Cybersecurity

Security threats, vulnerabilities, and data breaches have become a top priority for boards and senior executives around the world. The sophistication of attackers and the complexity of the threats require organizations to not only implement sound security technologies but also have robust controls and processes around information security.

Cyber Defense Initiative

As a part of our Cyber Defense Initiative, we are committed to helping clients evaluate the adequacy of the technology, controls, and processes implemented to secure your information assets and provide valuable recommendations for improving your organization’s security posture. Our accomplished information security professionals have experience advising clients in a variety of information security and privacy areas, including:

Vulnerability Assessment

A vulnerability assessment is intended to be a comprehensive evaluation of the security of your vital infrastructure, endpoints, and IT assets. It gives insight into system weaknesses and recommends the appropriate remediation procedures to either eliminate the issue or reduce the weakness to an acceptable level of risk.

Steps to the vulnerability assessment:

1. Identification and cataloging of IT asset
2. Discovery and prioritization of the vulnerabilities
3. Recommend procedures to decrease vulnerabilities

Penetration Testing

A penetration test attempts to simulate the actions of an external or internal attacker who is trying to exploit the vulnerabilities present within your organization. A qualified pen tester uses a combination of tools and techniques to bypass the existing security controls of the target organization. The goal is to gain access to sensitive systems and information.

Every pen test can be different depending on what is discovered during the simulation, however most follow these steps:

1. Determination of the scope and objectives
2. Information gathering
3. Identification of weakness to gain access
4. Demonstration of completion of objectives
5. Clean up and reporting

Phishing Campaign

Mature information security technology and controls are only as good as the people that are responsible for them. A recent study found that over 90% of data breaches were the result of a combination of phishing attacks and social engineering. To evaluate the effectiveness of your security awareness program, a phishing campaign can help you know where you stand.

Phishing campaigns test your employees’ propensity to click on email phishing lures with an effort of obtain system credentials utilizing open source technologies and false emails accounts with an endeavor of representing a reputable source. Obtained credentials will be reported for determining the effectiveness of users’ awareness of phishing email avoidance.

Cybersecurity Risk Assessment

We will perform assessments and make recommendations to help you improve your security and compliance efforts. Our team will assist with your compliance of the following requirements:

• Payment Card Industry Data Security Standard (PCI-DSS)
• Health Insurance Portability and Accountability Act (HIPAA) /Health Information Technology for Economic and Clinical Health Act (HITECH)
• International Organization for Standardization (ISO) 27001
• National Institute of Standards and Technology (NIST) Special Publication 800-53/800-171
• SOC 2 Trust Services Criteria
• General Data Protection Regulation (GDPR)
• Federal Financial Institutions Examination Council (FFIEC)