Services:  Preliminary Security Assessment

Vista’s Preliminary Security Assessment is designed to quickly and inexpensively identify many of the most common network and data security vulnerabilities and point the way toward fixing them.  Many vulnerabilities from:  data thieves, malicious hackers, other intruders, viruses, worms, and catastrophic data loss are identified.  The assessment can also give a preliminary indication of how close an organization's computer systems are to complying with the Payment Card Industry Data Security Standard and other security mandates.

The client pays a fee of $750 and receives the following four services:

1.  Initial Interview and Security Survey

The initial meeting takes place at the client's site and usually takes about one and a half to three hours.  A company representative—the person most knowledgeable about the organization's computer systems—provides the consultant with basic information, such as:

• The number of business locations and computers at each location
• How the organization connects to the Internet
• What computer programs and processes store credit card or other confidential data from customers

After the consultant gathers overview information, he physically examines a sample of the organization's computer systems.  This examination takes place accompanied by the company representative and does not require that the consultant have access to passwords or other confidential data.  To complete the examination properly, however, the company representative should be able to access and log in to systems such as:

• The network server, if one exists
• Any data backup systems used
• One or two typical user workstations
• Network devices, such as routers

2.  External Network Vulnerability Scan

The consultant will then run a scan on at least one of your organization's Internet connections.  The free scan is provided by a MasterCard/Visa approved independent security scanning firm and identifies hundreds of the more common ways computer systems can be attacked from the Internet.  A report will be provided to the client listing the vulnerabilities found by the scan and will be discussed in the Follow-Up Consultation.

3.  Security Evaluation Summary Checklist

A few days to a week or so after the scan is completed, the consultant will provide you with a Security Evaluation Summary Checklist.  That report will indicate, based on the information available from the Initial Interview and Security Survey as well as the scan, which systems and procedures appear to need attention and why.  Where feasible, it will also give a brief explanation of what steps might be taken to reduce security risks.

4.  Follow-Up Consultation

After you have had a chance to review the Security Evaluation Summary Checklist and scan report, you will have the opportunity to discuss the results with the consultant who performed the assessment.  You are welcome to discuss topics such as:  how serious any vulnerabilities might be and what might be involved in remedying them.  The Follow-up Consultation consists of one telephone or in-person meeting and usually lasts up to about an hour.

No quick security evaluation of this sort can identify all of the vulnerabilities that can affect computer systems.  Still, our Preliminary Security Assessment is a cost-effective starting point for two categories of businesses:

• Those that are forced by budget constraints to severely limit data security expenditures.
• Those that will use the results to immediately identify critical security gaps, while preparing for more extensive security evaluations and enhancements.

Of course, should the assessment identify security deficiencies, you are welcome to retain Vista or another qualified computer firm to do any additional work that may be needed to correct any deficiencies and assure that your computer systems are as reliable and secure as they can be.