nVisium

The Intersection of Software and Security

Improve Your Software Security

Talk to an nVisium Expert Today

Build Reliable and Secure Applications

By integrating security into the development process, nVisium strives to find and help fix security vulnerabilities in our client's software while teaching our clients the importance of incorporating security from the ground up. We offer a range of comprehensive services to ensure that you and your company are protected from cyber threats, including security assessments, software assurance, and training.

Services

Assessments

Application Assessments

A standard assessment combines static and dynamic analysis, which allows our team to evaluate all aspects of an application and test risk mitigation solutions, This service also offers the most precise remediation advice.

IoT Assessments

The Internet of Things presents its own unique set of security challenges and requires a broad skillset for assessing. Our IoT assessments identify weaknesses in an entire IoT architecture including software, hardware, API, and web/mobile components.

Network Assessments

Using a combination of automated and manual techniques, our team will identify risks to your systems and networks that attackers could find and exploit. We will provide detailed information of our findings along with recommendations to help remediation efforts.

Services

Assessments

Mobile Assessments

Our mobile assessments identify weaknesses in how an application interacts with the mobile device, the remote APIs it communicates with, how the application is written, and the libraries it uses to function.

Cloud Assessments

Cloud security assessments of AWS, Azure, or GCP go beyond the simple security issues that are easily detected through automation. We get to know the business purpose behind your architecture, review the design, and begin an analysis of security controls, monitoring and alerting, hardening, and IAM policies and permissions. We are an AWS Partner.

Services

Software Assurance

Code Remediation

Our Code Remediation service was designed to ensure you don't end up with a pile of unresolved bugs and security debt once an assessment is complete. We can integrate with your development team and follow their methodology as we submit the fixed code.

Software Assurance Lifecycle

Development of security processes, standards, guidelines, application risk management, dependency management, and other elements to be integrated into the Software Assurance Lifecycle. An in-depth analysis of the current software security program and related initiatives is performed.

Cloud Security Services

Cloud security review of AWS, Azure, or GCP that goes beyond the simple security issues that are easily detected through automation. We get to know the business purpose behind your architecture, review the design, and begin an analysis of security controls, monitoring and alerting, hardening, IAM policies and permissions. We are an AWS Partner.

Services

Software Assurance

Software Security Program

Evaluation of your current software security program and tailored recommendations to improve, grow and mature as an organization. Designed to provide detailed analysis, maturity scoring, and a future roadmap for your software security program based on the OWASP Software Assurance Maturity Model (SAMM) Framework.

Secure Architecture Review

Comprehensive review of the application or system design, including third-party services, data storage and transmission, infrastructure design, and more. The result will not only include a list of security risks, but also guidance to resolve these identified risks.

Security Integration

Integration of manual and automated processes to uncover and remediate security risks.We leverage software tools used for detection of security risks and our secure development expertise to remediate vulnerabilities in your development cycles. Especially critical in DevOps or Agile development shops where speed is paramount and traditional approaches fall short.

Services

Training

On-Demand Training Platform

Our browser based On-Demand Training Platform is the next generation of training. It is made up of engaging language specific content, uses an interactive grading engine, meets PCI DSS requirements and aligns with the OWASP Top 10. It can also be integrated with your organization's Single Sign On (SSO) provider

Services

Training

Instructor-Led Training

We offer instructor-led training, either on-site or virtually, using our state of the art cloud-based training environment. Regardless of the format, our training courses are highly engaging and teach developers how to identify and fix flaws in their own software.

“nVisium’s approach was unique and the team provided actionable findings. They strove to make our application secure and resilient.”

Rich Ronston / Director of IT Security at Deltek

“nVisium has a world class application security consulting team that brings unprecedented knowledge, innovation and leadership to help train, advise and assist our development teams.”

“nVisium performed a hybrid mobile assessment and then took those findings to build a custom security training course for our developers. The training was valuable, engaging and helpful for the developers to understand the importance of building secure software from the ground up. nVisium's training resulted in more secure code across the organization.”

Tony Trummer / Director of Security Engineering at Tinder

“PeopleNet engaged nVisium to perform an architectural review of one of our in cab devices. The nVisium team was exceptional - very professional, and extremely knowledgeable and engaging. The result was an exceedingly productive and informative review of our device. "

Kjell Erickson / Director of Vehicle Platform Software at PeopleNet

As an Application Security Provider we understand

We understand that risk mitigation extends beyond periodic assessments, training, and code remediation. nVisium has the capabilities to assist your team in implementing strategies, technology, and policies that align with your organization and development methodologies.

AppSec In Your Clouds

As cloud infrastructure and platform (IaaS/PaaS) providers differentiate their offerings, many organizations are adopting a multi-cloud strategy to leverage the best of what each world offers. Securing a multi-cloud environment presents challenges, as we need to ensure our core controls are replicated across different stacks. We need to protect serverless functions, container orchestration systems, Identity & Access Management (IAM), big data workloads, DevOps pipelines, and secure networking & content delivery across different operating environments.

Third-Party Library Dependencies

It is very easy to focus on what is directly presented when discussing outdated and potentially vulnerable software. Depending on the library or framework, we have to design and develop around their unique behaviors. The potential problem that seems to catch people off-guard is that our project dependencies may have dependencies of their own which will have their own outdated and vulnerable variants.

Secure Development Training – Garnering Engagement

Not too many people will argue against the benefits of training. Training helps us improve how we do our jobs. We can have long discussions about which styles of training are most beneficial and which are not. We can talk about learning techniques and how to get students to retain more knowledge and complete training courses with more practical benefits that are measurable in the real world. However, all of that is mostly irrelevant if no one shows up for your training. If you can’t get your students to engage in the training, it’s all for naught.

Angular and AngularJS for Pentesters - Part 2

In our previous blog post, we discussed how Angular and AngularJS applications are generally structured from an application security point of view. This time, we will explore different ways in which we can dynamically debug Angular applications whether the code is minimized or not. But why would that matter to application security researchers? By debugging Angular applications from the browser console, we can manipulate functions and scope variables to our liking. This can allow us to trigger behaviors that can help us discover front and back-end bugs, such as missing function level access control and insecure direct object reference. Furthermore, the techniques shown in this post can make it easier to examine bundled and minimized Angular code by leveraging tools provided by your browser’s developer tools.

Angular and AngularJS for Pentesters - Part 1

The web is a playground of ideas (both good and bad), technologies, bugs, and well, a LOT of fancy JavaScript frameworks. One of the most popular web frameworks today is Angular, a platform that simplifies the development of front-end web applications through a set of prescriptive patterns. As an application security professional, learning the fundamentals of this framework can give you an advantage during the initial phases of an application security assessment.

OWASP Internet Of Things Top 10 2018 Released

IoT or the Internet of Things has become a cornerstone of the American consumer and business markets as more and more connected devices are added to the mix every single day. Making sure these systems are secure is extremely important for both security and privacy. Over the holidays, the 2018 OWASP IoT Top 10 was released.

AWS re:Invent re:Cap

In this webinar, nVisium hosted a panel discussion to debrief AWS re:Invent 2018. Panelists from nVisium and Kenna Security discussed the latest AWS security announcements, trends, and AWS security topics to be on the lookout for in 2019.

AppDev To AppSec - The Transition

In 1978, the term Imposter Phenomenon was first introduced in an article by Dr. Pauline R. Clance and Dr. Suzanne A. Imes. It articulated that the introjection of societal stereotyping and our own internal bias lead to this common barrier to personal growth we see today. That is, even with great accomplishments we tend to look at ourselves as imposters. A few months ago I asked a few friends what does it take to be an Application Security Consultant? The answer surprised me.

The nVisium Difference

Why would you want to work for nVisium? This time around, we decided to ask some of our own to help explain why.

Have You Adapted Your AppSec?

For the past 20 years, application security has been built into many organization’s development processes and practices. When the Open Web Application Security Project (OWASP) was established in 2001, it bolstered the importance of application security. Since then, application security practices have been built to include many different processes, but they were all built based on a waterfall approach. Some of these different processes are (in no particular order):

Securing Kubernetes Architectures

In this webinar, nVisium’s CEO, Jack Mannino, explores the Kubernetes attack surface and presents methods to keep your cloud native systems resilient to attack. He demos the cloud-native attack services and show how to build a hardened infrastructure and deploy secure services using Kubernetes.

AppSec in an Agile World

In the ever-evolving, fast-paced Agile development world, application security has not scaled well. There are many types of security activities you can bake into your current development lifecycles—tooling, assessments, stories, scrums, iterative reviews, repo and bug tracking integrations—every organization has a unique solution and there are positives and negatives to each of them. In this session, we will talk through the various solutions to help build security into the development process.

Juggling OWASP Top 10 Vuln Data

Gain insight into some of the details of the OWASP Top 10 Call for Data and industry survey, and what we were attempting to learn. This session will provide tips and common pitfalls for structuring vulnerability data and the subsequent analysis. Learn what the data can tell us and what questions are still left unanswered. Uncover some of the differences in collecting metrics in different stages of the software lifecycle and recommendations for handling them.

Enhancing Application Security: Understanding and Utilizing Browser Security Features

This talk given at CodeMash 2018 will break down exactly what all of these acronyms and browser-enforced security policies mean. Attendees will learn implementation and long-term strategies in effort to increase security posture without potentially sink-holing your user’s traffic.

Machine Learning vs Cryptocoin Miners -- Part 1

With the meteoric rise of cryptocurrencies as an economic entity, morally corrupt folk have begun leveraging them as an easy way to convert popped boxes into money. Specifically, and obviously, this is done by turning compromised machines into cryptocoin miners. Many coins require the use of highly specialized hardware, such as Field-Programmable Gate Arrays (FPGAs) or Application-Specific Integrated Circuits (ASICs), in order for mining to see any kind of realistic return; however, many can be successfully mined using GPUs and even CPUs. Monitoring your AWS environment for malicious insiders or external attackers mining GPU-based coins is fairly straight forward for the vast majority of organizations: set up a CloudWatch event to trigger any time a GPU-enabled EC2 instance is spawned. Most organizations have no legitimate use for GPU-enabled servers, so if one is spun up, it’s almost certainly an event that warrants review. This has lead to attackers preferring to leverage coins that can be mined via CPUs. The most popular choice is Monero (XMR), though Verium (VRM) is another possible candidate.

Why Mobile Application Security?

In an era of constant, persistent connectivity, our relationships are becoming increasingly managed by instant communication channels, powered by mobile technologies. There are now more cellular subscriptions than there are people in the world and an estimated 10 billion mobile connected devices in use. The demarcation between business and personal time is no longer clear. We can use FaceTime, Slack, or have a GoToMeeting with clients on our smartphones, all while taking notes, sending emails, and even perhaps playing a little Trivia Crack on the side. We still love to go on vacations, yet, we still want to remain reachable during our downtime. Since carrying a laptop to the beach is a bit of a pain, we can just throw an iPad or Pixel C device into our beach bag. Our circles, both personal and professional, can now see the stunning backdrop with aquamarine water, sun-drenched sand, or a colorful, tall drink embellished by exotic fruits and a paper umbrella – all thanks to Instagram. Mobile technology enables us to respond from wherever we are, no matter what other things we may be doing. By having this latitude, we are forced into being connected, available, and productive in both our personal and business lives. We now carry a singular, small, smart device that provides us with constant connectivity, allowing us to be tethered to our businesses and personal lives, on-demand. But mixing business with pleasure not only raises privacy concerns, it opens our business networks to new threats. We have hundreds of mobile applications, of both business and personal nature, which are commingled on our devices. In some cases, they share, replicate, and backup data. This forces us into a tenuous balancing act of having to secure our business data and networks from these smart devices, and also to provide our employees with the flexibility to do their work from anywhere, at any time. With the gifts technology brings comes the responsibility to ensure that these devices and applications are used safely. By in large, most consumers aren’t aware of the clear and present dangers. To wit, 28% of mobile device users do not use the built-in password or device protections, yet, 80% of people use their smartphones to shop. A user’s sensitive data is stored in a myriad of locations within installed applications such as: in device memory, on the file system, numerous caches, and other built-in mechanisms like autocomplete or pasteboard. Furthermore, users can be tracked through GPS locations that the device may be tracking in contacts, images, map searches, etc. As such, a stolen or pre-owned device can include more than enough data to steal a person’s identity. Now it’s time to enter the world of mobile application security. I started my foray at a very small boutique consulting firm specializing in application security, as an Application Security Engineer in 2008. At that time, Apple was getting ready to release their second iPhone, the 3G. Google’s first commercially available handset was to be released shortly thereafter. Along with the iPhone 3G, Apple also unveiled their “AppStore” to the world. Although Blackberry had a stronghold on the business market, Apple and Google had other plans. Even back then, I foresaw the critical need to migrate existing application security practices into the mobile world, given the release of the Apple AppStore and the flurry of applications it added to the global market. It took a couple of years for Apple and Google to establish trust with the business world, and by 2010, it was clear that establishing mobile application security expertise to serve our clientele’s needs was required. Just a mere 7-10 years ago, mobile application security was a foreign concept and most clients had not given thought to leave their Blackberry worlds, but I saw the writing on the wall. I decided it was time to start researching and pursuing mobile application security. From the early days of mobile, I wanted to be involved in creating security practices, evangelizing the need for security with developers and contributing my expertise to both the technical and business sides of the house. The Open Web Application Security Project (OWASP) was a great place to help create application security standards to meet the new world order. A small group of us got together on a grassroots basis and drafted the ”Top Ten Risks of Mobile Security” and “Top Ten Controls of Mobile Security.“ We quickly determined that most of the threats and controls had to be focused on the data an application or organization may allow, store, or send to and from these devices. Once these top ten lists were drafted, I moved on to serve as an early reviewer of the “OWASP Mobile Testing Guide.” The Top Ten and Testing Guide have evolved greatly since then, but we had to start somewhere! As an application security practitioner, it is vitally important for me to ensure that businesses and individuals understand the security considerations and the ramifications if they aren’t apparent: The mobile world has evolved into “the internet of things,” or IoT, and I am delighted to be part of this rapidly evolving world with nVisium. I brought my skills and leadership to nVisium back in late 2015 because I believed in the strength of the organization, and the commitment to client’s and their application security needs. A lot of what we do is “break” current architectures to bypass built-in security controls or to expose missing security controls; however, we also help developers and clients understood the root causes and how to fix them. As an example, we were able to successfully bypass authentication and authorization controls to anonymously transfer money from one bank account to another. In another mobile assessment, we were able to successfully perform runtime manipulation and memory analysis of the mobile application to not only find and change the current logged in user’s password but also bypass the TouchID authentication mechanism. As experts in the fields of mobile application security, nVisium draws upon its combined decades of engineering and security experience to produce practical, scalable and repeatable services that help keep our clients’ software secure and businesses safe. We can integrate into your team’s existing development processes and workflows to help build a more robust security program.

Contact us Today

golang