Managed Vulnerability Assessment and Remediation
Long-Term Protection of Your IT Ecosystem
With 33 years in IT and 19 years in cybersecurity, ScienceSoft offers end-to-end vulnerability management services. We help midsize and large organizations in 30+ industries keep their IT environments free of security and compliance gaps.
Vulnerability management as a service is aimed to provide continuous protection of the entire IT landscape (policies and procedures, networks, applications) to detect and eliminate security and compliance gaps as soon as they appear. It offers a consistent approach as well as a tailored set of skills and tools to keep your changing IT environment reliably protected at any point in time.
Do you need vulnerability management services?
While consistent vulnerability management is part and parcel of any mature security program, it can be a lot to handle on your own. Fully outsourcing your vulnerability management to an expert security vendor will likely be a wise investment if:
- Your IT environment is growing bigger and more complicated, with the tech stack getting more diverse.
- Your company experiences regular intrusion attempts.
- Your company operates in a highly regulated field and needs to protect sensitive data.
Internal procedures
- Security policies: incident response plan, access control policy, remote access policy, change management policy, and more, depending on your business specifics and IT environment.
- Cybersecurity awareness among your employees.
Network security
- Endpoints: PCs, laptops, mobile devices.
- Email services.
- Security solutions: firewalls, IDS/IPS, network access controls, DLP systems, VPNs, SIEM, IAM.
Application security
- Web apps.
- Mobile apps.
- Desktop apps.
Data security
- Data repositories.
- Data encryption.
- Data backup.
- Data transfer.
|
|
|
|
|
|
|
Dmitry Kurskov, Head of Information Security Department at ScienceSoft, says: Applying cybersecurity measures once and forgetting about them forever is not a viable strategy. A corporate security system should be regularly monitored, assessed, tested, and improved. |
|
|
|
|
Cyber Threats We Keep Away
Viruses, worms, and trojans
Ransomware
DoS attacks
Phishing
Code injections
Man-in-the-middle attacks
Spyware and keyloggers
Advanced persistent threats
Identity theft
Unauthorized access
Insider attacks
Compliance breaches
Internal and external network vulnerability scanning
- Creating a comprehensive list of network targets to assess: e.g., servers, workstations, connecting devices, firewalls, etc.
- Configuring a vulnerability scanning tool: enlisting the target IP addresses, setting up the aggressiveness level of the scan, its duration, and completeness notifications.
- Scanning the network.
- Analyzing the scan results and filtering false positives.
- Compiling a report on the discovered vulnerabilities and the needed corrective measures.
SAST – automated source code review
- Analysis of the apps’ tech stack.
- Manual configuration and running of automated code scanning.
- Manual validation of the findings to remove false positives.
- Providing a report on the detected security flaws and a remediation plan.
- Defining the testing scope and approach (black, gray, white box).
- Investigating the ways for a potential attacker to break into the system.
- Documenting the discovered vulnerabilities and assessing the potential damage they may cause.
- Reporting on the findings and providing a remediation plan.
- Collecting the data about the company and the targeted employees from publicly available sources: e.g., online publications, social media.
- Preparing the content for phishing messages.
- Attempting phishing attacks at the target employees.
- Reporting on the results and outlining the necessary measures (e.g., training) to enhance cybersecurity vigilance among employees.
Database security assessment
- Assessing data sensitivity and criticality to define the potential data risks.
- Evaluating the database security controls: user access and privileges, data encryption, database configurations, etc.
- Reviewing the database procedures: e.g., database activity monitoring, data backup, data masking.
- Reporting on the detected security gaps and suggesting the needed remediation measures.
- Reviewing the established compliance-related cybersecurity policies and procedures.
- Reviewing the IT infrastructure, IT operations, and software that may affect compliance.
- Performing compliance gap analysis and reporting on the detected issues.
- Defining and prioritizing the remediation steps needed to achieve compliance.
Security policy review
- Detecting the missing or insufficient security policies.
- Improving your existing policies or designing new ones from scratch to fully cover the security measures needed to keep your IT infrastructure protected.
Why ScienceSoft
- 19 years in information security, 200+ successfully completed cybersecurity projects.
- A structured approach to managed security services based on more than 14 years of ITSM experience.
- 62% of our revenue comes from long-term customers that stay with us for 2+ years.
- An IBM Business Partner in Security Operations & Response since 2003.
- Experienced security engineers, compliance consultants, and Certified Ethical Hackers on board.
- ScienceSoft’s QLEAN App Suite is a finalist of the 2021 IBM Beacon Award for Outstanding Security Solution.
- A mature quality management system and full security of the data entrusted to us are proven by ISO 9001 and ISO 27001 certificates.
- ScienceSoft USA Corporation is listed among The Americas’ Fastest-Growing Companies 2022 by Financial Times.
Success Stories
AWS Cloud Security Assessment and Recurring Infrastructure Pentesting for a US Insurance Company
As a part of a long-term cybersecurity partnership with a US insurance company, ScienceSoft performed two annual penetration tests of its IT infrastructure and conducted a security assessment of the Customer’s AWS cloud assets. Following ScienceSoft’s guidance, the Customer was able to achieve and maintain a high level of security in its IT environment.
Network Vulnerability Assessment for a US Mobile Services Provider
As a result of a network vulnerability assessment for a US mobile services provider, ScienceSoft revealed over 300 security issues, including critical ones that could lead to the disclosure of sensitive data. Following ScienceSoft’s remediation guidance, the Customer was able to fix the detected flaws and prepare for PCI DSS validation.
IT Infrastructure Security Testing for an Asian Retail Bank
As part of a comprehensive vulnerability management program, ScienceSoft performed vulnerability scanning and network penetration testing for an Asian retail bank. Our team also conducted a security risk assessment of the Customer’s digital channels and ran a phishing campaign.
API Security Testing for a European Bank
As part of regular penetration testing services provided to a European bank with 100+ branches, ScienceSoft checked the security of a newly launched API and provided detailed guidance on how to remediate the found vulnerabilities according to best security practices.
Penetration Testing of the Network and Web Applications for a Mobile Operator
ScienceSoft tested 5 web applications and the external network of a mobile operator and delivered a remediation plan to eliminate the revealed security issues. We also designed a set of strategic measures to secure the Customer’s IT assets and the sensitive data of its clients in the long run.
Fixed price
You pay for a specified number of vulnerability assessment cycles a year.
Best for: Companies with well-established IT environments that want to test their security against emerging threats and reinforce their reputation as a secure business by undergoing regular security checks.
T&M
The frequency and scope of vulnerability assessment are agreed on individually.
Best for: Companies with dynamically changing IT environments that are experiencing rapid expansion or digital transformation.
Why Does Your Business Need Consistent Vulnerability Management?
According to Redscan research:
All about Cybersecurity
Services
Penetration Testing
IBM QRadar Tools: Deployment & Environment
Security Testing
Vulnerability Assessment
Managed Vulnerability Assessment
IBM QRadar Tools: Analytics & Reporting
IBM QRadar Tools: MITRE ATT&CK
Compliance Services
Security Assessment
Security Information and Event Management
IBM QRadar Tools: Data Integration