Services
COMPLIANCE
- Payment Card Industry Data Security Standard
- It is easy to read a requirements document but difficult to understand the nuances and intent of each requirement.
- Our personnel have been involved with the Payment Card Industry (PCI) Data Security Standard (DSS) for many years and contain some of the most experienced security assessors in the payments industry.
- Performed over 100 PCI audits for merchants, service providers, and acquirers.
- Our work in many key areas of the payment industry from merchants, processors, acquirers to the card associations themselves bring the experience and guidance to help our clients prepare for and complete audits in a cost effective manner.
- In addition to being knowledgeable about the standards, our consultants have contributed towards methodology and standards for Visa CISP/PCI, Payment Application Best Practices (PABP), and helped develop the Discover Information Security and Compliance (DISC) program.
- Gramm-Leach-Bliley Act
- Complying with GLBA can be stated as simply as “safeguard customer information” but implementers know it is not that simple.
- Out personnel have been working with financial institutions for many years helping many types of financial institutions comply with this regulatory requirement including: Banks, Credit Unions, Thrifts, Trusts, and more. We have developed a methodology that walks any organization through the compliance process starting with a risk assessment and used a risk-based audit methodology to perform subsequent audits including network security risk assessments, application risk assessments, and penetration testing.
- Our staff will cross-train your internal audit employees so you can take on more and more of the work over time.
- Our consultants have not only performed assessments they have also trained both NCUA and FDIC examiners in performing such risk assessments.
- Personal Privacy Laws
- Starting with California SB 1386 and expanding to 32 other states personally identifying information (PII) has become a national issue as companies work to protect the data from criminal compromises.
- Our consultants will guide your company through the legal differences between these privacy laws and how to comply and keep your customers data safe.
RISK ASSESSMENT
This strategic approach to information security is the best way to get a “big picture” perspective of corporate risk. This assessment examines systems, processes, and procedures throughout the enterprise and risk ranks each based on: confidentiality, integrity, availability. These factors are then matched against risk items such as Internet connectivity, vulnerability scans, and business importance, and an either increasing or decreasing risk.
This analysis shows you what systems have the highest risk and thus should be addressed first. Unlike simple vulnerability scans this shows you risk both outside and inside the enterprise. The final report gives executives and managers the ability to properly allocate information security capital using a risk based model.
All other security assessments that follow this risk assessment will show detailed vulnerabilities but only with a holistic risk assessment can the importance of those vulnerabilities ever be realized. How many times have you asked yourself, “Ok, this is a risk, but how big of a risk?” A risk assessment provides you the necessary data to make informed decisions that mitigate risk in a cost-effective manner.
DATA SECURITY ASSESSMENT
The Data Security Assessment is a nuts-to-bolts assessment of security across any number of corporate or enterprise lines of business. This assessment can identify specific risks to:
- Network Architecture and Perimeter Defense
- Server security (UNIX, Windows)
- Networking security (Cisco, Firewalls)
- Patch and Configuration Management
- Backup, Disaster Recovery (DRP) and Business Continuity Plans (BCP)
- Policies and Procedures
- Anti-virus
- Workstation Review
- Vulnerability Scan
Each report will rank each vulnerability or configuration risk as High, Moderate, or Low. This enables your IT staff to easily address the most important risks first and only address the Low risk items as time and money permit. It is important to remember that the goal is risk mitigation and avoidance not risk elimination.
PENETRATION TEST
This “hacker test” is several steps beyond a simple vulnerability scan. A vulnerability scan only shows potential risks while a penetration test actually shows what a hacker would have access to.
Corporations wish to protect their Internet presence from defacement or hacker compromise that could lead to customer information being lost. This test will test the following areas:
- E-commerce systems
- Firewalls, routers, and perimeter protection
- Intrusion detection systems (IDS)
- Application specific attacks
- Unvalidated Input
- Broken Access Control
- Broken Authentication and Session Management
- Cross-Site Scripting
- Buffer Overflow
- SQL Injection Flaws
- Improper Error Handling
- Insecure Storage
- Insecure Configuration Management
- Network vulnerabilities
- Remote Access and Virtual Private Network (VPN) vulnerabilities
Bookmark to:
