WINT ENTERPRISES security assessment report (SAR) summarizes the organization’s susceptibility to attack in relation to its policy and vulnerability conditions. Vulnerabilities are classified as high, medium, or low. High risk vulnerabilities are those which provide unauthorized access to the host, and possible, the network. Medium risk vulnerabilities are those that provide access to sensitive network data that may lead to the exploration of higher risk vulnerabilities. Low risk vulnerabilities are those which provide access to sensitive, yet non-lethal, network data.

CLIENTS BENEFITS
• Validate technological and procedural implementations to meet established security standards
• Ensure your organization’s ability to deliver services
• Maximize availability by identifying and correcting security gaps before they occur (redundancy and proactive monitoring)
• Customize a security program to your culture, industry and environment (multi-national, multi-vendor)
• Avoid business interruption and the resulting loss of customers (i.e. internet service providers)

TYPICAL SITUATIONS FOR A SAR
• Creating a security policy if one does not exists
• Re-enforcing defined security policy by having an audit conducted routinely
• Security hardening (new technology available)
• A new asset is acquired (application, network device, etc.)

TYPICAL SCOPE OF SAR
• Review current security policy before start of audit
• Check physical security
• Identify critical assets that might impact business if compromised
• Check known vulnerabilities on systems and applications
• Review selected employee’s knowledge of company’s security policy
• Prepare expert findings and recommendation for fixes in security policy

DELIVERABLES
Client deliverables for Security Assessment Report (SAR) are defined in the Statement of Work provided after the initial meeting. A WINT ENTERPRISES security assessment report is performed in accordance with our four-phase methodology – Define – Discover – Analyze – Recommend. Examples of deliverables include:
• An assessment of your overall security capabilities that takes into consideration technology maturity, security awareness and training
• Identify what you are trying to protect: lists of assets
• Provide a listing what you are trying to protect the assets from (the exploit)
• Provide industry best practice on how likely the threats are
• Implement measures that will protect Company ABC assets’ in a cost-effective manner. Design recommendation for IDS, firewall, AAA, documentation, etc.
• Provide documentation on how often the process (SAR) should be done – based on complexity, new vulnerabilities reported by vendors, size of company, changes (new employees, fired employees, etc.
• Final report on the gaps in security policy from SAR with fix