Solutions
Professional Services
Information security has a cost. The time and resources expended staying abreast of the risks and regulations can impact a business leader’s ability to execute on key business initiatives. BearHill has security specialists that can assist your organization in understanding your environment, your exposure, and the relevant defenses enabling you to make informed business decisions regarding risk mitigation. BearHill’s professional service offerings include:
Vulnerability Assessment
Network Penetration Testing
Application Penetration Analysis
Enterprise Security Assessment
Wireless Security Assessment
Application Code Review
Incident Response
Strategic Architecture Design and Review
Regulatory Gap Analysis
Firewall Design, Implementation, and Configuration Review
Access Control Consulting
Information Security Policy Creation
Vulnerability Assessment – BearHill’s Perimeter Defense Assessment (PDA) service analyzes your security posture by performing an extensive, non-destructive review of an organizations Internet facing hosts. The process uncovers vulnerabilities and provides your organization with the basis to make informed decisions on how to respond to each exposure. Each PDA incorporates reconnaissance, scanning & enumeration, vulnerability mapping and a results briefing. BearHill provides its clients with quarterly vulnerability assessment services via an annual service program, the Perimeter Defense Assessment Program (PDA-p).
Network Penetration Testing – BearHill provides external penetration testing through its Security Posture Assessment (SPA) service. While many vendors focus their offering on vulnerability ‘scans’, the actual means by which systems are exploited is much more complicated. Thousands of manual exploits can only be tested for via a professional, methodical exploitation of critical systems. The challenge with penetration testing is finding a team that is skilled enough to perform the testing without damaging systems they are exploiting. BearHill’s security engineers have a minimum of 10 -15 years industry experience and have worked in banking and similar high profile industries.
Application Penetration Analysis - Designed to assess the security of custom developed or off the shelf web applications. Application-level penetration analysis can be performed from both unprivileged and privileged perspectives. Typically, our team will require user-level account access and from a standard account will attempt to escalate privileges and otherwise gain unauthorized access to information assets through a variety of application level exploits. The goal of this portion of the exercise is to determine the risk of exposure of information to credentialed yet unauthorized users. When performing Application Penetration Analysis; BearHill employs a combination of automated and manual testing tools. A partial list of the battery of tests that BearHill subjects the application platform to include:
Data Extension Checking
Path Truncation
Hidden Web Paths
Brute-force Authentication Breach
Web Server Testing
Directory Enumeration
Backup File Checking
Cookie Manipulation
Parameter manipulation
Cross-Site Scripting
SQL Injection
Reverse Directory Traversal
Buffer Overflow
Hidden Field Manipulation
Known Vulnerability Checks
Extension Checking
Common File Checks
Enterprise Security Assessment – BearHill’s Enterprise Security Assessment (ESA) provides a technical review of an organization’s internal network from both a privileged and non-privileged perspective. An ESA assesses risks and vulnerabilities to critical information assets from internal threats and measures compliance to existing policies and applicable regulatory guidelines.
Wireless Security Assessment – Assesses the security posture of an organization’s wireless network. A Wireless Security Assessment provides an organization validation of current security controls protecting the wireless network, and provides a point in time assessment of the risks posed by the wireless network. The Wireless Security Assessment will help an organization identify potential risks due to unauthorized access to the wireless network, unauthorized monitoring of wireless communications and other wireless vulnerabilities.
Application Code Review – BearHill provides application code review, for custom and commercial applications, to identify code related vulnerabilities.
Incident Response - Our team is available to provide incident response, forensic analysis, and expert witness testimony related to computer security incidents. Our team has provided these services for e-commerce companies, governments, defense contractors, carriers, and has assisted in federal criminal investigations. We provide these services on a time and materials basis.
Strategic Architecture Design and Review - Our network architects are available to provide secure network design and implementation planning services. We assist organizations in reviewing their current infrastructures for design improvements, planning for new implementations, layered security design, and performance enhancements.
Regulatory Gap Analysis - BearHill’s Gap Analysis services are targeted to organizations seeking validation that the policies, procedures and technical measures they have implemented will enable them to be compliant with regulations such as SarbOx, HIPAA, GLB, Payment Card Industry Standards, FDIC/OCC banking regulations (FFIEC), etc.
Firewall Design, Implementation, and Configuration Review - BearHill can assist you in architecting and implementing a secure e-commerce environment. Firewall configuration and ruleset review services ensure pre-existing firewall implementations are secure and compliant with applicable regulations.
Access Control Consulting - BearHill has extensive consultative expertise in areas such as developing role based access controls, single sign-on, two-factor authentication, public key infrastructure and RADIUS. Our team can assist your organization in architecting a logical and technical access control methodology that meets regulatory specifications.
Information Security Policy Creation - Having a clearly documented Information Security Program is a key component of meeting regulatory requirements. Typically organizations have written acceptable use policies (AUP) which dictate the appropriate use systems, email and the internet. The Information Security Program must reflect roles & responsibilities, policies & procedures, and processes that are both manageable and enforceable. The resulting ‘document’ is often referred to as an Information Security Plan or Policy. A single all-encompassing, documented, information security management program typically facilitates addressing 60—75% of our client’s regulatory deficiencies. BearHill can assist your client’s in meeting this need with our policy creation specialists.