Strategic Partner for Your Success in IT, GRC, CRR, and Conformity Consulting & Certification.


ACTIVE CYBER DEFENSE



Continuous monitoring, responding, smart learning.



Active Cyber Defense solution proactively assesses your operational security and preempts threats. Our expert professionals are available to protect your cyber assets. Our Active Cyber Defense solution provides full-lifecycle support, incorporating constantly evolving security monitoring technologies, and advanced services such as security analytics, incident response, threat intelligence, and malware analysis.


In a constantly evolving threat landscape, attacks occur on a seemingly regular basis. Security technologies must adapt to identify ever-changing threat sources, mitigate risk, and minimize business loss.

  • A centralized Log Management solution, providing network visibility through an integrated dashboard.
  • Threat intelligence from internal and external intelligence sources as a force multiplier.
  • Security incident and compliance reporting, providing risk status, and compliance in real-time.

Countering advanced, determined adversaries requires an active approach to security, built on the premise that highly trained security personnel are needed to neutralize skilled and motivated threat actors. Active Cyber Defense solution augments and enhances your current defense against today’s malicious threat actors.



Threat Intelligence and Monitoring



  1. Design And Implementation Of SIEM Technologies
    • Assessing the client's log management system and proposing a suitable SIEM solution
    • Identifying the critical services/devices for SIEM integration
    • Design and implementation of the SIEM solution
  2. Threat Intelligence And Security Analytics
    • Industry threat briefings
    • Validating and prioritizing security countermeasures
    • Threat profile development and trend analysis
  3. Security Monitoring And Response Assessment
    • Reviewing foundational capabilities in security monitoring and response
    • Performing a red team assessment to identify attack signatures and areas of improvement
    • Recommending strategic future-state enhancements for the SOC
  4. Proactive APT Assessment
    • In-depth testing of device operating systems and kernel modules for integrity and stability to identify security vulnerabilities before the market
    • Repeatable testing processes that can be used to assess security across an entire product line
    • Testing that combines logical and physical-level access for deep analysis
    • Threat modeling to identify attack vectors and close security gaps early in the development process
  5. Compromise Assessment
    • Red teams constantly evaluate client environments for the presence of targeted attacker activity
    • Identifying traces of a potential compromise, breach activity, or malicious tools
    • Identifying unauthorized malicious third-party access to systems


Incident Response



  1. Incident Response Program Development
    • Assessment of current preparedness
    • Developing incident response documentation
    • Providing IR training and awareness
    • Simulation testing
  2. Response Readiness Assessment
    • Response evaluation through a review of current incident response plans, including policies and procedures, roles and responsibilities, and security controls
    • Gap Analysis based on leading practices
    • Conduct exercises to evaluate the client team’s response during a security incident, their awareness of the incident process, and their ability to identify and respond to an incident
  3. Malware Analysis
    • Identifying and assessing assets and data at risk of exposure to the latest malware
    • Reverse-engineer malware using dynamic and static analyses
    • Memory malware analysis
    • Identifying indicators of compromise and recommending eradication steps
    • Customized reports detailing the composition and behavior of malware


Managed Services



  1. Realtime Monitoring And Proactive Hunting
    • Round the clock monitoring of the client’s security event logs and alerts
    • Proactive monitoring: detecting attacks before critical services are disrupted or compromised
    • Identifying, categorizing, and prioritizing information security incidents
  2. Alert Analysis And Triage
    • Validation of the security incident
    • Correlation and expert analysis
    • Assessment of the incident’s criticality
    • Functional and hierarchical escalation as per service-level agreements
  3. Advanced Threat Intelligence And Analytics
    • Intelligence on botnet command and control
    • IP address/domain name of servers hosting exploits and malware
    • Various attack patterns and security compromise indicators
    • Predictive analysis of future attack vectors
    • Threat feed integration and internal intelligence harvesting
    • Tactical support for monitoring and incident response
    • Tailor-made subscription service packaging
  4. IR Investigation, Containment, and Eradication
    • Deep-dive incident analysis by correlating data from various sources
    • Determining if a critical system or data set has been impacted
    • Providing advice on containment, eradication, and remediation
      • Support for new analytic methods for detecting threats
      • Advanced network forensics, host-based forensics, and malware analysis




Sword & Shield consulting. All rights Reserved


Terms
Privacy
Cookies