IITAC Tiger Team

The security testing process is a discrete event test of a dynamic, stochastic system. The target is a system, a collection of interacting and co-dependent processes, which is also influenced by the stochastic environment it exists in. Being stochastic means the behavior of events in a system cannot be determined because the next environmental state can only be partially but not fully determined by the previous state. The system contains a finite, possibly extremely large, number of variables and each change in variable presents an event and a change in state. Since the environment is stochastic, there is an element of randomness and there is no means for predetermining with certainty how all the variables will affect the system state. A discrete test examines these states within the dynamic system at particular time intervals. Monitoring operations in a continuous manner, as opposed to a discrete one, would provide far too much information to analyze. Nor may it even be possible. Even continuous tests however, require tracking each state in reference to time in order to be analyzed correctly.

A tiger team is a specialized group tasked with testing the effectiveness of an organization’s ability to protect assets by attempting to circumvent, defeat or otherwise thwart that organization’s internal and external security.

Benefits for the client

Security loopholes and potential weaknesses that are detected are immediately reported to the contact (if required), together with a proposed solution. This procedure is suitable for iterative application hardening.

We will not issue a “this application is secure” stamp, since no software is 100% secure. However, it is possible to configure a software product in such a way that the effort involved for a potential attacker is too great to justify the rewards. This is an approach that is also used in areas such as cryptography.

The client receives a comprehensive and substantial final report, including a list and assessment of the remaining risks and suggestions for appropriate countermeasures, thus enabling proactive risk management.