Security Services

Threat Discovery

Endpoint Security

Project Security

SANS 20 Assessment

Incident Report

IoT Security

Enterprise Information Security Architecture Masterplan

Our EISA masterplan focus on I.T security throughout an enterprise and consists of the implementation of recommended best practices for an organization’s infrastructure, accordance with regulatory requirements and standards as well as a DNA survey (identifying users with privileged access and assessing their risk of causing a security breach).

IoT Security Assessment

Organizations need to bear in mind the associated hardware, the software, and the communication protocols in use for any IoT security assessment. An IoT assessment requires the ecosystem for a specific IoT technology to be thoroughly mapped and a detailed assessment plan to be developed. The elements of technology in any given IoT system can be different in architectures, operating systems, communication protocols, etc.

Assessing the security of an IoT technology includes strengthening the endpoint device security, protecting against unauthorized usage, avoiding elevation of privileges, reducing the risk of compromise, better user and data privacy, and strong encryption to avoid man-in-the-middle (MTM) attacks.

Understanding the complexities of the environment, adequate research of components, and development of a thorough assessment plan are the keys to success for securing the IoT. Secdoyen can help develop a risk assessment process to integrate into your IoT project initiatives, so your organization can identify and mitigate the risks before a threat agent takes advantage of the vulnerabilities.

Application Security

Protecting an organization’s most valuable assets and the data within them is integral to every organization’s operations. Secdoyen consultants help prioritize remediations, review migration proposals, provide manual penetration testing and launch a secure application.

Mobile and Cloud Security

Assessing present or anticipated exposure to information security risk
Penetration testing including misuse and unauthorized use
Attacks simulating Real-world Network, OS and app-level to provide insight
Secured Cloud solution design that achieves risks minimization
Mobile Security controls solutions based on mobile device use cases
Application of policies and processes to mobile programs

Project Security Assessment

A PSA is performed to assess the potential risk(s) introduced into the organization either by taking on a new IT project or by incorporating changes into an established IT solution project. The PSA process is ideally initiated either before or during the architectural stage of a project.

A security risk assessor is assigned during the initial concept/architectural stage of a given project to develop the appropriate security profile. The risk assessor continues to work with the project team until delivery, ensuring any potential risks are identified and therefore addressed accordingly.

The output is the Project Security Assessment (PSA) report. The goal is to determine whether the project addressed will introduce new risks to the organization’s IT infrastructure. This serves to inform the management about the overall risk and to implement safeguards or risk-mitigating measures. We have established a PSA process based on best practices driven from industry known standards.

Web Application Runtime Assessments

Examine access rights in the organization as a weapon against:

- Data, identity, and session thefts
- Backdoor mechanisms, the strength of mechanisms, compartmentalization of access rights, unauthorized data access, and system data loss checks.

Testing includes system defense checks against:

- - Hidden Field Manipulation
  - SQL Injections
  - Cross-Site Scripting
  - Cross-Site Request Forgery
  - Parameter Tampering
  - Buffer Overflow
  - Session Hijacking
  - Cookie Poisoning
  - HTTP Parameter Pollution
  - Command Injection

Wireless Assessment

Secdoyen identifies the wireless infrastructure components that can be discovered and the security mechanisms enforced on each node. Our approach is to conduct a combination of black-box and white-box testing. We start by completing a site survey, where we use high-powered wireless equipment to locate access points. We then map the wireless infrastructure presence and identify and detect vulnerabilities within the wireless spectrum. We offer a verified set of deliverables and reporting following this assessment.

Vulnerability and Penetration Testing

Despite every organization’s attempt at implementing a thorough cyber-security infrastructure, attacks are inevitable and expected. Secdoyen’s vulnerability and penetration testing service exposes an organization’s weakness before potential attackers can exploit them.

Our vulnerability assessment consists of identifying potential risks and documenting findings to formulate a strategic plan based on an organization’s needs. This differs from our penetration testing service which is an authorized simulated cyberattack on an organization’s I.T infrastructure to evaluate the security of the system.