IT managers spent huge amounts of time and resources to thwart the threat of year 2000 problems back then however most didn't understand that information security breaches in the Internet economy would be an even bigger threat. And unlike the millennium rollover bug, security is not a one-time, easy-to-identify issue. It's a process that must be continually refined using audits, access-rights revisions, new tools, and changes to how data is stored. That may be why so many businesses put security on the back burner until a crisis flares up. Protection from security breaches requires investment in technology, services, and personnel as well as adjustments in corporate culture--now.

INTEK has developed a suite of services to address the risks associated with having your systems publicly accessible to the Internet. Our offering is broken down into two components. The first component is performed remotely and consists of a network scan and vulnerability assessment. Prior to the scan, INTEK will need to gather information about your network. Once this phase is complete INTEK will provide a report with the results of our scan. We will also make basic recommendations on how to correct the problems that were identified. Optionally, INTEK consultants would be available for onsite assistance with correcting the vulnerabilities. Once the problems have been addressed the penetration tests and vulnerabilities assessments will be performed to verify the problems detected in the first scan have been corrected.

The second component of our services will be performed onsite. It includes reviewing/changing or developing a network security policy. It also addresses the customers current process for keeping operating system and applications patches up to date. 

The last and most critical phase of our onsite assessment is a systematic way for an organization to address its information security risks, sorting through the complex web of organizational and technological issues.

At the core of the approach is the concept of self-direction, where the organization manages and directs the information security risk evaluation. The approach uses a small, interdisciplinary team of an organization's personnel, the analysis team, to lead the process. This team includes people from the business units and information technology (IT). Information security is the responsibility of everyone in the organization, not just the IT department. People from the business units know what information is important to complete their tasks as well as how they access and use the information. The information technology staff understands issues related to computing infrastructure configuration as well as what is needed to keep it running. These perspectives are important in understanding the global, organizational view of information security risk.

Below is a flow chart of how the INTEK Basic Security Services work.

desktop-integration-planning-lan/wan-security-procurement-warranty-web-wireless

The remote assessment components are performed from our facility against your Internet perimeter.

Part of the scan includes network mapping. Network mapping is performed by OS fingerprinting, which allows us to develop a rough idea of the network architecture.

By identifying open ports, the types of services that are running on the systems can be determined, e.g. port 80 indicates the host is probably a web server. Using our toolset, we are sometimes able to determine what type and version the services are. This is especially critical in determining what approach a hacker would take, e.g. If a hacker determines IIS 5.0 is running would indicate Windows 2000 is installed, and from that the hacker would probably research known exploits and vulnerabilities that are specific to those systems/services.

From a patch level perspective we can determine from the scan whether or not the TCP/IP patch has been installed for Win NT version. 4.0, and this is based on the TCP sequence number predictability.

Reported vulnerabilities are only possible vulnerabilities. The assessment tool does not actually compromise the system but checks to see if conditions exist for a specific type of attack. Although when running DoS checks it could in fact bring the system down.

INTEK will check targeted applications for the following programming practices, which if implemented correctly can help to prevent attacks from occurring.

Encrypt stateless information if necessary. Using a randomly generated unique ID to track the user can prevent attacks, which are fairly easy, if static, sequenced IDs are used. Use session variables. Session variables are an advanced practice available in the latest web scripting languages, and track IDs and variables on the server side by tracking the user with a randomly generated ID. It is very secure, and prevents unauthorized entrance to a web site. Verify referring links. Though not foolproof, this ensures that traffic flows through a site as intended. It can also help spot malicious actions immediately. Program in checks to suppress standard error messages, which may reveal variables used in scripts, script names, and path names for the server.

This dependence requires very careful management of the technologies available to secure the data. The computer industry has developed many technologies to secure specific aspects of the storage and communication processes. These technologies are only as successful as the plan used to combine them.

Security can be defined as "the state of being free from unacceptable risk". The risk concerns the following categories of losses:

• Confidentiality of Information
• Integrity of data
• Assets
• Efficient and Appropriate Use
• System Availability
• Confidentiality-refers to the privacy of personal or corporate information.

The potential causes of these losses are termed "threats". These threats may be human or non-human, natural, accidental, or deliberate.

Using vendor approved and international corporate standards, INTEK will work with the customer to develop a comprehensive policy of "best practices" and system configurations to reduce the chance of compromising information integrity or exposure via malicious or non-malicious means.