As a niche penetration testing service provider, we pride ourselves on delivering to the highest standard
A fully managed and adaptable vulnerability scanning service using the best tools available today. We can help you to stay aware of the ever-changing security landscape
Strategic insight, compliance and legislative consultancy. We listen carefully and provide the right, timely advice
[su_spoiler title="SEE FULL LIST OF SECURITY TEST SERVICES" class="my-custom-spoiler"]PENETRATION TESTING
TISS Ltd offer a comprehensive range of testing and assurance services that will provide you with a measurement of risk exposure and advice on how to best secure your assets. Internal and external Penetration Testing can be conducted from a Black, White, or Gray Box perspective.
• Test the security of your technology
• Test the security awareness of your people
• Test the strength of your processes
• Identify and address the weaknesses and exposures in your business
TISS Ltd is a leading provider of penetration testing, with broad experience of network infrastructure and technologies in use today.
Testing is conducted from ‘Black, White or Grey Box’ perspectives, depending on project needs.
Penetration testing can be performed remotely to simulate an attack over the internet, or internally as by an individual with physical access to your network.
Services Offered Include;
•External penetration testing
•Internal penetration testing
•Wireless penetration testing
•Web application assessments
•Mobile application assessments
•Firewall configuration and rule set reviews
•OS, Database and Web server configuration reviews
TISS Ltd’s penetration testing methodologies are comprehensive and drawn from standard and global models designed to offer our clients maximum assurance whilst ensuring that testing is non disruptive and safe. Please get in touch with us us to discuss you penetration testing needs .
WEB SECURITY ASSESSMENT
Testing consists of discovering the vulnerabilities within and the likely threats to both your Website and Applications. It can be quite alarming to be told you’re vulnerable so we are equally adept at helping our clients find and implement solutions that mitigate or reduce the risk of compromise.
• Web application security assessment
• Application threat modelling
• Automated and manual code analysis
• Web server configuration assessment
With intimate knowledge of all the common coding platforms, as well as many of the more obscure ones, TISS Ltd is well placed to help assure the security of your systems, however complex.
Our web testing methodologies are well proven, and are drawn from industry bodies such as OWASP and many others.
Web security assessments are comprehensive but particular focus is given to;
• Authentication and Authorisation mechanisms
• Session security and management
• Cryptographic storage and transmission of data
• Application logic
• Input validation and data sanitisation
• Error trapping and information leakage
TISS Ltd's testing will identify vulnerabilities that could adversely compromise the confidentiality, integrity and availability of your system and data. Our success is based on our attention to detail, years of experience and focus on your specific needs and technology.
All web security tests require detailed planning and scoping. Please contact us to start discussing your project needs with a senior testing consultant.
We also offer source code review, security within the development lifecycle and workshops for developers enabling secure code development.
DATABASE SECURITY TESTING
If your organization collects and processes data, you face two major challenges: how to meet data compliance requirements and how to effectively protect from data theft and distortion. TISS data security solutions and services help you discover your database assets and risks, protect sensitive data, and comply with company governance and mandated regulations.
TISS data protection solutions address all aspects of database security and compliance with database auditing and real-time protection that will not impact performance or availability. TISS scales to support the largest database and Big Data installations. By automating security and compliance, it is not surprising that thousands many of organizations choose us to safeguard their most valuable assets.
The scope of what our experts perform is wide but below are the key focus areas;
• Discover and help classify sensitive databases
• Audit all access to sensitive data across all data stores
• Identify excessive user rights and dormant users, and enable a complete rights review cycle
• Protect RDBMS, data warehouses, Big Data platforms, and mainframe databases
• Alert, quarantine, and block database attacks and unauthorized activities in real time
• Accelerate incident response and forensics investigations with advanced analytics
• Match your evolving IT needs for high availability clustering and Amazon Web Services (AWS) cloud deployment
• Provide rapid time-to-value and predictable costs without negatively impacting database performance
ADVANCED SIMULATED ATTACK SERVICES
Advanced simulated attacks (ASA) allow for thorough in depth testing that could not be otherwise done on a production network with the risk of downtime. We simulate various high-level real world attacks with or without specific goals in mind.
• Latest security vulnerabilities exercised and utilise different attack vectors
• Notes detailing what was done and how to defend against it in the future
• Hardening and tuning your defensive systems for optimum security
Organisations generally approach security testing as a series of projects, aimed at assuring specific elements of hardware or software, rarely assessing the impact of these changes to the organisation as a whole.
Traditional security programmes that segment security into specific tests will inevitably be subjected to the rule of diminished returns, as the organisation’s security maturity increases. It is at this point that an organisation’s information security performance indicators are seen to flat-line, generally due to a combination of the following factors:
• Thoroughness of the current testing regime
• Reduction in information security budget
• Inter-system dependencies introduce hidden vulnerabilities
• Unidentified process-related vulnerabilities
Advanced Simulated Attack looks to provide a comprehensive check of the organisation’s vulnerabilities without limitations such as scope or omissions due to the operational impact of live testing.
It looks to identify vulnerabilities in the way the organisation does business and crafts specific scenarios around these. It’s only suitable for organisations that have mature security practices, looking to quantify their ability to defend against systematic and organised threat actors.
One of the concerns we hear from our clients is the expenditure of huge amounts of time researching an organisation in order to create attack scenarios. We don’t believe in wasting time, so we look to understand the business by engaging with the people that really understand the processes and systems that underpin it – you
SOCIAL ENGINEERING SERVICES
We take social engineering testing seriously, we perform multi pronged attack such as using telephone pre-texting, vishing, phishing and browser based exploitation attacks. Here are some of the most common goals:
• Obtain access to premises and steal equipment
• Collect information, plant rogue devices
• Social engineer employees for information
When assessing the security of any system or organisation, it is important to factor in the human and physical elements. Conducting periodic physical penetration testing and social engineering helps promote security awareness, and identifies areas where greater control may be required in order to stay within the tolerance of the organisation’s risk appetite.
TISS Ltd provides a tailored suite of services to ensure that any social engineering undertaken is both realisticrealistic, relevant and comprehensive. All services include open source profiling of your organisation, identifying targets and allowing the construction of pertinent pretexts and scenarios. Telephone Pre-texting and Vishing – Pre-texting is one of the oldest forms of social engineering, tricking an individual into divulging confidential and privileged information or prompting them to perform actions which impact the security of their organisation.
Physical Penetration Testing – Targeted physical testing, utilising techniques such as tailgating and pre-texting, will identify vulnerabilities in the way an organisation has structured or implemented physical security controls. It will usually have a specific aim or ‘flag’ that indicates that we’ve been successful in defeating these controls, such as a ‘stolen’ laptop or other sensitive asset. The assessment’s scope could equally encompass a full review of site security.
Phishing – The targeted emailing of members of the organisation, directing them to a malicious website to enter sensitive information.
Browser exploitation and extrusion attacks – Normally this form of attack will be orchestrated with another, such as phishing. The aim is to exploit the installed browser, gain control of the workstation and use this as a bridgehead or pivot point to attack other elements of an organisation’s network.
Malware susceptibility – It is important that the controls in place are robust enough to prevent a staff member introducing malware into your organisation. We will confirm this via a variety of vectors such as lost hardware or controlled access to malicious software embedded in hardware devices. Carefully planned exercises are invaluable in highlighting areas of risk and providing context around the security posture of an organisation. In the last 6 months a longlist of publicly listed businesses has been targeted by browser exploitation and extrusion attacks with varying degrees of impact.
Traditionally viewed by organisations as a nice-to-have, social engineering should now be considered an essential component of any security programme.
For more information about social engineering and the benefits it brings, please contact one of our security consultants, via the form below or request a call back
. MANAGED VULNERABILITY SCANNING SERVICES
Regular re-testing of your network infrastructure is an important step in identifying compromises to your IT systems.
It can also help to identify advanced persistent threats (APT) or other malware attacks. Recommended for any organisation with public-facing servers and interactive websites;
• Quarterly, monthly and on demand scanning arrangements
• Pin point your most vulnerable IP’s
• Maintain regulatory compliance
Managed Vulnerability Scanning (MVS) is best suited for businesses wishing to conduct regular testing of their network infrastructure to ensure continued high level of security and threat assessment.
Our specialised pen testing team uses a combination of vulnerability scanning tools to identify any vulnerabilities which may be present and provide you with detailed information on how to mitigate the threat to your organisation.
TISS Ltd’s Managed Vulnerability Scanning is comprehensive; particular focus is given to:
• External infrastructure vulnerability assessments
• Identification and removal of false positives
• Web application assessments
• Internal network vulnerability assessments
TISS Ltd’s Managed Vulnerability Scanning service will allow you to ascertain your current vulnerability posture enabling you to control and manage risk.
NETWORK INFRASTRUCTURE ASSESSMENT SERVICES
Your network infrastructure transports the lifeblood of your organisation, information. We will assess your organisation’s core, distribution and access level network infrastructure to identify areas of the network that expose key components to the myriad of threats out there.
• We can evaluate IDS/IPS and other alerting or control mechanisms.
• Firewall and network topography reviews
• Network segmentation analysis and data flow analysis
• VPN Evaluation
We help identify where the architecture of your network can be more effective and provide workable advice to improve.
TISS Ltd ARE LEADING PROVIDERS OF PENETRATION TESTING, WITH BROAD EXPERIENCE OF NETWORK INFRASTRUCTURE AND TECHNOLOGIES IN USE TODAY
Given the dependence on network devices such as firewalls, routers, switches and Intrusion Detection Systems (IDS) to maintain security, clients commonly request that these solutions are subject to further review, over and above that offered by an infrastructure penetration test. With direct access to these systems, our consultants can conduct a comprehensive review evaluating all aspects of the configuration that can impact security; how the firewall has been set up, the software versions in use and the modules that have been added. For firewalls and similar devices, the exercise can be extended to cover a review of the rule base.
For solutions that provide alerting, blocking or filtering (IDS, IPS, application firewalls, etc.), TISS can conduct controlled testing to evaluate the effectiveness of these systems. The type of testing covers the fundamental abilities of the system, the configuration that has been applied and how security staff interpret and respond to alerts. Whilst designed for live networks, this type of testing is equally applicable to systems under evaluation.
Testing is conducted from ‘Black, White or Grey Box’ perspectives, depending on project needs. Penetration testing can be performed remotely to simulate an attack over the internet, or internally as by an individual with physical access to your network.
Services Offered Include:
• External penetration testing
• Internal penetration testing
• Wireless penetration testing
• Firewall configuration and rule set reviews
• OS, Database and Web server configuration reviews
TISS Ltd’s penetration testing methodologies are comprehensive and drawn from global standards, designed to offer our clients maximum assurance whilst ensuring that testing is non disruptive and safe. Please get in touch with us us to discuss you penetration testing needs .
Configuration and implementation problems can lead to unauthorised access to sensitive information or networks; often without the intruder even setting foot inside a building. Therefore, wireless networks require close monitoring and periodic assessments to mitigate the exposure to security threats.
The purpose of a wireless assessment is to interrogate a wireless infrastructure, and to provide assurance that it cannot be used to compromise the integrity and confidentiality of an organisations network or data. In most cases the footprint of a wireless network will extend beyond the desired area. This effectively extends the network boundary beyond the physical boundary of private premises and into public space. The majority of mobile devices supplied today have wireless connectivity hardware enabled by default. An attacker can use such a wireless interface as a beachhead for further attacks into the wired corporate network infrastructure.
Whilst attacks against wireless networks have received less media attention of late, the attack vectors that gained notoriety throughout the last decade remain present and demand attention. TISS Ltd’s approach provides options for testing the full range of threats to a corporate wireless network, including authentication, encryption, segregation of guest and corporate services, the ability to compromise wireless clients and wireless denial of service testing.
Testing consists of discovering the vulnerabilities within and the likely threats to both your Website and Applications. It can be quite alarming to be told you’re vulnerable so we are equally adept at helping our clients find and implement solutions that mitigate or reduce the risk of compromise.
[su_spoiler title="SEE FULL LIST OF THREAT RESPONSE SERVICES" class="my-custom-spoiler"]SECURITY INCIDENT RESPONSE SERVICES
Responding quickly is key to any security breach, we provide incident handling and management services and track the threats down one by one. We strive act quickly and minimise the duration of impact by;
• Pinpointing source of breach
• Device isolation and network tapping
• Forensic analysis of logs and performance of forensic host intrusion analysis to build up a timeline of what happened and how it happened.
• In most of our cases we can trace back to the source of attack, this information can be forwarded onto authorities
TISS Ltd incident response services are comprehensive, but particular focus is given to:
•Incident readiness planning
•Host intrusion analysis
•Security events management
Secure collection and handling of electronic data is essential to every organisation.Inorganisation. In the aftermath of a security incident, you need a quick response and accurate identification.
If the security surrounding this information is breached, an immediate and comprehensive response is needed to diagnose, fix and secure the problem so an organisation may move forward. With TISS forensics incident response, our expert consultants work with you to prepare your organisation to respond quickly and effectively to a security incident.
For many organisations, the most challenging aspect of creating an incident response plan is the lack of visibility into an evolving threat landscape, and what proven practices work well when responding to an Incident.
Our incident response may cover a wide range of topics, and our primary aim is to work with existing response staff or as an independent team to provide service capability. Deep technical support for existing investigations is also available.
Incident Response topics include but are not limited to:
• Theft or leakage of Intellectual Property.
• Employee harassment by email.
• Unlawful intrusion into corporate IT systems.
• Fraud, threat or extortion.
• Possession and or dissemination of illegal images using corporate IT systems.
• Denial of service attacks.
• Employee breaches of corporate acceptable use policies (AUP).
Incident Response is important and neccesary because;
• Even the most vigilant, secure organisations can face acts of fraud, theft, computer intrusions,and other computer security incidents.
• Without up-front planning for Incident Response, it is much more difficult to recover from an incident.
• Without a formal process in place critical information may be lost.
• These procedures can be thought of as the Incident Handling Life Cycle.
NETWORK FORENSICS AND INVESTIGATIONS
The growth in network connectivity, complexity and activity, has been accompanied by an increase in the number of crimes committed within networks.
Security and network forensics is a critical requirement for many organisations to protect their information assets and investigate unwanted behaviour on their IT systems.
Our forensic investigation teams are made up of highly skilled engineers with a broad spectrum of skills, which also includes expert network penetration testers. Network investigations may include setting up network monitoring capabilities and the subsequent analysis of these traffic captures.
Investigations may also include log event analysis from network devices, endpoint security devices and the correlation of these with traffic analysis to track and trace a possible or actual network compromise.
This is important because it helps;
• To identify network intrusions.
• Respond to network breaches.
• Detect data leakage and determine its scope.
• Record and analyze raw network activity.
• Implement a continuous network monitoring solution.
• Identify and authenticate specific network user activities.
• Create custom data mining solutions with document authentication.
• Formulate and fulfill incident response plans to a breach or other network event.
FORENSIC ACQUISITION AND LABORATORY INVESTIGATIONS
It is essential that electronic evidence be acquired in a methodical, safe, and secure manner, and preserved in a manner that is admissible in a court of law.
TISS Ltd provides state of the art forensic acquisition and laboratory investigations. This is critically important in the event of a breach, theft, or inappropriate behaviour. it is absolutely crucial that electronic evidence be preserved. This electronic evidence contains the information needed to understand three things:
• How the events happened.
• How to mitigate the cause of the events.
• What data or resources may have been affected by the breach or theft.
Just as crime scene investigators carefully gather physical evidence, forensics acquisition professionals methodically, safely, and securely acquire electronic evidence in a manner that preserves the data and maintains the chain of custody. Our forensic service obeys the highest standards of secure storage and evidence handling. Using current, best of breed technologies, our laboratory facilities allow for most types of digital media to be forensically examined and evidential data recovered. All material is handled and documented in accordance with the Association of Chief Police Officers (ACPO) guidelines relating to digital evidence.
The forensics lab is able to process most types of common media; from server and RAID forensic images to the smallest removable piece of smart media used in devices like smart phones, digital cameras, PDA`s and GPS systems.
The lab is equipped with highly efficient and secure hardware based forensic imaging tools that provide integrity of the forensic images and drastically cut down the time to image over traditional software based imaging methods.
DATA RECOVERY SERVICES
TISS Ltd provides state-of-the-art data recovery services, solutions for any kind of data loss and any type of physical storage media.
Standard laboratory data recovery includes the recovery of deleted data from most common types of media; including media that has been reformatted in error or has become corrupted by other means.
Devices commonly handled include:
• Removable media
• USB devices
• Smart media
• Memory sticks
• Compact flash
• Laptop drives
• Desktop PC drives
Our forensic engineers can open most common password protected documents and files.
They can also gain access to laptops, desktops etc… where the users or administrators password has been lost or forgotten.
Note: There are limitations to the cost-effective recovery of data when the media in question has been electronically destroyed or has physical damage that precludes effective recovery.
[su_spoiler title="SEE FULL LIST OF SECURITY CONSULTANCY SERVICES" class="my-custom-spoiler"] INFORMATION SECURITY MANAGEMENT
Setting the bar for information security at an appropriate level can be challenging. Ensuring both effective security and streamlined working practices sometimes seem to be mutually exclusive.
TISS Ltd work alongside their clients to devise the right security strategy, and a workable plan for the implementation of well thought out security controls, policies and procedures.
Planning involves incorporating many internal and external factors such as, industry based risks, standards and legislation, risk apetite, company culture, and unique organisational risks.
TISS Ltd DISCREET SERVICES INCLUDE:
• Employee background checks/screening
• Business impact analysis
• Policy creation
• Threat modelling
• Risk assessments
• Security architecture reviews
• Solution and security roadmap design
• Project governance and oversight
TISS Ltd also offer many supporting services for implementation which can be found here.
Please get in touch with us to learn more about how effective information security management can bring about overall organisational benefits.
SECURITY TRAINING WORKSHOPS
TISS Ltd offers the very best in group security training workshops. We can offer our own course syllabuses, or bespoke a course to your requirements. A sample of the courses we run:
•Introduction to penetration testing, tools and techniques
•A guide to the management and procurement of penetration testing services
•Mobile application hacking
•Introduction to Computer Forensics
•Secure Development Life Cycle and Secure coding practices
We are more than happy to discuss any specific requirements you may have.
BUSINESS CONTINUITY PLANNING
In today’s volatile world, there are many events which can impact on a business’s ability to survive.
Crises of varying type and impact can pose significant threat to an organisation’s bottom line and ultimately, ability to survive.
There is now a lot of evidence to show that organisations with well planned and tested business continuity plans are many times more likely to recover from a serious crisis.
TISS Ltd can help you with your business continuity program, from defining critical business processes and dependencies, to solution design, implementation and testing.
Our crisis management consultants take you through table top exercises and workshops to ensure that should the worst happen, you will be well prepared.
Business Continuity Planning and Testing
We establish a variety of plans including work area recovery ; supply chain alternate supplier plans;
alternate workforce mitigation plans, and other non-IT business continuity plans.
We develop the plan and educate and train all client stakeholders to verify the feasibility of the plan to sustain mission critical business functions.
Business Continuity Program Assessment and Development
We evaluate our client’s BC management program, including review and gap analysis of policy, governance, management, strategy, documentation and testing. We then provide clients with the best path forward for development of a full BC program.
Business Impact Analysis
We provide the cornerstone of Business Continuity planning with a Business Impact Analysis to identify mission critical business functions, recovery time objectives and recovery point objectives to meet all of our client’s business requirements.
Business Risk Analysis
We provide this critical first step for our clients to identify threats and vulnerabilities and determine the potential for service loss. We then determine mission impacting threats such as natural disasters (floods, access denial, (geopolitical or labor unrest), and loss of environment component systems and communications. Our vulnerability analysis identifies potential exposures and seeks to determine best prevention methods.
Disaster Recovery Planning and Testing
We provide this service out of TISS-owned or operated data centers to include developing survivable and executable Disaster Recovery plans and the coordination and execution of repeatable disaster recovery tests to assure currency and viability of the plans. Disaster Recovery Plan development and maintenance is at the heart of the Business Continuity process and is an on-going activity that assures survivability.
Whether you are looking to design a business continuity program from the start, or are looking for assurance that your current plan is fit for purpose, TISS Ltd can help. Contact us for more information on BCP or to talk to one of our consultants.
SECURITY AUDIT AND COMPLIANCE
Across organisations, motivations for compliance and audit assessments vary dependent on whether they are regulatory or contractual. Drawing on our expertise, TISS is familiar with all information security data protection standards, both commonplace and unusual. While our consultants work most frequently with ISO 270001:2013 , their knowledge extends far further.
TISS applies a range of methods, including: interview, inspection, audit and technical assessment, to ascertain the position of the client’s organisation in relation to industry standards. The use of multiple assessment methods ensures that the information we provide at the conclusion of the multiple assessment methods ensures that the information we provide at the conclusion of the engagement is a valid and accurate representation of the client organisation’s position. With the strategy, scope and gap analysis defines, our focus then shifts to implementing the solutions under discussion, allowing your organisation to become compliant or certified in accordance with industry standards dependent on the requirements of the project. To this end, our consultancy team is flexible and can be engaged for individual projects or as a longer-term, strategic partner.
Further to supporting organisations in becoming industry compliant, TISS offers ongoing support which is invaluable in freeing-up and relieving pressure on internal resources. This can be achieved in a number of ways, including performing the internal audit functions, user awareness education and management of the security review and approval process for the third party suppliers.
SECURITY STRATEGY CONSULTING
The threat landscape of the information security industry is constantly evolving and organisation’s security requirements change accordingly. The high profile nature of threats to information security can often lead to them being misinterpreted and blown out of proportion, especially when the media become involved.
This is part of the essential role Portcullis plays for our clients, as we have access to the knowledge and resources which give us an accurate picture of the field’s current threat landscape. Using this expertise TISS Ltd can be trusted to review, revise and update our client’s internal approaches in accordance with the nature of threats actually facing the business. Once an accurate picture has been formed, TISS Ltd can provide the support to help secure our client’s organisation against real-world threats.
These projects can be distilled into four discrete areas, which can be delivered as individual tasks or as an ongoing cycle of work:
1. Working with our client’s to set viable information security objectives
2. Monitoring the success with which those objectives are being met
3. Developing a programme of works to meet those objectives
4. Providing support to successfully implement the agreed-upon programme of works
The initial two steps of this methodology define how effective the final steps will be and the overall value the project will deliver. Improvements cannot be delivered if the solutions offered do not address genuine gaps in an organisation’s security approach and capabilities.
• Unified Security Management like SIEMS like OSSIM and a variety of other Unified Threat Management platforms from companies like AlienVault, Cyberoam, Endian Firewall, Barracuda Firewall, pfsense, CISCO and Checkpoint
• Antiviruses like Kaspersky etc
• Biometric Access Control Systems
• Closed Circuit Televisions(CCTVs)
• Fire systems
• Physical security solutions like electric and Razor fences