Secure Network’s Red Team is highly specialized and competent in most fields of security, guaranteeing protection that is dependable.
A Vulnerability Assessment (VA) is a non-intrusive approach used to produce a prioritized list of security vulnerabilities, based on the risk associated to their potential exploitation.
A Penetration Test (PT) uses an intrusive and vertical approach to demonstrate how damaging security vulnerabilities could be in a real attack. It is an intensive service, as opposed to the vulnerability assessment that is an extensive one.
Applications process and handle most of a company’s information, including critical data. Custom applications have become an easy to reach and popular target for attackers.
It is therefore important to test your applications using the same techniques and tools used during a real-world attack, verifying the practical effectiveness of implemented security measures. Our Red Team employs the latest techniques, along with professional tools, to identify and exploit application vulnerabilities, in order to demonstrate what a compromise of your most sensitive information really means.
Our Penetration Testing activities are designed with a top-down approach, aimed at a specific goal, such as the compromise of a critical database or the theft of relevant data, which allows to verify the real impact of the identified vulnerabilities during a real attack.
The assessment results are documented in a report that contains the complete list of identified vulnerabilities, classified according to their relevance through a risk-based standard methodology. To assist during the vulnerabilities fixing process, all detected issues are widely detailed, including the necessary steps to reproduce them, and for each one suggestions and directions for the proper fix are provided.
Web applications store our personal information, manage our finances, share our documents and are an integral part of our everyday life, even during work activities.
Ensuring the security of these applications is essential to keep your information and services secure, minimizing the risk of cyber attacks. Security analysis is necessary even when end-users cannot directly operate on the application, like when dealing with APIs and web services.
Using a methodology based on the Open Web Application Security Project (OWASP) Testing Guide, Secure Network analyses your web applications, detailing every discovered vulnerability and suggests how to resolve it. Furthermore, all detected vulnerabilities are classified using the OWASP Risk Scoring Methodology
Smartphones and tablets are now ubiquitous, inside they bring with them our personal information and our business documents. The extended use of these devices, in both private and business activities, has attracted the attention of attackers, lured by new opportunities for data theft.
Secure Network provides professional Penetration Tests of the major mobile platforms: Android, iOS, Windows Phone and BlackBerry. Furthermore, Secure Network also analyses applications for Windows 8, developed for desktops, laptops and for the Microsoft Surface tablet.
Through a process analysis based on the OWASP Mobile Project methodology, Secure Network’s engineers check the security of the application. Analyses are also performed on the transmission protocols to ensure that information is safety transmitted to the back-end systems. The analysis is completed by the Penetration Test of back-end system with a methodology similar to that used for Penetration Test of Web Application and Web Services.
Although the current trend is moving applications to the web, desktop applications (thin and fat clients) are still widespread, especially in business environments. For this reason, analysing the security of such software is an important task for any company that relies on them for its critical processes.
The security analysis of these kinds of applications, however, presents different problems than their web and mobile counterparts, and that must be addressed with particular care. For this reason, Secure Network developed a custom methodology, based on the indications of OWASP, to ensure that even the analysis of these applications are extensive and complete.
Although comprehensive protection against the cracking and reverse engineering of applications is impossible, the addition of a solid layer of security cen help delay the attackers and make the malicious activity economically disadvantageous.
Secure Network verifies the robustness of licensing systems implemented in your applications to ensure that they are accessed only by users holding a regular license.
In addition, to make sure that the application is safe at other levels, Secure Network analyzes the obfuscation and anti-debugging techniques used to protect the application source code from reverse engineering.
The security of modern companies depends on the security of their most important infrastructures, which are the bases for their systems, applications and information protection.
By focusing on the actual customers’ needs, Secure Network performs different kinds of analysis depending on the desired result. These analyses can be performed from within the corporate network and offices or directly from Internet, acting like a real external attacker.
The security of your infrastructure plays a vital role and it is for this very reason that our Team is not limited to use automatic tools, but thoroughly analyses each problem, often using custom tools developed for each specific purpose.
The documentation provided after the analysis ensures that the customer fully understands the impacts associated with the identified vulnerabilities, and is able to reproduce themselves.Furthermore, to facilitate the fixing process of the identified vulnerabilities, Secure Network presents to its clients an action plan that includes the priority of individual issues, calculated using the international standard Common Vulnerability Scoring System (CVSS), and the suggested methods to properly fix them.
The analysis of corporate infrastructures allows to verify the effectiveness of the implemented security controls and to identify ways that a real attacker could exploit to compromise the target systems. These analyses can be performed either from inside the corporate internal network or directly from the Internet (external network).
Using professional tools and a specific methodology based on the Open Source Security Testing Methodology Manual (OSSTMM), Secure Network is able to perform a thorough analysis that can assess the individual issues based on their direct impact on your business.
Wireless networks are widely used both in personal and in corporate environments, providing a convenient alternative to traditional wired networks, but also creating new opportunities for attackers to gain access to your internal networks. To prevent wireless networks from becoming uncontrolled entry points to internal networks and critical business systems, it’s necessary to identify and fix the security issues that can lead to their compromise.
Using a tested methodology, which includes an analysis of the network’s infrastructure, targeted attack scenarios are designed to identify the existing vulnerabilities and their possible exploitation in order to compromise the network integrity. For this purpose, specialised tools are employed to get a detailed insight of the issues, which are then sorted according to their impact in order to help you fix the critical problems first.
The security of a company must not only take into account the applications and the critical infrastructures, but also the tools used by its employees to handle the daily business activities: the corporate workstations. Workstations and their users are indeed one of the favourite targets for attackers who exploit people’s lack of attention the reduced security measures implemented to gain access to internal networks and steal confidential information.
The workstations analysis is performed on standard systems configured for your employees, in order to determine whether it is possible to carry out real attacks on these systems or to exploit them as a bridge to more critical systems. Furthermore, the threats often do not come exclusively from the outside, but also arise within company, which must therefore protect against rogue employees who intend to steal critical information or, more generally, cause economic damage. To check the security of the company against possible internal attacks, we place ourselves in the same conditions of your employees and we use the standard workstations to perform the analysis.
Thanks to their many advantages, virtual infrastructures are now widely employed in corporate environments to manage large amounts of systems, including those most critical to the business. The security of these infrastructures and their administrative networks and interfaces becomes a key element to ensure the security of corporate information and services.
Secure Network was one of the first companies to develop in 2009 a methodology and several tools to analyse the security of virtual networks. Among these was VASTO (Virtualization Assessment Toolkit), the first toolkit for penetration testing of virtual networks, including solutions by VMware, Xen and Oracle.
With a wide experience in this field, Secure Network challenges your virtual infrastructure through targeted attacks aimed at its compromise. Tests may also include the review of the infrastructure management process and of network configuration in order to identifiy further vulnerabilities.
Enterprise Resource Planning (ERP) systems, including the market leader SAP, handleall kinds of business information, from human resources to production and payments management.
These systems have grown exponentially over the years and are now used as a container for diverse data. Because of their complexity, ERP systems are often configured and managed without regarding their security, leading even to their exposure on Internet.
Secure Network checks your ERP subystems for existing vulnerabilities, executing attacks from both the Internet and the internal network, acting as external attackers or rogue employees. Secure Network employs the same tools and the same techniques used by real attackers to compromise your most critical data.
Industrial Control Systems (ICS) and SCADA (Supervisory Control and Data Acquisition) are commonly implemented to control and manage complex industrial infrastructures, including electric utilities and gas pipelines. The critical nature of these systems, together with their complexity, makes them a high-value target and exposes them to significant threats.
The experience of Secure Network regarding the security of information systems used in the electricity and hydrocarbons fields, in Italy and abroad, can address the security challenges of these systems, which are very different from those found in more common contexts and technologies.
Secure Network is able to analyse the security of your infrastructure, paying particular attention to maintaining the availability of individual devices or the entire infrastructure.
The middleware layer allows applications on different systems to communicate with each other, exchanging all kinds of data and information through a unified solution.
Although the reliability guaranteed by middleware solutions is a key element for critical business systems, the security of these infrastructures is often ignored, partly because of the limited information on the subject and the lack of tools to analyze it.
For this reason, Secure Network has developed an ad-hoc methodology to perform Penetration Tests on middleware infrastructures, with a particular focus on IBM MQ and RabbitMQ.
An in-depth analysis of the source code is the key to effectively identify security vulnerabilities in your applications. Furthermore, addressing these issues during the development cycle of the software, and not in a production environment, can also reduce the time and costs associated with the process to fix the identified bugs and vulnerabilities.
Secure Network has developed a process that integrates automated tools with an in-depth manual analysis of the code, overcoming the technological limitations imposed by automated scanners, reducing false positives and identifying even the most complex vulnerabilities.
The result of the analysis is well documented, ensuring that your development team is able to find any issues identified, understanding their impact and the correct resolution, avoiding to introduce them again in the future.
The experience of Secure Network allows it to offer its Code Review services for web applications and web services, desktop applications, and the increasingly popular smartphones and tablets applications.
Web Apps & Services
Mobile Applications
Thick/Fat Clients
Embedded Devices
ABAP for SAP
Windows 8 Apps
Digital Forensics is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime.
Since a digital forensic evidence must be derived by the scientific method in order to be reliable and eligible to be admitted in court, whenever possible Secure Network adopts software, tools and methodologies with a verifiable mode of operation.
According to the international best practices and current standards, the only way to analyse an evidence when the original one is not available is performing a forensic copy of sequestered storage device, which means duplicating it in a way able to preserve its integrity.
“bit for bit” copy technique and hash calculation of acquired evidence must be implemented by the acquisition process in order to be considered reliable, repeatable and to guarantee the completeness of duplicattion process. Only with proper procedures and a bit for bit copy it is possible to ensure data integrity and maintaining the Chain of Custody (CoC) throughout the whole process.
By using specific procedures and analysis algorithms, it is possibile extracting apparently unavailable data due to its deletion from memory storage. These procedures rely on the common way the operating system manages disk space, marking the regions related to deleted files as free instead of wiping them.
The experience gained through the years contributed building the needed know-how to successfully manage digital investigation activity on the most common device. We are specialized on mobile forensics, a branch of digital forensics encompassing acquisition and analysis of mobile devices.
In case of a dispute between clients and suppliers, code review activity can be performed to verify if a software is correctly designed and implemented with respect to the given requirements and constraints. A certification of its characteristics is then provided, if required.
In case of an incident like a system intrusion, a proper incident handling process must involve computer forensics activities aimed to support the investigation, like evidence identification and acquisition, data extraction, information analysis and results documentation.
Forensics process allows to check data integrity, detecting vectors used by attackers and identifying who is responsible for the incident.
Malware analysis is performed by highly skilled analysts and it is aimed to understand the malicious software logic. Acquired knowledge is then used to develop effective counter-measures, proper risk management strategies and to enhance effectiveness of IPS and antivirus software.
Even before meeting every specific regulatory requirement, the achievement of internationally recognized standards ensures that your company effectively reduces the risks related to possible fraud and cyber-attacks.
The experience gained in the main international standards (e.g. ISO/IEC 27001 , PCI DSS) and national laws (Privacy) is accompanied by a thorough analysis, ensuring a complete and updated overview of all the involved systems and processes. It is also possible obtain a detailed action plan to address the deficiencies and achieve compliance with pre-established, gaining, at the same time, an enhanced level of security.
The policies form the basis of any security plan and define the requirements to be followed and rules that must be adhered to in different business areas. These documents provide, together with the implementation of appropriate technological tools, which all entities involved realize security measures in the form prescribed respecting the mandatory regulations and contributing to the security company.
The documents drafting takes place after a thorough analysis, technological and otherwise, of the Company in order to define the rules that are effectively implemented and able to respond to the real company needs.
An accurate and complete risk analysis allows to identify the exact vulnerabilities and threats that can compromise systems and critical information, providing, at the end of the analysis, an appropriate plan for their resolution.
The first step is defining the scope of analysis, which can be composed by single assets or complex infrastructures, and then identifying current threats on those targets. By analyzing implemented security policies we can estimate actual risks, categorize them and define proper mitigation processes.
Introducing security early in the design process is imperative for creating a trustworthy product. The Tiger team works with you step-by-step through the product’s development, contributing with excellent skills in embedded security to your product design team.
Our goal is to help your business making educated decisions and understanding threats your product could be exposed to. With this knowledge, we make sure your product has the security implementations it needs to possess. Our job is also about providing support developing and rolling out security features that could be essential to run your product in complete security for both your customers and your business.
Modern embedded devices are complex systems, with a wide variety of features. This makes space for attackers to exploit the products’ exposures.
Starting by setting up specific goals, our device penetration testing services apply real-world attacks to your product to identify potential vulnerabilities.
Reporting is the final step, and it provides a list of the issues revealed, including details on severity, reproduction steps, and suggestions for mitigation. Thanks to the information reported by our experts, fixes can be applied in a timely manner to prevent the vulnerabilities from being exploited in production.
Through the analysis of source code, we are able to identify vulnerabilities present in your product. By identifying these issues, root cause can be determined and fixes can be deployed in a timely manner.
Our experience with firmware development enables us to determine the most security critical areas of your code base, apply automated and manual methods to identify issues, and recommend fixes for each issue present. The final report provides information on how to fix the issues present, and helps prevent the same issues from happening again. By applying fixes before moving to a production environment, costs and risk are reduced.
Today, many facilities are protected by electronic access controls systems, typically using RFID cards for authentication. Our research has found numerous issues in these systems, which make them simple for attackers to defeat.
Our Access Controls Penetration Testing services consist of a real-world attack on your facility, combined with an audit of the technologies used. The aim is to identify the spectrum of attacks that could be used to gain unauthorized access, forge credentials, and tamper with access logging. The reporting consists of an overview of the system weakness, and specific countermeasures that can be applied to better secure your facility. Our goal is to provide both effective solutions that can be deployed immediately, as well as longer term upgrades.
Modern vehicles incorporate tens of Electronic Control Units (ECUs), driven by as much as 100,000,000 lines of code and tightly interconnected via internal networks. As repeatedly proven by security researchers, unconscious adoption of poorly configured components, unaware network design or insufficient understanding of employed technologies limitations may enable a plethora of local and also remote attacks to vehicles, causing great harm to manufacturer’s image and obliging to expensive post-selling recalls.
Our Team can guide you through the vehicle’s design process with the aim of realizing secure by-design internal networks, while at the same time minimizing the impact over the end-user experience and vehicle’s intended functionality. In addition, our experts can accomplish security assessments to selected modules, in order to judge their resilience to external attacks, simulate post-exploitation scenarios and propose effective mitigations.