Vulnerability & Risk Management

Vulnerability management lies at the core of the overall information security risk management process. This process is divided into Risk Evaluation and Risk Control parts.

Practically, the evaluation of information security risks is based upon hands-on examination of vulnerabilities, weaknesses and gaps. The follow-up acts that flow from these assessments create strong foundation for proper risk control.

Advanced vulnerability management services provided by our experienced, highly professional team ensure, that

  • identification of information security risks is thorough and complete
  • their detailed analysis establishes the real sources and impact of all uncovered issues
  • the prioritisation of risks leads to creating an effective bespoke risk reduction plan
  • the resolution of risks according to this plan brings their timely elimination or mitigation
  • vigilant monitoring of all information security risks is continuous and uninterrupted

This means all your information security worries are fully addressed.

Download a detailed Factsheet of this service here VM Summary.pdf
Download a management summary factsheet here VM Service Detail.pdf

More info on Vulnerability and Risk Management

The Risks
Malicious insiders, identity thieves and other cybercriminals could be at work, searching for any weakness in your infrastructure, network and data security, right now.

  1. The risks may come from within your organisation
  • caused deliberately, e.g. a disgruntled employee
  • caused accidentally, such as through employee carelessness
  1. The risks may arise from external sources, e.g. from a hacker or competitor
  2. The risks may come from a combination of internal (an employee involved in an insider job) and external (an accomplice to the employee) sources.

The Impact
The impact caused by such risks can be damaging to an organisation – resulting in loss of sales and income, customers and market share, intellectual property and reputation.  The average loss of a single worst security incident to a large business (>250 staff) in 2008 was in the range of £90,000 and £170,0001.  By understanding and addressing vulnerabilities and gaps your organisation can:

  • Reduce the regulatory, legal, compliance and liability problems
  • Assure important security-conscious partners and clients that their information is secure and will not go astray or leak out
  • Plan forensic investigations and prevent future incidents from happening
  • Reduce the risks inherent in remote and Internet access

The Service
Arhont specialists can assess and mitigate a wide variety of risks to support identification and elimination of both internal and external threats. We provide the following vulnerability assessment types:

  • External and Internal penetration testing
  • Web application and database testing
  • Wireless penetration testing
  • Tailored diagnostic security assessments
  • Security management/compliance audits

Benefits
Practical business advantages provided by our Vulnerability Management services can be divided into five main categories:

1. Financial benefits
Are achieved through savings made by preventing:

  • Monetary theft, valuable data loss, systems damage, services downtime, potential incident recovery, response and investigation costs and Compliance penalties

2. Technical benefits
Timely discovery and elimination of security gaps and misconfigurations greatly help to avoid unpleasant incidents, thereby

  • preserving confidentiality, integrity and availability of your data
  • ensuring uninterrupted operations of your systems.

3. Management benefits
Verifying that all data and systems, as well as business processes and employees conduct, are safe and under control is essential in maintaining an effective ISMS. Ask yourself the following questions:

  • Are your current security policies correct and followed through?
  • Are all the rules of classifying and handling confidential and valuable data in your company or organisation strictly adhered to?
  • Is confidential information leaking out, and who could be held responsible for it?
  • Are your technical staff and contractors sufficiently qualified to counter the latest security threats?
  • Are the already existing safeguards and controls adequately configured and maintained?

Arhont's independent information security audits can provide complete answers to these and other important IT, personnel and general security management questions.

4. Reputation benefits
Public exposure of fatal security breaches can seriously damage the image and reputation of your company or organisation, and shatter existing trust among current and potential customers and partners. Regular thorough assessments will clearly demonstrate your seriousness in safeguarding all data, systems and networks under your control.

5. Compliance and legal benefits
Subscribing for regular Arhont security services confirms your organisations intent to prevent incidents from happening. In the case of legal hearings, you can defend your conduct against negligence accusations.

Arhont Method

Arhont have comprehensive 12 step process that ensures the highest standards and reliability for assessments.
1. Objective Confirmation
This phase will clarify the objectives, prioritise the assessment targets and determine their validation procedures involved in the security testing.
2. Initial Reconnaissance
This is the information gathering phase where all publicly available information about the company, IT infrastructure and personnel is harvested and analysed.
3. Target Identification & Enumeration
Our specialists will determine the characteristics of all accessible services and systems to identify potential avenues to be exploited and safeguards to be verified. We identify the networks topology, operating systems version, patch levels, application versions, firewall rulesets, user account information, shares, etc.
4. Vulnerability Mapping
Discovering and analysing vulnerabilities and other security issues of all systems and services found during the Target Identification phase.
4a. Vulnerability Discovery:
Due to significant limitations of automated testing tools, all of our testing is performed and verified manually using a proprietary, repeatable and consistent methodology. This allows us to    discover and remedy novel, previously unreported vulnerabilities.
4b. Vulnerability Analysis:
Our specialists will thoroughly examine the vulnerabilities that may cause hazards to the production environment. At this stage, we will completely discard all false positives.
5. Escalate Privileges
We launch simulated attacks against the targets that were previously inaccessible. The key to this phase is hands-on approach.  No automated tool can duplicate the wits of our experienced specialists skilled in the art.
6. Exploitation Analysis
Our specialists assess security flaws uncovered by analysing the risk level of the vulnerabilities and the true consequences of exploitation.  A complex, strategic, unified approach to the vulnerability analysis is the key to its success.
7. Synthetic Risk Analysis
Only detailed threat, vulnerability origins and impact analysis by experienced professionals, who are capable of grasping the whole picture of the security state, can provide a realistic risk assessment.
8. Risk Reduction Planning
We will then prioritise all the discovered issues in terms of business risks and achievability. Remedies to these risks will also be prioritised on the basis of their criticality, availability and complexity.
9. Report
Our specialists work with you to develop a report that provides concise findings, clear to follow recommendations, and a prioritised list of rectifying actions. We will provide a separate Executive report, which is not technical, but provides clear summary for the management regarding the risks and our assessment of their impact, likelihood and mitigation.
10. Debrief
An onsite debrief meeting, where our specialists will go through the report to ensure it has been fully understood and that all objectives have been successfully met.
11. Recommendations Support
Our specialists will be available to provide additional support for the findings, and for any other assistance that may be required to carry out remediation work.
12. Optional
For a complete security assessment, we would recommend that the human factor is also tested. We also strongly advise, and can assist you, in reviewing existing Information Security Management System (ISMS) by scrutinising security programmes, plans, documentation and processes.

Why Use Arhont?

  • Arhont was founded in 2001 by professionals who were passionate about information security and wanted to set up a specialist security service provider that would provide realistic vulnerability assessments and offer real world practical advice.
  • Our passion for information security means we are at the forefront of current developments, and are well known amongst the international security community via multiple publications and complimentary tools.
  • These include the first books ever written on the subject of practical wireless attacks and defence, and security assessment of Cisco-based IT infrastructure.
  • Every Arhont specialist has a minimum 10 years practical experience and we employ leading experts in different fields of information security. Our professionals are MSc or PhD-educated.
  • Our hands-on experience enables us to undertake a wide implementation of necessary countermeasures in versatile environments.
  • One of the key founding principles was that Arhont remain independent by not partnering with suppliers or vendors selling any hardware and software, so that any advice given to our clients remains impartial and is always right for you.
  • Arhont specialists are always up to date on security matters, and keep abreast of all new development and threats.  We have an extensive record of contributing to various security-related communities, newsgroups and relevant press publications.
  • Our experts have extensive experience of working with various "flavours" of UNIX-compliant systems, Microsoft products and leading wireless and wired networking appliances.
  • We are well-versed in applied cryptography, configuration, evaluation, remote & local penetration and hardening of servers, workstations, specialised security appliances and other hosts.