Solutions

The atCISO offering provides a highly experienced and skilled resource to oversee the development and implementation of your cybersecurity strategy and program but most importantly, at a level which best suits your needs. From full-time to long-term to temporary support, we can customize the offering. Periodic reviews of security issues, implementation and maturity are available as well. The teammates which deliver the Chief Information Security Officer level services each have over 20 years of cybersecurity leadership experience.

atAssess is designed to provide a snapshot of your organization’s current implementation of security controls and policies as it relates to the Center for Internet Security’s (CIS) Critical Security Controls (CSC) for Effective Cyber Defense version 7.0 published April 2018. In addition, atAssess provides a Comprehensive Internal & External Vulnerability Assessment which conveys a snapshot of internal and external vulnerabilities that your organization is exposed to.

atAttack, or Penetration Testing, is an exercise designed to replicate the activities a computer attacker would take to compromise a system or network. The goal is to identify specific exploitable weaknesses in the organization’s computer systems, exploit the weaknesses through the same methodologies and tools attackers use, and gain access to the internal network. Penetration testing is performed from two perspectives; first to evaluate the infrastructure, following a formalized methodology called The Penetration Testing Execution Standard (PTES) and secondly the testing reviews up to two applications using the OWASP Top 10 testing methodology.

atComply delivers a compliance gap analysis and assessment. Several standards can be selected from as a base for comparison against your environment, such as NIST Cybersecurity Framework, Center for Internet Security 20 Critical Security Controls, ISO 27001,  NIST 800-171, and HIPAA.

atPlan offers an option to develop or update several key governance documents which many organizations should have supporting their cybersecurity program. The documents may include: Information Security Policy, Business continuity Plan, Disaster Recovery Plan, Incident Response Plan and/or Crisis Communications Plan, among others. Whether compliance driven or best practice motivated we can help mature and/or create these most important documents.

atArch is an Architecture Review which evaluates an organization’s networks and relationship among them from a security perspective. It also reviews the various security zones and the data flows among them. The architecture analysis involves four key areas including building a network map, enumerating the security zone architecture, mapping key data flows between those security zones and defining the location and type of sensitive data worth protecting within the environment.The goal of this review is to identify weaknesses being created or exacerbated by network architecture elements.

Technical Controls Review, atTech, focuses on your technical security controls and systems including firewalls, intrusion detection/prevention systems, anti-malware, mobile device management systems and endpoint protection solutions. This review provides a detailed look at the quality of the implementation of that control through eight areas: Appropriateness, Completeness, Configuration, Current Patch Set, Current Version, Local Security, Solution Maturity and Support Contract. These eight items are individually reviewed and scored allowing for a rollup scoring of the complete set of technical controls.

atAttack, or Penetration Testing, is an exercise designed to replicate the activities a computer attacker would take to compromise a system or network. The goal is to identify specific exploitable weaknesses in the organization’s computer systems, exploit the weaknesses through the same methodologies and tools attackers use, and gain access to the internal network. Penetration testing is performed from two perspective;, first to evaluate the infrastructure, following a formalized methodology called The Penetration Testing Execution Standard (PTES) and secondly the testing reviews up to two applications using the OWASP Top 10 testing methodology.

atSocial discovers the human security risk in your environment and offers planning to address these vulnerabilities along with security training to educate all members of your organization around human risk. Realize the level of susceptibility of employees through email phishing and spear-phishing attacks with a Social Engineering or Phishing Assessment.