Endpoint Security Assessment
Within a holistic security concept, client systems (such as PCs, notebooks, tablets, or smartphones) play a special role as the major tools for IT users. Not only unauthorized modifications of the system by users harbors security risks. More and more often, users and their systems are the victims of targeted attack attempts (spear phishing, drive-by infections, etc.).
In this way, client systems can be misused as a back door into the internal network using malware (e.g. Trojan horses). Mobile client systems (e.g. notebooks, smartphones, etc.) are subject to particular risks. Loss, theft or destruction of the system directly endanger the data stored on the system. Additional threats result from the use of mobile clients in areas that are not trustworthy from the point of view of information security (e.g. hotels, airports, etc.). Attacks can take place here, for example, via the Wi-Fi connection.
It is therefore advisable to subject client systems to a dedicated assessment. The corresponding tests are divided into two areas:
Objective
Identification of vulnerabilities in configurations and in the management of client systems with a risk assessment for specific threat scenarios
Question
How secure is the software and configuration of client systems and what can external attackers or malicious employees achieve in the worst case?
Scope
PCs, notebooks, smartphones, tablets or other mobile devices and their management environment
Client Security
The examination in the area of client security takes place primarily from the perspective of potential attackers (targeted and untargeted attacks) and from the perspective of the user himself (unauthorized administration, misconduct).
The following areas are covered by the assessment:
- Technical analysis of the security functions of the operating system and the installed applications ( penetration test )
- Attempt to escalate the local privileges
- Examination of the security-relevant configurations of the operating system (taking into account “Compliance Guides”) and the installed applications, such as Internet Explorer (e.g. security zones, active content such as Flash and Java), Microsoft Office and other security-relevant or critical applications
Client Management
An examination in the area of client management includes the integration of the client systems in security-relevant concepts and processes.
The following areas are covered by the assessment:
- Analysis of the process to provide stationary or mobile client systems (staging processes, provisioning, deprovisioning, etc.)
- Analysis of the update processes for client systems (patch management, software roll-out)
- Analysis of overarching management processes (interfaces of the roles and rights management to manage employees, password reset procedures, etc.)
Result
As a result of the assessment we will provide a detailed report. Depending on the type and scope of the project, the final report will include the following parts:
- Management summary with a description of the results and the security level
- Description of the project approach, scope, schedule and methodology
- Detailed description of identified vulnerabilities in order to understand underlying issues and to enable reconstruction of possible attacks (where necessary with proof-of-concept implementation)
- Detailed description of the iterative exploitation process when using chained vulnerabilities
- Risk assessment of identified vulnerabilities taking into account the IT environment or the application context (risk classification: low, medium, high, critical)
- Description of measures to remedy the vulnerabilities
- If necessary, a description of higher-level strategy, concept and process-related measures or optimization suggestions.