Information Security

The Web Applications codes could have vulnerabilities, which are exploited by hackers to gain the access of system components.

The Web App VAPT enables the organization to identify the vulnerabilities that are turning out to be threats by exploitations and could result into the financial and reputational loss to an organization.

Typically, transactions/logins are the keys to employees and customers of the organization to access the web application to carry out business.

Compromised web applications may lead to allow an entry to anonymous user, who may steal and misuse organization information.

Injection Attacks
Broken Authentication
Sensitive Data Exposure
XML External Entities
Broken Access Control
Security Misconfiguration
Cross Site Scripting
Insecure Deserialization
Use of components with identified vulnerabilities
Insufficient Logging and Monitoring

The mobile codes do have vulnerabilities, which are exploited by hackers to gain the access of user information.
Mobile App VAPT enables the organization to identify the vulnerabilities that are turning out to be threats by exploitations and could result into the financial and reputational loss to a user and ultimately to an organization.
The mobile apps are typically used for financial transactions while if compromised, the user may come across a financial loss. This may lead to legal consequences to organization and may lead to lose the reputation as well.

Improper Platform Usage
Insecure Data Storage
Insecure Communication
Insecure Authentication
Insecure Authorization
Insufficient Cryptography
Client Code Quality
Code Tampering
Reverse Engineering
Extraneous Functionalities

A cloud-based application is an application that operates with the help of cloud data. Cloud environments experience–at a high level–the same threats as traditional data center environments; the threat picture is the same. That is, cloud computing runs software, software has vulnerabilities, and adversaries try to exploit those vulnerabilities. However, unlike information technology systems in a traditional data center, in cloud computing, responsibility for mitigating the risks that result from these software vulnerabilities is shared between the CSP and the cloud consumer. The risks include unauthorized access to customer data, security risk at vendor, Compliance and legal risks, risk related to lack of control and availability risk.
Cloud App audit addresses these risks and ensures the organization for Cloud Functionalities.

Accountability and data risk
User Identity Management
Regulatory Compliance
Business Continuity and resilience
User Privacy and Secondary use of data
Service and data integration
Multi tenancy and physical security
Incidence Analysis and Forensics
Infrastructure Security
Non-production environment exposure

The IT Infrastructure is the back-bone for an organization. Flawless IT infrastructure serves the organization needs to build the business and profits.
The IT Infrastructure audit is carried out to verify the system’s internal control design, efficiency and effectiveness against stipulated and mandatory standards and best practices. This includes the review of design, implementation, performance, efficiency, embedded and alternative security controls and IT governance or management. Implementing the controls is a necessity while not sufficient to provide adequate security. Periodic review of the IT infrastructure and the processes is mandatory to ensure compliance to these controls.

Policy for the administration of IT infrastructure
Computing Devices
Networking Devices
Configuration
Business Continuity and redundancy
Connectivity
Encryption of data in transit, data in use and data at rest
Accountability and responsibility of administration
Monitoring and Logging
Reporting and frequency

The corporate networks are designed to serve multiple remote requests. The networks devices and vulnerabilities in design could allow the hackers to breaking down the network and entering into system to misuse the information. Penetration Testing enables the organization to understand the vulnerabilities at early stage and can be patched to harden the networks.

Information gathering
Network penetration
Application penetration
Assessment of infrastructure against frameworks
Identification of threats through vulnerabilities
Exploitation of threats
Proof of Concept
Reporting
Compliance verification
Final reporting

There remains a barrier between the developer and the user and the same is reflected in the application. An organization is always concerned for the functionality and validations defined in the applications.
The functional audit of an application needs domain experts and so is the competency of AITCPL. It is ensured that the application is functioning as expected and does not have short controls inviting income and revenue loss to organizations.

Policy for the use of application
parameterization and configuration
Input Controls
Processing Controls
Output Controls
Income/revenue leakage
Logical Access Controls
Segregation of roles
Exception Handling
Data handling

Information Systems and ITGC Audits

An information system includes people, processes and automated systems. An audit of the same to verify the vulnerabilities and reporting the same assists the organization to define and implement controls.
Post implementation of controls, IT general Controls (ITGC) are audited for the effectiveness and efficiency.

Policy and procedure for acquisition of Systems
Organizational Hierarchy and Access to IT Infrastructure
HR and Resource Management
Allocation of Physical and Logical Accesses
Roles and responsibilities
Inter-department movement of data
Interfacing of systems to external networks.
Overlapping roles and responsibilities
Organizational Hierarchy
Access Allocation to information and reports