Scribd Logo
Upload

Welcome to Scribd!

  • 75 views

    Swifttech Diagrams

    Uploaded by

    CROST
    Firehawk Consulting provided a report to SwiftTech summarizing concerns with SwiftTech's security posture. Key issues noted included AES-128 encryption for some file storage, unencrypted databases, weak password policies, lack of MFA for VPN access, outdated TLS usage, lack of network segmentation, unpatched servers with vulnerabilities in development, and no application vulnerability scanning. The report included network and data flow diagrams of SwiftTech's architecture.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Swifttech Diagrams

    Uploaded by

    CROST
    75 views10 pages
    Firehawk Consulting provided a report to SwiftTech summarizing concerns with SwiftTech's security posture. Key issues noted included AES-128 encryption for some file storage, unencrypted databases, weak password policies, lack of MFA for VPN access, outdated TLS usage, lack of network segmentation, unpatched servers with vulnerabilities in development, and no application vulnerability scanning. The report included network and data flow diagrams of SwiftTech's architecture.

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Firehawk Consulting provided a report to SwiftTech summarizing concerns with SwiftTech's security posture. Key issues noted included AES-128 encryption for some file storage, unencrypted databases, weak password policies, lack of MFA for VPN access, outdated TLS usage, lack of network segmentation, unpatched servers with vulnerabilities in development, and no application vulnerability scanning. The report included network and data flow diagrams of SwiftTech's architecture.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    75 views10 pages

    Swifttech Diagrams

    Uploaded by

    CROST
    Firehawk Consulting provided a report to SwiftTech summarizing concerns with SwiftTech's security posture. Key issues noted included AES-128 encryption for some file storage, unencrypted databases, weak password policies, lack of MFA for VPN access, outdated TLS usage, lack of network segmentation, unpatched servers with vulnerabilities in development, and no application vulnerability scanning. The report included network and data flow diagrams of SwiftTech's architecture.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 10

    Firehawk

    Consulting
    The following report was prepared on behalf of
    SwiftTech.

    Thank you for giving Firehawk Consulting the


    opportunity to review your security posture in
    anticipation of performing a SOC II security
    assessment.

    We hope you find the notes below as you begin


    your journey. Please do not hesitate to contact us if
    you have further questions.
    For

    SwiftTech
    Firehawk
    Consulting
    After review, Firehawk has noted the following areas of concern. You may wish to consider updating policy and security
    controls based on your current business goals, risk management posture, and compliance considerations.

    Controls
    Data Storage
    • VPC3 File storage supports only AES-128 encryption
    • Databases in production environment are unencrypted
    End User Management
    • Internal Network users require a 7-character password
    • Passwords never expire
    • VPN access does not require MFA
    Network Controls
    • TLS v1.1 is used between the cloud production environment and SwiftTech’s physical location
    • Application development Tiers are not logically segmented from Business Application servers
    Patching and Vulnerability Management
    • Development Tier servers are unpatched and contain multiple vulnerabilities
    Secure Software Development
    • Application code is not scanned for vulnerabilities before being published into production environment
    SwiftTech
    Speed, Flexibility, Success
    VPC1 VPN Users

    Web Servers
    VPC2 Internet

    HA 192.168.1.x
    VPC3

    Database Servers Log Management


    and Monitoring
    File Storage
    HA Internal Applications
    Test

    Dev Backup and Analytics

    Network Diagram
    Revision: xx/xx/xx
    Confidential
    Internal Users
    Inputs Multi-tenant Service Internal Processing
    Company Registration Web Servers
    Company Name
    Company Contact Info Code
    User Registration

    Data
    HA Test
    User Information (Private)
    Role Assignment
    Data Input Database Servers Backup and Analytics Customer Acquisition
    Project Details (Secret) and Communication
    Data
    Project Timelines
    Related Documentation HA Processing

    Data Data
    Internal Applications
    -De-identification
    -Analysis

    Data Flow Diagram


    Revision: xx/xx/xx
    Confidential
    Security Posture (1.) SwiftTech
    Relevant Frameworks (2.) SwiftTech
    Audit Against Frameworks (3.) SwiftTech
    Audit Against Frameworks (3.) SwiftTech
    pg2 (if needed)
    Governance Mechanisms for End-User SwiftTech
    Management Controls (6.)
    1.
    2.
    3.

    You might also like