Security Art

Red team testing has been defined by the SANS institute as one of the top 20 critical security controls for an organization.

Security Art will perform a full risk assessment of your technological and human factors. We will test all the technical aspects related to your core information assets as well as the procedures and controls that are supposed to keep them secret.

We simulate a real threat scenario that would be staged by a competitor or a perpetrator, including the actual tools and methodologies deployed by such threats.

The main deliverable of a red-team test is a clear overview of how you would stand in the face of a skilled attacker - be it a savvy hacker, or a competitor.

Red-team testing helps you identify the key weak elements that protect your intellectual assets, and be able to invest in improving the actual protection for your information (as opposed to "carpet bombing" with an array of basic products).

The engagement consists of the following elements:

• Information and Intelligence Gathering
• Threat Modeling
• Vulnerability Analysis
• Exploitation
• Risk Analysis and Quantification
• Reporting

Some of the phases above are visible to the customer and require some resources in order to accurately reflect the business value of the assets inside, as well as the business relevance of the threat agents/communities that are simulated. However, most of the engagement does not require any customer resources, and is taking place independently "behind the scenes".

The extent of the tests go beyond the usual use of off-the-shelf scanners and exploitation tools, and includes anything that a real-world scenario would include. This means that we will deploy targeted, crafted attacks agains the organization that simulate APT (Advanced Persistent Threat) compromises. Our attacks would be deployed through different paths into the organization - from the traditional direct attacks, through usage of social media, phisical presence, 3rd parties, employees, etc...

A red team test is significantly different than a penetration test as its scope is much broader, and is designed to test the organizations readiness for a real-world attack, measure the maturity of the risk management practice, and examine how well do detection and incident response work in it.

Following is a list of some of the areas we specialize in (on top of standard network / systems / applications)

Wireless Penetration Test

Security Art specializes in Wi-Fi security assessment. Mapping all active and passive devices related to your location, as well as rogue devices that may interfere with your operation or be used as a decoy to get your employees connected to them. We will test the security posture of your wireless network and identify any possible leaks or breaches that could potentially allow unauthorized access to your network, as well as provide you a high-level overview of how your network is seen by an outsider.We provide a unique Wi-Fi penetrating testing service that enables you to control those devices and mitigate your risk.

VOIP

“It looks like a phone and sounds like a phone. Therefore it must be a phone.” A few years ago that would have been a true statement, but that was before the dramatic increase in the use of VoIP. This cost-effective telephony solution has evolved quickly, and along with it, the accompanying security threats. If your organization uses VoIP telephony, you need to be aware of the ways your systems could be compromised:

• SIP Vulnerabilities - The increasing use of Session Initiation Protocol (SIP) for VoIP has opened up a whole new front in the information security arena. SIP is a relatively new protocol that offers little embedded security and it is especially vulnerable to hackers.
• Vishing - Similar to email security hazards, personal information can be compromised and information reached relatively easily.
• VoIP Hacking - Like any IP based device, a VoIP network is at serious risk of being hacked.
• Eavesdropping - By intercepting VoIP packets and reassembling them, hackers can gain personal and financial information. One method used to launch this type of attack is called "a man-in-the-middle," where a third party spoofs the MAC addresses of the two speaking parties, thus forcing the IP packets to flow through the hackers' system.

Social Engineering

Beyond the technical aspects of information security, and equally as important, are the security weaknesses originating from the human factor. The social engineering tools developed by Security Art will alert you to dangerous weaknesses caused by your employees, and will raise awareness and employee motivation toward information security:

• USB tokens infected by predesigned malicious software will alert you when an unauthorized device has been inserted into an organizational USB port (usually an end point device).
• An infected CD delivered to employees outside the company facility as a commercial advertising or other support-center impersonators request the employee’s username and password. You would be surprised how many employees give that vital information over the phone to a stranger!

How well do you think your actual premises are protected? Can a visitor collect sensitive information, be it an authorized one or not?

Non-standard devices

Buying candy from a vending machine is fairly routine, right? But if that vending machine is on your network, it might have the potential to provide more than just snacks. Today’s hackers use any and all networked devices to find their way to valuable assets. Just a few years ago, no one would have believed that a printer could be manipulated to conduct sniffing or hacking, but nowadays any device on your network presents a potential risk. Common security mechanisms find it hard or even impossible to identify and address non-traditional risks, but Security Art takes a radically different approach.

We believe that the “helicopter view” approach applies to information security and that traditional activities need to be augmented with new and innovative approaches. Mapping your nonstandard devices and ironing out the risks associated with them will provide powerful risk mitigation for a field that is often overlooked.