted attack. EdgeTeam has created security service offerings that examine your applications for common input validation vulnerabilities to language, coding, or platform-specific vulnerabilities.
Comprehensive Application Assessments
Comprehensive Application Assessments provide a comprehensive in-depth security review of the application environment and its potential attack landscape. Depending on the depth of the assessment, EdgeTeam will conduct “gray-box” testing against the application, in which the application code base and dynamic runtime environment, system configuration settings and protocols utilized by the application are analyzed for security vulnerabilities.
Application Threat Modeling
Application Threat Modeling provides a structured approach to objectively identify and evaluate threats to an application. Does your organization know which parts of an application need to be reviewed based on a compliancy requirement? EdgeTeam does, and we can answer that question for you.
Source Code Assessments
A Source Code Assessment provides an analysis of security vulnerabilities and programming errors contained in the source code of the application that affect the integrity of an application, its associated data, and the environment as a whole.
Database Assessments
This service examines configuration settings of databases supporting the application and their adherence to vendor-recommended best practices and/or compliance requirements (such as PCI and HIPAA).
Mobile Application Assessments
Mobile Application Assessments provide a security review of the security posture of a mobile application. This assessment can include a review of the data stored on the mobile device, as well as the application running within your environment. We currently support Google’s Android and Apple’s iOS mobile operating systems.
Packaged Web Application Services Available
In situations where a company has a need to review a large number of applications, EdgeTeam has created a custom packaged pricing schedule to meet the client’s needs.
Basic – The goal of this service is to provide a security review of the security posture of a web-based application. This service meets PCI 6.6 requirements and covers 17 of the 26 WASC test cases.
Premium – The goal of this service is to provide a security review of the security posture of a web-based application. This service meets PCI 6.6 requirements and covers all 26 WASC test cases, including Business Logic vulnerability testing. This service may include high-level source code analysis.
To assist our clients in truly quantifying the impact of a real-world security incident and/or attack against their environment, EdgeTeam uses the same tools and techniques as an attacker would for penetration testing activities to fully assess the effectiveness of the organization’s controls.
EdgeTeam uses a controlled approach to its penetration testing by first coordinating with client personnel to identify the goals and objectives of the test, set ground rules (rules of engagement), and expected end results. Finally, EdgeTeam consultants will maintain constant communication with client personnel throughout the testing so that everyone is aware of where the consultant is at, at each stage of the test.
Physical Penetration Testing
This service penetrates the physical security of a targeted facility through the identification of gaps and/or weaknesses in the facility’s physical security solutions. This service includes the manipulation of locks, identification systems, and entryways.
COTS/Vendor-Specific Penetration Testing
This service tests the security of an application or solution from a truly blind perspective, often known as “black-box” testing. Does your organization need to know if a new appliance or VOIP solution is going to introduce new vulnerabilities into your environment? Our COTS penetration testing can answer that question for you.
Comprehensive Penetration Testing
This service tests the security of an application, system, or device from a truly blind perspective, often known as “black-box” testing. Does your organization know what impact a vulnerability will have to your business? EdgeTeam can provide the answer by taking your security testing to the next level and actually exploiting the condition to get a real-world answer.
Social Engineering Testing
Social Engineering Testing identifies gaps in your employee security awareness training and pinpoints what changes to your business’s culture will need to be made to continue to conduct business in the modern world. Based on these needs, DirectDefense offers the following social engineering services:
User Based: This service uses various communication mediums (email, telephone, social networking, etc.) to take advantage of the environment’s users in order to gain access to sensitive information or targeted data. Common scenarios include coordinated texted calling scenarios and targeted email phishing schemes.
Physical Based: This service takes advantage of weaknesses in the physical security and your user’s security awareness training to attempt to gain unauthorized access to the facility and sensitive data assets.
Data Exfiltration Testing
Data Exfiltration Testing determines the number of protocols and services that can be leveraged to move data out of the network. This service simulates the exfiltration of various sensitive data types from the internal network to determine blind spots within DLP or other monitoring solutions.