Trofi Security Service Catalogue (1)
1 like542 views
Trofi Security offers various cybersecurity services including penetration testing, risk assessments, compliance services, and virtual CISO services. They perform three levels of penetration testing - black-box, white-box, and red team testing - with black-box testing simulating external attacks with limited prior knowledge, white-box incorporating internal knowledge, and red team involving social engineering. Trofi Security also provides compliance services for frameworks like PCI, ISO 27001, HIPAA, SOC 2 and others to help organizations implement security programs and prepare for audits.
Trofi Security Service Catalogue (1)
- 1. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity | trofisecurity.com We Know Security. We Know Compliance. Let Our Expertise Be Yours. TrofiSecurity.com Optimizing Your Information Security Investments. Service Catalogue
- 2. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY Every day new threats arise from both expected and unexpected sources – cyber-attacks on your network, social engineering attempts against your users, lost or stolen devices, accidental sensitive data leakage and even malicious insiders. Trofi Security offers organizations the management experience and technical expertise required to address all aspects of a successful information security program. Our focus is on providing advisory, assessment, and remediation services based on the specific security risks impacting your organization. Based on an analysis of your company’s risk profile, industry specific threats, and identified vulnerabilities, we work with your organization to mitigate your risks, while moving your organization to a higher level of compliance with relevant regulations and industry standards. Our consultants have the tools and expertise to develop cost-effective, security and compliance improvement plans, tailored to your business — that’s intelligent information security. DISCOVERY UNDERSTANDING YOUR RISK PROFILE • Security Strategy & Program Analysis • Technology & Security Audits • Application & Network Vulnerability Scans • Asset Inventory & Categorization • Risk Assessment & Analysis • Compliance Analysis REMEDIATION INFOSEC IMPLEMENTATION • Information Security Program Development • Risk Mitigation Strategy & Treatment Planning • Incident Response Planning & Development • Vendor Management Program Development • Application Security Subject Matter Expertise • Network Security Subject Matter Expertise MANAGEMENT INFOSEC MANAGEMENT PROGRAMS • Virtual CSO / CISO • Enterprise Governance, Risk & Compliance • Regulatory Audit Preparation • Security Program Metrics & Monitoring EDUCATION ORGANIZATIONAL AWARENESS • Security Awareness Training & Materials • Security Best Practices & Operational Plans • Security Intelligence and Sources • Security Mentoring & Guidance 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity INTELLIGENT INFORMATION SECURITY www.TrofiSecurity.com OUR REGULATORY EXPERTISE INCLUDES: PCI-DSS | ISOIEC 27001 | HIPAAHITECH | FISMAFEDRAMP | FFIEC | SSAE16 | SOX
- 3. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY 844 GO TROFI (844 468 7634) info@trofisecurity.com @trofisecurity vCISO Services Evolution of the Chief Information Security Officer www.TrofiSecurity.com • Cybersecurity Strategy • Network & Application Security • Intellectual Property Security • User Security Awareness • Regulatory Audit & Compliance • Information Security Governance • Information Security Risk Management • Incident Management In today’s digital world, your organization needs a comprehensive information security strategy. By leveraging the vCISO service model, you can be certain that strategy will be the most sound and cost effective way of protecting your business. Call Trofi Security today and let’s talk about whether our vCISO Services are right for your organization. While this worked for very small or low-complexity organizations, the increased focus brought awareness to executives that individual resources often lacked the breadth of expertise necessary to properly address risk in larger or more complex organizations. CTO CISO C/ISO ? ISO ISO ISO vCISO CTO CISO C/ISO ? ISO ISO ISO vCISO CTO CISO C/ISO ? ISO ISO ISO vCISO CTO CISO C/ISO ? ISO ISO ISO vCISO vCISO Services vCISO Services from Trofi Security make this model a reality for SMB organizations. Each of our senior-level consultants have over 25 years of experience across a number of industries including financial services, medical services, state and federal government, wholesale/retail, and more. Our consultants can help your organization in the areas of: From small- and medium-sized businesses (SMB) to Fortune 500 enterprises, the need to address risks to information assets has long been understood; however, the manner and focus of that effort by organizations has steadily changed over time. Driven by a combination of factors from awareness, to growth in e-commerce channels, to increasing exposure to both internal and external threats, organizations have had to find better solutions for their information security strategies. The following depicts 4 major steps in that evolution: In the beginning (and still true for many smaller organizations) a CIO or CTO often played a dual role in order to fill in for the lack of a dedicated resource. Whether by lack of awareness or limited financial resources, this model failed to provide the focus necessary to properly address information security risk. DEDICATED ROLE Divisional ISO(s) split role As awareness and budgets grew, organi- zations hired dedicated resources to provide necessary focus on information security risk. an organization. The idea was to network these individuals together to provide a more compre- hensive information security strategy. To be effective, it came at a very high resource cost, and often meant organizations over-spent to get the expertise needed. To address the breadth and complexity of information security risks, organizations began hiring divisional security officers, with specific expertise, to focus on a more narrow aspect of resource, working as an integrated partner to your organization. Leveraging highly-experienced, industry-certified, security experts in this manner ensures an organization is getting the very best information security guidance, across all aspects of their business, in the most cost- effective manner possible. The “virtual” CISO model solves for the shortcomings of prior models. A vCISO resource is, in fact, a team of experts, fractionally applied by a primary CISO
- 4. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY Uncertain whether your organization meets the new PCIv3 requirements? Struggling to even meet the PCIv2 requirements? Or perhaps your organization is one of the 80% of Level 1 Merchants who failed their initial audit last year, and incurred significant remediation and retesting costs. The Qualified Security Assessor (QSA) audit process can be costly even under the best of circumstances, much less when a company is out of compliance or simply unprepared. If this sounds familiar, it’s time to give Trofi Security a call. Trofi Security provides PCI-DSS Compliance Readiness Assessment and Remediation Services to help clients assess their true compliance posture, address gaps in their cardholder data protection capabilities, and prepare for QSA audits. Our regulatory experts will help ensure your successful audit by taking your team through the execution of 3 key processes: Assessment, Strategy, and Remediation. Assessment • CDE Scope and Segmentation • Internal / External Penetration Testing • Policy and Procedure Analysis • Standards Testing • Team Interviews • Mock Audits 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity PCI-DSS Compliance Readiness and Remediation Services www.TrofiSecurity.com Achieving and maintaining PCI-DSS Compliance requires a comprehensive strategy in order to avoid the costly mistakes that come without it. If you have questions about your PCI Readiness, PCI Compliance Requirements, or just have questions, contact Trofi Security today! Remediation • Security Program Development • Security Awareness Development • Technology implementation: >Web Application Firewalls > Multifactor Authentication > File Integrity Monitoring (FIM) >Anti-virus >Vulnerability Scanning >Event Logging and SEIM Strategy • Remediation Roadmap Development • Policy and Procedure Guidance • Technology, Standards, and Resource Selection • Timeline and Budget Forecasting
- 5. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY Trofi Security’s comprehensive HIPAA Risk Assessment Program was developed in direct response to the need for medical practices to have a security advocate to help them achieve HIPAA Part 15 of the required Meaningful Use Core Objectives and Measures. The Meaningful Use Risk Assessment Process must be conducted at least once prior to the beginning of each electronic health record (EHR) reporting period. While it is not impossible for a medical practice to conduct their own Risk Assessment, it is not always feasible or recommended, and should not be taken lightly. Most medical practices simply do not have the time, expertise and resources available to conduct a comprehensive assessment. By leveraging our expertise, you will have more time to focus on your patients, while Trofi Security ensures your practice’s compliance through an evaluation of the following security control areas, as defined by the HIPAA Security Rule: 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity HIPAA Compliance Meaningful Use Risk Assessment Services www.TrofiSecurity.com Administrative Safeguards Administrative Safeguards are a special subset of the HIPAA Security Rule that focus on internal organization, policies, procedures, and maintenance of security measures that protect patient health information. Technical Safeguards The technology, and the policies and procedures for its use, that protect electronic health information and its access. This is typically firewalls, intrusion prevention, antivirus, and other technologies. PHYSICAL Safeguards The physical measures, policies, and procedures to protect a covered entity’s electronic information systems and related buildings and equipment, from natural and environmental hazards, and unauthorized intrusion. During the Assessment: Beyond the Assessment: (optional) • Develop and Implement a risk management plan • Implement security measures • Evaluate and maintain security measures Our consultants will work with your team to address these control areas by performing the following key steps during the assessment and, optionally, beyond the assessment: • Identify the scope of the assessment • Identify and document potential threats and vulnerabilities • Assess current security measures • Determine the likelihood of threat occurrence • Determine the potential impact of threat occurrence • Determine overall level of risk • Identify security measures and finalize assessment documentation To learn more about how we can help you through this process, contact Trofi Security today.
- 6. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY Information is one of the most important and valuable assets to any organization. In today’s globally connected business environment, the confidentiality, integrity, and availability of that information faces an ever growing list of threats from both internal and external sources. Organizations that pursue an ISO 27001 certification and registration path, have made the choice to protect their information assets by constructing an Information Security Management System (ISMS) based on internationally-accepted, industry best-practices. ISO 27001 Certification Benefits 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity ISO 27001 Certification Readiness and Remediation Services www.TrofiSecurity.com • Demonstrates that your organization’s infrastructure, applications and processes have passed rigorous, independent third-party testing. • Provides clients with the assurances that your organization has tight and effective control over its operations; and that the likelihood of financial loss, operational failure or corruption of data is mitigated. • Serves as a broad regulatory foundation, applying to numerous legislative and industry compliance requirements, both domestically and internationally. • Provides a framework for improving both the maturity and efficiency of all organizational processes, while ensure those processes evolve in the most secure manner possible. Trofi Security assists organizations in preparing for ISO 27001 certification audits by assessing an organization’s current information security infrastructure and practices, developing a gap analysis against ISO 27002 guidance, and formulating a roadmap for organizations to reach compliance. Trofi Security ISO Readiness and Remediation Service Benefits Building an Information Security Management System (ISMS) capable of achieving ISO 27001 certification is one of the most valuable steps an organization can take to ensure critical information assets are protected. Taking that step is a big investment in time and resources. Call Trofi Security today, and we’ll ensure you get the best possible return on that investment. • ISO 27001/27002 Compliance Gap Analysis • ISO 27001/27002 Risk Profile Assessment • ISO 27001 Compliance Roadmap • Collaboration with ISO Compliance Experts
- 7. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY More and more companies are outsourcing certain functions to service organizations. As a result, service organizations are being asked to provide assurances to their customers that their controls over financial reporting, IT security, availability, processing integrity, confidentiality, and privacy are adequate. Service Organization Controls (SOC) 1, 2, and 3 audit reports can meet these demands, as well as be an effective marketing tool to differentiate a service organization from competitors, attract new clients, and strengthen existing client relationships. Depending on an organization’s specific needs, a Type I or Type II report may be most appropriate. See the chart below to determine which report and report type is right for your organization. SOC 1 A proprietary, non-public report focusing on the controls specific to the integrity of financial reporting processes. This is the successor to the original SAS70 report. The SOC I is required by many clients and service organizations for their financial reporting needs. 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity SSAE16 | SERVICE ORGANIZATION CONTROL (SOC) Audit and Readiness Services www.TrofiSecurity.com SOC 3 Similar to SOC2 Type I report, but less detailed. A public statement of certification by an authorized CPA auditor, without divulging otherwise proprietary or sensitive system information. Allows the display of an approved seal in marketing material and on websites. No Type I or Type II report designation is available. SOC 2 A proprietary, non-public report focusing on the controls related to the security, availability, processing integrity, confidentiality, and privacy of client data. The SOC II is required by many clients and service organizations to maintain regulatory compliance. Type I Focuses on a description of a service organization’s system and on the suitability of the design of its controls to achieve the related control objectives. Type I In addition to Type I attestations, a Type II report include the auditor’s opinion on the operating effectiveness of the controls, as well as a description of the tests used by the auditor to verify that effectiveness. Trofi Security provides both readiness and audit services for all of the reports and report types above. Whether your organization is preparing for an audit and needs the expertise of experienced SSAE16 practitioners, or needs to complete the audit process to deliver certifications to clients, Trofi Security has both the information security experts and the authorized Certified Public Accountants on staff to assist. The SSAE16 SOC reports are quickly becoming a contractual requirement for doing business across virtually every industry. To ensure your organization is ready to achieve SSAE16 certification, or to audit your controls when are ready, call Trofi Security today! SOCaicpa.org/soc Fo rm erly SAS 70 Repo rts AICPAServi ce Organization Con trolReports
- 8. TROFI SECURITY® INTELLIGENT INFORMATION SECURITY Penetration testing uncovers critical issues and demonstrates how well your network and information assets are protected. Combined with a comprehensive security program, penetration testing can help you reduce your risk of a data breach and become proactive about threat management. Trofi Security performs testing from an attacker’s point of view. We don’t just run a couple of scanning applications and give you the canned report from these tools. We use real-world attacks on your organization’s infrastructure, based upon all available information about your organization, its technologies, and its people. We then combine those results with observations about your environment by our team of security experts, in order to give you a detailed view of your organization’s actual risk exposure. Trofi Security employs a number of proven methodologies as part of its testing services, depending on how comprehensively an organization wants to test its environment. These methodologies are categorized into 3 service types: Black-box Testing (Level 1) • External penetration tests simulating a “no previous knowledge” scenario of the systems being attacked • Explores most likely attack scenarios posed by external and unrelated actors. • Tests are crafted based on information collected during discovery. 844 GO TROFI (844 468 7634) | info@trofisecurity.com | @trofisecurity Penetration Testing Black-box, White-box, and Red Team Services www.TrofiSecurity.com Each form of testing reveals things that the other might not. We recommend that our customers have us perform all 3 forms of testing to give them a truly accurate representation of their attack risks. By engaging Trofi Security to emulate your adversary, you can discover critical exploitable vulnerabilities and remediate them before they are exploited. Our team is highly experienced and trained in the latest tools and techniques used by individuals that commonly compromise wired & wireless networks, web applications, mobile applications, and more. The results of every penetration test presented by Trofi Security include complete details on the systems, applications and networks identified, exploitation results, as well both tactical and strategic recommendations to remediate your environment. Call Trofi Security today, and know for certain what risks your organization is facing. “Red Team” Testing (Level 3) • Combines aspects of Level 1 and Level 2 testing, while also employing various social engineering attacks. • Simulates a determined actor making a very direct and specific attack against your organization, with local, physical access to your locations and people. • Tests are crafted based on Level 1 discovery, and Level 2 knowledge of locations and people. White-box Testing (Level 2) • Internal & External penetration tests based upon “prior knowledge” of the systems being attacked • Additionally explores risk exposure to internal employees and vendors, with intimate knowledge of systems. • Tests are crafted based on specific, known technologies and system configurations.
- 9. www.TrofiSecurity.com 844 GO TROFI (844 468 7634) info@trofisecurity.com @trofisecurity About Trofi Security Trofi Security, originally Trofi Systems Solutions, was founded in 1999 to provide IT security advisory and compliance services to client organizations, as well as to serve as a security-community contributor in the development of cross-industry security best practices. Trofi Security’s methodologies and expertise have been used successfully on more than 1000 projects, nationally, during its 15 year history. Trofi Security has built a comprehensive set of tools and practices aimed at providing full lifecycle information security services to its clients, through engagement within multiple levels of an organization’s strategic and tactical initiatives. These services include: • Virtual C/ISO • Enterprise Risk Assessments • Information Security Program Development • Business Continuity Planning • Penetration Testing • Vulnerability Assessments • Computer Forensics • Secure Development Lifecycle • Security Awareness Training