V Asked Questions

For information about VISTA security testing, please select the request form below that meets your security needs.

What is VISTA penetration study?

The VISTA penetration study is an audit of the process of identifying network and device vulnerabilities before hackers can exploit the security holes. The vulnerability test, also called security scanning tools, assesses the security of your network or host systems and reports system vulnerabilities that your network administrator can use to make any necessary security adjustments. Vulnerability testing can scan networks, servers, firewalls, routers, and applications for vulnerabilities. Generally, the scan can detect known security flaws or bugs in software and hardware, determine if the systems are susceptible to known attacks and exploits, and search for system vulnerabilities such as settings contrary to established security policies. The VISTA is not intrusive.

Penetration testing is a "best practice" IT security tool for any financial institution connected to the Internet. Independent testing is required by the recently released FFIEC Information Security Booklet (pages 80-81) as well as by the Gramm-Leach-Bliley Act. For most Internet connections, the FDIC, OCC, OTS, FRB, and NCUA examiners will require Internet security testing. The vulnerability test is part of Prevention, Detection, and Response as outlined by the FDIC in the white paper "Risk Assessment Tools and Practices for Information System Security."

Return to the top of the page.

What is the difference between the Internal - VISTA, and External - VISTA?

The External - VISTA tests your financial institution's connection to the Internet to ensure that your firewall is properly configured to prevent unauthorized intrusion from hackers.

The Internal - VISTA tests your financial institution's internal network that includes your servers, firewalls, routers, and workstations to prevent unauthorized intrusion from insiders.

To perform the Internal - VISTA, we install a pre-programmed scanner box on your network.
Scanner box. Click to enlarge.

Return to the top of the page.

What does VISTA test for over and beyond port scanning?

The VISTA penetration study and Internet security test is much more sophisticated than just scanning ports. As a hacker would begin, we also begin by conducting a comprehensive port scan. The TCP and UDP port scans provide vital information about the open ports from which critical data is obtained. This critical data provides the in-depth penetration-vulnerability information necessary for the Internet security audit.

With the information gathered from initial port scan, we perform a network discovery that depicts the network topology, access points to the network, machines names, IP addresses, operating systems, and discovered services, such as HTTP, SMTP, Telnet, SNMP, etc. With this captured information, the appropriate vulnerability is selected out of over 18,000 know vulnerabilities; the appropriate test is performed, and results interpreted.

The penetration security risk assessment, includes all routers, switches, hubs, firewalls, servers, workstations, printers, and wireless access devices.

During the testing, detection and auditing databases includes PostgreSQL, Oracle, SQL Server, MySQL, Microsoft SQL, and Sybase. These tests for vulnerabilities or erroneous configurations show the possible access points that would allow for information leaks, theft of data and confidential customer information, unauthorized penetration that could lead to intrusion, and denial of service attacks.

The testing is further capable of identifying viruses, backdoors, worms, Trojans, and other malicious applications. This testing is accomplished by sending specially crafted packets to the accessed host and analyzing the response.

Return to the top of the page.

We outsource our network administration duties to an independent vendor. Why wouldn't their vulnerability test be considered independent?

Since your vendor probably designed your computer security, the vendor would not be considered independent. In addition, the vendor probably sells software and hardware. Yennik, Inc. are strictly IS security auditors and do not sell software or hardware.