Security controls

The following information outlines NT-ware’s process and methodology as a basic standard for any security and PEN testing organizations we engage to test our product. Any external testing organization must follow privacy, security, and confidentiality agreements.

To maximize coverage and ensure that we detect all high-risk vulnerabilities, our testing process includes the following security controls:

• Authentication: defines a set of requirements for generating and handling account credentials safely.
• Access Control: defines how an application can safely enforce access control. In most applications, access control must be performed in multiple different locations across various application layers.
• Session Management: defines a set of requirements for safely using HTTP requests, responses, sessions, cookies, headers, and logging to manage sessions correctly.
• Configuration Management: verifies that a system performs as intended. This includes defaults, common paths, configuration, backups, and known vulnerabilities/security patches.
• Cryptography: The Encryption Verification Requirements set out criteria to verify an application’s encryption, key management, random number, and hashing operations, which must be used.
• Data protection - at rest/in transit: defines a set of measures to protect sensitive data e.g. personally identifiable information.
• Input Validation: measures to validate input to ensure it is safe for use within an application.
• Output Encoding: Escaping Validation Requirements, which guarantee that output is encoded correctly so that it is safe for external applications.
• Error Handling and logging: defines requirements that can be used to check tracking of security-relevant events and identification of attack behavior.

Security assessment process

Security assessments follow key stages, but as project requirements and tests are unique to each project, the penetration testing process is invariably adjusted to fit the project’s needs.

Information gathering

The penetration tester will gather all available information about the test subject, focusing on both the target’s technical details and publicly available information about the application's owner. NT-ware Operations and NT-ware Development are working closely with the commissioned PEN testing company to provide a detailed view of the features and product prior to each test; this is known as Gray-Box testing.

Planning and analysis

Once technical and public information has been collated, the tester begins the attack planning, from the overall approach of the penetration test to identifying which targets require further research.

Vulnerability detection

• Identifying the configuration and setting variables
• Identifying pattern matching, lexical analysis, and parsing
• Data flow analysis
• Generating attack vectors
• Identifying functions to attack

Vulnerability exploitation

• Generating attack code
• Executing the attacks
• Further analysis of the exploit to escalate privileges
• Creating a usable Proof of Concept / real-world example
• Documenting the attacks

Reporting stage

• Documenting the methodology
• Analysis of the findings
• Risk assessment
• Generating the report
• Internal peer review

Report development stage

• Report planning
• Information collection
• Writing the first draft
• Review and finalization

Risk calculation

Our risk rating is based on the OWASP risk rating methodology. The likelihood and impact of findings are categorized as LOW, MEDIUM, or HIGH on a scale of 0 to 9. These metrics are then calculated to provide an overall severity rating.