Managed Services Monitoring and Management Security Support
Security Support
IPsoft will undertake responsibility for comprehensive security provisioning. For IPsoft to deliver guaranteed security coverage, the customer environment needs to be secured at each security layer: the physical, network, system, application, datastore, and process components of the system. Since each component has unique vulnerabilities, security will be viewed in layers. With a layered approach to security, it is important to understand that a system is only as secure as the weakest link. Each layer of security is dependent on the other layers. The absence of adequate controls in one layer of security can weaken the controls present in the other layers. Risk Assessments IPsoft will undertake on-going security assessment at each of the following five main security risks to the Customer's infrastructure. Exposures to these risks span across all security layers and should be mitigated within each layer:
IPsoft will assume off-hours responsibility to mitigate security risks in the above identified layers for Customer systems. The chart below presents the security risks and identifies at which layer the risk may occur. Security Attacks Covered The major attacks and vulnerabilities to the system discussed throughout the document are based on the information sensitivity and system criticality of the Customer system/application. The table below presents the attacks that are analyzed and their associated layer sensitivities. The chart below maps each security attack to the potential risks to the Customer system's security. Checks Performed IPsoft deploys checks for continual security monitoring. These include the following. Only representative checks are included as there are over 1400 checks total. Summary of Service Checks PerformedApplication Vulnerability Check Apache Web Server Server Info SQL Authorization Batch Executables Chunked Encoding Exposed Directory Listings Exposed ASP Source SSL Overflow BIND Domain Name Service Daemon Server Info Version Query ZXFR Vulnerability iQuery Vulnerability Cisco Router Exploits AIRONet Denial of Service Cisco 675 HTTP Denial of Service Unauthenticated Login GSR ACL Errors HTTP Administrative Access SSH Vulnerabilities VOIP Denial of Service Washington University FTPd Anonymous FTP Available WUFTPd Backdoor Bounce Attacks CWS Root PASV Denial of Service PASV On Connect Stack Overflows Root Access Microsoft Internet Information Services (IIS) Buffer Overflows UTF8 Decode Bug Fragmented Packet Disclosures Directory Transversal Bug Default.ida Authentication Bypass MS Frontpage Denial of Service IIS FTP Denial of Service ISASP Overflow Malformed Request Ignores Security Parameters Various Perl Exploits Default Scripts Left Available Administrative Access Remotely Accessible Oracle Enterprise Database Server DAD Admin Open Listener Accepts Unauthenticated Requests Java Process Manager Buffer Overflow Java Server Pages Source Visible PLSQL Buffer Overflow MOD_PLSQL (Apache/Oracle) Directory Transversal Unauthenticated Web Admin Server Allows Unauthenticated Access MySQL Database Invalid Password Server Information No Password Unrestricted Root Access OpenSSH Secure Shell Daemon Channel Open Server Information Uses Login Environment Buffer Overflows AFS Vulnerabilities CRC32 Validation Error Kerberos Validation Error PHP Web Scripting Language Server Information IMAP Overflow Safe Mode Enabled Qualcomm POP-3 Mail Daemon QPopper Server Information Buffer Overflow Leads to Remote Administrative Access EUIDL Enabled Allowing Excessive System Information to Unauthenticated Users Denial of Service SNMP Server Information Default Communities Enabled Denial of Service Attack IFaces Enabled LANMAN Services Vulnerability Oversized Length Field Xdmid Enabled
Security Administration IPsoft will 24x7 monitor the security of the server and apply system and network corrections to mitigate breaches. In the event of security attack detection, IPsoft will expeditiously place filters and/or patches to insulate the server from the attack. Routine services required to configure a secure eCommerce environment would include the following. Summary of System Security Management Services
IPsoft will inform Customer about security events affecting the Customer. Information and advisories regarding generic security problems issued by CERT will be regularly reviewed and distributed to the customer (if applicable to the customer) by IPsoft Operations staff. Customers may designate a list of up to five security contacts who will be authorized to request site disconnection or reconnection as necessary. Security Audit IPsoft will conduct periodic audit for Customer system and network security. This would include: Summary of Security Auditing Services
IPsoft will configure and intelligently monitor Customer's chosen intrusion detection system (IDS), Internet Security Scanner. Summary of Intrusion Detection Services
As a follow-up to the system security audits, IPsoft will perform penetration testing from privileged accounts, unprivileged accounts, and the internet at large. Summary of Penetration Testing Services
IPsoft will analyze the security of Internet and Intranet firewalls being utilized for securing access to Customer. Summary of Firewall Deployment and Maintenance Services
IPsoft will implement and maintain web security measures to guarantee the security and integrity of Customer. Summary of Web Commerce Security Services
|