Internal & External Network Security Assessment

NETBankAudit’s Internal & External Network Security Assessment provides a thorough, multi-layered evaluation of your institution’s network security posture. Our approach leverages industry-leading tools and experienced security consultants to identify vulnerabilities, assess risks, and recommend actionable improvements for both internal and external environments. The assessment is fully integrated into the IT audit process and supports compliance with FFIEC and industry best practices.

Internal Network Security Assessment

Our internal network security assessment is designed to identify vulnerabilities and exposures within your organization’s internal environment. We use a combination of automated tools and expert analysis to ensure a comprehensive review of your network, systems, and physical security controls.

Process and Methodology

Industry-Leading Tools: NETBankAudit uses top commercial-grade testing tools, managed onsite or remotely by highly trained and experienced penetration testing and vulnerability assessment engineers.
Authenticated Scans: We perform authenticated scans of your internal address space to identify and prioritize security weaknesses and their implications on the internal network. Administrative credentials are entered by your IT team for security and accuracy.
Expert Analysis: Scan results are analyzed by a senior vulnerability-testing engineer, certified in information security, who develops custom recommendations for remediation, including step-by-step procedures and/or automated tools where appropriate.
Comprehensive Coverage: Our tools and methodology ensure an accurate and comprehensive analysis, reducing the likelihood of false positives. We test for firewall issues, SNMP access, router/switch checks, proxy/DNS settings, remote & VPN services, RPC checks, patch management, misconfigurations, services, port scans/service scans, domain name services, FTP/SMTP settings, system users, default passwords, obsolete software, and more.
Non-Public Information (NPI) Protection: We evaluate open shares, unlocked databases, and other network configurations that could expose NPI.

Internal Vulnerability Assessment

Patch Management: Focuses on critical areas such as patch management (OS and application), configuration of networked devices, and authentication controls (OS and specific applications/services).
Comprehensive Device Scanning: NETBankAudit prefers to scan all devices on the network to ensure all vulnerabilities are identified, but the extent of testing and exclusions is discussed with your team prior to testing.
Authenticated Device Analysis: Authenticated scans attach to each workstation or server and analyze the registry, installed software, and device configuration, providing the most accurate assessment of vulnerability posture.
Patch Verification: This assessment verifies that your patch management procedures are working as intended and are adequate.
Alternative Testing: If administrative credentials are not provided, NETBankAudit recommends internal penetration testing to ensure a valid test.

Scope of Internal Technical Review

Network Device Analysis: Includes a mix of Windows servers and workstations, with scans of all devices where possible. Review of user identification and password controls for desktop applications.
Firewall and Router Analysis: Scans with the latest open-source automated tools to identify and prioritize security weaknesses and implications. Review of firewall rule sets and router settings for best practices and potential conflicts.
Physical Security Assessment: Isolates points of low-, medium-, and high-risk pertinent to information security. Assesses access to buildings, servers, removable media, systems documentation, and surveillance/defense methods. Includes interviews with employees to determine understanding of security policies and procedures.
Virus Protection: Assessment of current and planned virus prevention/control tools and policies to determine their effectiveness and role in the security program.

Internal Penetration Testing (Optional)

Simulated Attacks: With limited assistance from IT staff, NETBankAudit performs an internal penetration test, attempting to identify and exploit any discovered vulnerability found during an unauthenticated review of the network.
Realistic Threat Simulation: This simulates what an attacker would attempt if they gained access to the internal network.
Operational Coordination: Testing is coordinated with management and staff to minimize operational disruption.

External Network Security Assessment

Our external network security assessment simulates real-world attack vectors to identify exposures accessible from the internet. We combine automated and manual techniques to uncover vulnerabilities and test the resilience of your external-facing systems.

External Vulnerability and Penetration Testing

Simulated Attacks: Simulates the attack vectors that might be used by a determined attacker, including discovery, enumeration, vulnerability mapping, and exploitation phases.
Discovery: Upon receipt of confirmed target IPs and/or domain names, we expand our knowledge of your Internet presence by conducting extensive discovery searches, including time synchronization, name services lookups, whois lookups, dig operations, DNS zone transfers, and more.
Enumeration: Actively tries to obtain usernames, network share information, and application version information of running services, expanding knowledge of the environment.
Vulnerability Mapping: Maps the profile of the target environment to publicly known or, in some cases, unknown vulnerabilities.
Exploitation: Attempts to gain privileged access to a target system by exploiting identified vulnerabilities, such as launching password guessing attacks using collected usernames. Any successful exploits are communicated to IT staff immediately with recommended remediation steps.
Manual Verification: Ensures discovered vulnerabilities are not false positives, and only safe exploitation is performed (no buffer overflow or denial of service attacks).
Comprehensive Assessment: Includes public information gathering, network mapping, host discovery, vulnerability identification, and attempts at vulnerability exploits.

Public Information Gathering Process

Manual and Automated Searches: Use of manual and automated searching techniques to identify public information pertaining to the institution, uncovering configuration errors, accidental posting of sensitive/internal information, malware, malicious sites, and phishing attacks.
Domain Name Searches: Name services lookups, whois lookups, polling registry information, dig operations, DNS zone transfers, and more.
Primary Website Review: Technology security assessment of the public website for sensitive content, access rights, and web server technology. Evaluation of potential web access vulnerabilities (OWASP Top 10 risks), Google searching for documents/configuration info, and site crawling for unlisted directories.
Email Address Searching: Specialized tools are used to gather email addresses belonging to the institution.
Advanced Google Searching: Finds information posted/published regarding the institution, with only items of interest reported.

Dark Web Search (Optional)

Dark Web Intelligence: Search for bank information on the Dark Web, including evidence of bots or malware associated with bank IP addresses, compromised user accounts/passwords, bank in breach databases, bank routing number, and card issuer identification numbers.

External Vulnerability Penetration Test

Discovery: Passive electronic discovery of identified targets, including time synchronization, name services lookups, whois lookups, dig operations, dnswalk, and research of web/application servers.
Enumeration: Active and passive discovery of target networks/domains, traceroutes, ping sweeps, and mapping of routers, hosts, firewalls, etc.
Vulnerability Mapping: Non-port scanning reconnaissance, OS fingerprinting, intense port scanning, analysis of ICMP traffic, and identification of time protocol vulnerabilities.
Exploitation: Bulk vulnerability scanning, manual verification, application attacks, brute force attacks, CGI/web exploits, and attempts to bypass firewalls/IDS/IPS using tools such as firewalk.
Safe Exploitation: Mapping vulnerabilities to known exploits, carrying out only safe exploits that will not harm the target device or cause service loss.

Additional Testing Options

To further strengthen your security posture, we offer additional assessments tailored to your institution’s needs. These options provide deeper insight into specific areas of risk.

Wireless Penetration Test (Optional)

Network Design Review: Assessment of wireless network design and documentation to understand deployment in the network.
Authentication Review: Review of two-factor authentication in use on wireless networks.
Access Point Identification: Identification of all wireless access points in range of the testing laptop.
Vulnerability Assessment: Assessment of security vulnerabilities associated with each device.
Encryption Key Testing: Testing using specialized and open-source tools to attempt to obtain handshake data to wireless access points. If WEP or WPA is used, attempts to identify the wireless encryption key via dictionary and side channel attacks; if WPA2 is used, dictionary attack on captured handshake data.

Quarterly Firewall Ruleset Audit (Optional)

Firewall Configuration Review: Initial review of firewall configuration with a specialized tool designed to audit firewalls and network devices.
Ongoing Change Management: Every three months, an updated firewall configuration and all change management documentation related to firewall changes are reviewed.
Reporting: Deliverables include an executive summary for Board or Audit committees and a supplemental report with technical details and findings for IT staff.

Deliverables

Our assessment provides clear, actionable results to help you prioritize remediation and strengthen your security posture.

Comprehensive Reports: Assessment reports for internal and external environments, including all findings and recommendations.
Prioritized Remediation: Prioritized list of vulnerabilities and actionable recommendations.
Executive Summary: High-level summary and technical details for remediation.

Supplemental Reports: Additional reports for optional services such as wireless, firewall, and dark web assessments.

Internal & External Network Security Assessment