External Security Assesment is important for all Network and applications

The most common solution to external network security assessments is scan, scan, scan…and then scan some more

One of the most common vulnerability assessment activities for all companies of all sizes is an external scan, typically targeting internet-facing websites. Because we service the vulnerability assessment and penetration testing needs of large enterprises, we know “you know” that scanning external-facing network resources is important, and an obvious high priority. But we also challenge you to understand that scanning alone is not enough, unless all you really want is a checkmark for an audit of one kind or another.

A complete job of assessing the hardness of your external network includes multiple steps. Here are four of the main steps that you should be familiar with:

1. Anonymous information gathering to discover all Internet-facing assets a hacker could identify as potential entry-points into your network
2. Scanning of your internet-available network access points and web servers for known vulnerabilities (non-credentialed)
3. Verifying scan-result findings through in-depth manual pen testing attack techniques (both credentialed and non-credentialed)
4. Providing deeply informed remediation guidance and advisory services for identified/verified vulnerabilities

Why is BriskInfoSec approached to discuss external vulnerability assessment work with large enterprises?

BriskInfoSec is approached by our large enterprise clients to assess the security of their external-facing network assets for many reasons, but chief among them are dissatisfaction with their own internal tools, their present provider, and/or their own internal team’s ability to effectively manage all of their external testing work efficiently over time in a consistent and professional manner. These kinds of situations frequently result in an assignment for someone in a company’s security staff to search out alternatives; which then open up an opportunity for BriskInfoSec to present our highly-disciplined, in-depth approach to assessing the security of their external-facing network assets as compared to their present approach.

What do these companies discover when comparing BriskInfoSec approach to external security testing with their own present approach?

Because BriskInfoSec is driven by an across-the-board corporate culture that’s passionate about delivering the highest-value findings and recommendations possible, we do more than the basic steps, we do all the steps on your behalf; and then even more than that. If you assign mid-to-low-level-importance projects to others, fine, we see that frequently. But if you have a set of high-value software assets or critical points-of-entry into your network, working with BriskInfoSec always begins with an education about scanning versus penetration testing:

• Scanning and penetration testing are not the same thing, no matter how much the marketing folks working for the scanning tools manufacturers and scanning service providers make it sound that way
• Scanning is never enough, it is only an initial step in the entire assessment process
• Just the scanning step alone done effectively needs multiple scanning tools and multiple over-lapping scans run against the same resources in order to accomplish a thorough job of the scanning step
• Scanning the same resources  with different tools (as just recommended) naturally returns different results in different data formats
• Correlating and normalizing all this desperate scanning data requires special technology: like our proprietary CorrelatedVM™ platform that’s used by all of our pen testers and available (in part) to you through our CorrelatedVM Portal at no additional cost
• Scanning identifies potential vulnerabilities, and the different scanners may recommend different remediation actions – but BriskInfoSec’s CorrelatedVM platform fixes that problem as it correlates and normalizes all the scanning data from multiple scanning products and multiple rounds of scanning into the best set of recommended remediation actions
• Potential vulnerabilities identified by the initial scanning effort need to be verified by experts to eliminate false positives, and to thoroughly analyze the remainder, while also probing for any unidentified vulnerabilities the scanners could not find – this is work that only an expert pen testing company like BriskInfoSec can deliver 

In-depth pen testing to final reporting of findings and recommendations is what sets BriskInfoSec apart, and why we are given the critical responsibility of assessing the security of your most high-value/high-risk external-facing network assets.

The power of CorrelatedVM comes at no cost to you and provides real benefits that only BriskInfoSec can deliver

CorrelatedVM™, our proprietary vulnerability assessment and pen testing management platform, will be utilized for your external network penetration testing service when you hire BriskInfoSec. The CorrelatedVM platform and your complimentary access to its SaaS-based customer portal set our deep-dive pen test work and customer-facing deliverables light years apart from all other pen test services. This one-of-a-kind, powerful platform has been continually enhanced and used exclusively by BriskInfoSec’s elite team of pen test consultants on every pen test engagement for over a decade now.


Once you see our team in action with the CorrelatedVM platform, and what CorrelatedVM can offer your organization in the way of automating and disciplining your external vulnerability assessment efforts, you’ll realize how it solves presently unsolvable problems that will profoundly benefit all of your vulnerability management programs going forward.

Contact us for conduct external security testing against your applications and Network with affordable price info@briskinfosec.com

U.S. spied on United Nations by hacking into video conferencing system at New York headquarters: report

The German magazine Der Spiegel says the U.S. National Security Agency secretly monitored the U.N.’s internal video conferencing system by decrypting it last year.


The weekly said Sunday that documents it obtained from American leaker Edward Snowden show the NSA decoded the system at the UN’s headquarters in New York last summer.
Quoting leaked NSA documents, the article said the decryption “dramatically increased the data from video phone conferences and the ability to decode the data traffic.”

AP Photo/The Guardian, FileEdward Snowden, who worked as a contract employee at the U.S. National Security Agency, in Hong Kong.

In three weeks, Der Spiegel said, the NSA increased the number of decrypted communications at the UN from 12 to 458.
Snowden’s leaks have exposed details of the United States’ global surveillance apparatus, sparking an international debate over the limits of American spying.
The U.S. government’s efforts to determine which highly classified materials the leaker took from the National Security Agency have been frustrated by Snowden’s sophisticated efforts to cover his digital trail by deleting or bypassing electronic logs, government officials told The Associated Press. Such logs would have showed what information Snowden viewed or downloaded.
The government’s forensic investigation is wrestling with Snowden’s apparent ability to defeat safeguards established to monitor and deter people looking at information without proper permission, said the officials, who spoke on condition of anonymity because they weren’t authorized to discuss the sensitive developments publicly.
The disclosure undermines the Obama administration’s assurances to Congress and the public that the NSA surveillance programs can’t be abused because its spying systems are so aggressively monitored and audited for oversight purposes: If Snowden could defeat the NSA’s own tripwires and internal burglar alarms, how many other employees or contractors could do the same?
In July, nearly two months after Snowden’s earliest disclosures, NSA Director Keith Alexander declined to say whether he had a good idea of what Snowden had downloaded or how many NSA files Snowden had taken with him, noting an ongoing criminal investigation.

SAUL LOEB/AFP/Getty ImagesThe National Security Agency (NSA) headquarters at Fort Meade, Maryland, as seen from the air, in this January 29, 2010 file photo. The NSA has said that it destroys all data it isn't supposed to see.

NSA spokeswoman Vanee Vines told the AP that Alexander “had a sense of what documents and information had been taken,” but “he did not say the comprehensive investigation had been completed.” Vines would not say whether Snowden had found a way to view and download the documents he took without the NSA knowing.
In defending the NSA surveillance programs that Snowden revealed, Deputy Attorney General James Cole told Congress last month that the administration effectively monitors the activities of employees using them.

These decisions are made to make sure that nobody has done the things that you’re concerned about happening

“This program goes under careful audit,” Cole said. “Everything that is done under it is documented and reviewed before the decision is made and reviewed again after these decisions are made to make sure that nobody has done the things that you’re concerned about happening.”
The disclosure of Snowden’s hacking prowess inside the NSA also could dramatically increase the perceived value of his knowledge to foreign governments, which would presumably be eager to learn any counter-detection techniques that could be exploited against U.S. government networks.
It also helps explain the recent seizure in Britain of digital files belonging to David Miranda – the partner of Guardian journalist Glenn Greenwald – in an effort to help quantify Snowden’s leak of classified material to the Guardian newspaper. Authorities there stopped Miranda last weekend as he changed planes at Heathrow Airport while returning home to Brazil from Germany, where Miranda had met with Laura Poitras, a U.S. filmmaker who has worked with Greenwald on the NSA story.

Marcelo Piu/AFP/Getty ImagesDavid Miranda (left), the Brazilian partner of Glenn Greenwald, a U.S. journalist with Britain's Guardian newspaper who worked with intelligence leaker Edward Snowden to expose US mass surveillance programmes, is pictured at Rio de Janeiro's Tom Jobim international airport upon his arrival on August 19, 2013. British authorities faced a furore after they held Miranda for almost nine hours under anti-terror laws as he passed through London's Heathrow Airport on his way home to Rio de Janeiro from Berlin.

Snowden, a former U.S. intelligence contractor, was employed by Booz Allen Hamilton in Hawaii before leaking classified documents to the Guardian and The Washington Post. As a system administrator, Snowden had the ability to move around data and had access to thumb drives that would have allowed him to transfer information to computers outside the NSA’s secure system, Alexander has said.
In his job, Snowden purloined many files, including ones that detailed the U.S. government’s programs to collect the metadata of phone calls of U.S. citizens and copy Internet traffic as it enters and leaves the U.S., then routes it to the NSA for analysis.
Officials have said Snowden had access to many documents but didn’t know necessarily how the programs functioned. He dipped into compartmentalized files as systems administrator and took what he wanted. He managed to do so for months without getting caught. In May, he flew to Hong Kong and eventually made his way to Russia, where that government has granted him asylum.
NBC News reported Thursday that the NSA was “overwhelmed” in trying to figure what Snowden had stolen and didn’t know everything he had downloaded.
Insider threats have troubled the administration and Congress, particularly in the wake of Bradley Manning, a young soldier who decided to leak hundreds of thousands of sensitive documents in late 2009 and early 2010.
Congress had wanted to address the insider threat problem in the 2010 Intelligence Authorization Act, but the White House asked for the language to be removed because of concerns about successfully meeting a deadline. In the 2013 version, Congress included language urging the creation of an automated, insider-threat detection program.

Free messaging apps unsafe, claim hackers

NEW DELHI: The free text messaging app on your phone can be used to steal your personal information. Sounding this warning, hackers and cyber security professionals have claimed that internet companies can access a mobile user's chat logs and phone data, including location, contacts, mail and much more, through some of these free texting apps.

To prove their point, a team of young hackers demonstrated on Sunday how text messages sent through a Chinese free texting app can be decrypted. They said foreign governments could also be using this method to access data for surveillance or spying.

The vulnerability of free messaging users was one of several privacy issues that hacking enthusiasts discussed at The Hackers Conference in the capital on Sunday.

'Govt fails to tap potential of hackers despite web attacks'

Participants at The Hackers Conference in Delhi on Sunday said the government wasn't utilizing the potential of hackers despite its websites increasingly coming under attack.

Often considered an underground community, hackers are increasingly becoming part of the mainstream IT industry and contributing as security experts. Some also use their skills for larger good, to investigate government documents and data. At the conference, there were people from all of these categories.

"Hacking is like an art which needs skill to master. It is also like science, extremely logical. Today private companies use ethical hackers to make themselves secure. We know of companies that pay hackers more than they spend on developing software," said Kishlay Bharadwaj, 24, a freelance security analyst and organizing member of the conference. Hackers are paid around Rs 1 lakh per month by social networking sites, search engines and software companies, he said, adding that some of these hackers are just teenagers.

Kishlay and Mohit Kumar, 24, another organizing member, said it was about time that the government woke up to the potential of hackers. "The public sector doesn't hire freshers. There is also a misplaced idea that all hackers are criminals. They are just people who are technically sound. There is a 16-year-old hacker who is being paid Rs 4 crore per annum by a leading search engine. The Indian government should understand how important cyber security is," Bharadwaj said.

He said it was easy for hackers from other countries to deface central government websites, create fake pages and fake log-in credentials.

The Jharkhand police was the first government body to start a process of rewarding people who are able to find loopholes on any website or IT infrastructure of government departments. Dinesh O Bareja, an advisor with Cyber Defence Research Centre, Jharkhand police and state IT department addressed hackers on how the 'bug bounty' system was being used effectively.

According to Prabhjot Singh, 28, another organizing member, Indian hackers were increasingly making use of their skills to expose the 'bad' side of governments. "There are many Indians on the group called Anonymous, which is a network of hactivists. Those in 'Op India' of Anonymous are for instance leaking the list of Indian account holders in Swiss banks," Singh said. Edward Snowden, he added, was a role model who showed how leaking data can be for public good. "He is great and he should be given an honor for his bravery," adds Prabhjot.

Not everyone was so candid at the conference. Said Akshat Singal, 13, the youngest participant and member of the hacking community, "I can't say what I think of Snowden; it's controversial. All these issues about cyber security are controversial. But I like computer security and want to understand it. It affects everyone from a fruit vendor to a businessman. There is a rise in connectivity among people but nothing is safe or unsafe in the virtual world," says Singal who studies in class VII at Modern School, Barakhamba Road.

While Singal was probably the only school student at the meet, many other youngsters raised concerns about privacy. Saumya Vishnoi, 25, a security analyst, was appalled at the vulnerability of government's digital data and said there was lack of awareness about violations of privacy on smartphones.