Triaxiom Security
Partner with us to meet your Information Security needs.
  • About Us
  • Services
    • Penetration Testing
    • Compliance Audit
    • Strategic Consulting
  • Blog
    • Penetration Test
    • PCI Compliance
    • Best Practice
    • Current Events
  • Contact Us
2020 Cyber Security Awareness Month
22 Oct 2020

Cyber Security Awareness Month – 2020

In the spirit of Cyber Security Awareness Month, today we take a look back at useful tricks and tips to help improve your organization’s cyber security awareness. This year, with the pandemic and many employees working from home, cyber security awareness is paramount in keeping your company secure. Remember, you are only as secure as […]

What is a cyber security risk assessment
15 Oct 2020

What is a Cyber Security Risk Assessment?

A cyber security risk assessment can take many forms. In order to determine what sort of assessment is best suited, you first need to define your goals and work backwards to determine the type of assessment required. Today, we will discuss some of the different ways to assess cyber security risk . Below are common […]

pen test
8 Oct 2020

What is Involved in a Penetration Test?

Penetration testing, or pen testing, is essentially hiring a security expert to ethically hack into your organization’s network and tell you what vulnerabilities exist, how an attacker may use them against you, and what the level of risk associated with those vulnerabilities is. Penetration test is commonly shortened to pen test, and the two can […]

Rationalizing the need for a penetration test to a senior leader
6 Oct 2020

Rationalizing a Penetration Test to Senior Leaders

We get it. It can be tough to sell or rationalize a penetration test or one-time security service to senior management that may not be aware of the importance of security for your organization. You are constantly peppered with questions like “can’t we spend our security budget on a blinky box that will protect our […]

CREST Accreditation
1 Oct 2020

Triaxiom Receives CREST Accreditation

Exciting news! Triaxiom has officially become a CREST Accredited Member Company and is now accredited in the Penetration Testing discipline. Becoming CREST certified speaks to the level of expertise, quality, and professionalism that our engineers incorporate into each and every assessment. “CREST is pleased to welcome Triaxiom Security as an accredited member company. Triaxiom Security has been through […]

Haddon Matrix
29 Sep 2020

What is the Haddon Matrix and How Does it Relate to Security?

In this blog, we are going to take a look at the Haddon Matrix to see how it can be used to help us in information security. The Haddon Matrix does not come from the security space, or really IT at all, but rather it is a term used in Injury Prevention. It has since […]

24 Sep 2020

BSides Charlotte is this Weekend!

This Saturday, September 26th, 2020 will be the first virtual (and completely free to attendees) BSides Charlotte event. Since it’s virtual, anyone can attend if you just go and register for the event. It’ll feature 2 free workshops (which are probably already sold out) and a secure coding competition put on by Secure Code Warrior. […]

Penetration Testing Changed During the Pandemic
22 Sep 2020

How Has Penetration Testing Changed During the Pandemic

In today’s blog, we are going to look at how penetration testing has changed during the pandemic. With the increase in users working from home and less reliance on a corporate network, certain aspects of penetration testing have become easier, or more likely to succeed, while others have become much more difficult. We will explore […]

white box vs. black box
18 Sep 2020

White Box vs. Black Box Web Application Penetration Testing

Information Security can be a difficult topic for organizations to understand and communicate about for a variety of reasons, but perhaps none more prevalent than the terminology that gets thrown around. As such a dynamic and fast-moving industry, it can be hard for inside veterans to get on the same page about certain topics, much […]

Tips to improve your incident response tabletop exercise
15 Sep 2020

Tips to Improve Your Incident Response Tabletop Exercise

Incident response tabletop exercises are a great way to mature your overall security posture. As with most mock exercises, the more thought and effort you put into the execution, the more you will ultimately get out of it. Today, we explore tips to help improve your next incident response tabletop exercise. 1. Treat it Like […]

«‹ 4 5 6 7›»

Looking for something specific?

Join our Newsletter!

Don’t be left in the dark. Enter your email below and become part of our newsletter. We promise not to spam you!

Recent Posts

  • CBBHHTB CBBH – Course and Exam Review
  • OSINT - Open Source IntelligenceWhat Your OSINT Says About You
  • Bypass Duo MFA for RDPBypass Duo MFA for RDP

Categories

Most Discussed

API Penetration Test Best Practice Checklist Cloud Common Vulnerabilities comparison COMPLIANCE configuration review Core Values Cost Current Events Education External Penetration Test firewall HIPAA improvement Incident Response Internal Penetration Test methodology Onsite Assessment Passphrase Passwords Password Security PCI PCI DSS PCI QSA penetration test Physical Penetration Test Problems QSA Quick Tips Regulation Remediation Report Risk ROC SAQ Security Awareness Small Business SMB Social Engineering vetting vulnerability Web Application Penetration Test wireless
Back to top
Triaxiom Security
© 2024 Triaxiom Security, LLC. All rights reserved.
Privacy Policy
NIST Gap Analysis

Our gap analysis is an interview-driven process which comprehensively explores your current security policies, procedures, and techniques. We’ll find the gaps in your NIST/DFARS compliance, and provide a roadmap for meeting your compliance objectives.

Some of the topics our interviews will cover include:

  • Physical security
  • Security assessments
  • Systems and communications protections
  • Access controls
  • Audit and accountability
HIPAA/HITECH Gap Analysis

This assessment involves a comprehensive audit on all the ways electronic protected health information (ePHI) is stored, processed, or transmitted on your network. A HIPAA/HITECH Gap Analysis will be a complete audit of your organization’s:

  • Physical safeguards
  • Administrative controls
  • Technical controls
  • Security policies and procedures
  • Organizational requirements
  • Breach notification & incident response
GDPR Gap Analysis

Our gap analysis is an interview-driven process which comprehensively explores your current security policies, processes, and infrastructure against General Data Protection Regulation (GDPR) Requirements. After evaluating the scope of your environment, and the privacy data that is stored, processed, or transmitted throughout your environment, Triaxiom will evaluate your organization’s compliance posture, identify any shortfalls, and provide tailored recommendations to boost your security posture and meet compliance requirements. Topics include:

  • Utilizing the NIST Cybersecurity Framework (CSF) Triaxiom will evaluate your organization’s ability to provide an “reasonable” level of security to any personal data storage and processing, per GDPR Article 32.
  • Evaluate your organization’s incident response process to ensure the ability to identify and contain ongoing attacks. Additionally, we will evaluate the organization’s data breach notification policy and procedures required in the event of an incident.
  • Review the collection, transportation, and destruction of data from EU Citizens to ensure consent, right of access, right to rectification, right of erasure, right to restriction of processing, right of data portability, and right to object are met.
  • Audit the processes in place for ensuring third-party compliance with GDPR. This includes the evaluation of third-party compliance, outline of responsibilities to third parties, and breach notification requirements.
PCI DSS

 

Level 1 Merchants and Service Providers

Triaxiom is a PCI Certified Qualified Security Assessor (QSA) organization. As such, we are certified by the PCI Council to perform your QSA On Site Assessment for Level 1 Merchants or Service Providers.  Our consultants have conducted countless PCI Compliance Assessments, filling out numerous Reports on Compliance and Self Assessment Questionnaires for organizations across a wide variety of industries.

Level 2, 3, 4 Merchant and Service Providers

Lower level merchants and service providers can leverage a Qualified Security Assessor (QSA) to assist them with determining their scope, what PCI requirements pertain to their organization, and assist with filling out their applicable Self Assessment Questionnaire (SAQ). Further, the SAQ will reflect that you had a QSA assist you, demonstrating to your clients and merchant bank that you had an unbiased third-party assess your compliance.

Formal Risk Assessment

A formal risk assessment evaluates the threats to your organization, the vulnerabilities of your network, and the security controls you have in place to protect your network. A risk assessment correlates information from your security assessments and evaluates the overall risk to your organization to help drive strategic decisions.

Best Practice Gap Analysis

Our best practice gap analysis is an interview based review of your information security program. We use the Center for Internet Security (CIS) Top 20 Critical Security Controls to comprehensively review all aspects of your information security program. Some of the areas covered include:

  • Inventory and asset management
  • System hardening
  • Account management and principle of least privilege
  • Disaster recovery and continuity of operations
  • Incident response

Customized Security Consulting

Have a need not mentioned? Contact us today to customize an assessment or package to meet your security needs. Our engineers have a wealth of experience performing a wide variety of assessments, and we’re confident they can meet your needs. Let us know how we can help.

Incident Response and Malware Analysis

When you suspect you have been breached, knowing exactly how it happened and what was affected can be difficult to discern. Our certified engineers can assist you with the incident response process, ensuring the malware is removed and normal business operations are restored. Moreover, our root-cause analysis will attempt to determine how the breach was possible and steps to take to prevent it from happening again. Moreover, we will evaluate the malware including:

  • Open-source intelligence – We will evaluate the hash and any unique strings in the malware to see if they match known-malware signatures.
  • Reverse-Engineering – Where possible, we will recreate the incident with advanced process monitors and determine the exact malware behavior.
  • Log Analysis – Using the information gathered, we are now able to analyze the logs of affected devices to determine if the breach spread to other machines.

Security Policy Review and Creation

Comprehensive security policies written by security professionals. Our policies are designed to meet your compliance needs while optimizing your business requirements. Some of the policies we can help with include:

  • Access Control Policy
  • Acceptable Use
  • Disaster Recovery Plan
  • Password Policy
  • Incident Response Plan

Internet of Things Security Assessment

Developing a secure IoT solution depends on a number of security considerations. This assessment will evaluate the IoT device and its associated infrastructure against common attacks. It can include an evaluation of the edge device, the gateway, the cloud infrastructure, and/or any mobile applications. Our engineers will evaluate your IoT Device utilizing the OWASP IoT Framework Assessment methodology.

Cloud Security Assessment

This assessment is an evaluation of your organization’s cloud infrastructure for security vulnerabilities. Our engineers will assist you in evaluating the unique security responsibilities associated with cloud computing. Individual services can include cloud application assessments, cloud infrastructure penetration testing, host/OS configuration audits, and cloud architecture reviews.

Best Practice Gap Analysis

Our best practice gap analysis is an interview based review of your information security program. We use the Center for Internet Security (CIS) Top 20 Critical Security Controls to comprehensively review all aspects of your information security program. Some of the areas covered include:

  • Inventory and asset management
  • System hardening
  • Account management and principle of least privilege
  • Disaster recovery and continuity of operations
  • Incident response

Password Audit

During a password audit, our engineers will evaluate the strength of passwords currently in use in your organization. We will take a dump of your employees’ hashed credentials and run them through a password cracker to identify weak passwords and common usage patterns. This audit can be used to justify stronger password policies, used in security awareness training to improve password choice among employees, and used to help understand the organization’s overall risk if an attacker is able to capture hashed credentials.

Firewall Audit

A firewall audit is a manual inspection of your firewall using the Center for Internet Security (CIS) benchmark and device-specific best practices. In addition, our engineer will review the firewall rules, searching for overly specific rules, proper rule sequencing, or other gaps in your security posture. Finally, the firewall audit will include network scanning to validate its effectiveness.

Host Compliance Audit

A host compliance audit involves the manual inspection of a workstation, server, or network device using the Center for Internet Security (CIS) benchmark and device-specific security best practices. This assessment will identify the security holes in your system and provide specific actions to take to harden the device.

Vulnerability Scanning

Vulnerability scanning is a regular, automated process that identifies the potential points of compromise on a network. A vulnerability scan detects and classifies system weaknesses in computers, networks and communications equipment and predicts the effectiveness of countermeasures. Our engineers will conduct this scan for you and use our expertise to remove false positives and produce a risk-prioritized report.

Physical Penetration Test

A physical penetration test is an assessment of the physical security of your premises. Our engineers will attempt to gain access to your facility by identifying weaknesses and/or using social engineering. Once inside, our engineers will attempt to gather sensitive information, gain access to sensitive areas such as the data center, and attempt to gain internal network access.

Social Engineering Assessment

This assessment is designed to target and take advantage of the human-element to gain access to your network. This is done using a variety of methods to get an employee to click on something they shouldn’t, enter their credentials or otherwise provide them when they shouldn’t, or divulge information that may assist an attacker in breaching your network. The goal for the engineer performing this assessment is to gain information that may assist an attacker in future attacks, gather credentials, or gain a foothold on the internal network. This assessment will include:

  • Phone-based attacks
  • Spear phishing attacks
  • Bulk phishing attacks

External Penetration Test

An external penetration test emulates an attacker trying to break into your network from the outside. The goal of the engineer performing this assessment is to breach the perimeter and prove they have internal network access. This test includes:

  • Open source reconnaissance against the organization
  • Full port scan covering all TCP ports and the top 1,000 UDP ports of the targets in scope
  • Full vulnerability scan of the targets
  • Manual and automated exploit attempts
  • Password attacks

Internal Penetration Test

An internal penetration test emulates an attacker on the inside of your network. This could be either an attacker who is successful in breaching the perimeter through another method or a malicious insider. The goal of the engineer in this module is to gain root and/or domain administrator level access on the network, and gain access to sensitive files. Activities include:

  • Active and Passive network reconnaissance including traffic sniffing, port scanning, LDAP enumeration, SMB enumeration, etc.
  • Vulnerability scan on all in-scope targets
  • Spoofing attacks such as ARP cache poisoning, LLMNR/NBNS spoofing, etc.
  • Manual and automated exploit attempts
  • Shared resource enumeration
  • Password attacks
  • Pivoting attacks

Wireless Penetration Test

A wireless penetration test is a comprehensive evaluation of the wireless networks in your organization using automated and manual methods. Areas covered include:

  • Password attacks
  • WEP/WPA cracking
  • Guest wireless segmentation checks
  • Traffic sniffing attacks
  • SSID spoofing
  • Rogue access point discovery

Web Application Penetration Test

A web application penetration test is an in-depth penetration test on both the unauthenticated and authenticated portions of your website. The engineer will test for all of the OWASP Top-10 critical security flaws, as well as a variety of other potential vulnerabilities based on security best practice. Activities include:

  • Website mapping techniques such as spidering
  • Directory enumeration
  • Automated and manual tests for injection flaws on all input fields
  • Directory traversal testing
  • Malicious file upload and remote code execution
  • Password attacks and testing for vulnerabilities in the authentication mechanisms
  • Session attacks, including hijacking, fixation, and spoofing attempts
  • Other tests depending on specific site content and languages

Contact Us