1. Portfolio and Services Overview
Tel: +27(12) 743 6123
Cell: +27 79 191 2362
Email: rhys@networksecurityservices.net
Website: www.networksecurityservices.net

2. Rhys A. Mossom Network Security Services – Service Portfolio Page 1 of 6
1
Rhys A. Mossom – Services Portfolio
Network Security Services Portfolio
With experience consulting for a number of large institutions including Banks, Governmental departments,
multimedia services and online e-stores, I can provide comprehensive holistic services including but not limited
to:
• Internal and External Penetration Tests
• Web Application Security Assessments
• Vulnerability Assessments
• Source-code Reviews
• Information-Security Training
• Social Engineering and Internal Security Assessments.
• Research and Development
• Information on Delivery of Reports
These tests and services are designed to address various needs likely to arise in any organisation utilising
internal and external networks, allowing a bespoke package solution to address specific needs.

3. Rhys A. Mossom Network Security Services – Service Portfolio Page 2 of 6
2
Rhys A. Mossom – Services Portfolio
Services Overview:
Internal and External Penetration Tests
The objective of this type of assessment is to identify issues and report on vulnerabilities on a wide level to
allow the client to resolve or mitigate the issues. In a penetration test, vulnerabilities are actively exploited to
gauge the extent of vulnerability impact on infrastructure and business operations.
In this test the client is provided with a comprehensive report detailing vulnerabilities found, how the
vulnerability was exploited, suggested-resolutions and evidence of vulnerability-discovery.
A Penetration Test is completed in one of the three following ways, each with their own advantages:
White Box
In this method of testing the security of system or subnet, is done with full prior knowledge of the device or
network. This is usually done to simulate an attack from an internal, administrative level attack.
Grey Box
In this method of testing the security of system or subnet, is done with limited prior knowledge of the device or
network. This is usually done to simulate an attack from an internal, but non-administrative level attack.
Black Box
In this method of testing the security of system or subnet, is done without any prior knowledge of the device or
network. This is usually done to simulate an attack from an outside intruder.
Back to top
Web Application Security Assessments
In this type of Penetration Test, Web application assessments are performed to identify potential or realized
vulnerabilities in a client’s Web application.
Web Application Assessments security assessments follow a similar testing methodology to Network
Penetration Tests. Vulnerabilities are discovered hands-on through the use of manual testing. Finally if
vulnerabilities are found they are exploited to discover the extent of risk. Mitigation of these issues will
minimize the attack surface available.
Web Applications are a major source of data disclosure due to their wide use on the internet and as such,
databases (such as MYSQL or MSSQL) are often used to store confidential information and are therefore
frequent targets for attackers. Many businesses rely upon Web Applications to store critical data including
confidential customer information such as credit card numbers and ID numbers.

4. Rhys A. Mossom Network Security Services – Service Portfolio Page 3 of 6
3
Rhys A. Mossom – Services Portfolio
In this test the client is provided with a comprehensive report detailing vulnerabilities found, suggested-
resolutions and evidence of vulnerability-discovery.
Attack Methods:
 Buffer Overflows
 Clickjacking
 Cross Site Request Forgery (CSRF)
 Cookie Theft/Session Hijacking
 Cross Site Scripting (XSS)
 LDAP Injection
 SQL Injection
 XML Injection
 Remote code execution techniques
 Logic Flaw Exploitation
 Remote/Local file inclusion (RFI/LFI)
 username and password weaknesses
 Denial of Service (DoS)
 And more according to various standards.
Back to top
Vulnerability Assessments
A vulnerability assessment is performed to identify and report on security issues contained in networks,
websites, applications, or software that could potentially be subject to future exploitation.
A Vulnerability Assessment is a pre-emptive measure allowing clients to close issues on pre-production
software and systems. No vulnerability-exploitation takes place in this assessment.
With this test the client is provided with a comprehensive report detailing possible future vulnerabilities found
and suggested-resolutions.
Back to top

5. Rhys A. Mossom Network Security Services – Service Portfolio Page 4 of 6
4
Rhys A. Mossom – Services Portfolio
Source-code Reviews
In this test, source-code is reviewed to ensure it follows recognized safety measures. This is a pre-emptive
option allowing software to be rigorously reviewed pre-production helping ensure deployed source-code is
deemed safe and secure from bugs and vulnerabilities. Source code reviews can be performed in a number of
different languages to meet the client’s demands.
In this test the client is provided with a comprehensive report detailing possible future vulnerabilities found and
suggested source code alterations.
Back to top
Security Training
Courses can be provided which cover the following topics:
 Bluetooth & Wireless Hacking
 Web Application Hacking
 Social Engineering
Courses are presented hands-on, with equipment provided to demonstrate the fundamental aspects of
information security and security assessments. Additionally reference training material will be provided.
Back to top
Social Engineering and Internal Security Assessments
In this option both physical security vulnerability issues and security policy are highlighted and reported upon.
Social engineering is a non-technical form of hacking where sensitive information is gathered through the
exploitation of people through either computer based or non-computer based manipulation.
This can include:
• Blind assessments of security personal
• Assessment of general security-awareness
• Assessment of physical security methods such as RFID/Magstripe/etc.
• And more.
Back to top

6. Rhys A. Mossom Network Security Services – Service Portfolio Page 5 of 6
5
Rhys A. Mossom – Services Portfolio
Research and Development
In an industry that is so dynamic, companies must continually revise their methodologies, tools, ideas and
products. This is necessary due to technology advancement and development. R.A.M Network Security
Services Labs functions as an R&D group to discover and create new knowledge about cyber-security related
topics for the purpose of enabling development of valuable new products, ideas, methodologies, services, and
new information security tools.
R.A.M Network Security Services Labs conducts research on two frontiers: Hardware and Software.
Software:
 Cyber threats and countermeasures
 Reverse engineering
 Vulnerability identification
 Malware analysis
 0day (Zero Day) discovery
 Development of new security tools
 Proof of Concept (PoC) exploits and vulnerabilities
 R.A.M Network Security Services acts as an vulnerability advisor
Hardware:
Misc. Hardware:
 Wireless systems and reverse engineering
 Hardware data protocol reverse engineering
Authentication Systems:
 Smart ID systems
 Smart card security research
 Secure smart card applications
 RFID Systems
 Fingerprint recognition systems
 Iris recognition
 Facial recognition systems
Back to top

7. Rhys A. Mossom Network Security Services – Service Portfolio Page 6 of 6
6
Rhys A. Mossom – Services Portfolio
Information on Delivery of Reports
Reports are written using the following general methodology:
 An Executive Summary detailing the overall findings and possible impact
 Grading of Vulnerabilities
 Technical summary that details the following:
o If vulnerability is detected, what was detected and what would be the impact if this issue was left
unmitigated.
o If vulnerability is detected, how was it detected, with what actions, methods or tools were used
during the assessment.
o If vulnerability is detected, and was successfully exploited during the course of analysis, it would
be explained how this was done and what could be achieved during exploitation.
o Detailed suggested remediation is provided to correct the vulnerability. If this is applicable,
hyperlinks are provided leading to related suggested reading material.
 A presentation of the report and findings can be performed. This is done to help the client understand
the report and for the client to ask any questions that might require answering regarding the report or
assessment.
Back to top
Rhys A. Mossom Network Security Services Pty (Ltd)
Email: rhys@networksecurityservices.net
Website: http://www.networksecurityservices.net
Telephone: +27 (0) 12 743 6123
Telephone: +27 (0) 79 191 2362
Back to top