Cybersecurity should be an important and amplifying component of an organization’s risk management. To better address these risks, the Cybersecurity Enhancement Act (CEA) of 2014 updated the role of the National Institute of Standards and Technology (NIST) to include identifying and developing cybersecurity risk frameworks for voluntary use by critical infrastructure owners and operators. NIST was charged with identifying a prioritized flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls that may be voluntarily adopted to help organizations identify, assess and manage cybersecurity risks. 

Under the CEA, the development of NIST’s cybersecurity framework has continued evolving, and on April 16, 2018, NIST released version 1.1 of its “Framework for Improving Critical Infrastructure Cybersecurity” (the “Framework” or “NIST Cybersecurity Framework”).

We use this framework to evaluate an organization's cybersecurity efforts and identify deficiencies, gaps, or other weaknesses that may exist in the Governance, Risk, or Compliance Control environment.

An External Penetration Test serves to identify additional external vulnerabilities and weaknesses of an organization’s networks and computers.  We conduct our test in two phases. In the first phase, we act with limited knowledge of an organization’s external network, also known as a black box test.  We perform reconnaissance and information gathering using publicly available information about the organization. During the second phase, we use network information discovered during the first phase to perform port scanning, service enumeration, vulnerability scanning, and exploitation attempts.  

An Internal Penetration Test serves to validate the conclusions reached during the separate Vulnerability Assessment. Malicious actors can gain access to the internal network by remotely exploiting vulnerabilities on a client machine or by gaining physical access to a client machine or network access point.  We conduct an Internal Penetration Test on an organization’s internal network, behind its firewall(s) and other perimeter defense mechanisms. An internal penetration test is a realistic assessment of an organization’s information security controls and incident response procedures, and tests the organization’s ability to defend its critical data from a malicious attacker already on its internal network.  Our goal is to gain administrative access to an organization’s network by identifying and exploiting vulnerabilities on the organization’s network devices.

We utilize widely adopted penetration testing methodologies that include information gathering, service enumeration, vulnerability scanning, and exploitation.

Our Vulnerability Assessments identify vulnerabilities that could present security risks to the organization.  We perform independent, detailed vulnerability scans of the organization’s servers, workstations, and other network devices.  We look for known exposures on the computers and network devices, including missing patches, insecure configurations, and Trojan horse programs. 

When combined with other technical attacks, social engineering is the most successful way to compromise an organization’s network. 

Our Social Engineering procedures allow the Organization to test the effectiveness of its firewall, intrusion prevention system, other technical controls, and its employee security awareness. We work with the appropriate level of leadership to plan and execute social engineering campaigns using a pre-determined combination of spear-phishing, websites with “malicious” payloads, documents with embedded “malicious” code, and/or other client-side exploits.