Cybersecurity Services

Continuous Vulnerability Scan is an important vulnerability management component and an integral part of threat modeling. It provides a vendor-neutral vulnerability security risk baseline that is essential in closing cyber risk gaps and alignment with regulations.

Our vulnerability risk scan relies upon widely accepted industry standards (PTES technical guideline and OWASP testing guide). PreCog Security vulnerability scan report contains a description of the vulnerability, its location, and suggested mitigation steps.

Security testing is important for all organizations to help them understand present security posture, risk and threat exposure. It provides a starting point and vendor-neutral security baseline that can be the foundation to build your security practice, allocate resources, close security gaps and align with regulations.

PreCog Security team leverages open source and commercial tools to discover potential vulnerabilities that could be exploited by automated bots and attackers in applications or networks. Depending on the specific task, language or system at hand, we utilize dynamic and static analysis tools and vulnerability scanners to identify and assess vulnerability bugs easily.

Our vulnerability risk scan relies upon widely accepted industry standards (PTES technical guideline and OWASP testing guide). PreCog Security vulnerability scan report contains a description of the vulnerability, its location, and mitigation steps.

PreCog Security’s penetration testing approach is focused on optimizing the conducted tests and the time that is available to uncover security vulnerabilities in the testing object. We custom tailor our testing to discover vulnerabilities that could have the most potential risk and impact, regarding a possible threat scenario, optimized for the ease of discovery by a third party. This enables us to discover vulnerabilities that have the biggest possible damage on the system but are practical and realistic according to the threat model of the testing object. We work closely with your network, DevOps and security teams during and after the testing.

Our penetration testing methodology follows is aligned with industry standards (PTES technical guideline and OWASP testing guide). PreCog Security penetration testing report contains a description of the vulnerability, its location, and in-depth mitigation steps with our engineers.

“The cost of removing an application security vulnerability during the design phase ranges from 30 to 60 times less than if removed during production” NIST, Gartner and IBM.
Integrating security in the existing DevOps teams and system is a complex, yet critical method that requires disjunct skillsets. We typically suggest starting with three roles and three (or more if possible) candidates. The candidates can be recruited inside the current teams if specific members want to be more security-focused, or we can recruit horizontally or vertically from inside the organization. The common goal is internal expertise development with specific security roles that will cover the areas of:
– Governance and architecture
– Application development
– DevOps and infrastructure

Secure code is developed by developers who are security conscious and have the required skillset to write secure code. In order to achieve this, all developers need to be trained in secure development practices. PreCog Security created unique application security training for dynamic and growing development teams. There are two parts to it: Initial AppSec training for the entire team covering the entire class of common AppSec vulnerabilities defined by the current OWASP Top 10 list, and DevSecOps training for the entire team covering the domain of DevSecOps (CI/CD, DevOps, systems hardening, secrets management, API security).

As businesses are racing to innovate and streamline their operations, so is the quest for the adoption of cloud services. Yet, these present major cybersecurity and compliance risks. Implementing cloud security best practice covers multiple information security areas of your environment and business. Gartner estimates that “through 2022, at least 95% of cloud security failures will be the customer’s fault.” The question is no longer “Is Cloud secure?” but “Am I using Cloud securely and properly?” PreCog Security team advises customers to fully understand the shared security model that most cloud vendors provide. It is imperative to understand where cloud vendor’s security starts and where it is customers’ responsibility to implement security cloud security controls internally.

Entering into a business relationship with a Fortune 500 company or a large client (buyer) can produce an incredibly complex procurement for a vendor (supplier, startup). When purchasing products or outsourcing managed services for core operations it can expose an organization (buyer) and its customers to security risks leading to intentional or unintentional incidents impacting the continuity of electronic communications services. In order to prevent or mitigate such security risks, organizations (buyers) have the opportunity to apply specific security requirements through their internal Third-Party Risk Management to their suppliers or outsourcing partners.

Compliance readiness, implementation of processes and documenting relevant procedures can separate startups with enterprise client revenue vs struggling bootstrap startups. Our team is highly trained to evaluate your organization’s readiness to adapt and respond to new regulations and communicate them successfully across all your teams and BUs. At the same time, we intend to highlight information security and operational security best practices whether you are at the beginning of your compliance journey or well ahead. Our goal is to assist you to run an information security management system (ISMS) according to ISO 27001/ISO 27002 and align to other compliance requirements such as GLBA, FINRA, SOX, GDPR as well as SOC1 and SOC2. This includes defining and writing procedures, best practices and help with implementing organizational and technical controls that are mandated by ISO 27002 or NIST 800 series. We provide a fully tailored service according to your threat model, risk profile, and specific organizational issues.

When analyzing the security maturity of any organization, one of the most important stages of information security management is the identification of threats and risks. In order to be precise in this identification, multiple approaches are used, depending on the level of assessment or the required focus and rigor. In practice, unfortunately only limited and few types of actual engagements are practiced which in turn does not enable the organization to perceive real risk or to prepare its security mitigation strategy in an appropriate way. This results in an increased number of data breaches and successful exploitations by cyber criminals and other parties.

PreCog Security team focuses on performing a guided audit or test against an organization or a testing object. For example, this approach can include performing an audit and developing process according to ISO 27001 for an organization or verifying the security level of an application according to OWASP ASVS (Open Web Application Security Project – Application Security Verification Standard). When a company wants to simulate a realistic threat against a system and find vulnerabilities, it is suggested to perform penetration testing on an application, network or organization. The result is that the company simulates an attacker of a certain skill level, and aligns hired testers to that same skill set of an attacker in order to discover vulnerabilities or risks.

Our approach for strategic risk assessment and analytical red teaming takes a blended approach with three critical areas and phases:

Phase 1 – Baseline Assessment and Identification (where is the organization now)
Phase 2 – Customized Risk Framework Development (where the organization wants to be)
Phase 3 – Implementation of Risk Framework (how the organization is doing)

Supply chain security and red teaming involve the assessment of an organization’s ability to detect and respond to a real-world breach event. As corporate and software development environments evolve with the adoption of new technologies such as (cloud, microservices, containerization, and Kubernetes) so does PreCog Security focus on performing a guided audit or test against an organization or a testing object.

This approach can include performing an audit and developing a process according to ISO 27001 for an organization or verifying the security level of an application according to OWASP ASVS (Open Web Application Security Project – Application Security Verification Standard). When a company wants to simulate a realistic threat against a system and find vulnerabilities, it is suggested to perform penetration testing on an application, network or organization. The result is that the company simulates an attacker of a certain skill level, and aligns hired testers to that same skill set of an attacker in order to discover vulnerabilities or risks.