Strategic Partner for Your Success in IT, GRC, CRR, and Conformity Consulting & Certification.


OFFENSIVE SECURITY SERVICES



A proactive, adversarial approach to threats



Gain insight into your organization’s current security posture, as seen by the attacker. SSC’s Offensive Security Services enable you to augment and enhance your current defenses against today’s malicious threat actors.


Periodic offensive security testing improves your organization’s ability to anticipate security breaches before they occur, enabling you to respond quickly and decisively.


Save your organization from the potential financial and brand image loss that a security breach would entail. SSC’s Offensive Security Services can identify and test for potential weaknesses in your organization’s security preparedness. We provide in-depth information on real and exploitable threats and enable your organization to proactively defend against real-world attacks

  • A proactive, adversarial approach to protecting your organization’s networks, applications, and computer systems
  • Augment your defenses with managed vulnerability testing on your organization’s digital infrastructure
  • Static and dynamic code analysis, using automated and manual testing methodologies to identify vulnerabilities in hosted applications


Application Security



  1. Black/Grey Box Application Testing
    • Black-box and Grey-box application security testing
    • Identifying potential vulnerabilities
    • Automated and manual analysis of web applications
    • Testing for OWASP Top 10 vulnerabilities
    • Sector-specific business logic testing
    • Reporting – findings and recommendations
  2. Application Source Code Review
    • Automated and manual source code analysis
    • Reviewing application code with a focus on security considerations
    • Analyzing application source code to identify security vulnerabilities in the code
    • Reporting – vulnerability findings, recommendations, high-level mitigation steps
  3. Mobile Application Security
    • Mobile-friendly web application assessment:
      • Penetration testing on mobile websites
      • External review of supporting infrastructure
    • Native mobile application assessment (Grey-box/ Black-box):
      • Penetration testing of applications installed on mobile devices
      • Testing focused on network connections and data handling
      • Assessing the risk of device-specific attacks
  4. Smart And Embedded System Security
    • In-depth testing of device operating systems and kernel modules for integrity and stability, to identify security vulnerabilities before the market
    • Repeatable testing processes that can be used to assess security across an entire product line
    • Testing that combines logical and physical-level access for deep analysis
    • Threat modeling to identify attack vectors and close security gaps early in the development process
  5. Preproduction Application Testing
    • Analyzing the security posture of applications in the development stage
    • Identifying potential vulnerabilities and recommending high-level mitigation steps before the application is deployed in a production environment
    • Based on the OWASP methodology
    • Providing recommendations for risk minimization
    • Reporting – gaps, recommendations
  6. Secure SDLC
    • Identifying touchpoints throughout the SDLC from a security perspective
    • Reviewing the existing SDLC process, SDLC documentation standards, and technology-specific policies
    • Reviewing project-specific evidence, and performing sample code reviews for common development issues
    • Assessing security involvement across SDLC phases
    • Reporting – identifying current gaps and providing recommendations


Infrastructure Security



  1. Threat Modeling: Threat modeling is a process that allows developers, architects, and managers to apply a structured approach to security:
    • Identifying the threat environment, applications, architecture, and technology used
    • Defining system trust boundaries and data flows
    • Performing threat analyses and providing countermeasures
  2. Vulnerability Assessment
    • Identifying vulnerabilities associated with the client’s IT infrastructure
    • Eliminating false positives
    • Providing recommendations for risk mitigation and control
    • Reporting – vulnerability findings, recommendations, high-level mitigation steps
  3. Infrastructure Penetration Testing
    • Based on well-defined A&P methodology
    • Analyzing the security posture of the client's network
    • Identifying potential vulnerabilities by emulating real-world attacks
    • Reporting – vulnerability findings, recommendations, high-level mitigation steps
  4. Wireless Penetration Testing
    • War dialing the client's network to identify wireless access points outside permissible bounds
    • Identifying rogue access points
    • Capturing wireless handshakes
    • Breaking the encryption methods/keys deployed in WLAN
    • Reporting – vulnerability findings, recommendations, high-level mitigation steps
  5. Cloud Security Assessments
    • Identifying security and privacy risks
    • Comparing current state security to the desired state and to best practices
    • Cloud infrastructure security assessments by conducting penetration testing and configuration assessment for public/ private cloud infrastructure
    • Reporting – findings and recommendations
  6. Red Team Assessment
    • Performing scenario-based red-team assessments based on organization and industry-specific threats
    • Assessing the client's security posture by using a threat-based approach that mimics the likely techniques employed by probable threat actors to compromise agreed-upon targets
  7. Situational Awareness Reviews
    • Evaluating current capabilities to detect and respond to threats against critical assets and processes
    • Facilitated reviews, working with key company stakeholders, to determine critical assets and security controls to mitigate associated threats
    • Attempting to discover identify available security controls and evaluating their likely efficacy against probable threat actor groups
  8. Ongoing Enablement Services
    • Building, transforming, enabling, and sustaining threat and vulnerability management program
    • Recurring testing and assessments, incident response support, threat intelligence, and continuous knowledge sharing with SSC's in-house IT team
  9. Security Configuration Assessments
    • Based on proven methodology and industry-leading practices
    • Analyzing network, servers, database, and application configurations
    • Identifying potential configuration issues
    • Reporting – findings and recommendations


Managed Services



  1. Managed Application Security
    • A managed program for sustaining application security, customized to meet your organization's needs
    • End-to-end security integration in the SDLC that drives business value and supports accelerated application development
    • Technologies such as dynamic analysis tools, static analysis tools, software composition analysis tools, and interactive application security tools
    • Implementation and configuration of these tools
    • On-boarding of applications
    • Fine-tuning of tools and applications
    • Performing automated tool scans
    • Reviewing output from tools and filtering out false positives
    • Dashboards and reporting
    • Remediation support
  2. Vulnerability Management
    • Monitoring information security vulnerabilities continuously, and tracking patch and vulnerability management efforts performed by the client
    • Identifying and report critical vulnerabilities reported by our VA tool daily
    • Identifying and reporting new vulnerabilities detected by the tool for all external and internal assets, regularly
    • Periodic status tracking of all outstanding vulnerabilities
    • Providing additional inputs and vulnerability analysis
    • Preparation of a security posture dashboard presentation
  3. Security Configuration Management
    • Determining the configuration checks to be performed, per baseline settings, as well as the systems, servers, and applications to be checked
    • Configuration of the security compliance management tools
    • Reviewing the output of security checks and identifying and documenting valid deviations and false positives
    • Dashboards and reporting
    • Remediation support
    • Deviation tracking and closure




Sword & Shield consulting. All rights Reserved


Terms
Privacy
Cookies