Publicly Available Independent Security Reports

anastasia — Tue, 01 May 2007 04:21:01 -0700

Juniper Networks
Juniper Networks (Japanese version)
Macromedia
WebEx Communications

Companies often have functionality that needs to be established as consistent with industry standards. Others may have security features that need to be highlighted as differentiators in their industry. Almost all businesses need to verify to their auditors and customers that an independent security assessment has been performed.

However, budgets and schedules rarely support a comprehensive security review of an entire product or service. To this end, iSEC Partners has developed a methodology for conducting ongoing security assessments that are focused on:

Creating an Independent Security Report (iSR) that highlights the validation testing of “security assertions”
Assessing high-risk components
Conducting tests that address questions raised in most vendor security questionnaires
Creating a process for ongoing security QA while satiating the needs of security, product development and marketing teams

iSEC Partners’ Security Assurance Program is an iterative process that provides a practical view of what a motivated attacker might accomplish. iSEC Partners conducts assessments that model specific threat scenarios, identify vulnerabilities, and enumerate exploitation possibilities. While the testing methodology is flexible, each assessment includes – at a minimum – the following processes:

Documentation review
Developer interviews
Threat modeling
Design review of new features and functions
Active testing of mutually agreed upon features and functions
Review of changes made to fix vulnerabilities identified in previous releases
Manual and automated penetration testing
Code review (where necessary for validation)
Validation testing of “security assertions” for inclusion in the Independent Security Report (iSR)

iSEC Partners’ iSR provides high-level information about the ongoing process to improve security and more specific information about tests conducted against specific features. iSEC Partners believes the independent review of security assertions provides the following benefits:

Customers and prospective customers benefit from validation of specific assertions made by the product and visibility into the ongoing security assessment process
Our Clients receive the iSR that can be used proactively in their sales processes. They also benefit from consistent and recurring recommendations for improving the security of their product. This predictable and consistent review is much more efficiently folded into the development process than ad hoc security reviews conducted when budgets allow and customers demand.
Venture Companies and individual investors benefit from the knowledge that the company and product they have invested in - or are evaluating for funding – have an ongoing security assessment process

iSEC Partners -

Publicly Available Independent Security Reports