Discover, deploy, and manage professional cloud software and solutions for Tencent Cloud.

Tencent Cloud Marketplace

Tencent Cloud Marketplace provide a new sales channel for ISVs and Consulting Partners to sell their solutions to Tencent Cloud customers. We make it easy for customers to find, buy, deploy and manage software solutions, including SaaS, in a matter of minutes.

Sell in Tencent Cloud Marketplace

Connect users to virtually any resource and configure and secure their remote devices with the JumpCloud Cloud Directory Platform. From one pane of glass, manage user identities and resource access, secure Mac, Windows, and Linux devices, and get a full view of your environment for compliance and auditing.

\nProduct Description\n\n- Secure User Management

Use group-based access control to instantly grant new users access to the resources their role/department requires. When a user leaves your organization, simply suspend their account and their resource access goes with it — keeping confidential data and processes secure.\n\n- Cross-OS Device Management

Bring together the Windows, Mac, and Linux devices at your organization within one cloud console for centralized operating system management.

Implement a Zero Trust security model to secure user access to devices, applications, files, networks, and other resources from a single cloud directory platform.

Monthly suscription and yearly suscription supported.

\nSSO Package - User Provisioning & SSO to web apps 

\nCore Directory Package - Identity & Access Management 

$11 per user per month, billed annually.\n\nJumpCloud Platform - Complete IAM & device management 

$15 per user per month, billed annually.\n\nPlatformPlus - Advanced security through Zero Trust and 24x7 Premium Support  

Support Documention: support.jumpcloud.com .

\nSupport Contact: support@jumpcloud.com.

\nSupports : Windows, Mac, Linux, and iOS devices .\n\n

Please visit this page for supported versions.\n\nTerms of Services\n\n

By subscribing to this product you agree to terms and conditions outlined in the product Terms of Service (TOS) which can be found here .

- Real time error tracking monitoring for any runtime, any device.

- Track crash-free sessions, crash-free users, and version adoption with Sentry release management tools.

- Build and share custom queries and dashboards by URL, geography, device type, etc.

For software teams, Sentry is essential for monitoring application code health. From Error tracking to Performance monitoring, developers can see clearer, solve quicker, and learn continuously about their applications - from frontend to backend. Loved by over 1 million developers and 70,000 organizations worldwide, Sentry provides code-level observability to many of the world's best-known companies like Disney, Peloton, Cloudflare, Eventbrite, Slack, Supercell, and Rockstar Games.

\nPricing is dependent on a number of factors. High level pricing is available here. We can customize pricing based on customer requirements.

\nFor all paying customers, our team of specially dedicated support agents are here to solve all your Sentry-related woes. Just log in to your Sentry account and head over to your organization's support page.

Your subscription will be automatically renewed at the end of the subscription cycle. You cannot cancel your subscription while it is active, but you can cancel the auto-renewal.

Software as a service is a delivery model for software applications whereby the vendor hosts and operates the application over the Internet. Customers pay for using the software without owning the underlying infrastructure.\n\nEnd User License Agreement

By subscribing to this product you agree to terms and conditions outlined in the product.

\nYugabyteDB uniquely combines enterprise-grade relational database capabilities with the horizontal scalability and resilience of cloud native architectures. YugabyteDB is like PostgreSQL reimagined for a cloud native world.\n\nFree - No licensing Cost.\n\nCommunity Supported (Comminity Forum, Slack and StackOverflow).

YugabyteDB Managed  On-Demand\tYugabyteDB Managed  On-Demand - Coming Soon\t$0\n\n

YugabyteDB Anywhere 48 Cores Minimum Production Cluster\t$100,000\n\n

You will be billed monthly for additional usage costs if your usage exceeds your contract. Your additional usage costs will be determined by the number of units you use above your contract.

YugabyteDB Managed On Demand Usage (Per Core Per Minute)\t$0.25/unit

\nCommunity Forum: https://forum.yugabyte.com/\n\n

Slack: https://yugabyte-db.slack.com/ (Signup)

\nDeployment Guide\n\nEnd User License Agreement

\nAutomated password reset solution, integrates directly into the Active Directory, allowing users to reset their passwords using an advanced voice recognition biometric engine. This can be used on a standard phone call with an IVR system, or with an app. It is a self-attended system that is available 7x24 if needed, at a fraction of the cost of a regular help desk and with high security.

\nMonthly suscription. Charged by user.\n\n

Standard Delivery Time: 5 days. Subject to change after evaluation of the architecture is completed.\n\n

Deployment Charge: after evaluation may apply a deployment charge. If deployment requires integration with another application or personalization, it will be charged at a rate of US$ 40.00 per hour.\n\nNo refunds.

222_20220225110355.png

\nFor support send an email to: support@homini.com\n\n

Included support hours: Monday to Friday 7:00 am to 5:00 pm (GMT-5)\n\n

\nWe provide the infrastructure and the client pays for using the service.

\nReal-time Content Intelligence: results are returned with very low latency to enable proactive, real-time moderation of harmful or inappropriate content. 

\nBest-in-class Performance: Hive's visual models deliver human-level classification accuracies and handily outperform other solutions. 

\nFlexibility: Hive does not proscribe enforcement actions - instead,  we provide classification metrics that platforms can use to customize moderation logic to their specific community guidelines and user expectations.

\nEasy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your moderation stack.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our deep learning models provide visual classifications for a wide variety of subject matter in both images, video, GIFs, and live streams, which can be used to automate content moderation or streamline human review. We offer access to our models at a fraction of the cost and time required for internal development.\n\nYou can learn more about our moderation products at https://hivemoderation.com. A detailed user guide for our visual moderation API is available here.

\nPricing is by volume according to the number of tasks submitted. For details, please contact sales@thehive.ai .

\nFor inquiries and support, please contact support@thehive.ai .\n\nBilling is pay-as-you-go according to number of tasks submitted. As such, Hive does not offer refunds.

\nHive delivers its model classifications as a service - task submissions and analysis can be done programmatically with API calls using a unique authorization key or by manual upload to a project dashboard.\n\nEnd User License Agreement:\n\nUse of Hive APIs are subject to the terms provided at thehive.ai/terms-of-use.  Use of an API key constitutes an agreement to those terms.

\nTo be performed after client have fixed all vulnerabilities detected.

\nReal-time Content Intelligence: results are returned with very low latency to enable proactive, real-time moderation of harmful or inappropriate content. \n\n

Best-in-class Performance: Hive's models achieve high classification accuracies and  outperform other automated solutions in head-to-head comparisons.\n\n

Flexibility: Hive does not proscribe enforcement actions - instead,  we provide classification scores  that platforms can use to customize moderation to their specific community guidelines and user expectations.\n\n

Easy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your moderation stack.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our deep learning models analyze the meaning of text with attention to context and nuance identify hate speech, sexual content, spam, promotional material, and more.  We offer access to our model classifications at a small fraction of the cost and time required for internal development.\n\nYou can learn more about our moderation products or try a demo at https://hivemoderation.com.  A detailed guide to the Hive text moderation API is available at https://docs.thehive.ai/docs/text-moderation-api .\n

\nVulnerability assessment on target using white box methodology. Based on OSSTMM, OWASP, PCI ASV, NIST recommendations, the vulnerability assessment is to be conducted with knowledge and credential of the target, to provide comprehensive view on security vulnerabilities and its exposures. The test will not be intrusive and destructive.

Deliverable: One (1) assessment report for all targets.

\nReal-time Content Intelligence: Hive APIs return results with very low latency and are optimized for real-time needs.\n\nTaxonomic Alignment with IAB Standards: Hive's classes align with standard advertising identifiers to enable sophisticated, contextually-targeted advertising. \n\nBest-in-class Performance: Hive's models achieve state of the art accuracies and outperform other solutions in head-to-head comparisons.\n\n

Easy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your programs and applications.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our visual/scene classification models can accurately classify scenery, subjects, and objects in images and video and map results to standard advertising taxonomies. We offer access to our models at a small fraction of the cost and time required for internal development.\n\n

\nHive delivers model results as a service - task submissions and analysis can be done programmatically with API calls using a unique authorization key or by manual upload to a project dashboard.\n\nEnd User License Agreement:\n\nUse of Hive APIs are subject to the terms provided at thehive.ai/terms-of-use.  Use of an API key constitutes an agreement to those terms.\n

Real-time Content Intelligence: Hive APIs return results with very low latency and are optimized for real-time needs.                                                                            \n\nBest-in-class Performance: Hive's models achieve state of the art accuracies and outperform other solutions in head-to-head comparisons.\n\n

Easy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your application.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our face identification model can accurately detect human faces within images and video and also offers classifications of gender, age, and similarity to a face in a target image. We offer access to our models at a small fraction of the cost and time required for internal development.\n\nMore information is available at https://docs.thehive.ai/docs/face-detection-identification .

\nHive delivers model results as a service - task submissions and analysis can be done programmatically with API calls using a unique authorization key or by manual upload to a project dashboard.\n\nEnd User License Agreement:\n\nUse of Hive APIs are subject to the terms provided at thehive.ai/terms-of-use.  Use of an API key constitutes an agreement to those terms.

\nYugabyteDB Anywhere gives you the simplicity and support to deliver a private database-as-a-service (DBaaS) at scale. Use YugabyteDB Anywhere to deploy YugabyteDB across any cloud anywhere in the world with a few clicks, simplify day 2 operations through automation, and get the services needed to realize business outcomes with the database.\n\nAnnual Subscription based Commercial Support (Core based licensing)

\nSupport Portal\n\nAnnual Subscription\n\nCancel Anytime

\nDeployment Guide\n\nEnd User License Agreement 

\nReal-time Content Intelligence: Hive APIs return results with very low latency and are optimized for real-time needs. \n\nVersatility: Hive's model is trained on a wide variety of images, including handwriting, memes and emojis, scene text, and documents such as receipts and menus.\n\nBest-in-class Performance: Hive's models achieve state of the art accuracies and outperform other solutions in head-to-head comparisons.\n

\nEasy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your programs and applications.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our text detection models can detect and transcribe image-based text in a wide variety of contexts to support content intelligence, document parsing, and content moderation use-cases in many widely spoken languages  We offer access to our models at a small fraction of the cost and time required for internal development.\n\nMore information is available at https://docs.thehive.ai/docs/ocr-text-recognition .

\nHive delivers model results as a service - task submissions and analysis can be done programmatically with API calls using a unique authorization key or by manual upload to a project dashboard on-device.\n\nEnd User License Agreement:\n\nUse of Hive APIs are subject to the terms provided at thehive.ai/terms-of-use.  Use of an API key constitutes an agreement to those terms.

Best-in-class Performance: Hive's models combine classification accuracies and outperform other solutions.\n\n 

Flexibility: Hive does not proscribe enforcement actions - instead,  we provide classification metrics that platforms can use to customize moderation logic to their specific community guidelines and user expectations.\n\n

Easy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your moderation stack.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our deep learning models extract overlay text or digitally generated captions (including emojis) from images in order to identify harmful or inappropriate content, as well as spam, promotions, and personal information.  We offer access to our model classifications at a small fraction of the cost and time required for internal development.\n\nMore information is available at https://docs.thehive.ai/docs/ocr-text-recognition-moderation .

\nReal-time Content Intelligence: Hive APIs return results with very low latency and are optimized for real-time needs.\n\nSophisticated Insights: In addition to logo identifications, Hive's model will classify each logo's prominence and placement physical objects, giving you a more complete picture of brand exposure and performance in visual content.\n\nBest-in-class Performance: Hive's models achieve state of the art accuracies and outperform other solutions in head-to-head comparisons.\n\nEasy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your programs and applications.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our comprehensive logo detection model is the most sophisticated in the world, capable of identifying over 5,000 unique logos as well as detecting visibility and placement.  We offer access to our models at a small fraction of the cost and time required for internal development.\n\nMore information is available at https://thehive.ai/hive-logo-and-brand-solutions .

\nReal-time Content Intelligence: results are returned with very low latency to enable proactive, real-time moderation of harmful or inappropriate content.\n\n 

Best-in-class Performance: Hive's models achieve high classification accuracies and  outperform other automated  solutions in head-to-head comparisons.\n\n

Flexibility: Hive does not proscribe enforcement actions - instead,  we provide classification scores that platforms can use to customize moderation to their specific community guidelines and user expectations.\n\n

Easy Integration: Hive APIs require just a few lines of code to submit tasks and integrate model predictions into your moderation stack.\n\nHive is the industry leader in cloud-based AI solutions trusted by some of the largest platforms in the world. Our audio moderation solution combines precise speech-to-text transcription with our best-in-class text moderation model to identify hate speech, sexual content, spam, promotional material, and more.  The Hive API will also return a fully-punctuated transcript of detected speech. We offer access to our model classifications at a small fraction of the cost and time required for internal development.\n\nYou can learn more about our moderation products or try a demo at https://hivemoderation.com.  

\nHive delivers its model classifications as a service - task submissions and analysis can be done programmatically with API calls using a unique authorization key or by manual upload to a project dashboard.\n\nEnd User License Agreement：\n\nUse of Hive APIs are subject to the terms provided at thehive.ai/terms-of-use.  Use of an API key constitutes an agreement to those terms.

\nYugabyteDB Managed is the easiest way to get started with YugabyteDB. Effortlessly ensure continuous availability and limitless scale of your cloud native applications. Focus on building your business, and leave database operations to Yugabyte.\n\nPay as Go per Hour Billing.

\nSupport Portal.\n\nHourly Billing.\n\nCancel anytime.

As part of our professional services, LGMS will include a twelve (12) months of cyber security risk ratings and monitoring, with pro-active alerts if there are new threats detected. \n\n

The findings will be presented in an easily accessible report with a scored analysis of cyber threat intelligence signals for IT risk management and security posture check.\n\n

LGMS Security Team will assess target(s) in scope and acquire a forensic/triage image of the target(s) in scope. The forensic image will then be brought back to LGMS lab for forensic analysis.

The scope of the initialization is to enable LGMS forensic experts to perform initial study and to conduct preliminary assessment of the case. During the study, LGMS shall inform the client on the recommended next course of action including feasibility and limitations from technical perspective, (if any) against the client's requirements.\n\n

NOTE: The duration of the case study may varies based on the complexity of the case assigned to LGMS.

LGMS Security Team to perform review and assessment on client's SWIFT infrastructure against SWIFT Customer Security Control Framework v2021 which including network architecture, information security operations, policy and procedure of workflows. The assessment includes documentation review, onsite interview session with responsible personnel, review on evidences and records. \n\n

List of applicable SWIFT security principles cover the following:

- Restrict internet access & protect critical systems from General IT environment

- Reduce attack surface and vulnerabilities

- Manage identities and segregate privileges

- Detect anomalous activity to systems or transaction records

- Plan for incident response and information sharing\n\n

One (1) comprehensive SWIFT Security Compliance Assessment Report

SWIFT Customer Security Control Framework v2021

Annual certification fee from the International Certification Body.

Information security management system (ISMS) internal audit is to provide independent assurance on the effectiveness of the implementation of an organization based on ISO/IEC 27001:2013 standard and applicable controls.\n\n

LGMS ISO/IEC 27001 Lead Auditor and Audit Team to conduct review on ISMS documentation and records, interview session with respective personnel, observe security parameter configuration on in-scope system components to provide assurance on the effectiveness of the management system implementation and operation. 

\nDeliverable: One (1) comprehensive ISO/IEC 27001 Internal Audit Report.

LGMS ISO/IEC 27017 Lead Implementer and consultant team to provide advisory and assistance on ISO/IEC 27017:2015 standard and information security controls implementation for client defined scope of services outlined in the later section. \n\n

The overall implementation advisory will be divided into four (4) organized phases in the following:\n\n

- Define scope of Information Security Management System (ISMS)

- Risk identification, assessment, treatment

- Define statement of applicability (S.O.A)

- ISMS documentation enhancement & preparation

- Management approval for ISMS documentation

LGMS ISMS Consultants to perform ISO/IEC 27001:2013 scoping and gap assessment on client's defined scope of assessment outlined in the later section to identify scope applicability, potential gap and provide recommendation for enhancement. Baseline for the assessment will adopt ISO/IEC 27001:2013 information security standard and controls applicable to the scope of assessment. The overall gap assessment includes documentation review, onsite interview session with responsible personnel, observe system configuration, review on evidences and records.\n\n

One (1) comprehensive ISO/IEC 27001 Scoping and Gap Assessment Report with itemize scope entities, potential gap, and recommendation for enhancement.

LGMS PCI Team to perform offsite verification and review on client PCI DSS SAQ document. The process will identify potential incomplete information input and incorrect information representation of client's business nature involved with cardholder data.

LGMS PCI QSA Team to perform offsite validation and review on client's current business environment which involves in processing, storing and transmitting cardholder data against PCI DSS v3.2.1, SAQ. During the course of the assessment, LGMS PCI QSA Team will conduct documentation review, observe system configuration and validation on all the in-scope entities (Technology, Processes and People).

Attestation will be provided by the Qualified Security Assessor (QSA) on the SAQ Attestation of Compliance (AOC) document upon client compliant to all the required PCI DSS requirements within SAQ.\n\n

PCI QSA attestation on One (1) PCI DSS SAQ AOC Document and One (1) PCI DSS SAQ Document

LGMS PCI QSA Team to perform compliance audit and off-site assessment on client's current business environment which involves in processing, storing and transmitting cardholder data against PCI DSS v3.2.1. During the course of the assessment, LGMS PCI QSA Team will conduct documentation review, interview sessions with responsible personnel, observe system configuration and verification on all the in-scope entities (Technology, Processes and People). The assessment will generate relevant documents for compliance justification.\n\n

Complete official PCI DSS Report on Compliance (ROC) and Attestation of Compliance (AOC) documentation.

LGMS PCI QSA and Security Team to provide advisory and assistance on PCI DSS v3.2.1 requirements and security controls implementation for client defined scope of coverage outlined in the later section which involves in processing, storing and transmitting cardholder data. \n\n

The overall remediation advisory will be divided into three (3) organized phases in the following:\n\n

Phase 1 - Remediation Advisory & Planning

- Provide recommendation on identified gap areas.

- Formulate remediation plan align with the business IT security strategy.\n\n

Phase 2 - Remediation Advisory & Remediation Assistance

- Enhance or develop required policies/ procedures to meet PCI DSS v3.2.1 requirements.

- Provide technical expertise in evaluating product vendors for technology solutions.

- Monitor progress of action items and remediation plan.

- Assist in verifying control implementation and its effectiveness

- Recommend of compensating controls and define key roles and responsibilities as mitigation measures to ensure compliance to PCI DSS v3.2.1 requirement.\n\n

- Provide checklist for pre-assessment review.

- Support in records compilation and preparation for PCI DSS off-site assessment.

LGMS PCI QSA and Security Team to perform PCI DSS scoping and gap assessment to identify scope applicability, potential gap and provide recommendation for enhancement on client's defined scope of coverage outlined in the later section which involves in processing, storing and transmitting cardholder data. Baseline for the assessment will adopt PCI DSS v3.2.1 requirements applicable to the scope of coverage (Technology, Processes and People). The assessment includes documentation review, onsite interview session with responsible personnel, observe system configurations, review on evidences and records.

- One (1) comprehensive PCI DSS Scoping and Gap Assessment Report with itemize scope entities, potential gap, and recommendation for enhancement with prioritized approach.

- One (1) PCI DSS Prioritized Approach Tool Document

Based on industry common security best practices and PCI ASV recommendation, to perform detailed network architecture diagram analysis.\n\n

Deliverable: One (1) assessment report for all network diagrams.

Perform stress / load / performance testing on the target application to identify potential performance bottlenecks based on the proposed test scenarios.

LGMS Security Team to obtain list of employees’ email address from CLIENT, the target employees should contain personnel from different departments. “Promotional campaign” email will be sent to all the target employees and any access to the LGMS Security Team customized web site will be logged. Logged information may include ID number, mobile phone number, masked password and etc.\n\n

LGMS Security Team to obtain list of employees’ DID or mobile phone number from CLIENT, the target employees should contain personnel from different departments. The team will masquerade as CLIENT internal help desk or internal IT support, and attempt to extract information from the target employees. Information may include username, password, department details, workstation details and etc.\n\n

Deliverable: One (1) assessment report for all scenarios per cycle in each engagement.

The purpose of the tabletop exercise to simulate potential cyber security attack scenarios based on client's infrastructure in order to assess the client's incident response process, flow, escalation procedures. \n\n

LGMS team will prepare the scenarios and facilitate the tabletop exercises with the participants to assess the client's theoretical ability in incident response handling in accordance to their policies and procedures.\n\n

The purpose of the cyber drill is to simulate a potential cyber attack scenario through various technical challenges inspired by real cyber attacks to assess the client's incident response readiness. \n\n

LGMS will prepare the scenario and facilitate the cyber drill to assess the client's technical capabilities in incident response handling such as technical incident analysis, network and system forensics, threat identification, incident response and containment.

Based on the industry common security checklist or client's own hardening checklist, to perform detailed network device configuration security assessment. Administrator privilege is required for this assessment.\n\n

LGMS shall use scripts or tools to extract the configurations only if possible.\n\n

Deliverable: One (1) assessment report for each network device type.

LGMS Security Team will perform security review on the client's existing wireless access point to identify potential security issues via following activities:\n

- War driving: Detect open and secured access point.

- Rogue wireless access point detection: Detect unauthorized access point.

- Signal mapping: Provide wireless access point signal analysis on target premise.

- Password cracking: Cracking weak wireless access point encryption such as WEP if applicable.

- Dictionary password cracking: Attempt to crack wireless access point encryption such as WPA-PSK and WPA2-PSK with password list of more than 1 billion keywords if applicable.

- Security implementation check: Wireless access point captive portal security assessment and WPS implementation security assessment if applicable.\n\n

Deliverable: One (1) assessment report for each engagement.

LGMS Security Team to conduct network discovery and segmentation penetration testing in attempt to gains access to Cardholder Data Environment (CDE) network from out-of-scope systems/networks. Objective is to ensure network segmentation methodology and controls are implemented, operational and effective in preventing and isolating out-of-scope systems/networks from affecting the systems security of the CDE.\n\n

Deliverable: One (1) Network Segmentation Penetration Testing Report for each round of review.

LGMS Security Team to perform cardholder data discovery scan on in-scope system components provided by client with automated and manual approach. For automated approach, LGMS Security Team will introduce scripts and/or tools for the discovery scan without affecting data integrity on the servers, whereas manual approach involved manual reviews and validation to finalized the scan results in the documented report.\n\n

Deliverable: One (1) Cardholder Data Discovery Scan Report for all targets.

Web service penetration testing based on OWASP. LGMS Security Team will be assessing the web service as if the users of the target, service details such as its function and API documentation if any. Credentials are required for testing (if applicable). Automated and manual methods will be used to uncover vulnerabilities from the web service. The test will not be intrusive and destructive.\n\n

Deliverable: One (1) assessment report for each web service.

Based on the common industry security test cases, LGMS Security Team will be assessing the client application as an authenticated users. Credentials are required for test. Automated and manual methods will be used to uncover vulnerabilities from the client application. The test will not be intrusive and destructive.\n\n

Deliverable: One (1) assessment report for each client application.

Based on the common industry security test cases, LGMS Security Team will be assessing the client application as an unauthenticated users. Credential is not required for test. Automated and manual methods will be used to uncover vulnerabilities from the client application. The test will not be intrusive and destructive.\n\n

Mobile application penetration testing based on OWASP Mobile Security Project. LGMS Security Team will be assessing the mobile application as if the users of the mobile application. Credentials are required for test. Automated and manual methods will be used to uncover vulnerabilities from the mobile application. The test will not be intrusive and destructive.\n\n

Deliverable: One (1) assessment report for each mobile application.

Web application penetration testing based on OWASP. LGMS Security Team will be assessing the web application as if the users of the web application. Credentials are required for testing. Automated and manual methods will be used to uncover vulnerabilities from the web application. Assessment such as content management system (CMS) version check, access control check, default credential check will be performed where applicable. Intrusive test such as password brute forcing will not be included.\n\n

Deliverable: One (1) assessment report for each web application.\n\n

Note: LGMS Security Team will attempt to identify known security vulnerabilities and check for the use of default credentials for the CMS where applicable, however, configuration security review, pages and forms after login of the CMS will not be included in this assessment.

Web application penetration testing based on OWASP. LGMS Security Team will be assessing the web application as an unregistered user. Credential is not required for testing. Automated and manual methods will be used to uncover vulnerabilities from the web application. Assessment such as content management system (CMS) version check, access control check, default credential check will be performed where applicable. Intrusive test such as password brute forcing will not be included.\n\n

Based on OWASP recommendations, source code review will be performed using automated and manual methods to identify potential security issues of the source code. Common platform source codes are supported.\n\n

Deliverable: One (1) assessment report for each application.\n\n

Note: The target source code will be used solely for verification and analysis purposes. These activities will be carried out by the LGMS Security Team in isolated, highly secure and accredited LGMS laboratory. The source codes will not be distributed to any parties.

As the only official CIS member in Malaysia, LGMS Security Team has exclusive access to the latest CIS security configuration benchmarks, the de facto standard for security configuration in the industry, with benchmarks for more than 150 technologies/platforms.\n\n

Based on CIS benchmark or client's own hardening checklist, to perform detailed database configuration security assessment. Database administrator privilege is required for this assessment.\n\n

As the only official CIS member in Malaysia, LGMS Security Team has exclusive access to the latest CIS security configuration benchmarks, the de facto standard for security configuration in the industry, with benchmarks for more than 150 technologies/platforms.

Based on CIS benchmark or client's own hardening checklist, to perform detailed host configuration security assessment. Administrator privilege is required for this assessment.

LGMS shall use scripts or tools to extract the configurations only if possible.

LGMS as PCI Approved Scanning Vendor (ASV) has integrated the PCI Security Standards Council (SSC) tested and approved ASV scan solution on the online service for businesses to conduct external vulnerability scanning required by PCI Data Security Standard (PCI DSS) Requirement 11.2.2. Scan report generated is recognized and compliant to PCI DSS requirements.

Deliverable: One (1) Official PCI ASV Attestation report for all targets, number of reports based on the frequency of scan engaged.

External penetration testing on target using white box methodology. Based on OSSTMM, OWASP, PCI ASV, NIST recommendations, the penetration test is to be conducted with knowledge and credential of the target, to provide the best possible simulation of an external attacker who has significant information about the target. The test will not be intrusive and destructive.

External penetration testing on target using black box methodology. Based on OSSTMM, OWASP, PCI ASV, NIST recommendations, the penetration test is to be conducted without prior knowledge of the target, to provide the best possible simulation of an external attacker. The test will not be intrusive and destructive.

Vulnerability assessment on target using black box methodology. Based on OSSTMM, OWASP, PCI ASV, NIST recommendations, the vulnerability assessment is to be conducted without prior knowledge of the target, to provide visibility on potential security vulnerabilities and its exposures. The test will not be intrusive and destructive.