Threat Intelligence Reporting
Threat intelligence is evidence-based information of the motives, goals, and resources of an emerging or existing threat. Avertium's Cyber Threat Intelligence (CTI) Unit develops Threat Intelligence Reports (TIRs) to provide context regarding adversaries and other threats to the cyber security landscape.
Avertium's Cyber Threat Intelligence Unit (CTIU) actively hunts for and conducts research on emerging threats and threat actors to continuously improve our services and threat detection capabilities, and to help our clients better understand the threat landscape and individual profiles of threat actors. Avertium issues a weekly Threat Intelligence Report that features a specific threat from a current topic such as ransomware, cryptojacking, malware, phishing, worms, etc. The CTIU also develops TIRs that feature specific threat actors who are actively exploiting vulnerabilities. Threat actor specific reports contain the following:
Another aspect of threat intelligence Avertium provides its clients comes in the form of Flash Notices. A flash notice is an emergency communication vehicle used to deliver information to Avertium's customers, as well as internal staff, about active threats. Those threats include information about vulnerabilities found within software and servers that are being exploited in the wild. The notice has a general turnaround time of between 24 and 48 hours. These notices are typically one page but can be longer depending on the threat.
A typical Flash Notice includes:
Activities
Deliverables
Attack Surface Analysis
With well over 50% of breaches involving third-party vendors, an Attack Surface Analysis is an essential element of an organization's overall security program. Avertium's Attack Surface Analysis (ASA) focuses on your organization's and its third-party vend0ors' threat landscape including technical, financial, and compliance-based risk. Avertium's ASA service assesses your vulnerability and risk, including weaknesses introduced through your third-party vendors, to possible data exposure, system compromises or other cyber activities, and provides you with valuable actionable insights to protect your systems, brand, and reputation.
Our ASA Service measures your risk posture, benchmarks security performance against industry peers, and provides mitigation strategies to improve your risk scoring, then clarify and effectively reports security status in an easily digestible format appropriate for executive leadership. This arms you and your CISO or CIO with compelling and actionable information to drive strategic initiatives to reduce risk and susceptibility to ransomware and mature the organization's overall security posture.
Activities
Twice annually, Avertium will:
Deliverables
Special Note
Avertium's Attack Surface Analysis provides information that may include system vulnerabilities and sensitive data exposure such as leaked usernames, passwords, social security numbers, financial data, and other personally identifiable information (PII) related to Client, your employees, and/or your third-party vendors.
Incident Response Tabletop Exercise
A tabletop exercise is an excellent tool to use to help prepare for a cyber incident by identifying the proper steps to take in the event of a successful attack.
Avertium consultants will prepare for and facilitate a tabletop exercise to test Client's existing Incident Response (IRP). The exercise will take place remotely with up to twenty (20) designated IT staff members and other personnel selected by the Client. The purpose is to test the incident response team on their understanding of how to handle an incident and their ability to follow the documented plan.
Avertium may use the guidance and scenario information gathered from the following sources:
Activities
Deliverables
Incident Response Plan Review
An incident response plan is a set of written instructions for detecting, responding to, and limiting the effects of an information security breach/event. Our analysts will work with Client to review or update an existing plan or draft an effective new plan that will mitigate the duration and impact of a breach.
Efforts to support the incident response plan update will not exceed the number of retainer hours purchased and identified herein. Any additional hours required to support the project can be purchased at the agreed upon hourly rate and will be added in a separate SOW.
If travel to Client location(s) is required and approved by Client, reasonable, documented, and preapproved transportation expenses will be reimbursed at the actual cost, to include economy class airfare and local transportation.
Activities
Deliverables
Semi-Annual Threat Briefing
Avertium's Cyber Response Unit (CRU) has a long history of dealing firsthand with threat actors of all types and it has its finger on the pulse of the challenges you could be facing today. The CRU is continuously learning how cyber criminals gain unauthorized access to systems and data, what techniques they use, and how they adapt to and circumvent tighter controls. This services gives you the benefit of what the CRU is learning, from both extensive research and in the trenches, in a way that is actionable for you and your team.
Activities
Deliverables
NIST CSF Security Assessment
Avertium will assess the organization's infrastructure to include systems, architecture, processes, and procedures. Additionally, Avertium will interview key technical and administrative personnel to determine gaps between NIST CSF recommendations and the organization's current operations.
Avertium will follow compliance guidance from NIST CSF, which is broken down into five functions: Identify, Protect, Detect, Respond, and Recover, and includes the following control categories:
The results of the assessment are used to identify deviations in the organizational control environment from what is recommended by the NIST CSF. Avertium will recommend guidance where gaps are identified in order for the organization to achieve compliance.
Activities
Avertium will perform the following tasks to evaluate the organization's compliance with NIST CSF control guidance:
Deliverables
Scoping Note
Before submitting the Work Order for this service, the application must be scoped by Avertium to determine the number of hours required for the assessment. Please contact your Account Executive to schedule a scoping call.
External Network Penetration Test
Avertium's External Network Penetration Test services are performed against public facing networks in support of Client's goals to validate security controls and compliance with multiple compliance frameworks.
Penetration Testing can be used to identify, document, and test a vulnerability or security risk within a designated set of IT IPs, assets, applications, websites, and devices. Penetration testing includes the manual or automated exploitation of the identified vulnerability and the manual gathering and identification of vulnerabilities within the targeted environment.
Our security professionals developed a methodology that is constantly updated with new techniques and approaches. It consists of a three phased approach, including:
The Planning and Preparation phase begins with verifying client goals for the assessment and validating target scope. A well-defined Rules of Engagement process will also be introduced. The assessment team will perform Open-Source Intelligence Gathering (OSINT), and network mapping to understand the target network architecture.
The Assessment phase continues with performing host and service discovery. Vulnerability scans will be performed and analyzed to develop attack paths and scenarios. Configuration weaknesses and vulnerable systems are then exploited to gain unauthorized or privileged system access. Manual testing is also performed to not only validate scanning results, but also to discover issues the scanners may not detect. Throughout the test, we work with you to identify appropriate target systems and to keep you up to date on the attack's progress
The Reporting phase documents all discovered vulnerabilities and the affected systems and includes recommendations for remediation. Findings will be prioritized based on severity and ease of exploitation. This phase can be thought of as the most important phase, as it presents the client with actionable items that can be used to further secure their networks and applications.
Although we use this framework as a guideline for managing our penetration testing engagements, our methodologies are heavily tailored and consider the maturity level, industry, threat landscape, and overall need of the client.
Activities
Avertium will:
Deliverables
Internal Network Penetration Test
Avertium's Internal Network Penetration Test services are performed against internal networks in support of Client’s goals to validate compliance with multiple compliance frameworks.
Penetration Testing can be used to identify, document, and test a vulnerability or security risk within a designated set of IT IPs, assets, applications, websites, and devices. Penetration testing includes the manual or automated exploitation of the identified vulnerability and the manual gathering and identification of vulnerabilities within the targeted environment.
Our security professionals developed a methodology that is constantly updated with new techniques and approaches. It consists of a three phased approach including:
The Planning and Preparation phase begins with verifying client goals for the assessment and validating target scope. A well- defined Rules-of-Engagement process will also be introduced. The assessment team will perform Open-Source Intelligence Gathering (OSINT), and network mapping to understand the target network architecture.
The Assessment phase continues with performing host and service discovery. Vulnerability scans will be performed and analyzed to develop attack paths and scenarios. Configuration weaknesses and vulnerable systems are then exploited to gain unauthorized or privileged system access. Manual testing is also performed to not only validate scanning results, but to discover issues the scanners may not detect. Throughout the test, we work with you to identify appropriate target systems and to keep you up to date on the attack's progress.
The Reporting phase documents all discovered vulnerabilities and the affected systems and includes recommendations for remediation. Findings will be prioritized based on severity and ease of exploitation. This phase can be thought of as the most important phase, as it presents the client with actionable items that can be used to further secure their networks and applications.
Although we use this framework as a guideline for managing our penetration testing engagements, our methodologies are heavily tailored and consider the maturity level, industry, threat landscape, and overall need of the client.
Activities
Avertium will:
Deliverables
Wireless Penetration Test
Avertium's Wireless Penetration Testing services are performed against Client’s public/private wireless networks, inside and outside of Client’s physical location(s). The objective of the wireless security assessment is to examine the subsystems, components, and security mechanisms composing the system’s infrastructure and identify weaknesses.
Both opportunistic and targeted threats with limited resources are evaluated. It is assumed that the “targeted with unlimited resources” threat cannot be defeated and, therefore, is not considered. The physical location will be evaluated for rogue or unauthorized wireless access points and a site-survey of the location will be conducted. Avertium will perform attacks against the wireless network and associated wireless clients. These attacks can include attempts to circumvent or break the security implementation to gain access, perform man-in-the-middle attacks, malicious wireless network impersonation, or de- authentication attacks.
Methodology - Wireless Assessment
Avertium’s Wireless Penetration Testing services are designed to validate customer wireless technology environments against simulated real-world threats. Once services are initiated, our testing team will work with Client to confirm the scope and testing objectives. The services are also tailored to Client requirements and data processing environment.
Our security professionals developed a methodology that is constantly updated with new techniques and approaches. It consists of a three phased approach including:
The Planning and Preparation phase begins with verifying client goals for the assessment and validating target scope. A well- defined Rules of Engagement process will also be introduced. The assessment team will perform an initial review of the wireless network to gain a better understanding of design and currently implemented security controls.
The Assessment phase continues with performing site surveys and targeted attacks against the wireless access points and connected devices. Configuration weaknesses and vulnerable systems are then exploited to gain unauthorized or privileged system access. Throughout the test, we work with you to identify appropriate target systems and to keep you up to date on the attack's progress.
The Reporting phase documents all discovered vulnerabilities and the affected systems and includes recommendations for remediation. Findings will be prioritized based on severity and ease of exploitation. This phase can be thought of as the most important phase, as it presents the client with actionable items that can be used to further secure their networks and applications.
Although we use this framework as a guideline for managing our penetration testing engagements, our methodologies are heavily tailored and consider the maturity level, industry, threat landscape, and overall needs of the client.
Activities
Deliverables
Web Application Assessment
Avertium will conduct a security assessment of the target web applications. The objective of a security assessment is to examine the subsystems, components, and security mechanisms composing the system’s infrastructure and identify weaknesses.
Avertium uses commercial tools, public domain utilities, proprietary tools, and manual testing techniques based on our extensive experience to examine the security posture of an application using numerous industry frameworks such as the Open Web Application Security Project (OWASP).
OWASP’s security testing categories include:
Activities
Avertium will:
Deliverables
Web App Project Assumptions
Scoping Note
Before submitting the Work Order for this service, the application must be scoped by Avertium to determine the number of hours required for the assessment. Please contact your Account Executive to schedule a scoping call.
Mobile Application Assessment
Avertium will conduct a security assessment of the target mobile application(s). The objective of the security assessment is to examine the components, and security mechanisms composing the application’s infrastructure, and to identify weaknesses. Avertium utilizes public domain utilities, proprietary tools, and manual testing techniques to examine the security posture of a mobile application using frameworks such as OWASP’s Mobile Security Testing Guide, and the Mobile Application Verification Standard.
Methodology - Mobile App
Avertium’s Mobile Application Testing services are designed to validate customer technology environments against simulated real-world threats. Once services are initiated, our testing team will work with Client to confirm the scope and testing objectives. The service is aligned with several frameworks such as Payment Card Industry PCI DSS, Open Web Application Security Project (OWASP), and Open-Source Security Testing Methodology Manual (OSSTMM). The services are also tailored to Client requirements and data processing environment.
Avertium’s Information Security Assessment, Evaluation, and Testing (IASET) services are designed to provide a holistic, point- in-time view of a company’s overall information security posture. We leverage a standard approach developed initially by the National Security Agency (NSA), and the PCI Council’s guideline for Penetration Testing released in March 2015. The OWASP Mobile Security Testing Guide and the Mobile Application Verification Standard are also utilized to help organizations meet industry standard security requirements and provide a method for consistent delivery of information security assessments.
This mobile application assessment will be based on the application architecture and requirements, such as:
Scoping Note
Before submitting the Work Order for this service, the application must be scoped by Avertium to determine the number of hours required for the assessment. Please contact your Account Executive to schedule a scoping call.
Activities
Avertium will assess the mobile application based on the following threat-based categories:
Deliverables
Threat Hunting Services
Today’s advanced cyber threats come in many forms; from the opportunistic local threat actors to the nation-state sponsored well organized, and everything in between. Many have access to a broad range of intelligence and tools, and they can conduct sophisticated and advanced attacks. These attacks can go undiscovered for several weeks or even months.
Understanding how these threat actors work, the tools they use, and the techniques they employ (TTP’s) allow you to “know your adversary”, discover if they present a threat to your company, and either eradicate them from your environment or prevent them from gaining unauthorized access to systems or data. Staying ahead of current attack trends enables you to protect your critical assets in advance, rather than dealing with the fallout from unauthorized access or a ransomware event.
Avertium offers Threat Hunting as a Service which proactively hunts for threats by leveraging the threat intelligence we gain from researching emerging threats and threat actor behavior, along with the knowledge we’ve gained from threats we’ve seen across our range of services.
Activities
Deliverables
Scoping Note
The number of scenarios that can be addressed during the threat hunting activity is dependent on the complexity of the scenario and the number of hours the client wants to allocate to the threat hunting engagement. Before submitting the Work Order for this service, a planning and scoping call to determine the level of effort, the number of scenarios, and the resulting number of hours to allocate.
* Client must have SentinelOne or Microsoft Defender for Endpoint in production for the target environment prior to requesting Threat Hunting Service