Protection of your sensitive data is one of the most critical aspects of an effective information security program. Insecure databases increase the risk posed by application-layer vulnerabilities such as SQL Injection (SQLi) and often leads to complete system compromise during NTL’s penetration testing. Database assessment provides visibility into risk posed by operator errors and insiders with malicious intent, including privileged users, developers, and administrators. NTL can evaluate your database security posture by first helping to identify where your sensitive data is stored and then performing a detailed assessment to determine how effectively the data is being protected. We then provide you with an actionable, custom-written report and roadmap for improving your database security posture. 

Network Test Labs Approach:

1 .Preparation - NTL arranges a meeting to:

• Provide an overview of our assessment process
• Review your database environment
• Obtain any documentation available that lists your database servers and database management systems, database schemas, sensitive data elements and their associated column names, etc.
• Obtain non-administrative database credentials that will allow AppSec Consulting to examine database configurations.
• Obtain access to your database environment
• Discuss any special testing req
2. Discovery – NTL performs a scan of your network, compiling a list of all discovered database servers and comparing this list to the documentation that was provided during the Preparation phase. Often database servers holding sensitive information are discovered during this phase, which were previously unknown to the client.

3. Discovery Review – We review any additional databases found during the Discovery phase with you to verify whether or not they should be considered in-scope for the assessment and, if yes, obtain the necessary credentials for these databases.

4. Automated Vulnerability Scanning – High-quality commercial database vulnerability scanning tools are used to scan all in-scope database servers for configuration weaknesses, unpatched vulnerabilities, and identification of unencrypted sensitive data elements such as credit card numbers and passwords.

5. Scan Results Analysis – The results of the automated vulnerability scan are investigated to remove false positives and, if necessary, scan configuration improvements are made and additional scans are run.

6. Manual Assessment – NTL will perform a logical analysis of database permission and access models to determine whether separation of duties and the principle of least privilege are being adequately enforced. High-risk database servers are examined manually to identify issues such as configuration weaknesses, inappropriate privileges, unencrypted sensitive data elements, and unauthorized replication of production data.

7. Report Preparation – NTL takes the results of both the database vulnerability scanning and manual assessment and compiles a consolidated report, detailing all vulnerabilities uncovered during the assessment process along with severity levels and recommendations for how to remediate all vulnerabilities that was identified during the assessment.

8. Debriefing – NTL presents all findings to executives and key stakeholders, answers all questions, and provides remediation advice.