Service Overview
This service provides a post-M&A integration cybersecurity assessment aimed at identifying the weakest security points in the newly formed attack surface following infrastructure integration. The objective is to analyze the root causes of identified vulnerabilities and provide cost-effective mitigation recommendations and a risk reduction plan.
Methodology
The assessment is executed in multiple stages using an internal grey-box approach. CYE receives access to the network as a standard employee and attempts to escalate privileges toward predefined targets. The assessment location is pre-selected to ensure value - such as a site containing a data center or R&D team.
Access is granted via remote VPN or a jump box provided by the assessed organization.
The assessment includes the following activities:
Offline information gathering
Threat modeling (including identification of key assets and threat sources)
Interviews with the technical team
Security operations assessment (monitoring, incident response, crisis management)
IT infrastructure and network architecture review, including segmentation and firewall rules
Internet connectivity strategy, internet perimeter and exposed services assessment
Endpoints, mobile, servers, and network equipment policy and configuration assessment
Sensitive data and privacy management
Identity management and remote access assessment
Results summary and analysis
Report construction
Deliverables
The final report includes:
Executive Summary
Overview of activity and results
Infrastructure state analysis
Graphical representation of security evaluation per security domain
Comparison graph against industry benchmarks
Security strengths
Key areas for improvement
Attacker achievements
Methodology
Results Summary
Prioritized asset and threat source lists
Main attack scenarios
Consequences and impact
Detailed list of identified vulnerabilities by risk level
Initial recommendations for short-term and long-term mitigation
Prerequisites
The following items are required before starting the assessment:
Designated point of contact from the assessed company
Definition of crown jewels and their IP addresses
Assessment restrictions (e.g., forbidden assets or activities)
Two sets of domain/user credentials
VPN or remote access and endpoints for internal testing
Customer Engagement
This activity involves limited disruption to the organization, with most work conducted remotely and coordinated with the internal point of contact.
Relevant Standards
MITRE ATT&CK's knowledge base of adversary tactics and techniques
NIST Cybersecurity Framework
Center for Internet Security (CIS) Critical Security Controls
Security Domains Covered
Cross-organization policies, procedures, and governance
Security operations, monitoring, and incident response
Servers, network equipment, and endpoints security
Sensitive data and information management
Identity management and remote access