Report Content
Overview Information of Scanning
Summary of the Findings
Details of Analysis of Findings
Risk Ratings
Remediation Details
Competencies
Security Services
25 years in Security implementation and management:
- Certified ISO 27001, CEH, CISA, CISM
- Email Security
- Antivirus, Data Security
- Physical Security
- Network Security
- System Backup & Restore
- IM Application Security
- Network Infrastructure Monitoring
- Business Continuity Plan in real practices with SARS and Covid19
Security Testing
5+ years of experiences for large software companies
- 50 skillful, 20 certified engineers
- Certified CEH, CompTIA PenTest+, OSCP
- Test is executed for TMA systems and client systems
- Standard test process defined
- Test category: web, applications, network, software, OS, Database
- Test method: Blackbox, Greybox, Whitebox
Techniques & Tools
Standards
- CVSS Score v3
- NIST and CIS Compliance
- OWAPS Top 10
- Request For Comment (RFC)
Security Platform Type
- Web Application
- System Security
- Network Security
- Cloud Security
- Physical Security
Security Test Types
- Vulnerability Scanning
- Compliance Scanning
- Web Application Scanning
- Fuzzing Testing
Test Tools
- Nessus
- Codenomicon Defensics
- Qualys
- Burp Suite Pro Scanner
- Compliance scanners (Openscap)
Security Testing Process
Vulnerability Scan (Nessus)
- Nessus is a vulnerability scanner which is designed to scan networks and identify vulnerabilities, misconfigurations, and other security issues.
- It supports various types of platform and scans, including host discovery, port scanning, network scanning and host-based scanning.
- It generated details reports based on severity of vulnerabilities and theirs remediation
Compliance Scan
- A compliance scan is a type of security scan that assesses an organization's compliance with industry or regulatory standards
- Follow two of most popular organization: National Institute for Standards and Technology (NIST) and Center for Internet Security (CIS)
- Supporting many platforms and systems such as OS, Network Devices, Databases, Web Application…
Fuzzing Testing
- Codenomicon Defensics is an automated protocol robustness tool that sends unexpected or malformed data (a.k.a. “Fuzzing”) to test the protocol stack’s behavior.
- It organizes and tests many protocols (SIP, IPv4, IPv6, H.248…) by message type. For example: the SIP test suites consist of over 20 message types (Invite Bye, Invite Refer, Invite Cancel….)
Web Application Scan
- Qualys' web application scanning can identify vulnerabilities in web applications, including those that may be used to steal sensitive data, take control of the application, compliance issues related to web application security. Qualys also support vulnerability scanning
- Burp Suite Pro scanner can scan web applications for a range of vulnerabilities, including SQL injection, cross-site scripting (XSS), remote code execution, and file inclusion vulnerabilities. It can also identify issues related to authentication, access controls, and session management.
Case Study
Vulnerability Scan
Compliance Scan
Codenomicon Defensics
Web Application Scan
- System under test: Carrier VoIP Provisioning Portal Server which is a Web UI provides secure subscriber provisioning, device provisioning, system resource management, etc…
- Test method: Credential on
- Test category: Web Application
- Tools used: Nessus
Test Procedure:
- Execute vulnerability scanning against the target
- Generate scan reports
- Check for real issue
Summary of issues found:
- RPM package updates
- TLS vulnerable version
- Apache Log4j
- System under test: Media Server which is a Linux system provides media processing functions, system resource management, etc…
- Test method: Credential on
- Test category: System Compliance
- Tools used: Nessus
Test Procedure:
- Execute OS Compliance scan against target
- Generate scan reports
- Check for real issues of failed compliance items
Summary of issues found:
- Compliance Failure Items of system
- System under test: Carrier VoIP Server which provides secure SIP calls
- Test method: Credential on
- Test category: Call Server
- Tools used: Codenomicon Defensics
Test Procedure:
- Setup SIP UAS message with Invite-Bye call
- Run the suite with randomized anomalies
- Check the behavior of target to the anomaly messages
Summary of issues found:
- Target switch activity to standby unit since it can’t handle anomaly in Record-Route header
- Target response improperly to the valid anomaly in Call-ID according to SIP RFC
- System under test: Call-Signaling Processing Server which is a Web UI provides signaling processing of call, secure subscriber provisioning, call routing, etc…
- Test method: Credential on
- Test category: Web Application
- Tools used: Qualys
Test Procedure:
- Execute Web Application scan against target
- Generate scan reports
- Check for real issues
Summary of issues found:
- Command Injection
- Cross-site Request Forgery
- Cookie Missing Security Attributes
Contact Us
Share with us your challenges. We are here to support.
Related Case Studies
Cybersecurity
RPA
Software Testing
Security
TMA has 10+ years of experiences providing services of Security testing and Penetration testing
Explore More
Cybersecurity
Data Science & AI/ML
A solution to monitor and classify user behaviors using AI/ML models, providing personalized security training based on individual
Explore More