The Comprehensive Penetration Test is performed on a surprise basis. The intention is to thoroughly test the intrusion detection and response procedures to ensure that security breaches are quickly identified, investigated and contained. Our team also performs a full vulnerability assessment of the operating systems, databases, network devices, and the resident within the network.

Includes:

• Testing of IDS and IPS
• Internal Network Security Assessment
• Internet Review
• Web Application Security Assessment
• Dial-up Review

The IT Security Baseline is performed with the knowledge of the IT staff. It is similar to the Comprehensive Penetration Test except that the intrusion detection and response procedures are not tested. The first performance of this project sets the baseline, and subsequent tests enable the development of formal metrics to measure enhancements made between test cycles.

Includes:

• Internal Network Security Assessment
• Internet Review
• Web Application Security Assessment
• Dial-up Review

The Network Vulnerability Assessment is a condensed, lower-cost alternative to both the Comprehensive Penetration Test and the IT Security Baseline. The assessment is performed with the knowledge of the IT staff. The network scope may be limited and does not include the testing of intrusion detection and response procedures.

The Internet Review is performed to identify vulnerabilities on the Internet-facing systems owned by the Client. The review also determines if an attacker can gain access to Client's corporate assets remotely from the Internet. This review is performed remotely from the Canaudit lab, and includes up to 65 labor hours of testing.

Process:

• Network Mapping
• Service Identification
• Manual Testing
• Automated Testing
• Verification of Identified Vulnerabilities

The Dial-up Review, also known as demon dialing or a war-dial, is performed by Canaudit against the Client’s phone network to identify, test, and exploit unsecured modems. External dial-up intrusion detection and response will be measured. Performed remotely from the Canaudit lab, this audit includes a review of up to 5,000 phone numbers. Additional numbers can be tested for an additional fee, no higher than Canaudit's standard rates. Testing is performed after Client's normal business hours to ensure no business disruption.

Process:

• Connect
• Identify
• Penetrate

The Web Application Security Assessment tests the security of one web site. The assessment is conducted in two stages, the first performed without knowledge of the clients network or valid authentication credentials. The second stage is conducted with authentication information, provided by the Client, to identify issues that would otherwise not be apparent.

Specific Checks include, but are not limited to:

• Parameter Injection
• Command Execution
• Cross-Site Scripting
• SQL Injection
• Directory Enumeration
• Directory Traversal
• SSL Strength
• Path Manipulation
• Brute Force Authentication Attack
• Known Attacks
• Service Availability