Incident Response

Compromise Assessment

Compromise Assessments Service Provider – Team Up with Us

Compromise Assessments (aka Threat Hunting) should be a mandatory service, or internal capability, for any organization who takes security seriously. As an experienced compromise assessments service provider, we deploy techniques to reduce the gap between a breach/compromise and detection of advanced adversaries. Even in the case of a past compromise, detecting what and how it happened is key to prevent such events from happening in the future.

However, the benefits of doing periodic Compromise Assessment go beyond this by producing an accurate picture of what “normal” looks like and what “blind angles” exist in the threat detection strategy.

In the threat landscape context of today’s advanced adversarial capabilities, this service is perfect for organizations who may have an MDR service already and want to expand their visibility over the corporate environment to find new, advanced cyber-threats. When companies from the same industry (and/or country) appear in the news for being targeted by cyber-criminals it is highly recommended to show due diligence by performing such assessments of the enterprise network/services.

Detection of Embedded Threats with Latest Methodologies

Before anything, it is important to mention that senior IR consultants with at least five years of IR engagements qualify to be the compromise assessments service provider.

The Compromise Assessment delivered by the Offensive Shield team uses a wide range of DFIR evidence to produce a comprehensive view of the enterprise environment. The detection logic covers:

  • Patterns of known attacks (e.g. MITTRE Att&ck library).
  • Complex algorithms fine-tuned in hundreds of such engagements to detect unknown attacks.
  • Customer specifically tailored detection logic.

The evidence used is log-based (from cloud or on-prem technologies),file-based artefacts, network-based evidence as well as in-memory artefact structures.

Types of Compromise Assessment:

  • Targeted Compromise Assessment – a subset of the Advanced CA, this engagement is more targeted. Examples: assess if the logs of a business application or service (e.g. a web application or cloud service) contain any evidence of attack attempts; analyze all the evidence from a branch office or affiliate/partner environment to find evidence of past or present compromise.
  • Advanced Compromise Assessment – Conducted by Our Compromise Assessments Service Provider, The Method Uses Advanced Threat Intelligence and Includes All Available Network and Host DFIR Evidence to Discover Advanced APTs Activity.

FAQ

? What is the difference between a Compromise Assessment and Threat Hunting?

A
The assurance that comes from the result is the main difference. Threat Hunting aims at finding evidence of attacks in a given set of logs/evidence analyzed, the level of assurance (that there are no active threats in the enterprise) provided can be extremely subjective – depending on the scope and quality of evidence used.

A Compromise Assessment final report needs to answer hard questions such as “is the organization compromised?” or “what are the critical areas to address to ensure the threat detection strategy will not miss an APT”. As such, Compromise Assessment by the very nature of its objectives needs to be very thorough in both scope and depth of the analysis performed.

A
The vast majority of MDR services detection capability rely only on log-based evidence. This is already a major difference in the visibility provided of a CA versus an MDR service. Even more, the quality of the use-cases used in the MDR service depends a lot on the experience of the people involved in delivering that service. As the renowned compromise assessments service provider, we take pride in our team comprising senior professionals who have the experience to handle even the most complex requirements.

A
Our team will immediately notify the customer with all details of the threat and provide recommendations on how to handle the threat. This should result in an Incident Response investigation done either by the customer’s own security team, or by Offensive Shield’s team of IR consultants.

support

GET IN TOUCH!

Feel free to call us at

+44 20 3918 8614Or Email Us!