Security

Vulnerability Assessments

Is your network growing more complex and more difficult to manage and you don't have the time to get every patch and research/fix every vulnerability?
Is the number of entry points into your network increasing with things such as VPN's or wireless access points?
Do you know if a malicious self-propagating Worm, Virus, or Trojan has the ability to dwell on your network?
Do you need to have trend analysis reports to give to an auditor to show that you are proactively securing your network?
How can you prove to management that your security policies are correct and working?

The way to answer all these questions is with a Vulnerability Assessment. Identifying and correcting vulnerabilities on network devices and systems before they can be exploited is essential to bulletproof networks against intruders. Vulnerability assessment is a systematic approach to identifying and prioritizing vulnerabilities, enabling IT organizations to receive non-intrusive testing of their network from the "hacker's eye view". Security breaches are measued in downtime, repairs, draining of IT resources, and immeasurable damage from loss of customer confidence. The ultimate cost of network security failures can be loss of business. With early vulnerability detection companies can take corrective action before damaging network attacks can take place.

Vulnerability assessment works hand in hand with firewalls and IDS/IPS. The vulnerability assessment identifies potential vulnerabilities before they can be exploited, which QualysGuard has the largest KnowledgeBase of vulnerability signatures in the industry (5,500+) and they add on average 85+ new vulnerabilities every single week. Then the intrusion detection system notifies the customer when irregular activity has occurred. A vulnerability assessment enables IT to identify and close obvious holes so that the intrusion detection system has fewer places to check. Vulnerability assessments also work with firewalls by recognizing vulnerabilities that may have inadvertently been introduced by firewall policy changes. These are some of the devices scanned: Web Servers, SMTP/POP Servers, FTP Servers, Firewalls, Databases, E-Commerce, LDAP Servers, Load Balancing Servers, etc...

Firewalls

Do you have a lock on your network door?
Does your company have remote locations with no security, but you're the one that has to implement a solution with a slim budget?
Is your company looking to you for suggestions on upgrading the existing firewall for the job?
Are you having questions concerning your firewall doing its job or is it even the right firewall for the job?
Is your company paying annual licensing fees for your current firewall?
Do you know if your firewall can handle a DMZ or any other network segments besides the inside and outside?

These are all questions that we will run into sometime in our IT career and when they arise we want to know where to go for the answers. Thomas Technologies can answer those questions that aren't always in black and white. We carry multiple options in the firewall arena, depending on how large or small your company is, how many VPN's you want the firewall to terminate, how many sessions will be passing through the firewall, etc. Firewalls are usually the beginning of a company's security platform; they are the base of the security pyramid that all other tools can build upon. The firewall is the gatekeeper of the network, allowing and disallowing certain packets from passing through, restricting certain ip addresses from coming in or going out, and also locking down unused ports. Firewalls can come equipped with many tools such as the ability to be a DHCP server, have real time fail-over, and also be a VPN gateway for your company. These are just a couple of examples of how a firewall can be much more efficient and effective in your network.

VPNs

Are there issues that you face and don't have answers to?

Do you have employees, management, or partners that need secure remote access into the corporate network?
Is their concern about the security of your current remote access solution?
Are you paying outrageous fees for point-to-point connections to your remote locations?
Does your company have policies stating that there can be no remote access without encryption or secure tunnel?
Do you want to extend your local area network securely, but don't know how to do it?

A Virtual Private Network (VPN) is a secure, private communication tunnel between two or more devices across a public network (like the Internet). These VPN devices can be either a computer running VPN software or a special device like a VPN enabled router, firewall, or concentrator. There are multiple options that are offered when choosing what to use when terminating a VPN and some of these options are:

Software access option-Remote user with a software VPN client and personal firewall software on the PC.
Remote-site firewall option-Remote site protected with a dedicated firewall that provides firewalling and IPSec VPN connectivity to corporate headquarters.
Hardware VPN client option-Remote site using a dedicated hardware VPN client that provides IPSec VPN connectivity to corporate headquarters.
Remote-site router option-Remote site using a router that provides both firewalling and IPSec VPN connectivity to corporate headquarters.

The days of having a point-to-point connection to every remote site from your corporate LAN are long gone. Today's answer for remote access is a virtual private network, ensure your remote site has a dedicated connection and a router or firewall with vpn capabilities. At the Host site you will need one connection coming into the network and a router or firewall with vpn capabilities. The other option is to put VPN Client software on the laptops of the mobile users. The mobile users can then create a VPN through the software client from any location with a dedicated connection. Thomas Technologies can create a solution that is right for your scenario and we can seamlessly implement the solution we provide.

Intrusion Prevention

How do you know what kind of traffic is coming through the ingress points of your network?
Do you know if your network is being targeted by crackers or hackers for their use or just to be malicious?
Is a firewall the only security object in your network?
Can you show management that your network isn't being penetrated by outside attackers?
Are you unsure when questions arise about the security of your network and the steps being taken to secure up vulnerabilities?

These are all questions and issues that IT departments are faced with on a daily basis. One of the steps that can resolve some of these headaches is implementing an Intrusion Prevention System into the scenario. Intrusion prevention, put simply, is the ability to analyze data in real time to detect, log, and prevent misuse or attacks as they occur. The word "misuse" is broad, and can reflect something as severe as stealing confidential data to something minor such as misusing your email system for spam. There are multiple types of attacks and scans that an attacker will use, such as port scans, icmp sweeps, smurf attacks, buffer overflows, etc.. These attacks are recognized by the sensor and are matched against signatures to see if the sensor needs to create an alarm. If a match is made, the alarm is then sent to the director/event viewer so that it can be viewed by the person managing the IPS. Or if a match is made the IPS can be set to immediately block the packets.

Sniffer Analysis

Is your network slow and having bandwidth issues, but you don't know where to look?
Are there protocols running on your network that aren't suppost to be there?
Are you not sure of all the ip addresses that are passing traffic on your network or other segments of your network?
Do you have hosts on your network that aren't suppose to be there?
Do you know who or what hosts are broadcasting and to where they are broadcasting to?

As IT professionals we would all like to have the piece of mind that these are not questions that are going unanswered in our network. How can you ensure that your network and the applications it supports delivers the availability, security, and reliability that your business requires to succeed. Sniffing your network can help by providing fault and network performance management, network monitoring, protocol decodes, and expert analysis capabilities to all key segments (local area network, wide area network, and gigabit Ethernet). The ability to sniff your network offers the opportunitty to monitor, validate, and evaluate your entire network infrastructure, from troubleshooting and baselining, to real-time and historical analysis for trending. You can identify and correct network performance problems and bottlenecks before they impact your users. Thomas Technologies can offer this service with the ability to create reports from the information that is gathered by the sniffer. If management wants to see the results, but doesn't want to see a bunch of 1's and 0's, we can create graphs, charts, and timelines so that they are getting a feel of how informative and helpful sniffing your network can be.

1860 I-30 East : Rockwall, TX 75087 : Phone (800)842-8493 : Fax (972)771-4550