Information security, sometimes shortened to InfoSec, is the practice of defending information from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (e.g. electronic, physical).

Application Security

Application Security Assessments are designed to identify and assess threats to the organization through proprietary applications or those delivered by vendors with little or no customization. Our application security assessment methodology is designed around the following well known security assessment guides such as:

  - OWASP Top 10 (Open Web Application Security Project
  - Threat Modeling processes such as STRIDE and DREAD
  - OWASP’s Software Assurance Maturity Model (OpenSAMM)
  - Open Security Testing Methodology Manual (OSTMM).
  - Web Application Security Consortium (WASC) guidelines

As your applications may provide interactive access to potentially sensitive materials, it is vital to ensure that these applications don't expose the underlying servers and software to malicious attack(s) or allow any unauthorized user to access, modify or destroy data or stop critical system services.

Penetration Testing

A penetration test, or pen test, is an attempt to evaluate the security of an IT infrastructure by safely trying to exploit vulnerabilities. These vulnerabilities may exist in operating systems, service and application flaws, improper configurations, or risky end-user behavior.We specialize in the whole spectrum of penetration testing capabilities – right from information gathering, foot-printing, vulnerability assessment, exploitation, and reporting.

Spear phishing

Spear phishing is a deceptive communication technique in which a victim is lured via e-mail, text or tweet by an attacker to click or download a malicious link or file. The common objective of this technique is to compromise the victim machine by stealthily inserting a backdoor which seeks to obtain unauthorized access to confidential data remotely.

These attempts are more likely to be conducted by attackers seeking financial gain, trade secrets or sensitive information. Popular Techniques used for the Spear Phishing attack comprise of mixture of social engineering, client side attacks, and requests via social networking sites etc.

Spear phishing is more dangerous than normal phishing because the message seems to originate from a known trusted source, there is information in message supporting its validity, and the request appears to form a logical basis.

RootKit Analysis

The term “rootkit” is known for more than 15 years Originally, the term “rootkit” referred to a group of small, handy tools allowing developers keep “root” (“administrator”, in Windows terms) access to the functions of the operating system. Rootkits are programs ensuring persistent, robust and undetectable presence in the computer.

Essentially, rootkits are merely tools using certain techniques to bypass system protection mechanisms and algorithms to masquerade their very presence in the system. As pretty much any technology, rootkits can be used for malicious and legitimate purposes.

Most rootkits are used in combination with viruses, Trojans and computer worms for explicitly malicious purposes. Therefore, antivirus developers created a variety of tools for discovering rootkits. There are multiple types of anti-rootkit tools based on several principles.

  • Firewalls filtering network traffic and detecting suspicious network activities;
  • Intrusion Detection Systems (IDS) locating and removing rootkits already installed;
  • Intrusion Prevention Systems (IPS) identifying and neutralizing rootkits before they can be installed into the system.

Malware Analysis

Malicious software, or malware, plays a part in most computer intrusion and security incidents. Any software that does something that causes harm to a user, computer, or network can be considered malware, including viruses, trojan horses, worms, rootkits, scareware, and spyware

Malware analysis is the art of dissecting malware to understand how it works, how to identify it, and how to defeat or eliminate it.

We perform both static and dynamic analysis for finding malware by using standard tools as per the industry standards.

Security Awareness

In today’s world of advanced persistent threats and government sponsored attack, we observe that cybercrime, financial frauds and social engineering attacks have blended together into such a malicious force that it may even completely destroy our trust in technology.

All of these attacks rely strongly on exploiting this very trust factor. The trust that we place in our people, processes, and infrastructure. One of the strongest deterrents against such attacks is to constantly drill the message of information security through the rank and file of your organization. These initiatives must be multi-pronged, creative, tuned to your culture, and measures on a periodic basis for their effectiveness.

Key benefits of Security Awareness Program

  • Helps you to enhance user resilience to new-age threats such as Advanced Persistent Threats (APTs), threats around BYOD policy implementation and social engineering attacks.
  • Ensures that the IT and security teams are aware of the latest developments in information security
  • Provides an easy to understand content which engages in unique and interesting ways with different stakeholder groups

Security Metrics

Compliance to the ISO 27001 standard and associated controls helps an organization to understand information security risks and develop an information security management system (ISMS) in order to address the risks identified.

The ISO 27001 implementation process aims to provide management an intuitive understanding of information security. However, management also requires answers to the following questions in order to take effective strategic and tactical business decisions regarding information security management system (ISMS) and plan future investments in information security accordingly. (Brotby, 2009)

  • How secure is the organization at present?
  • How much security is enough?
  • How do we know when we have achieved the required level of security?
  • What are the most cost-effective solutions?
  • How do we prevent over-spending on IT assets or under-protecting assets?
  • How well can risk be predicted?
  • What level of maturity have the controls that are implemented so far achieved?
  • Is the security program going in the right direction?

In order to get answers to these questions, an effective method to measure the effectiveness of ISMS controls are required.

Moreover, ISO 27001 requires the organization to “undertake regular reviews of the effectiveness of the ISMS” and to “measure the effectiveness of controls to verify that security requirements have been met”. ISO 27004 standard has been developed in order to accomplish this.

The International Standard ISO/IEC 27004:2009(E) provides guidance on the development and use of measures and measurement in order to assess the effectiveness of an implemented information security management system and controls or groups of controls, as specified in ISO/IEC 27001.