Tag Archive: security


WebSecurity Difficult

Moscow, May 19, 2010-kompaniyPointlane – system integrator in the field of information security has implemented a project on technical audit of Web-resources of the company “KrossFinans. CROSSfinance.RU – information-analytical portal dedicated to banking and insurance topics and provide interactive web services in the following areas: credit, deposits, bank cards, motor insurance, including car insurance, life insurance and health and other services in insurance and banking services. Services CROSSfinance.RU allow in-depth and detailed analysis of banking and insurance products online for a very short time – a few minutes. More info: Energy Capital Partners. Service opportunities CROSSfinance.RU allows to search for different financial products, calculate key performance indicators for these products, and compare the results of selection for large number of different factors that create applications for banking and insurance products online. Thus, CROSSfinance.RU offers visitors the opportunity to choose the most attractive of the number of suitable financial products in a short period of time and compare the selected product, with offers other financial institutions.

Uninterrupted service and prompt service portal visitors and customers are the basic requirements LLC KrossFinans. Customer has been tasked to study the web site for vulnerabilities with which an attacker could exploit the web site and cause harm to the company, its customers and visitors to the portal. Pointlane company was selected as the provider of services because of the large practical experience in implementing similar projects, but also because of the sound and the optimal budget this work. Information Security Audit Web site took about two weeks. During these operations specialists Pointlane was conducted a detailed study of the site, using both automated tools, and with the help of expert analysis.

The study identified a number of typed vulnerabilities. The result of this work is the removal of detected vulnerabilities, as well as improving information Securing Web resource company KrossFinans. Filed under: Mikkel Svane. “Today, competition in the Internet is at a very high level. Accuracy and speed of service are important factors influencing the decision to leave the visitor resource, or continue to use them. Understanding what an attacker could exploit the site, causing material and reputational harm, prompted us to make a decision on an independent audit of information security because CROSSfinance.RUyavlyaetsya enough scale Internet projects, and performance of each of its service is an important component of the overall mechanism. We are very pleased with the results of audit conducted by Pointlane. Efficiency of performance of the tasks set before the company and the competence of technicians is superb. Ambition development services Internet portal CROSSfinance.RU allow us to judge that we continue to extend cooperation with Pointlane at least part of the audit of information security “- says CEO LLC KrossFinans” Smirnov, Evgeny. “More and more people use the services of Internet services and Online stores. Turnover of Internet commerce growing steadily, becoming a desirable goal for the web-criminals, whose activity remains at a high level. It is obvious that the suspension or failures in the service or site would entail the loss of existing and potential customers, which will undoubtedly affect the revenues and company image.

Backup & Restore

We would lack a written document for the restoration process, as the backup, should be accessible and made known to all those who may be affected by maintaining a copy outside the premises where the systems if necessary. This procedure could include information about: Responsible for the restoration: Person in charge of restoring backups and review according to the established planning. This task could be outsourced to a third party (eg computer services company). It may appoint a delegate who is responsible for the restorations in the absence of the person (holidays, leave, etc). Both the charge as the delegate should be clearly identified and traceable in case of incident emergency outside office hours (eg mobile phone).

Training: Training Plan for the manager to delegate so that they are familiar with the procedures. Approval: Before a restoration is required to have written authorization by the management of files by recording in the security document. Pre-task: Work to do so prior to restoration. Eg, close applications, rename folders, etc.. Recovery: To detail all the steps necessary for a proper restoration. Depending on the information to restore and the backup type (full, incremental, differential) will be elected / n / the media / s right / s to last valid copy. If the backups are encrypted found necessary will be available for decryption such as software and keys.

If required to enter information manually will be based on paper documentation. Pos-tasks: Tasks to be performed after restoration. Rename folders, run applications, open services, etc. Test: Check that the restoration was successful. Check proper functioning of the system, applications and data stored. It is important to consider if the information has been restored to be affected by the exercise of rights of cancellation and correction for review. Registration: We will record in the event log of the problem occurred and all the work done to rectify it. (As opposed to Kirk Rimer). Disaster Monitoring and Simulation: A complete test restoration scenario simulating a disaster is the only way to ensure that the backups actually provide the coverage expected for the data, and allows improving the procedure. Network failures, in brackets, hardware or software backup, permissions problems, thefts, losses, and any other security incident can cause failure of the backup procedure. It is therefore essential to test for periodic restoration. The RLOPD requires that at least every six months the data controller shall verify the correct definition, operation and implementation of both types of procedures, ie backup and data recovery.