We know that identifying and prioritising risk puts us in the driver’s seat, and we know that the deployment of risk-based controls avoids wasted time and money, putting resources and budgets where they are most needed. But designing and deploying controls are only the first two parts of a successful cyber strategy and there is a third facet to be considered: Verification.
Controls must be verified to confirm they’re effective, resilient, and they continue to deliver as your risk identification and prioritisation matures. Without continuous (or at least frequent) verification, controls that worked in the past may later be found to offer little more than a false sense of security.
For over 25 years, dotSec has provided penetration testing services for a wide range of corporate and government organisations, but what makes dotSec’s pen tests unique?
Surprise: dotSec’s pen testers don’t just do pen testing!
Instead, our pen testers can build things like AWS-hosted services, IAM systems, they have system hardening skills, and they rotate through roles including EDR and SIEM analyst. All of this makes dotSec’s testers uniquely experienced to provide you with prioritised strategies that are practical and reasonable to implement.
Phishing remains the most frequent form of social engineering, but attackers increasingly diversify their methods to bypass technical safeguards and target human vulnerabilities.
Social engineering tests will help verify the effectiveness of your social engineering and security-awareness training controls.
Equally importantly, social engineering exercises will also help you to comply with requirements from recognised frameworks and standards such as ISO/IEC 27001 (A.6.3), PCI DSS (12.6), and the Australian Information Security Manual (ISM) user education controls.
A Capability Maturity Assessment measures how well your security processes and controls are designed, managed, and improved over time, helping you benchmark against standards and build a roadmap for improvement.
Our assessments are generally (depending on customer requirements; the NIST CSF is another option) conducted with reference to selected controls from IT security frameworks and guidelines such as the CIS Critical Security Controls (v8.1), ISO/IEC 27002:2022, and the Australian Privacy Principles (APPs), but the NIST CSF and ASCS Essential Eight are also useful in some circumstances.
A Cyber Security Tabletop Exercises (TTXs) is a highly interactive and engaging activity, that is designed to test your organisation’s incident response plan, capabilities and processes.
A TTX provides a safe and controlled environment for the organisation to practise it’s incident detection, containment and response strategies, and identify areas of weakness that need to be addressed.
By conducting TTXs, your organisation can test it’s incident response strategies and practices, without the interruption and cost associated with an adversary emulation test.
