CORE IMPACT is a commercial automated penetration testing software solution developed by Core Security Technologies which allows the user to probe for and exploit security vulnerabilities in computer networks, endpoints, web applications and wireless networks. IMPACT allows the user to transparently pivot (as through a proxy) on an exploited target to continue probing and exploiting other elements of the network. The product's interface is designed to be usable by individuals both with and without specialized training in penetration testing and vulnerability assessment, and includes functions for generating reports from the gathered information.

What can Core do?

1. Penetration Testing , you gain visibility into the cause/effect and prevention of data breaches
   a) What might attackers know about your system
   b) Which system on the network can be compromised
   c) What attack paths could be used
   d) What data would be exposed
   e) What are the solutions
   f) Were the solutions effective
   g) Are we able to address compliance mandates
2. Replicate Cyber attacks
3. Expose you own vulnerabilities
4. Schedule tests to run automatically on a recurring basis
5. Establish and maintain an audit trail of your vulnerability management practices
   

ISSAF is constantly evolving a framework that can model the internal control requirements for information security. By defining the tests along with the domains to be tested, it seeks to unify management policies with technical operations to ensure there is complete alignment between all levels in between.

ISSAF covers major information technology platforms, most high level IT related operational processes, and is intended to be applicable to major industry verticals such as banking, manufacturing and services. This ubiquity of ISSAF is intended to ease it's adoption as the preferred security assessment framework by IT departments worldwide.

• Evaluate the organizations information security policies & processes to report on their compliance with IT industry standards, and applicable laws and regulatory requirements
• Identify and assess the business dependencies on infrastructure services provided by IT
• Conduct vulnerability assessments & penetration tests to highlight system vulnerabilities that could result in potential risks to information assets
• Specify evaluation models by security domains to :
  o Find mis-configurations and rectify them
  o Identifying risks related to technologies and addressing them
  o Identifying risks within people or business processes and addressing them
  o Strengthening existing processes and technologies
  o Provide best practices and procedures to support business continuity initiatives

Business Benefits of ISSAF

• The ISSAF is intended to comprehensively report on the implementation of existing controls to support IEC/ISO 27001:2005(BS7799), Sarbanes Oxley SOX404, CoBIT, SAS70 and COSO, thus adding value to the operational aspects of IT related business transformation programmes.
• Its primary value will derive from the fact that it provides a tested resource for security practitioners thus freeing them up from commensurate investment in commercial resources or extensive internal research to address their information security needs.
• It is designed from the ground up to evolve into a comprehensive body of knowledge for organizations seeking independence and neutrality in their security assessment efforts.

It is the first framework to provide validation for bottom up security strategies such as penetration testing as well as top down approaches such as the standardization of an audit checklist for information policies.

Qualys' on demand approach to IT security and compliance enables organizations of all sizes to successfully achieve both vulnerability management and policy compliance initiatives cohesively, while reducing costs and streamlining operations. Using an innovative Software as a Service (SaaS) approach, the QualysGuard® Security and Compliance Suite combines Qualys' industry leading vulnerability management service with a comprehensive IT compliance solution.

Unique Benefits:

• Software-as-a-Service (SaaS) Advantage — There's nothing to install or manage. Support for operating and maintaining the solution falls squarely on Qualys. Read More >
  
• Global Deployment — Easily performs scans on geographically distributed and segmented networks both at the perimeter and behind the firewall.
  
• Lower and Predictable TCO — On demand SaaS technology offers significant economic advantages with no capital expenditures, extra human resources or infrastructure or software to deploy and manage.
  
• Comprehensive and Up-to-Date — QualysGuard has the largest KnowledgeBase of vulnerability signatures in the industry (6,000+) and performs over 200 million IP audits per year. Since QualysGuard is centrally managed, vulnerability and software updates are made in real-time
  
• Highly Scalable — Rapidly deploy and expand using QualysGuard's on demand architecture.