The Benefits of Letting Us Attack You
A CDW Comprehensive Security Assessment can uncover your organization’s vulnerabilities, so you can address them before cybercriminals do.
Most organizations have experienced the stomach-turning feeling of a security breach. The story generally goes the same way every time: An attacker discovers a previously undetected flaw in a security control and manages to leverage it to compromise other systems. After a lengthy investigation, the organization’s cybersecurity team discovers the root cause of the compromise and corrects it to prevent the same incident from recurring in the future.
Wouldn’t it be great if there were a way to jump off this treadmill and discover how an attacker might gain access to your systems and information before an attack occurs? CDW offers a Comprehensive Security Assessment (CSA) service where our white hat hackers use the same tools and techniques deployed by cybercriminals against your network. The difference is that we’re the good guys, and we use the information we discover during this penetration test to help you improve your network security. You get all the lessons learned that normally result from a security breach without actually experiencing the breach itself.
Our customers tell us that they experience three significant, and sometimes unexpected, benefits when they engage us for a CSA.
1. Identifying Unmanaged Devices That Are Insecure
One of the most common discoveries we make on customer networks is that they often have devices that lack proper security controls and fall outside of normal management practices. We find embedded devices — such as controllers installed by HVAC firms or leased multifunction printers — that run full operating systems but haven’t been patched in years. We also commonly discover appliances that were installed four or five years ago but that nobody’s touched since. These devices are one of the first places we turn when trying to establish a foothold on a target network.
2. Discovering the Extent of Trust Relationships
Once we establish that first foothold, we use our initial compromise as a pivot point to expand our access on the target network. We might begin by obtaining one user’s credentials through a social engineering attack and then use that password to attempt connections to every system and application we can discover. We then repeat that process and continue to accumulate new privileges. Our customers are usually surprised to see how far we get with this approach. In most cases, we’re able to gain administrative access before the end of the assessment.
3. Improving the Cybersecurity Skills of Internal Teams
Our customers often ask us to have their own cybersecurity teams observe the testing, and we’re happy to oblige. Even skilled security professionals learn quite a bit by watching over the shoulder as penetration testing specialists probe a network, gain initial access and pivot from there. Security team members who monitor our tests benefit from knowledge transfer and the ability to calibrate their security tools in real-time to better detect similar attacks down the road.
These benefits are just the start to what our customers gain by undertaking a penetration test of their security controls. CDW offers a customizable menu of testing services, including external probes from the internet, internal testing where CDW staff travel to your site and connect to your local network, and social engineering tests where we evaluate the ability of your staff to withstand phishing attacks.