Services Offering
Security Services
Vulnerability Assessment and Penetration Testing Services
A typical network of any company will have two types of networks - internal and external. To protect against external network, firewall is used. But can you secure your network just by putting firewall or IDS or IPS??? If your answer is YES, we are here to challenge you with our external penetration testing services. We STRONGLY believe that no network can be 100% secure. The rule is ‘The safest computer is the one which is not powered on or the one which is not connected to any network’. As soon as you connect your computer to any network, there is always a chance of some malicious user to come in.
What about the internal network? As the statistics suggests, possibilities of being attacked is more from internal network than external network. Around 65% of time attacker is from internal staff. What does this mean? Does this mean that you don’t have to trust your employees??? The answer is “NO”, You have to trust your employees to run your business smoothly. The real question is how to over come these issues??? You might have created VLANs and blocked access using firewall from your internal network. The only solution to these can be periodically performing vulnerability assessment against your internal network by specialized researchers like us.
Network Architecture Review
Network design plays most important role in achieving security. SECInfy offers to review network design from security prospective. SECInfy researchers review network design and meet client’s team for understanding their network requirement. At the end of this exercise, our team suggests a change in network to achieve maximum security without affecting performance of the network. SECInfy researchers help client team in implementinjg industry’s best practices securely.
Application Penetration Testing
Our team checks security of the application without having access to application source code. We offer two different approaches as a part of Application Penetration testing approach which is also known as black box assessment.
- Security as a part of your development process
It is the best approach to follow security methodology as a part of development lifecycle. The main idea is to detect security issues at architecture level and fix them. We at SECInfy always follow this method. Our team closely works with client’s development team and review application design, application communication and periodically review source code for security issues.
- Security for already developed application
It is not always possible to implement security from architecture especially when application is already developed. One can not afford to rewrite entire application again due to security loop holes. There is always a work around of any issue. SECInfy researchers’ find all type of vulnerabilities in application and recommendation solution to overcome it. Report of this exercise will include vulnerabilities and the relative recommendations to resolve them We also check the configuration issues as well. Many times it is observed that application is sacrificed due to poor configuration. Many times, question comes that can as a company, we verify security of the application which we bought from the vendor. The answer is “Yes”, as you are implementing application in your network, vulnerability in vendor application can lead to a sacrifice in your network. Next question is, as we don’t have access to source code, how do we fix it. The answer is - Our researcher can also suggest software/products to resolve vulnerabilities especially when changing application code is not allowed.
Source Code Reviews
We review application code from security point of view and finds possible attack points in the code.. The objective is to traverse through the entire application code base and to identify loopholes and possible security vulnerabilities. The report of this exercise will cover exact location of the issue (Filename along with line number) and guideline for developers. We also check code quality with secure coding practices. As an add-on service to this approach, we also offer SECInfy developers to change your code.
Development Services
We provide offshore development services for our clients which also includes our own researched solutions. We specialize in:
- Web Server defense tools
- ISAPI
- HttpModules
- Apache Modules
- Desktop information gathering tools (using windows SDK or WMI)
- Network information gathering tools (using windows SDK)
- iPhone Application Development
