Security Assessments
Why do businesses need security assessments?
Security evaluations are useful for any business which stores data (such as customer credit card information), but are especially needed in industries which must meet compliance standards, like PCI, FedRAMP, and GDPR.
Without a robust security plan, hackers could exploit flaws in your IT infrastructure to:
- Distribute malware — In this scenario, malware would be delivered to everyone who visits your company’s website. When your website is flagged by search engines like Google and Bing for distributing malware, search engines will prevent your domain from showing up in search results. This would cause difficulties for prospective customers who are trying to find your services.
- Distribute ransomware — In a ransomware attack, hackers seize and lock down your business’s IT systems, such as your customer database, company email accounts, and more. Hackers claim they will return your systems if you pay a hefty ransom, but some companies never recover their information even after sending the requested payment.
- Cause other types of harm — Sometimes it’s difficult to understand a hacker’s motivation. They may steal your customers’ information or your intellectual property to sell it to another business. However, they may not even care about profiting from your company’s information; they may just want to hurt your reputation.
knit identifies your vulnerabilities, offers suggestions to fix any issues we find, and collaborates with you to implement security solutions on a timeline which is realistic for your budget.
What does a security risk assessment involve?
There are several methods we can use to evaluate security risks in your business’s IT systems. Depending on your needs, we may use:
- Penetration testing — A penetration test (sometimes called a pen test) simulates a cyber attack on your IT systems to find vulnerabilities which hackers might try to exploit in the future.
- Red teaming — This approach is typically used with organizations which have already conducted a penetration test and want to explore a more multi-faceted approach to security. A red team gets creative to find more angles they could use to invade your IT systems.
- Attack surface analysis — Initially, an attack surface analysis identifies all the vulnerabilities in your systems so you can know where hackers are likely to attack. This analysis can be ongoing to monitor changes in your attack surface as you work to minimize weaknesses.
Security evaluations and testing help your business discover:
- Exposed weaknesses which could be used to attack your IT systems
- Sensitive company information which has accidentally been made public
- Causes behind the vulnerabilities in your IT infrastructure which need to be addressed
Here’s an example of how your security evaluation may look:
Recently, a business to business (B2B) software company hired us to conduct a security evaluation with a “no knowledge” approach, acting as if we knew nothing about their business. We used information gathering techniques to find everything their company had exposed online which an outside hacker could use to attack their network. We found a lot of information which shouldn’t have ever been made public, including:
- Names and addresses of internal servers
- Third party vendors they use, which could have allowed for supply chain attacks
- Servers hosting development versions of their software
- Outdated servers
- And many other ways they could potentially have become compromised
We prepared a security risk report, as well as a list of recommendations to remedy the issues we discovered. Now we’re working with the company’s leadership to prioritize and fix the highest risk issues.