Audit Services

Our full IT audit / review is one of the best and most thorough in the industry. We pride ourselves on being both thorough and practical addressing cybersecurity and IT related risks as well as areas of IT regulatory concern. The scope of the full review includes all of the below assessments and audits.

• Cybersecurity / IT General Controls Review
• Internal Security Assessment
• External Security Assessment
• Social Engineering Security Assessment

We will provide an assessment (satisfactory, needs improvement, or unsatisfactory) for each of the below areas:

• Internal security assessment
• External security assessment
• Cybersecurity / IT general controls review

All respective areas of the Social Engineering Security Assessment will receive a pass or fail based on individual tests/targets/locations.

Secure Guard Consulting's internal security assessment involves scanning network assets internally from behind the corporate perimeter firewall, providing a comprehensive view of the organization's IT environment. We scan a defined list of IP addresses that correspond to servers, file sharing systems, printers, employee PCs, etc. to identify any vulnerabilities based on current threats.

The scope of the Internal Network Security Assessment is to determine if internal network security controls are effective in preventing or detecting unauthorized persons from gaining access to data or system functions. Our internal assessment is conducted onsite with an underlying focus on identifying real vulnerabilities and reducing false positives. When possible, Secure Guard Consulting will employ an authenticated (credentialed) scan where an active logged-on session to the operating system will be created allowing the testing process to comprehensively identify risks.

We will provide an assessment (satisfactory, needs improvement, or unsatisfactory) based on the results of the internal security assessment:

     Or contact us directly at 515-229-5674

Secure Guard Consulting's Internal Penetration Test is designed to demonstrate what a potential attacker could do if they breached your perimeter defense(s) and were on your internal network. This type of testing mimics the actions of an actual attacker exploiting weaknesses in internal network security without the usual dangers.

The Internal Penetration Test involves going beyond traditional credentialed vulnerability scanning and attempting to exploit identified vulnerabilities.

The scope of the Internal Penetration Test will be to utilize information obtained from the above Credentialed Internal Vulnerability Scanning performed and actively exploit identified vulnerabilities as well as perform other internal penetration tests (e.g., privilege escalation attacks, arbitrary code execution, lateral movement on the network, etc.).

No opinion will be delivered regarding the Internal Penetration Test; we will only provide fact-based data or outcomes of the internal penetration test within the report.

Secure Guard Consulting's external security assessment specifically examines an organization's security profile from the perspective of an outsider or external hacker who is targeting the organization from the internet without access to systems and networks behind the external security perimeter. We provide a variety of options including annual or quarterly external scans.

The scope of the External Security Assessment is to determine if internet security controls are effective in preventing or detecting unauthorized persons from gaining access to data or system functions. Our external assessment is conducted offsite on a defined list of external internet facing IP addresses to identify vulnerabilities while reducing false positives.

NOTE: We provide a variety of options including annual, quarterly, and monthly external scans.

We will provide an assessment (satisfactory, needs improvement, or unsatisfactory) based on the results of the external security assessment:

     Or contact us directly at 515-229-5674

Whether we're talking about internal applications, internal web based applications, external web facing applications, our application penetration testing has you covered.

The scope of application penetration test will vary depending on the application being tested. Based on the application’s attack surface, generally speaking, we will attempt to brute force into the application, perform SQL injection attacks, directory traversal, etc.

No opinion will be delivered regarding; we will only provide fact-based data or outcomes of the application penetration test within the report.

The scope of the Cybersecurity / IT General Controls Review (including GLBA compliance) included a review of the information systems in use by your organization, and a review of the technical, administrative, and physical safeguards associated with maintaining the security and confidentiality of customer information. The review will include an in-depth review of documentation related to your organization’s information security program. In addition, interviews will be held with key members of the staff.

Some of the areas that will be covered during the Cybersecurity / IT General Controls Audit/Review include the following:

Information Security Program	IT Risk Assessment	Document security
Change management	Audit program	Operations
Network remote access	System logging and monitoring	Separation of duties
IT management	Internet banking (including CATO)	Web site
Systems authentication	Network services	Electronic funds transfer (EFT)
Incident response	Core banking system	Security awareness training
IS/IT policies and procedures	Wire transfer	Imaging
Email	Automated Clearing House (ACH)	Customer identification procedures
Backup procedures	Branch/Remote capture	Information Security Strategy
Access Controls	Authentication	Network Access
Application Access	Remote Access	Physical and Environmental Safeguards
Encryption	Patch Management	Malicious Code Prevention
Configuration and Change Control	Personnel Security	Data Security
Service Provider Oversight / Vendor Management	Business Continuity / Disaster Recovery	Insurance
Security Monitoring / Firewall Administration	GLBA Compliance

The Cybersecurity / IT General Controls review will involve 2-5 days onsite with remaining conversations occurring via phone and email.

We will provide an assessment (satisfactory, needs improvement, or unsatisfactory) based on the results of the Cybersecurity / IT general controls review

Our Social Engineering Assessment is based on current “real world” scenarios. All assessments are accomplished in a way that there is no actual infringement or damage on your network, computers, or users and include no permanent installation of damaging programs and no affect to the user’s computer or environment.

The scope of services for this social engineering assessment may cover one or more of the following threat vectors (as per agreement):

1. Email - A uniquely crafted email is sent to a set of users that attempts to gather information by having them click on a link to a “fake” web page (such as a fake Outlook Web Access page) and request data such as password information. No malicious program shall actually be installed. CIO will be notified of all information gathered in order to remediate in a timely manner.

2.      * Email assessment target range is a sampling of employees.

3. Phone - A social engineering attack is executed against an agreed upon set of limited users via a phone attack, utilizing phone spoofing and social engineering methods.

4.      * Target range size is agreed upon prior to assessment services.
   

5. In-person - A social engineering attack is executed against an agreed upon locations where the assessment will be in person. For example, unescorted attempt to enter authorized areas (What is the reaction of employees and security personnel?)

6.      * Target range size is agreed upon prior to assessment services.
   

No opinion will be delivered; we will only provide fact-based data or outcomes of the social engineering security assessment within the report.