Your Website’s Security Is Important –Find the Best Vulnerability Scanner for It

Even though computerized application security scanning and testing has been part of organisations’ operations for more than a decade, it still is a complicated and daunting process.  

However, the good news is that you will find a number of methods that guarantee a highly automated scan with reduced time and improved accuracy of results.

Creating an effective test environment can be difficult, but it surely is indispensable in today’s day and age.

For website security and vulnerability scanner for your e-commerce, follow these 3 guidelines:

Permit Sufficient Time

When you have a limited time frame to work in, testing a web security and vulnerability scanner can be overwhelming. It is important to know that sufficient time is required to settle and be comfortable when working with varying configuration methods and compare their outcomes.

Furthermore, checking reports of each technique again and again for accurateness and precision requires time.

Utilize a Real App, Not a Public Test App

Testing a web scanner on real application makes sense. As a business owner, you clearly know which applications have more vulnerabilities than the rest. So, the best practice is to test web security on those real applications, instead of public applications.

Find a Trustworthy Vendor

Regrettably, under certain circumstances, you may be compelled to depend on the conclusions of the scanning vendor. This is because the process can be complex. As a result, the only way to find a reliable website security scanner that’s tailored to your needs is by spending some time over the phone or person-to-person with multiple vendors to find out what can be achieved and what will remain untouched.

More often than not, this means coming up with a technically sound person and spending some time with them to learn how the website scanner works, its strengths and the kind of applications it has problems with.

When you pursue these 3 basic strategies, you perk up your chances of accessing one of the most programmed, precise and trouble-free application security testing solution.

We have just that for you at Lean Security. Offering a range of website security testing solutions, we have dedicated web vulnerability scanner to perform managed web vulnerability scanning and security audit. Just give us a call at +61 (0) 2 8231 6635. 

Web Security Practices The Financial Sector Must Implement ASAP

The financial services segment is the most important target for cyber criminals, making it one of the many sectors that need to take a substantial stand for the security of their web applications.

The cyber criminals have numerous opportunities at hand to violate and breach your website and thus, your customers. Despite the fact, a good number of financial firms put themselves at risk by not investing in the security of their web applications and its top practices.

 As per the  Security Spending Benchmarks Project Report, web application security accounts for less than 10% of the total security expenditure in nearly 36% firms. On the other hand, 33% aren’t even aware of what portion of their security expenditure is allocated to web applications.

Stated below are some of the best practices that the financial sector must follow for ultimate web security:

Improve Risk Assessment

Financial firms must analyse their web transactions, and determine the extent of risk based on types of transaction conducted. They must jointly develop risk alleviation strategies.  Make certain to evaluate detailed attributes such as:

·         Type of customers,

·         Capacity and capability of transactions,

·         Sensitivity of information and current level of security,

·         User-friendliness and customer experience, and

·         How mobile devices are connecting with the environment. 

Beyond considering the monetary losses, also think of liabilities, risks and reputation. Make it a practice and perform this assessment every year to determine probable impact and required levels of security.

Establish Rigorous Authentication Standards

The threats are increasing and growing stronger. Hence, the need for stronger authentication is greater than ever. Growing above usernames and passwords for wire transfers, financial firms took over alternate solutions such as OTP (One Time Passcodes) tokens. However, even these methods aren’t effective anymore, particularly against man-in-the-browser hits.

There are a range of advanced techniques that offer desired level of protection in two ways:

·         Using an individual communication channel under a user or

·         By depending upon the superior behaviour-based deception discovery engines that can instantly sense the anomalies in transactions or website navigation.

Undertaking a Layered Approach

It is astounding to learn that there is no solitary corroboration or conventional fraud discovery solution to bring progressive malicious attacks on banks and other financial institutions to a standstill. What financial firms need is an additional layering of diverse, corresponding safety measures and technologies. Some examples include:

·         Well-built authentication,

·         Observable fraud discovery,

·         Out-of-band substantiation of transactions, 

·         Mobile verification and extensive confirmation digital SSL certificates — these offer the most reliable means of defending customer information and dealings in a financial surrounding.  

At Lean Security, we offer comprehensive protection of applications within the financial sector against unauthorized access and introduction of malicious codes.

Our services include, but are not limited to, application security testing, web security scanning, manual web penetration testing and more.

For more information, email us at info@leansecurity.com.au or call +61 (0) 2 8231 6635 for further information. 

Web Security Concerns In 2016- Healthcare Under Attack!

2016 started with a BANG for the worldwide hospital and healthcare industry. Several security-related incidents took place, from a ransom-ware attack on a LA hospital to an attack on a hospital in Melbourne, and so on. Three other incidents took place in the span of just 2 months into the new year!

While concerning for the security industry, it’s actually not a surprise. The healthcare industry was so far excluded in security breach concerns of the past, but with the Internet of Things on the rise, this industry has become as vulnerable as every other.

Modern Medical Devices More At Risk of Being Hacked

The medical devices and equipment used today in healthcare makes use of fully-functional computers that have complex operating systems and applications installed. Since most of these devices also make use of the Internet, external networks and various types of cloud based servers, cyber-criminals and hackers don’t need to put in too much effort to steal important data or make entire systems corrupt.

Web Application and Cloud Security Not a Concern for Health Departments

This has become a huge concern. Why? Unsecured authorization, program design vulnerabilities, unencrypted communication channels and critical buys and anomalies in software can and do lead to attacks. Security experts at Lean Security reckon there’re 3 main reasons why hackers and cyber-criminals are able to gain access to hospital systems so easily:

Ø  Usage of Internet with no or weak authorization

Ø  External devices not being protected (from being accessed) by local networks

Ø  Vulnerabilities in software design and architecture

Lean Security’s Recommendations to Improve Security Infrastructure in the Healthcare System

Following these recommendations will not only improve security of your systems but will also educate employees on what should be done in case of an attack or breach.

Ø  Implement IT security policies and make sure they’re being adhered to.

Ø  Develop timely patch management and vulnerability assessment policies as well.

Ø  Take steps to protect your systems from malware and hacker attacks.

Ø  Keep a close eye on your own local network.

Ø  Test all your web and mobile applications for anomalies and performance bugs.

Having a sound security infrastructure is quite possible with the right help. In addition to implementing IT policies and making sure employees know what to do in case of a security breach, you’ll need the help of expert security testing services. Get in touch with us to learn more.  

Can Your Website Withstand The Pressure Of A Live Video Event?

Businesses have finally learnt about load testing? In 2013, companies like Calvin Klein, Coke, Axe and several others suffered a massive crash (after putting in millions to air adverts) during the Super Bowl. Yes, why should we worry about the Super Bowl? It isn’t about the sport but how companies picked themselves up and did something about their site’s awful load times.

The fact that only one site crashed last year during the game communicates a lot about how seriously companies are treating the issue, especially with something as big as a live event at stake.

Live Video Streaming Becoming an Important Part of Consumerism

Before the emergence of live video streaming, the world may have thought: what are the chances of thousands of viewers watching the same thing at the same time? It’s hard to imagine even now, when watching videos has never been easier, how video streaming live has become an important part of consumerism.

Website load testing has become an essential element, as online viewing changes from binge watching on Hulu or Netflix into watching live video events. Companies that have shifted their marketing to the online video spectrum or stream video on demand know more than ever the issues their site can (and does) face under pressure of a live event.

Live Video Events Not the Same as Online Streaming

It’s a one-shot deal when it comes to video live events. The very nature of this mode of online video viewing means interested individuals will likely tune at the same time as everyone else - which is a lot of online traffic for the host site.

The Trouble with Video Live Streaming

Take a note of this next time you stream a live rugby match between two very popular teams: is the video loading fast enough? Is the streaming clear and unhanging? For a live video stream to be successful, the hosting site doesn’t only need fast load times for the video, but the site itself should be able to stay up despite a giant wave of online traffic.

Does your website experience any video streaming issues? One way to find out is by employing live video load testers that’ll test load times of your website under stress. You can also contact Lean Security and ask about our website application testing services. 

3 Tips For Creating Better Web Browsing Experience For Your Customers

Everyone wants and expects their website to perform in a certain level. E-commerce businesses depend on more sales, bloggers are looking for better traffic, and non-profits want more participation from viewers.

All of this is only possible with good website performance. Therefore, when the site comes crashing down, everything else follows.

Creating a Better Web Browsing Experience for Consumers - An Essential Marketing Strategy?

A business’s marketing and operation strategies will only work today if websites, web and mobile applications perform at their peak effectiveness. You’d have to re-think improvement if website and applications aren’t getting the optimal level of performance needed.

While a usability test can be an effective tool to improve your website and applications, you can also do the following to improve web browsing experience for customers.   

Improve Your Search Function

Content is king for any website. This poses an issue as linking every video, blog or white paper from your website’s homepage becomes difficult (the site can get cluttered). For this to work, i.e. web browsing experience, users must find it easy to find content in the first place.

There are numerous ways to improve the search function of your website - the easiest and simplest being making the search box highly visible.   

Check out the Competition i.e. What Are They Doing?

You’ll have competitors, whether just entering a particular industry or been in the playing field for some years. Take advantage of this by evaluating their websites and applications. Ask yourself these questions:

Ø  Are they doing anything different than you? What is it?

Ø  Is their site more professional looking? How does it compare to yours?

Ø  Are they using any keywords that you aren’t?

Ø  How fast is the loading time of their website?

Think Multi-Platform – Mobile Applications and Its Design

While businesses are expanding their viewership and e-commerce prospective by introducing mobile applications, this won’t do any good if design and usability isn’t up to par as in its web counterpart.

While placing the website main subject categories – i.e. contact, home – at the top does work when viewed on a desktop, the same design shouldn’t be used in the mobile application.

Implementing a responsive web design on mobile applications is the best way to go about this.  

Since mobile is the future of e-commerce, think about developing a seamless mobile application as opposed to focusing on other marketing strategies. Lean Security can help test the new mobile application.   

3 Reasons How Managed Security Services Can Help Save Your Business

Viruses, once the bane of every IT administrator’s existence have taken a back-seat in light of the cyber and data security threats faced by businesses today. This increasing awareness of security threats in system infrastructures as well as determined and highly sophisticated cyber criminals is causing a shift in IT security systems and how they are being managed.

In order to mitigate risks, businesses are turning to professional managed security services because why not?

Protecting Businesses against Security Breaches, an Insurmountable Task

Companies are trying to keep themselves floating in the turbulent sea of security breaches and global onslaught of cyber attacks but are badly failing. Its obvious staying ahead of the curve requires more than just a sound IT infrastructure and what with 61% of Australian companies expecting a security breach, the question here is: what needs to be done?

Outsourcing your IT functions and department to a professional managed security service seems to be one answer. How would it help?

Your Company Can Make the Most of Their Security Budget

You’ll have to face huge costs by implementing your own security measures. Additionally maintenance of a rigid security posture isn’t possible with a large organization, using various devices and networks to conduct their work. While many cyber challenges do get addressed by rising security budgets, more often than not the need for extra security funding and staff retention is realized late.

Don’t forget, recruitment of new security personnel requires time and training which is why outsourcing this task to a MSSP (managed security service provider) can help decrease the large, upfront costs.

Admit It; You Simply Can’t Take Care of Everything

Even if you can take care of the company’s web application security, there’s a stark difference between doing a very good job and doing an okay one. Yes, outsourcing wasn’t considered a good word before but it is now proving to be a viable and highly effective solution to business growth and to utilize specific skill sets.  

Outsourcing your security needs to a trusted managed service provider will ensure you can concentrate on developing and expanding your business.

Increasing Threat of Evolving Security Anomalies

What you see now in the security landscape may be very different tomorrow. Since the threat environment is forever evolving and adapting to new security measures and technologies, the need to have a professional team of security experts back your business is an advantage.

 An established managed security service like Lean Security can help address every security concern, monitor and respond to the gravest of threats so that you can run your business with ease and no concern at all.

Top 4 Application Security Issues in Healthcare Industry

The healthcare industry is increasingly becoming a promising domain for applications that can help provide better services to patients, while making the job considerably easier for healthcare providers.

A large number of applications utilize Wireless Medical Sensor Networks (WMSNs) for effective communication, efficient practices and patient mobility.

While the integration of WMSNs keeps growing every day in the healthcare sector, applications still face some security issues.

Here we discuss the 4 most prominent WMSN application security issues in the healthcare industry:

#1-Monitoring Patient Vital Signs

The most common application security threats that arise in the healthcare industry have a lot to do with patient confidentiality. If there are no appropriate security protocols in place, an adversary can snoop on patient vital signs through free communication channels. Similarly, if the individuals have a powerful antenna, they can easily pick up on the messages from the network.

#2-Routing Threats

In a multi-hop environment, data packets are forwarded to the base station through multi-hop routing procedures. This comes with its own set of security threats. A malicious code may refuse to forward certain information and it may simply be lost in transit. If the attacker is overtly included in the routing path, this threat could be stronger.

#3-Location Threats

Patient mobility is supported by medical sensor networks so that the location of patients can be identified to reach them on time. Typically, location features are based around radio frequency, received signal strength indicator or ultrasound. If adversaries constantly receive radio signals and are able to identify codes, they could gain direct information that may compromise a patient’s privacy. Of course, someone who is probing information to identify patient location could have even worse intents.

#4-Activity Tracking Threats

Those with malicious intent can also break into patient records when the patient is busy exercising in a health-club. Based on the wireless medical sensor data a hacker could precisely identify the present activity on the patient. Even worse, the hacker could even send over the wrong exercise tips or advise medication that could result in injuries and bodily harm.

As medical sensors are placed on a patient’s body to send over health data like location, heart rate and health feedback to a base station, it might very well be possible for a hacker to alter information which may raise erroneous concerns about the patient’s health.

A well-planned security mechanism with appropriate security testing services in place can help keep the risks of these threats to a minimum. Drop us an email at info@leansecurity.com.au to learn more about our services.

A Guide to Establishing a Successful BYOD Policy

While the Bring Your Own Device (BYOD) is a growing phenomenon among business in various industries, it certainly comes with its own risks. Allowing employees to use their own devices to perform organisational functions results in substantial benefits as workers can access information from anywhere.

This makes up for increased productivity and smooth communication as employees can speak with individuals in entirely different time zones whenever it is convenient.

 If you are struggling to establish and implement a BYOD policy that contributes to your overall success, here are a few tips that can help:

Identify Permitted Devices

While it was quite easy back in the Blackberry days, things are complicated today. There are a number of device choices that range from iOS to Android based phones.

Therefore, it is imperative to specify what you imply with the integration of a BYOD policy. Do you think you should tell employees to bring Android tabs but not iPhone?

Make sure you let employees know which devices they can bring in addition to the organisation-issued devices you continue to use.

Establish Strict Security Policies

A prominent number of smartphone users avoid keeping their devices locked. They see locks as hurdles to easy access to their device. This can particularly be problematic when you have too much of sensitive information accessible through employees’ devices.

If your employees wish to make use of their own devices with the corporate systems, make sure they accept a complicated password. The password should be lengthy and alphanumeric in nature. You simply can’t settle with a four-digit pin code.

Specify Which Apps Are Allowed And Those That Are Prohibited

This rule should apply to all devices connected to your environment, personal or corporate. Some of the most significant considerations should include replacement email applications, social media browsing apps along with VPNs.

Address questions like:

·         Should you allow users to install and download apps that come with serious security risks?

·         Do the commonly used apps have security holes in their integration?

·         What if an app enables spammers to gain access to mail through your company?

Specify Your Employee Exit Approach

Having a BYOD policy is not all about personal device use within the organization.

What happens to those devices and data within when the employees leave? How would you ensure that removal of email, access tokens, and other sensitive information?

The trouble is, ensuring this is not as simple as having the employees return the corporate issued devices. Implement an ‘exit wipe’ to the devices and make sure your rights to enforce this wipe are clearly communicated to exiting employees.

Are you looking for mobile app security testing or a penetration testing provider who can help you implement the perfect BYOD policy in your organisation? Look no further.

At Lean Security, we can provide actionable insight to implement a successful BYOD policy that actually works for you. Give us a call at +61 (0) 2 8231 6635 to learn more.

4 Tips to Improve Security of Financial Apps

Although mobile applications provide users with easier ways to gain access to critical information on the go, these apps can quickly turn into a nightmare, in cases of breaches.

In order to provide immediate access to financial data for users, apps need to be balanced perfectly between convenience and security. When considering financial mobile apps for your financial institution, make sure you follow these tips to remain safe:

#1-Protect Sensitive Data

Most financial applications either use a person’s bank account details or card numbers to establish identity.

This data is constantly transmitted over the internet to conduct transactions. There should absolutely be no reason to store this data on the device or send it over the wire. Applications should always make use of a different key for identifying a user account.

#2-Passcode Access

A prominent number of smartphone users will turn off the PIN access to the device if they have enabled security for the device itself. It is important to have the financial application check if the user ever turns of the password for their device. If they do so, the user should automatically be prompted to turn it back on.

It is also important to constantly re-evaluate users when they are conducting money transfers, paying bills, or making peer to peer payments. Doing this will not necessarily slow down the user experience, but will work as confirmation for the action to be implemented. If the applications notices any suspicious activity from the Web services side, it should push an additional question to the user before the action can be completed.

#3-Data Services Access

All data should be requested over a SSL to enhance encrypted communication. This SSL certificate should at least be of 256-bit encryption strength. Furthermore, the native application client should utilize OAuth, which allows applications to connect to data services without having to store username and password. This way the sending of credentials is kept to a minimum.

#4-Images Of Checks

Check images consist of all user data like account numbers, routing numbers and billing addresses. Encryption of large images on a device is slow compared to text data. It is highly recommended that images of checks that are stored for remote deposit capture should be forwarded to the server immediately after being taken. The check image should never be cached or stored in the device to be retrieved later.

These basic practices are the heart of what we do at Lean Security to make sure your mobile and web applications stay safe.

Get in touch with us at +61 (0) 2 8231 6635 or drop us an email at info@leansecurity.com.au to learn more about our security testing services.

BYOD and Growing Security Threats

With more and more companies allowing employees to bring their own devices, the Bring Your Own Device (BYOD) trend is gaining traction. By allowing workforce mobility and flexibility, BYOD has had a significant impact on the traditional IT model.

Although BYOD has greatly improved workforce productivity, it has brought about various challenges to business data and IT security. This is especially true of small and medium enterprises that typically lack knowledge and resources to mitigate BYOD risks and make the most of the opportunities it brings.

Let’s take a look at some of the key challenges that you might be facing when implementing BYOD policy in your organization.

Software Issues

Mobile phones and tablets are the weakest links when it comes to data security. A study identifies that 97 percent of employee’s devices have privacy issues, while 75 percent of them lack appropriate encryption to keep business data secure. This, coupled with the fact that most of the devices lack anti-virus protection or contain outdated firewall protection, means that the company’s digital environment has become more prone to attacks, thus opening the floodgates of data leakage.

Gartner predicts that one in two companies will stop providing devices to their employees by 2017. Therefore, organizations are responsible to implement robust device management policies to keep devices secure so as to control the riskiness of the business environment.

A centralized system like Mobile Device Management (MDM) can be a good way to keep track of the operating systems within the environment to ensure that the entire system is upgraded and secure.

Malicious Attacks

One of the most serious concerns for BYOD-driven organizations is dealing with the challenges of storing personal and corporate data on the same device. When the employees use a single device for both personal and professional purposes, there is always a risk of data theft. Theft may result from malware or malicious programs that users may install unknowingly. With these malicious programs, hackers may acquire login credentials to have access to the business network. An effective way to overcome the challenge is to implement a multi-layered verification system to make sure that only authorized users are granted the access to the business network.

Untrustworthy Employees

BYOD can make it easier for people to steal company’s confidential data. While it’s not possible to obliterate the risk completely, businesses need to have a strong endpoint security to prevent data leakage. Besides, establish a stricter policy regarding data privacy and confidentiality to prevent people from exploiting corporate data.

Secure your IT environment by running a vulnerability scan with us. Along with vulnerability scanning service, we offer penetration testing, web service security testing, and mobile app security testing to make sure that your business environment remains safe and protected. Get a trial or contact us at +61 (0) 2 8231 6635 to learn more about our services.