Service overview
Intruders know how to go unnoticed inside an infrastructure for months. It is possible that a compromise could occur before monitoring is implemented, and intruders could leave little to no traces. So, even if it seems quiet on the SOC front, the risk of a real threat can still persist.
Compromise Assessment is a detailed inspection of your infrastructure for signs of a breach and traces of an intruder. For this, we apply both automated and manual methods
When you might need the service
Suspected breach
Identify signs of compromise, determine the attack vectors, and minimize the damage
Low cybermaturity
Uncover hidden threats and vulnerabilities that may have gone unnoticed due to insufficient cybersecurity measures
Mergers and acquisitions
Reduce the risks of acquiring a company with overlooked incidents or vulnerabilities in its IT infrastructure
Audit or inspection
Identify and eliminate potential problems, and ensure compliance with standards and regulations
New CISO
Familiarize the new CISO with the state of the infrastructure
Project stages
1
Collection of current and retrospective data within the infrastructure and from external sources
2
Data analysis: automated (TI, MDR) and manual (threat hunting), incident classification
3
Investigation of detected incidents
4
Reporting with incident classification, detailed description, and cybersecurity guidance
How it works
- EDR receives data from endpoints
- Retrospect Module collects syslog data about network connections and security solutions from NGFW
- Brand Protection aggregates external data about leaks and potential threats
- EASM scans the external perimeter for vulnerabilities
- Threat Intelligence analyzes a database of more than 50 million relevant indicators of compromise
- EDR uses over 2,000 automated detection rules for suspicious activity
The service also includes threat hunting where we manually search for threats and anomalies in the infrastructure
Advantages
Entire infrastructure check
We leverage EDR for automated data collection and analysis to assess the entire infrastructure or its significant portion rather than individual critical hosts
Identifying misconfigurations
In addition to detecting possible compromise, we identify misconfigurations that may cause future intrusions
No third-party vendors
We utilize our own EDR solution which enables flexible adaptation to the specific features of any infrastructure
Quick response
We quickly detect signs of a breach and eliminate it as soon as possible, switching to 24/7 operation in case of an active infection
Threat-centeric approach
We focus on the most widespread threats by leveraging the information from the Threat Intelligence portal, which houses threat data relevant to your industry and geography
Comprehensive analysis
We monitor endpoints, network activity, antimalware logs, vulnerabilities at the perimeter, and attacker activity on the darknet
You might also need
