The number one reason you are spending money on Cybersecurity is to?

Q.) What is the number one reason companies are spending money on cyber security?

A.) It is, to keep the bad guys out.

Q.) How do most companies go about trying to prevent the bad guys from getting in?

A.) They spend money on defensive security technologies designed to keep the bad guys out.

Q.) How many companies know that the technologies they deployed are effective?

A.) Very few.

These simple questions and their answers categorize how most companies approach cyber security. They pile money on the latest trend in defensive security hoping that it works as good as the manufacturers’ marketing does. Most often this approach gives a false sense of security. They reason that the technology purchased is a big box brand that costs allot of money so it “must” be a good solution. That is where most companies make a grave mistake.

The truth is a lot of it is marketing hype, designed to sell you a “sense of security”, while in fact it may not be doing the job you hoped it would. Asking the vendor if it is working is going to get you an affirmative answer. Asking them to verify it usually gets you nowhere. Even if they offered, wouldn’t it be like scoring one’s own report card?

In the scenario above you are left having to believe that all is well. Life goes on, time goes by and then it happens, you experience a breach. Panic ensues, triage begins, and damage control follows. This is a cycle we’ve witnessed for nearly 28 years in cyber security.

Why does this happen? How can it be avoided?

Simply put, people put too much trust in defensive security technologies without verifying or validating that it is functioning as designed or implied. Period.

Consider the first question asked in the article, “What is the number one reason companies spend money on cyber security?” and the answer “To keep the bad guys out.”

The reason this question is asked is to put things into perspective. If the mission is to keep the bad guys out and you’ve never considered how and where they get in, what techniques they use, and in some cases how easily bypassed some big box defensive

security technologies are, you may realize that you should ask a “good” guy that knows how bad guys does their dirty work.

The right person for the job

You would not ask your plumber to fix your transmission; you would take it to a shop that specializes in transmissions. For the same reason, when you want to ensure that you’ve identified all the weaknesses in your infrastructure that a bad guys can leverage, you should consider an “expert” in offensive security. Not your IT guy, not your system or network admin who may dabble in security, and or who may be somewhat bias and unaware of any blind spots.

The most important “Point in time audit” you may have.

But a penetration test is “just a point in time” test, many may logic, but so is a full physical health exam… They will both tell you the condition or state you or your organization is in and either one could prevent a terrible outcome.

Your physician may require a CT scan, an MRI or blood work. He or she most certainly will ask a lot of questions so that they can prescribe treatment or a remedy. The same thing can be said about a comprehensive penetration test.

Through the course of scoping a penetration test, we will ask questions related to your infrastructure, to determine the best approach and to provide maximum coverage. In our discussion, we will discuss internal, external, cloud, wireless, web application, source code and mobile applications if applicable, to fully understand the attack surface and to assign subject matter experts to each network segment included in the engagement.

We will discuss a social engineering approach, we will discuss end point security, IDS, IPS, SOC, NOC and every aspect of security controls you have. We ask this not to gain an unfair advantage, rather we ask so that we can plan the most effective and comprehensive engagement in a compressed timeline, because we recognize that budget constraints are real.

The deliverable.

We do not check boxes, we produce results with action plans and remediation.

We will provide insight as to how a bad guy may leverage existing technologies, as well as report on existing technologies that are effective so you can justify the money spent.

The report is where, as they say, “the rubber hits the road”. Our report will tell you what we found, how we found it, and why we found it. Your report will be the roadmap

you need to follow to ensure that all gaps are closed, all leverageable vulnerabilities are identified with remediate recommendations.

Cheaper than you think

The kicker in all of this? A comprehensive penetration test will likely cost less than the technology you have in place that you assume is working.

Our message is direct. Bad guys want to get in, you want to keep them out, and we can help.

Consider booking a 30 minute free consultation with our management to determine a path forward to begin to validate all the time, money and effort you have put into your security.