Self Assessment Questionnaire

Vendor Risks

59% of Security Compromises Occur at the Vendor and/or Service Provider Level

You have successfully implemented patch management, limited user rights, configured anti-virus properly on all machines, and strong web content filtering has been implemented. But what about the risk invited directly into your network? The issue is twofold. Firstly, it concerns vendor-operated equipment which a vendor dumps onto your network insecurely. While the vendor may be "responsible" for these machines, you are inviting risk into your network by allowing them to operate in a vulnerable manner. Many ATM Machines, for instance, are no more than poorly configured out of date windows machines.

Are you allowed to audit any of their IT assets that exist on your network?

Are all 3rd party devices on your network up-to-date and patched?

Secondly, there is the serious issue of service providers you connect to and who - in turn - you allow connections from, often directly into the internal network. Connecting to these companies who are possibly insecure, results in your organization remaining in the shadow of their insecurity and introduces risk:

Do you trust they have secured their own network from intrusion?

Do you trust their employees?

Do they have an adequate employee background check and vetting process?

Unlike many other risk areas, which are more tangible and can be mitigated through a configuration tweak or with improved policies, service provider oversight issues are much more challenging to tackle. The time frame for effective mitigation is also more extended, as it requires communicating this issue to the vendor or provider and then leveraging a change in their security posture.

Have you reviewed their service level agreements and security policies to ensure they are consistent with or more stringent than yours?

Have you obtained past security audits?

Do those audits focus on the assets that implement your service?

Website:

1 in 3 websites can be Compromised

Our team is capable of compromising approximately 1/3 of the transactional websites that we audit. Attacks focused specifically on web applications are a recent but rapidly growing risk are that all industries should be aware of. Web attacks are often based on injecting remote commands into a website's backend database through the use of seemingly innocuous text input forms and the insertion of simple characters. This can result in an attacker harvesting the entire customer database or even completely compromising the network. The following 4 questions address the bulk of website security risk:

In user input properly escapade and sanitized before displaying and inserting into database?

Have you ensured that session IDs are suitably unique and random?

Are all session IDs connected only over HTTPS?

Are your web users and their data adequately segregated from each other on the website?

Firewalls:

60% of Firewalls are Mis-Configured

Despite the fundamental security role that firewalls play for virtually all organizations, some executives, auditors and IT staff remain complacent in their approach to managing the risk associated with this control. This is a flawed approach, because in this case the devil is in the details and a minute configuration error, such as a typo or redundant line, can significantly degrade the value of this control. Of the many security controls likely deployed throughout an institution's network, subtle firewall-based risks are a significant area of auditing responsiblilty for management to consider. This is because the are heavily relied upon and considered quite basic, but in reality they are heavily prone to extremely subtle configuration-based errors.

Is egress filtering implemented?

Are important filters rendered useless by a default/implicit rule set?

Management may not understand specific firewall configuration syntaz, but enforcing policies and procedures which ensure that the firewall is strictly peer-reviewed, tested and assessed by experts is crucial. Are configurations regularly peer reviewed/double checked?

DMZ

Consistently Mis-Configured

DMZ(demilitarized zone) is a name for a network that is segregated from the rest of the internal network. Segmentation is the process of breaking up your network into different security zones. This means consciously placing confidential data in distinct security zones. DMZs are often used to host servers that have access directly from the internet, for example, web servers and email servers. The assumption is that all publicly accessible servers will ultimately be compromised sooner or later; if they are, you don't want your entire network and data to be compromised, so keep them segregated on a properly configured DMZ. The problem is that about half of the DMZs our audit team reviews are mis-configured and don't always provide the protection that you expect.

Is the firewall that implements the DMZ configured correclty to ensure that the internal network is properly segmented from teh DMZ?

While obvious servers such as email and website mahy be in the DMZ- are all internet accessible servers hosted on the DMZ?

Validation:

Many security controls exist, but are not achieving the desired result

Much of the security risk we identify during the course of our audits is not due to a missing security control. Instead the risk is usually associated with an existing control that is not configured correctly and is not providing the intended security. We call this the gear myth which we have documented on our blog. Besides not providing the risk mitigation that you might expect, mis-configured controls are even more dangerousin that they may provide a false sense of security - sometimes it is better to have a missing control that you are aware of rather than an existing control thta you are not aware is ineffective. The following question address the general category of risk.

Peer Review: Is there a process for verifying configurations and deployments of IT systems?

Server Deployment: Are servers really deployed up to current standards?

Do you periodically review/audit servers on your network?

Add up your scores to determine your total score