Assess Overview

Companies are always surprised when they find out just how vulnerable they are to cyber attacks. Unfortunately, a lot of companies find out the hard way. They suffer an attack and then are forced to deal with the fallout which includes losing business and having to spend a fortune to recover, if they recover at all. Nearly 60 percent of small and medium sized businesses are forced to shut down after a cyber attack. With cyber attacks and data breaches on the rise, cybersecurity needs to be a priority for all businesses.

You need to begin your cybersecurity journey with an assessment. This allows you to uncover blind spots and deficiencies you may be unaware of. Once you have baselined your risk you can begin to develop a strategy to mitigate, transfer, or manage that risk. This will help you measure the effectiveness of your security program. By prioritizing your risk you can make more intelligent decisions on where to invest your time and budget on the largest most impactful risk.

We can help you identify holes in your cyber security strategy before someone tries to exploit them. Through our work with 1000’s of mid-market businesses we understand a variety of industries, healthcare, finance, accounting, manufacturing, ag, software/tech, AEC. Using our industry specific knowledge we have developed a proprietary methodology to asses risk that are unique to your industry and the geographic areas you do business in. This process is adaptable and scalable to a businesses of any size.

Our comprehensive cybersecurity assessment includes:

• Information Security
• Discover Vulnerabilities
• Cyber Risk & Resilience Review
• Risk Ranked Vulnerabilities
• 12 Month Tactical Plan
• 18-24 Month Strategic Plan
• Business Continuity

An important step of any cybersecurity assessment is discovering vulnerabilities in your network. Penetration testing methods are designed to simulate what would happen in a real world attack. This means a suite of attack scenarios that will exploit gaps in your network security. To put it another way, a penetration test will show you how a hacker would steal your data, compromise your business, ransom your network, or otherwise damage you.

There are many common vulnerabilities and attack vectors that nearly every company must deal with. Penetration testing can help identify opportunities for many common exploits including the following:

• Buffer overflow exploit
• Linux stack overflow exploit
• Integer overflows
• Enterprise DMZ Breach
• Spoof communications
• Dlmalloc Heap Overflow exploits
• Injectable Shellcode
• Window Kernel Rootkits
• SQL Injection
• Packet Sniffing

User Risk Assessment

While there are discoverable vulnerabilities based on software, the reality is that finding technical exploits is only a part of the equation. Oftentimes, the weakest link in a company’s network are the people that use it. The majority of hacks do not involve a hooded hacker writing and executing malicious code. Rather, a large percentage of attacks come from social engineering hacks.

Social engineering attacks generally refer to an attacker using an interaction with a person to obtain protected information or to compromise a system. The most common form of social engineering comes from phishing attacks. Phishing attacks use emails, social media, or malicious websites to solicit sensitive data. Usually, the attacker will pose as an authority or trusted source to ask that a person give up information.

For instance, an attacker may pose as the IRS in an email to solicit financial information from a person. The attacker may ask outright, or direct the person to a malware site, or even ask that the person download a document which has malicious malware in it. The key, of course, is that the victim believes the attacker to be who they claim to be and that the person hands the information over voluntarily.

Clearly this has organizational consequences. All it takes is one employee to click on the wrong link or open the wrong email and your entire business could be at risk.

Below are some quick statistics to illustrate how much of a threat phishing attacks alone pose to every company.

• 95% of successful attacks on enterprise networks are phishing based
• 76% of businesses have been a victim of a phishing attack in the last year
• 30% of phishing emails are opened by the target
• 43% of breaches are attacks on small and medium businesses

These stats illustrate why every cybersecurity assessment should include an assessment of user risk. User risk assessments may include brute force attacks on user passwords to see if users’ passwords are too simple. They may also include simulated phishing attacks to identify whether a company’s employees and users are aware of the threats posed by phishing communications.