CYBERSECURITY

Information Security Incident Management (Cyber Incidents)

The complexity and diversity of the environment of the modern company’s activities determine the presence of residual risks, regardless of the quality of preparation and implementation of measures to counter them. Also, there is always the possibility of implementing new, unknown to date, threats to information security. The unwillingness of the organization to handle such situations can significantly complicate the recovery of business processes and potentially increase the damage.

Incident management is an important process that provides an organization with the ability to first identify an incident and then resolve it more quickly using selected support tools.

The purpose of the security incident management:

• restoration of normal operation of services in the shortest possible time;
• minimizing the impact of incidents on an organization’s work;
• ensuring coherent handling of all incidents and service requests;
• focusing support resources on the most important areas;
• providing information to optimize support processes, reduce the number of incidents, and plan management.

The lack of incidents does not indicate that the security management system is working correctly, but only indicates that the incident is not fixed.

Any organization that is serious about information security issues needs to take an integrated approach to protecting information assets, which include:

• information: databases and data files, contracts and agreements, system documentation, research information, user guides, training material, operating or maintenance procedures, business continuity plans, recovery measures, audit logs, and archival information;
• software assets: application software, system software, development tools and utilities;
• physical assets: computers, telecommunications equipment, replaceable media, and other equipment;
• services: computing and telecommunication services, utilities (for example, heating, lighting, power supply, and air conditioning);
• people and their qualifications, skills and experience;
• intangible assets, such as the reputation and image of the organization;

Specialists of our Agency provide services for the implementation of information security incident management systems for the following tasks:

• identifying, informing, and recording information security incidents;
• response to information security incidents, including the use of the necessary means to prevent, reduce, and repair the damage suffered;
• analysis of incidents that have occurred in order to plan preventive protection measures and improve the information security process as a whole.

We carry out the establishment of an incident monitoring system for the following objects:

• hardware (switches, routers, scanners, UTM devices);
• bundled software (operating systems, anti-virus gateways, personal anti-virus systems, data processing subsystems, and available services);
• information resources (databases, user files available on the network, etc.);
• actions by users of a corporate network.

We carry out facility surveys in the process of managing information security incidents

Collection and analysis of information on the currently available and used regulations, procedures, and means of ensuring information security and incident management.

We carry out the identification of sources of information security events, collect information on the information systems used and information processing technologies. We determine the scope of the information security incident management system. We are drafting the documents “Objectives regarding the development of information security incident management systems” and “Specifications for an automated information security monitoring and incident management system”.

We investigate cases of violation of security policy, dangerous and unforeseen events, analyze the causes that led to them, accompany the data bank of such events during the operation of an integrated information protection system

Investigation of cyber incidents will solve a number of problems and eliminate or minimize the consequences the company suffers in the event of a cyberattack, namely:

• the risk of data integrity violation, which can lead to data compromise and loss of significant amounts of funds in client accounts;
• the risk of reputational losses, when publicity of information about a possible hacking or compromise of an information system can lead to a decrease in the company’s image in the market;
• risk of customer drain in the case of fund loss and increased concerns about system security;
• impact on financial indexation when breaches of confidentiality and integrity of data can lead to direct and indirect financial losses for the company.

The tasks of investigating cyber incidents are as follows:

• precisely diagnose cyber incidents;
• localize and minimize the consequences and losses;
• identify the underlying causes, channels, and evidence;
• restore compromised information systems;
• implement protection measures to eliminate such incidents in the future.

The main purpose of creating an organization’s information security system is to mitigate the risks of information assets and reduce the negative consequences of possible incidents.

Information Security Threat Tracking

Reliable data security cannot exist without actively identifying and tracking threats.

We carry out risk analysis and develop an optimal strategy for monitoring, disclosing plans, and preventing malicious actions of attackers.

Information Security Vulnerabilities Detection

We conduct vulnerability detection at all levels of IT infrastructure, and software and hardware components of apps. We perform security analysis using dynamic (tuning, fuzzing, and instrumentation) and static methods, including source code analysis. If necessary, reverse engineering of the app is carried out.

Security Event Tracking

Corporate infrastructure can consist of thousands of elements, which, together with detection systems, generate a huge flow of information. Statistics show that a large percentage of implementations of log management systems, security events, and flood attack mitigations do not justify the planned business case. Our team will analyze the infrastructure, suggest optimal settings for existing components, or indicate the need for additional means.

For abnormal events, we conduct a detailed analysis of the causes that caused them. This includes low-level parsing of network protocols and program behavior. Monitoring profiles are constantly being adapted to changes in the IT infrastructure.

Program Protection

Unauthorized copying, bypassing application licensing restrictions is one of the oldest crimes. We offer our clients effective solutions from unauthorized interference for all popular platforms (Windows, Mac, iOS, Linux, Android, etc.), which will provide significant savings in funds and resources to develop security methods on their own.

Stress Testing

The most well-known way among attackers to harm a business is to eliminate the functioning of online resources (DoS attacks). The best way to check the reliability of your resource protection is our stress testing service. In a controlled way, we will generate a large load on all levels of network protocols, conduct detection of vulnerabilities or incorrectly configured components, which make it impossible for the company resources to work.

Penetration Test

Authorized attempt to bypass the information system protection tools. The result of the test is a report containing a list of detected vulnerabilities, used attack vectors, results achieved, and recommendations for remediation. The results of the “pen-test” of an information system depend not only on the quality and conditions of setting up and operating the software implementation, but also on similar hardware metrics, the correctness of personnel actions, the streamlined and consistent operation processes.

Application Penetration Tests

This test uses real attack strategies to identify flaws related to the application itself and its links to other IT infrastructure. As part of this service, our experts shall manually check the source code of your new or existing apps in combination with dynamic tests and real attacks.

Our detailed report will allow your security team to find and prioritize the errors to be fixed:

• Threat model approach;
• Confirmation of the concept for each detected vulnerability;
• Easy tracking of attack details;
• Risk and probability assessment for each vulnerability;
• Mitigation and recommendations for improvement;

Intranet and Extranet Penetration Test

Penetration testing approach uncovers vulnerabilities that can exist in your networks, creating real-world attack scenarios in a controlled and professional manner.

Our final report contains the results of the identified vulnerabilities in general and a description of the attack development that we follow, which allows your IT staff to prioritize patching up based on the issues that led to the compromise:

• It is easy to follow the attack path;
• Confirmation of the concept for each detected vulnerability;
• Assessment as a list of vulnerabilities;
• Risk and probability assessment for each vulnerability;
• Mitigation and recommendations for improvement;

Penetration Test for Infrastructure and Applications

This test covers cloud infrastructure, apps, and corporate network integration. Our service takes into account the specifics of the cloud infrastructure.

Here is what you can expect:

• It is easy to follow the attack path;
• Confirmation of the concept for each detected vulnerability;
• Threat model approach;
• Risk and probability assessment for each vulnerability;
• Mitigation and recommendations for improvement;
• Social engineering

Checking Office and Personal Belongings for Listening Devices

There are many types and models of listening devices in the market. There are expensive products and primitive devices; many homemade listening devices – it will not be difficult for a specialist to assemble it from the relevant details. Many models require a minimum of skills, and any person who allegedly came to your company on business can disguise a listening device in a few minutes.

We often carry out orders for the inspection of office premises for detecting listening devices, and often such suspicions are correct. But the information obtained using these devices, can result in serious financial losses for the business. And personal conversations should not be made public. That is why we recommend checking the office premises in case there are listening devices.

Listening devices verification of the premises is divided into several stages:

• Visual inspection.
  It helps to install simple "bugs", hidden in inconspicuous, but accessible places.
• Check with special equipment
  It allows to identify listening devices that are embedded, for example, in the wall finish or power lines.
• Dismantling listening devices.

Experience in this area, as well as the availability of appropriate technical equipment, allows us to check the premises in a short time. The accurate period of time will depend on the size of the premises, the complexity of processing, the availability of computer hardware, etc.

How often should the check be conducted?

Checking the premises for the listening devices is required when suspicions arise. For example, you hear unusual noises when talking on the phone. Most often, one check is enough for your detractors to understand the futility of their intentions.

But it doesn’t always happen that way. Therefore, you have the opportunity to run the check if there are the listening devices or order business intelligence periodically, to be confident in your own safety and your business.