BT Secure Networking Quick Start

BT Secure Networking Quick Start Service

Preserving the integrity, confidentiality and availability of information and computing resources is a leading priority for every organisation. Failure to identify vulnerabilities and validate the effectiveness of security controls could compromise the very future of a business.

The BT Secure Networking Quick Start service enables organisations to assess their network security rapidly, identify weaknesses and then take cost-effective remedial and preventative measures.

The service is based on a unique set of tools, experience and knowledge, drawing on the expertise of consultants from across the BT Group who have come together to form a Global Centre of Excellence.

The importance of Secure NetworkingNetwork security is changing, with attacks on businesses no longer motivated simply by a desire to cause damage and disruption. According to Gartner: “Financially motivated, targeted attacks are increasing, and automated malware-generation kits allow simple creation of thousands of variants quickly.” (Gartner, December 2006)

Although currently fewer than 10% of attacks are against a single company, the financial impact of a successful attack can be enormous – perhaps as much as 50 to 100 times greater than a purely malicious worm or virus. Gartner’s December 2006 report included the bleak prediction that 75% of enterprises would soon be affected by financially-motivated, targeted malware. The threat hasn’t diminished and organisations in all sectors are under pressure to respond accordingly.

Of course, the damage goes well beyond the purely financial. Other concerns include damage to a company’s reputation, legal action stemming from a failure to protect customer information, lost productivity as employees are deluged by spam or held up by a slow network, and compromised assets like wasted bandwidth and damaged hardware.

About the BT Secure Networking Quick Start service

Improving secure networkingThe objective of the Secure Networking Quick Start is to assess the client’s current security level against known vulnerabilities and best security practice procedures. It aims to:l Provide valuable recommendations on ways

to improve or fix any weaknesses foundl Give advice and offer solutions to equip your

business to manage network security more effectively in the future

l Assure and give confidence to your organisation, its customers and shareholders that the business is secure from external attacks, including the potential financial loss and loss of goodwill that comes with them

How do we do this?l BT offers independent technical audits and tests of IT systems and networks by simulating real-life attacks on the technical security of these systems. BT’s security consultants are specialists in IT and communications security and have vast experience. We have people who are approved by the UK Government’s CESG CHECK scheme, and are Certified Ethical Hackers and NSA certified security professionals. Using the tools and techniques available to real attackers such as hackers, industrial spies or criminals, and then applying a systematic testing methodology, the BT teams can thoroughly test the effectiveness of existing technical security defences and countermeasures.

Status checklistClients can begin the Quick Start service by completing a simple checklist on their current network security status. This enables a high level discussion to take place between clients and their BT Account Manager, which helps establish the most appropriate starting point for the Quick Start service.

The checklist does not require technical input and should be completed by a senior member of staff who is aware of the current network security provisions and status.

There are two levels of Quick Start on offer. Although both analyse network and existing security, they differ in purpose and the level of detail. The checklist will help decide which is most appropriate.

Level one: Workshop (1 day) &Technical Risk Assessment (3 days)Level one enables BT to identify the areas of your environment that require security assurance. This is achieved through a one day workshop session and a technical risk assess-ment. The outcome allows BT to create a high level security assessment strategy, taking into account your business objectives, asset criticality and long-term security goals.

Step one: (1day) Client WorkshopThis is an interactive question and answer session to identify your security objectives for the short to medium term. A security effective-ness register is used to quantify the potential risk posed to your organisation.

Step two: (3 days*)Technical Risk Assessment This optional assessment utilises state of the art technology to create a technical risk model, which enables the risk level to be assessed from identified threat sources such as third parties, employees and the internet. The resulting model then enables BT to recommend developments to your security strategy. This assessment can be broken down into 3 steps:

The process

a) Network MappingA network mapping exercise is a quick way to help confirm your internet presence, providing a map of which devices from your organisa-tion’s network are visible online. At a basic level, this process identifies known and potentially unknown devices on the network. It also assesses the network’s segregation to make sure external boundaries are protecting the network as intended.

b) Vulnerability AssessmentUsing the results from the network mapping in step one, we assess the critical devices to find the potential vulnerabilities in your system or network, and recommend fixes.

c) Risk ModellingThis allows you to visualise the network, verify access policy compliance and routing rules and discover root causes of violations. It also helps you to simulate attacks on the network, appreciate the most cost-effective remediation alternatives and understand the business impact of threats.

This enables corporations to focus on the type of threats that are most destructive to their specific operations.

Step three: Executive Summary Report Our security consultants produce an executive summary report outlining the findings and priority areas identified for further action. Additional feedback is delivered and the report’s findings are reviewed with the customer. This can be done via a web confer-ence or a face-to-face meeting.

*Duration is subject to size and complexity of network. Modules in Level 2 are offered separately and some are subject to availability outside of the UK

Level two: Quick Start Secure Networking Assessment

Approximate duration: 2 weeks+*,dependent on the modules selected. A Secure Networking Quick Start Assessment will typically take place over a two to three week period. This will establish a much greater understanding of your organisation’s network security by performing further specialist assessments of your individual devices and security components.

Step one: PlanningA brief meeting is held to agree the basic engagement structure, the key stakeholders required and a schedule for further meetings. This initial meeting will also identify which of the modules outlined below are most appropriate for the engagement.

Step two: Initial Situation AnalysisWe establish a general understanding of your organisation’s network architecture and known issues and requirements through a documentation review and by using high level review tools. Typically, this will require network diagrams, security policy and procedure documents, and interviews with key stakeholders.

Step three:Option Assessments Modules Module 1) Network MappingA network mapping exercise is a quick way to help confirm what’s running on an organisation’s network and where your network perimeters end. The process looks to identify unknown devices on the network as well as assessing the network’s segregation to make sure external boundaries and internal gateways are protecting the network as intended.

Module 2) Intelligence Gathering & Blended AttacksBT recognises that social engineering has become more sophisticated, with criminals harvesting information about organisations that is publicly available. We can attempt to holistically test the physical, technical and social elements of your security, combining real-world criminal methods and tools in attempt to gain access.

The process

Module 3) Web Application TestingThis testing identifies and investigates the prioritisation of vulnerabilities found in thin client (web browser) and thick client (java) applications, including front end and back end systems. Activities include SQL injections, cross site scripting, decompiling code, and HTML proxy manipulation. Tests are performed with an in-depth application scanning tool and thorough manual checks.

Module 4) Penetration TestingPenetration testing is similar to the vulnerability assessment in level one.However, in this module our consultants go deeper, exploring and exploiting the vulnerabilities to gain access to the system. This enables us to produce a comprehensive report detailing any vulnerabilities.

Module 5) Firewall Rulebase AssessmentA firewall rulebase assessment sees our security and firewall experts using general best security practices to identify areas of weakness, like insecure protocols, poor change control and inefficient rule order.

Module 6) Email Application AssessmentThrough our partnership with MessageLabs, we provide a time limited assessment of your business’s email traffic. This assesses the levels of viruses, SPAM, and general content control issues within your email.

Module 7) Voice & VOIP AuditA lucrative target for hackers, VoIP is a complex application and inherits the security issues common to other data network applications. It also has a number of unique security issues, and new VoIP-specific vulnerabilities and attack tools are announced each day. We provide a security assessment and a real-time audit of your enterprise telecom network.

Module 8) Secure Code ReviewWith extremely large databases of customer information to protect, and numerous access points, many companies are prime targets for organised crime, foreign governments, and malicious insiders.The secure code review, in conjunction with Penetration and Application testing, ensures web applications have a level of assurance required to handle financial and personal information.

Module 9) Database Activity Monitoring Cyber villains have been attracted by the huge amounts of money that can be made from targeting corporate databases and are using sophisticated hacking techniques to steal and profit from their data. Through our partnerships we are able to carry out real-time database activity monitoring.

Module 10) Wireless Enterprise Audit After evaluating your existing wireless network security, we pinpoint potential weaknesses via our thorough wireless enterprise audit. We test wireless intrusion detection system (IDS) alerts and identify weaknesses and vulnerabilities specific to your wireless infrastructure. We can then offer you a unique tailored wireless solution for your organisation.

Module 11) Mobile Worker Assessment Evaluating the risks associated with remoteand home working security, we take a risk-based approach in reviewing the security of these potential backdoors into your organisation’s network infrastructure. Remote access and VPN testing can be undertaken, along with a mobile worker audit. We will attempt to breach a mobile worker’s laptop and its access controls with a host review to see if valuable data can be accessed.

*Duration is subject to size and complexity of network. Modules in Level 2 are offered separately and some are subject to availability outside of the UK

A concise report:Based on the modules selected, this report:l Details how your network security compares

to best security practicel Lists any vulnerabilities foundl Provides a test results section l Makes recommendations for any remedial

actions required

It also provides predicted results, reports, analysis and practical information on imple-mentation and fast-track problem resolution.

The purpose of the report is to prevent attackers gaining access to your network, decrease the amount of time spent responding to security incidents, identify areas that can be managed with greater efficiency and provide peace of mind that your security infrastructure is protecting the network as intended.

The outcome

To help us complete the Quick Start, you will need to provide some information. The exact requirements will vary according to which Quick Start option you take, but it may include:l Up-to-date network diagramsl Security policy documents (what services you

want to allow through your firewall and why)l An electronic or paper copy of your current

firewall rulebase (an electronic copy in HTML format is preferred) and IP address informa-tion of firewall(s), connecting infrastructure, and servers (so machines in the rulebase can be easily identified)

Please note that if it is not already part of your company’s IT security policy, you may wish to inform your employees that communications and web usage may be monitored and logged during the Quick Start.

We will, of course, coordinate any activities that are tested on the network with you to ensure that false alarms are not generated and end-users are not impacted.

The following questions are geared to indicate the most effective starting point for a BT Secure Networking Quick Start engagement with your organisation. Please answer ‘Yes’, ‘Partially’ or ‘No’. The relevant box should be completed and you can then total your answers in the summary section to give an indication of current status.

1. Organisational awareness and commitmentIs there a formal owner for IT security within your organisation?

Yes Partially No

Is there recognition across senior management and key stakeholders of the need for, and value of, secure networking?

Yes Partially No

Are the senior management team aware of the impact of any current issues being faced in the network security area, and the need to resolve these issues?

Yes Partially No

Is there a network security strategy and policy in place and is it well defined across the organisation?

Yes Partially No

If yes, are the strategy and policies being followed?

Yes Partially No

Status checklist

2. Current secure networking effectivenessAre you measuring your network security standards against industry standards and best practices?

Yes Partially No

Are regulatory and internal compliance requirements being fully met?

Yes Partially No

Is user access being efficiently and effectively provided and removed according to business needs?

Yes Partially No

Is your network security infrastructure enabling new applications to be deployed rapidly to meet new business opportunities?

Yes Partially No

3. Current and planned secure networking initiativesAre the business and functional requirements which drive secure networking initiatives well understood throughout the organisation?

Yes Partially No

Are these requirements established on a regular basis and managed accordingly?

Yes Partially No

Is there a business case for network security agreed across the organisation?

Yes Partially No

Are secure networking initiatives being formally prioritised and co-ordinated, to achieve the greatest immediate and long term business benefits?

Yes Partially No

Is there a clear roadmap agreed across the organisation for improving network security with measurable milestones in place?

Yes Partially No

4. Summary Yes Partially No

1. Organisational awareness and commitment

2. Current secure networking effectiveness

3. Current and planned secure networking initiatives

Offices worldwide

The telecommunications services described in this publication are subject to availability and may be modified from time to time.Services and equipment are provided subject to British Telecommunications plc’s respective standard conditions of contract. Nothing in this publication forms any part of any contract.

© British Telecommunications plc 2008Registered office: 81 Newgate Street, London EC1A 7AJRegistered in England No. 1800000

Designed by Loewy: London

PHME 53150

About the BT Quick Start SeriesBT’s Quick Starts are concise, service-led engagements focused on key services and technologies that are of critical importance to organisations within the digital networked economy. These services and technologies combine to form a wider infrastructure model, each representing significant advances and long-term efficiency for the organisations deploying them. The Quick Starts can be used as an integral part of an organisation’s roadmap along their development journey.BT Quick Starts enable customers to assess, test, plan and establish the validity of each service or technology in manageable parts. Each Quick Start is formed using defined stages with clear outcomes and will provide the necessary information not only for the technical aspects of deployment, but also for the commercial justification of infrastructure or network changes.

What next?We can take you through the benefits and implications that would directly affect your organisation. In addition, we can help to build tangible examples which are more valuable to your business stakeholders. Contact your BT Account Manager to arrange a meeting and discuss collaborative working in more detail.

Why BT?BT Global Services is a market leader in providing secure networking consultancy and solutions. In 2006 BT was awarded the Frost & Sullivan European Market Leadership Award in the Customer Premise Equipment (CPE) Managed Security Services (MSS) market. In the following year, BT was awarded leadership in the North American Gartner MSSP Magic Quadrant. In 2008 BT was awarded “Strong Positive” in Gartner’s Asia and European MSSP Market Scopes.

BT’s position in the secure networking market has strengthened with the acquisition of Infonet in February 2005, followed by the acquisition of Radianz the following month, and then most recently Counterpane in 2006 and INS in 2007. This has been rapidly followed by several other acquisitions in 2008l INet with a strong track record in Italian

Blue Chips. l FRONTLINE with security capability

throughout the Asia-Pac region.l Net2S, a technology and security consultancy

specialising in capital markets.

BT’s Managed Security Service offerings are very comprehensive and include firewall/VPN, IDS/IPS, anti-virus, anti-spam, URL filtering, strong authentication services (PKI), security event monitoring and correlation, vulnerability assessment and threat mitigation.