Penetration Testing/Red Team Exercise
Validate your network’s and application’s security defenses through simulated (ethical) hacking situations.
– Test your network perimeter.
– Test a specific application (WebApp, Mobile, etc.).
– Meet your PCI or other compliance obligations.
– Test your technical and process/procedural controls through an expanded “Red Team” or “Purple Team” exercise involving your Security Operations Analysts in the threat scenario.
Cyber Training and Awareness
An organization’s people are the most common attack target (phishing, social engineering, business email compromise). Turn the tables and empower your people to be a strong component of your cyber defenses.
Typical components of Training and Awareness:
– Socialization of policies, procedures, and standards.
– In-person, virtual, or computer-based training sessions on IT and Information Security.
– Simulated phishing campaigns.
– Communications relating to cyber awareness (emails, newsletters, posters, etc.).
Compliance (PCI, SOX, HITRUST, FRB/OCC)
Achieving compliance regulatory obligations is a necessity to operate and thrive as a business.
Key components of a compliance program include:
– Design and implement controls.
– Test and validate execution of controls (collection of evidence).
– Completing assessments or audits for external validation or certification.
– Evaluating and remediating findings (or gaps) in controls.
Identity and Access Management
Understanding, managing, and controlling identities is becoming an imperative in today’s modern threat landscape.
Potential areas of support or focus include:
– Zero Trust
– Role Based Access Control (RBAC)
– Identity Governance
– Single Sign On (SSO) and Universal Identity Mgmt
– Multi-factor Authentication (MFA)
– Privileged Access Management (PAM)
– Customer/Consumer Identity Management (CIAM)
– Service Accounts and non-human identities.
