Home > Research > Articles

Our research initiatives shape into papers and articles published at various security-related and IT audit-related sites.

Indian APT – the Hangover Effect – Full Report on Malware Analysis
K.K.Mookhey, July 2013
Full report of our findings of a malware analysis done, which had a number of common points with the Norman “Hangover” Report.

Reserved Bank of India (RBI) Gopalakrishna Committee Report on IT
K.K.Mookhey, June 2013
The RBI constituted the Working Group on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds, which produced its report in January 2011. The Working Group was headed by Mr. G. Gopalakrishna and is popularly known as the Gopalakrishna Committee Report. The presentation below highlights some of the salient points, with special emphasis on Chapters 1 (IT Governance), 3 (IT Operations) and 4 (IT Outsourcing). The original report is available here Our analysis of this is available here

IT Act 2000 - Penalties, Offences with case studies
Manasdeep & Irwin Puri, January 2013
This article sheds light on the extent and scope of IT Act 2000 (amended vide IT Amendment Act 2008) and the factors that led to its development. We also look into various cyber-crime case studies which were prosecuted under penalties and offences as defined in the Act.

Guidelines for selecting the right MDM vendor for your business.
Manasdeep, January 2013
This article sheds light on the concepts of Mobile Device Management(MDM); its deployment in organization, challenges faced and risk mitigation(s) possible. It also puts forward the guidelines for selecting the right MDM vendor for your business.

Advanced Persistent Threats - Mitigation, Services, and Solutions
Manasdeep, November 2012
With all the buzz surrounding the term Advanced Persistent Threats (APTs), we decided to de-mystify the jargon and present the view from the trenches.

Distributed Denial-of-Service Testing Methodology
Manasdeep, November 2012
An article on Distributed-Denial-of-Service (DDoS) attacks, their various types and our methodology for testing the robustness of your network against them.

Spear Phishing Testing Methodology
Manasdeep, September 2012
An article on our Spear Phishing Testing Methodology which can be used in social engineering exercise to determine organization wide susceptibility to an APT style attack.

Information Rights Management - Implementation and challenges
Manasdeep, September 2012
An article on Information Rights Management (IRM) and our methodology for its proper implementation in achieving secure flow of sensitive information within and beyond the organizational boundaries.

RBI Guidelines
Archana Puri, September 2012

Data Leakage Prevention - Implementation and Challenges
Manasdeep, August 2012
This article focuses on common pitfalls when implementing a DLP solution to secure your organizational information assets. The article also lists out our practical insights; lessons learnt and recommended process to achieve an effective and efficient DLP implementation.

New Remote Flaw In 64-Bit Windows 7
NII team member webDEViL finds MS 0-day,Slashdot,December 2011

Step-by-step aircrack tutorial for Wi-Fi penetration testing
Sanoop Thomas, SearchSecurity TechTarget article, September 2011

Auditing IT Project Management
K. K. Mookhey, IT Audit, by the Institute of Internal Auditors, May 2008

Assessing Bandwidth Use as a Function of Network Performance
Nikhil Wagholikar, IT Audit, by the Institute of Internal Auditors, Nov 2007

Essential Aspects of an Effective Network Performance Audit
Nikhil Wagholikar, IT Audit, by the Institute of Internal Auditors, Dec 2007

Evaluating Application Security Controls
K. K. Mookhey, IT Audit, by the Institute of Internal Auditors, June 2007

MS Office Security
Khushbu Jithra, SecurityFocus Infocus article, August 2006
This article discusses Microsoft Office's OLE Structured Storage and the nature of recent dropper programs and other exploit agents, in an effort to scrutinize the workings of some of the recent MS Office exploits. The second part of this article then collates some forensic investigation avenues through different MS Office features. Parts of the article sample different MS Office vulnerabilities to discuss their nature and the method of exploitation.

Dissecting NTFS Hidden Streams
Chetan Gupta, Forensic Focus article, July 2006
This article discusses Alternate Data Streams feature of the NTFS filesystem. It underlines the importance of this feature from a hacker's perspective and a forensic investigator's perspective.

Five Common Web Application Vulnerabilities
Sumit Siddharth and Pratiksha Doshi, SecurityFocus Infocus article, May 2006
This article looks at five common Web application attacks, primarily for PHP applications, and then presents a short case study of a vulnerable Website that was found using Google and was easily exploited.

Key Strategies for Implementing ISO 27001
K. K. Mookhey & Khushbu Jithra, the IIA's ITAudit article, February 2006
This article brings to light various strategies involved in implementing ISO 27001 - from identifying business objectives to preparing for the final audit.

Evading NIDS, revisited
Sumit Siddharth, SecurityFocus Infocus article, December 2005
This article discusses IDS evasion techniques in addition to the frag3 preprocessor and fragment reassembly in a multihost environment.

SQL Server Security
K. K. Mookhey, The IIA's ITAudit article, March 2005
This is the first part of a two-part article that discusses securing the SQL Server. It covers secured SQL Server installation from an IT Auditor's perspective.

Penetration Testing of IPSec VPNs
K. K. Mookhey & Rohyt Belani, SecurityFocus Infocus article, Feb 2005
This article discusses a methodology to assess the security posture of an organization's IPsec based VPN architecture. It discusses blackbox penetration testing of a VPN server, and then a full configuration and architecture review.

Common Criteria - an overview
K. K. Mookhey, Information Systems Control Journal by ISACA, Volume 1, 2005
One evaluation methodology that provides an excellent framework for Application Security Assessment is the Common Criteria for Information Technology Security Evaluation, also known as the Common Criteria or CC. This article provides an overview of the Common Criteria covering the Functional and Assurance Requirements.

Metasploit Framework - 3 parts
K. K. Mookhey & Pukhraj Singh, SecurityFocus Infocus article, 12th July 2004
This is a three part article that talks in-depth about the Metasploit Framework - installation, configuration, and development of custom exploits using the framework.

Common security vulnerabilities in e-commerce systems
Sumit Siddharth & Pratiksha Doshi, SecurityFocus Infocus article, 27th April 2004
This article discusses common attacks and vulnerabilities in e-commerce shopping cart systems, with reference to SecurityFocus vulnerability reports where relevant.

Auditing Oracle Security
K. K. Mookhey, The IT Audit, Vol. 7, April 15, 2004
This article discusses various aspects of Oracle security that must be considered, including secured installation, initialization parameters, users and profiles, roles, object and system privileges, logging, listener security, etc.

Detection of SQL Injection and Cross-site Scripting Attacks
K. K. Mookhey & Nilesh Burghate, SecurityFocus Infocus article, 18th March 2004
This article discusses techniques to detect SQL Injection and Cross Site Scripting (CSS) attacks against your web applications using regular expressions with the open-source IDS, Snort

Open Source Tools for Security and Control Assessment
K. K. Mookhey, Information Systems Control Journal by ISACA, Volume 1, 2004

Apache Security Controls and Auditing
K. K. Mookhey, Information Systems Control Journal by ISACA, Volume 5, 2003

On our website

SAP R/3 Approach Paper: SAP R/3 Security Assessment Framework
This approach paper describes a security assessment framework for SAP R/3 implementations. It covers various aspects of the SAP system and the database along with the underlying operating system.

The Unix Auditor's Practical Handbook
This handbook is meant to be a practical step-by-step guide to auditing Unix. It covers the various aspects of UNIX security and gives the reader the commands and techniques to carry out the audit.

Guide to Sybase Security
This document provides details on security and auditing of the Sybase database server.