What Is Penetration Testing?

Pentesting or penetration testing is a means of evaluating computer and network security by identifying and exploiting vulnerabilities that a real attacker would attempt.

Pentesting will usually include a research stage (collecting information), identifying vulnerabilities, entry points (scanning), attempt to break in (exploiting) and feedback on the findings (reporting).

Strategies include:

Targeted testing sometimes referred to as the “lights-on” approach and is performed in collaboration with the organization’s IT team.

External testing targets the visible servers or devices (DNS, email servers, web servers, firewalls) an outside attacker would have access to normally in order to determine how far they could break in.

Internal testing would be conducted from the inside – behind the firewall – with authorised access, in order to establish what damage could be done if an employee directed or assisted the attack.

Blind testing implies only a limited amount of information (i.e. name of the company) is available before the test takes place. This strategy requires extensive research and it may involve higher costs.

Double blind testing means not only the information of the target company is limited but also limits the number of people aware that the test is taking place. This is done in order to test the company’s security, attack identification and response policies.

For application testing: 

White-box testing the tester is given specific knowledge about the programming code in order to understand whether the program performs the intended purpose or not.

Black-box testing tests whether the tester has information on the input and output of the program but is not aware of the inner workings of the software.

Grey-box testing (translucent testing) is a combination of white-box and black-box testing.

What Is STIG Compliance?

STIG (Security Technical Implementation Guide) Compliance is a standardized guideline for installation and maintenance of software and hardware according to the (U.S.) Department of Defense regulations. STIG also comes with a “checklist” which gives instructions on how to verify if a device is compliant, and if not, how to make it compliant.

Gold Disk is a system administrator tool which allows scanning for vulnerabilities and automates a system configuration compliant with STIG. As of 31st of December 2012 Gold Disk was terminated (and taken off public domain) and other scanning solutions: Host Based Security System – HBBS, Security Content Automation Protocol – SCAP, Compliance Checker – SCC were to be used instead.

STIGs can be downloaded at the IASE (Information Assurance Support Environment) website, and they are regularly updated to address new configurations.

What Is PCI Compliance?

PCI Compliance – Payment Card Industry Data Security Standard is a set of requirements designed to ensure all businesses which handle credit card information maintain a secure environment. It was created by the five major card schemes like American Express, JCB, Visa, MasterCard and Discover Financial Services to prevent and reduce card data fraud. Even though it does not have any legislative power the regulators can apply fines, or increase transaction fees or terminate the relationship with the merchant.

Source: bigcommerce.com

PCI compliance came about in order to improve payment procedure security, but the responsibility to enforce compliance lies with the merchants and customers not with the PCI council.

Even more to the benefit of individuals running businesses from home, PCI compliance can at least offer guidance on security measures, since intruders do focus on the home users as “easy targets” with home run applications that are not adequately protected.

For all external facing IP address merchants that store cardholder data, a quarterly scan by a PCI Approved Scanning Vendor is compulsory to validate the compliance.

Usually for a merchant to be declared compliant, the process will involve internal scans, penetration tests and file monitoring for the cardholder data environment. If customers need transference to a third-party website during transaction, then the third-party IP address needs to be submitted to the scan as well.

PCI DSS guide on security requirements consists of six rules:
·         Build and maintain a secure network and systems
·         Protect cardholder data
·         Maintain a vulnerability management program
·         Implement strong access control measures
·         Regularly monitor and test networks
·         Maintain an information security policy

PCI compliance council categorises merchants under 4 levels:
1.       Merchants processing over six million Visa transactions per year, regardless of transaction channel.
2.       Merchants processing one million to six million Visa transactions per year, regardless of transaction channel.
3.       Merchants processing 20,000 to 1 million Visa transactions per year, e-commerce transactions.
4.       Merchants processing fewer than 20,000 Visa e-commerce transaction, and all other merchants processing up to 1 million Visa transactions per year, regardless of transaction channel.

What Is ERP?

What is ERP?

ERP – Enterprise Resource Planning is a piece of software, or more accurately a collection of different applications, each satisfying a particular business demand, that synchronize together in order to provide an integrated management of business processes. Mainly focused on the back office functions that do not affect the general public directly, ERP has developed from a manufacturing resource to a core enterprise system, automating processes, by using a database as an information bank.  Although the specifics vary from one organization to another, most will include:

·        Product Planning
·         Manufacturing
·         Marketing & Sales
·         Inventory
·         Purchasing

By 'integrated' it means that ERP will “pull” together the information from all these departments and provide an accurate picture for the Accounting department, for example. ERP is also capable of analysis and reporting which feeds information in at management level for decision-making purposes.

Configuration & Customization

Successful ERP implementation for any business means understanding what specific processes the business needs and, once the software is out of the box, setting up these processes.  The software is designed to support a number of configurations and any performance mishaps will be assigned to the software provider. Customization on the other hand is a more complex process which personalizes the software further than configuration and therefore it will fall under the customer’s responsibility. Customizing ERP can be done in different ways, some more complex than others such as:

·         Re-writing part of the software – complex, invasive and harder to maintain. May  resist upgrades and require subsequent re-writing or testing.

·         Creating an entire new module to work within the existent system

·         Outsourcing third-party software

Advantages
·         Transparency for management and collaboration between departments
·         Automated and synchronized work flow
·         Central analysis and reporting system
·         Central database storage

Disadvantages
·         Cost and resources deployed for implementation, configuration and personalization
·         Cost and time saving will not be noticeable straight away
·         Data migration and employee transference from existing software to ERP
·         High (ERP software) switching costs means vendor control over upgrade / maintenance costs

What Is Active Directory?

Active Directory is a Microsoft implementation of LDAP (Lightweight Directory Access Protocol) consisting of a centralized database containing information that will be used to authenticate users and locate resources. Aside from authentication, AD also deals with authorization. The other process AD is responsible for is accounting – documenting the authentication and authorization for each user. As keeping multiple copies of databases allowing singular access to objects is not feasible and it would leave the system prone to vulnerabilities, AD stores information hierarchically and allows for centralized computer management.

Authentication – who are you? (Username/password)

Authorization – What access/permissions do you have?

Accounting – Logging of your activity.

AD comprises of two object categories:

·         Resources - for example: Printer queue data

·         Security - for example: Differentiation between system administrator and a normal user

Generally the benefits of using Active Directory revolve around the centralized management feature, but network administrators can also write scripts for controlling group policy, automating administrative tasks (assigning software to machines on the domain, managing printers, setting permissions for network users etc.) or use AD as a phone book to retrieve contact details for the users on the system.

OU – Organizational Units are AD’s criteria boxes, which can be split down in subcategories, allowing the system administrator to allocate resources / grant access according to narrower ranges of sub-criteria. For example, OUs allow you to setup access for a new geographical location (e.g. Spain) in organization X. In the Spain OU, two more OUs will be created for Sales and Purchasing departments, in Sales two other OUs for Technical and Operations. For each of these OUs, the administrator will then create the users and authorize authentication and resource access. 

Requirements

ADDS run on Windows 2000 and any later editions, but client applications can be produced for and run on earlier versions like Windows NT 4.0 or Windows 95. 

What Is Java?

Java (not to be confused with JavaScript) is a programming language brought out by Sun Microsystems in 1995. It has become one of the most popular programming languages in use due to its platform independence. This means that the program can be run on almost any type of operating system (Windows, Unix, Linux, Macintosh, cell phones etc.). There are two parts to Java. One is the runtime that is installed on the system, sometimes without the awareness of the user, this allows the user to run Java apps on his / her computer. The other is the browser plug-in which allows the user to run Java apps in the browser.

In terms of security, the Java Runtime installed on the device does not pose a cyber threat; it’s the browser plug-in that is more vulnerable. Kaspersky Lab announced that the Java browser plug-in was responsible for over 50% of all security breaches last year. Most experts will advocate  disabling of the plug-in, while some say that even the runtime should be disabled because of the updates it requires, the space it takes up and the annoying toolbars it can install on the system. If an app requires the plug-in, it can simply be re-installed.

JavaScript is a programming language that is not related to Java and is built into each individual web-browser e.g. Firefox, Chrome, Internet Explorer, Safari, Opera. It is not a plug-in and it does not present the same security issues that Java does. It is not recommended to disable it because it would ruin the experience of web-surfing as nearly all internet pages have it in use. 

What Is SharePoint?

SharePoint is an online collaboration platform developed by Microsoft. From a business point of view, SharePoint allows participants to share documents and files to access calendars and check availability, or to take part in team discussions. Much like the traditional email or the more recent solutions from Google (Google Docs or Google Wave), SharePoint has a Microsoft Office user-friendly interface and is closely integrated within the Office suite.  According to an online poll SharePoint scored an 8.8% as opposed to 29.98% for the more conventional and familiar email, in terms of user preferences.

SharePoint consists of 6 key areas:

·         Sites – one collective infrastructure that allows collaboration across Intranet, Extranet and Internet.

·         Communities – enables people to work together and share information in a very straight-forward and  efficient manner.

·         Content – offers a compliant content management experience that doesn't affect the ease of usability.

·         Search – it provides users with the ability to find content, information and people across multiple sites; much like a Google-type of browsing.

·         Insights – the reporting and analyzing feature of SharePoint that compiles data into intuitive dashboards and scorecards for business intelligence.

·         Composites – enables an extra layer of customization with no-code solutions for a more personalized experience.

It is commonly accepted that SharePoint’s greatest strength is the collaborative capacity, which along with the social media capabilities contributes to a great online environment for communication and sharing. The drawback for using it is that it may require extensive setup and customization in order to bring the features to a fully functional state. 

What Is VPN?

VPN or Virtual Private Network is a group of computers networked together over a public connection – usually the Internet. Businesses use VPN to offer their staff fast secure and reliable access to network resources when they’re geographically away from the local area network (LAN). For an organization that needs to employ a sales force, communication is essential for the productivity of its staff. In the early days, remote connections were made by using leased lines – private network connections that form a wide area-network (WAN) – which were secure and reliable, but these had high costs which increased according to distance. Private internal networks or Intranets were established for employees’ secure collaborations. With VPN, the intranet was made available to staff in different office locations, working from home, or customer sites, minimising data security risks. Furthermore they covered a wider area and were much more cost effective than leased lines.

The main benefits of a VPN connection are:

Security – it protects data on a public network and encrypts it, so that anyone intercepting it cannot read it.

Reliability – Connections should be equally accessible regardless of the geographical distance or the number of connections at any given time. 

Scalability – VPN services expand so you can manage network growth without the need for increasing costs.or replacing the technology altogether.

There are two types of VPN:

Remote-access VPN or Virtual Private Dial-up Network allows a user to connect to the company’s private network from a remote location.

Site-to-site VPN establishes a connection across multiple office locations. The connection is settled via two means, either Extranet based – for companies that operate with customers, partners, or suppliers and wish to make data readily available to them without giving access to their private networks - or Intranet based for companies that have multiple offices in different locations and need to join into one collective private network.