Cyber Security

BWC has been delivering full-scale consulting services in information security. We help our customers to protect their IT environments by proactively identifying security threats and gaps.

Enhance your information security through our competencies to:

Monitor how protected and robust your cyber-environment is against APTs, ransomware, and other offenses.
Identify existing vulnerabilities in your network to prevent potential attacks.
Uplevel the performance of your information security solutions.
Timely detect cyberattacks in your network.
Keep your sensitive data secure.
Ensure you’re compliant with information security standards in your industry.

APT Protection

Companies of any size are getting exposed to advanced persistent threats (APTs) more than ever. BWC’s security consultants configure and fine-tune SIEM solutions to perform proactive detection of APTs to avoid financial losses, sensitive data leaks and retain corporate reputation.

BWC’s SIEM team will help your organization resist APTs by fine-tuning your security solution to make it scan your network thoroughly.

We check how well QRadar monitors the network and analyze if the platform can reveal APT presence.
We fine-tune your SIEM solution to enable proper monitoring of your current security state and detect visible signs of an APT.
We configure and fine-tune QRadar to factor in possible attack scenarios so that it can detect APT symptoms.
We provide QRadar with a set of specific correlation rules that will allow you to catch APTs in your particular business environment.

APT-focused SIEM solutions allow companies to:

Monitor their IT landscapes at different levels to capture an APT at any stage.
Analyze all security events in a single console. This enables detecting APT symptoms using the entire set of security parameters available in SIEM platforms.
Develop strong anti-APT defense in line with industry best practices.

Penetration Testing Services

BWC delivers penetration testing to identify potential gaps in companies’ networks that intruders can break through.

In cooperation with our customers, we choose between Black Box, White Box or Grey Box penetration testing to pick the profile that suits your case best.
We develop custom test scenarios to check networks, applications, services and operating systems.
We use a number of attacking techniques, such as SQL injection, spoofing, social engineering, etc., to cover every scenario that intruders may exploit to assail your company.
We analyze test results and put them together in a comprehensive report. The report shows how easy existing vulnerabilities are to exploit and how much damage such an exploit can cause to a compromised system.
We develop a rehabilitation scenario that includes our recommendations on how to eliminate the revealed aberrations and achieve a shellproof protection. On demand, we will fix the vulnerabilities properly.

Penetration testing allows our customers to:

Get a comprehensive overview of their network, application, and operating system vulnerabilities to be proactive and prevent attacks instead of combatting them.
Check if a system’s defense is still rocking after adding new applications, seriously modifying the current ones, or introducing new offices.
Understand if the current defense is sufficient, or if they should take measures to improve it.
Reveal potentially dangerous non-compliance with corporate security policies and industry-specific security requirements, such as GLBA, HIPAA, PCI DSS, FISMA/NIST, both compulsory and non-mandatory.
Prevent downtimes caused by systems’ inoperability that can spiral into huge financial losses and reputation damage.

Vulnerability Assessment

Elements of the IT Environment We Assess

BWC’s vulnerability assessment services imply reasonable costs along with high quality. The qualifications of our information security team allow detecting vulnerabilities and finding weak points in the following components of the IT environment:

IT infrastructure:

Network. We assess the efficiency of your network segmentation, network access restriction, the ability to connect to the network remotely, firewall implementation.
Email services. We evaluate the susceptibility to phishing attacks and spamming.

Applications:

Web applications. We assess the susceptibility of a web app to various attacks following Open Web Application Security Project (OWASP) Top 10 Application Security Risks.
Mobile applications. We evaluate the security level of a mobile app following OWASP Top 10 Mobile Risks.
Desktop applications. We assess how data is stored in an app, how this app transfers information, whether any authentication is provided.

Assessment Methods We Apply

Our security testing team combines automated and manual approaches to take the full advantage of the vulnerability assessment process.

Automated scanning

To start the vulnerability assessment process, BWC’s security engineers use automated scanning tools the choice of which depends on each customer’s needs, requirements and financial capabilities. These scanners have databases, which contain known technical vulnerabilities and allow detecting your company’s susceptibility to them. The main advantage of the automated approach is that it is not time-consuming and ensures a wide coverage of security weaknesses possibly existing in a range of devices or hosts on the network.

Manual assessment

BWC’s security testing team performs the manual tuning of the scanning tools, as well as subsequent manual validation of the scanning findings to eliminate false positives. Upon the completion of such manual assessment performed by our specialists, you get reliable results containing only confirmed events.

Cooperation Models We Offer

We’re ready to put in efforts and provide you with high-quality assessment, no matter which model of cooperation you choose.

One-time services

One-time services allow getting impartial security level evaluation and avoiding vendor lock-in. Choosing this cooperation model may help a customer to form an opinion on the vendor and decide whether to cooperate with them afterwards. BWC is ready to offer you one-time services to assess the protection level of your network, application or another component of the IT environment. When getting acquainted with the target of assessment, our security testing team thoroughly studies the details, i.e., gathers the information on software installed on the devices in the network, understands the basic configuration of the devices, collects the available public information on the known vulnerabilities of the device version, vendor, etc. After that, assessment activities are carried out.

Managed services

Opting for managed services means building long-term relationships with one vendor. Once the information on your IT infrastructure is gathered in the course of the first project, the vendor is subsequently able to carry out vulnerability assessment spending less time on the project and reducing the costs for you. If you want to stay fully aware of any decreases occurring in your company’s security,BWC suggests putting vulnerability assessment in your list of regular tasks and offers the appropriate services conducted on a regular basis. We have all the necessary resources to perform vulnerability assessment quarterly, half-yearly or once a year depending on your need to meet regulatory requirements, the frequency of applying significant changes in your network, application, etc.

Regardless of the chosen cooperation model, we provide you with a final vulnerability assessment report upon the completion of the process. The report is split into two parts – a technical report(comprehensive details on the assessment activities performed by BWC’s security engineers) and an executive summary (the information on your overall security state and the revealed weaknesses easy to understand for employees with limited knowledge in the security area). Moreover, we are ready to give you valuable recommendations concerning corrective measures that should be implemented to remediate the revealed vulnerabilities.

Vulnerabilities Classification Techniques We Apply

When conducting vulnerability assessment, we divide the detected security weaknesses into groups according to their type, severity level, etc. following the classifications below.

Web Application Security Consortium (WASC) Threat Classification.
Open Web Application Security Project (OWASP) Testing Guide.
OWASP Top 10 Application Security Risks.
OWASP Top 10 Mobile Risks.
Common Vulnerability Scoring System (CVSS).

Classifying vulnerabilities allows BWC’s security engineers to prioritize the findings according to the impact they may have in case of exploitation and direct your attention to the most critical weaknesses that need to be eliminated on a first-priority basis to avoid financial and security risks.

Challenges We Solve

Vulnerability assessment scope is defined without considering the customer’s requirements.

Information security vendors may follow one common pattern when performing vulnerability assessment for different customers who may have specific requirements. In their turn, BWC’s security engineers primarily focus on getting all the details concerning the customer’s request and the target of vulnerability assessment at the negotiations stage. Our specialists clarify if the customer needs to be compliant with PCI DSS, HIPAA, GDPR, GLBA, and other regulations and standards, what elements (servers, services, applications) the infrastructure includes, whether the firewall protection is applied in the network, etc. Such information allows us to estimate an approximate scope of work correctly, as well as efforts and resources needed to complete the project and not let it go beyond the scope.

New and more sophisticated vulnerabilities occur every day.

Hackers keep finding new attack vectors to get inside corporate networks, steal sensitive data, etc. BWC’s security testing team always stays tuned for the latest changes in the information security area by constantly monitoring the occurrence of new weaknesses and checking the updates of scanning tools databases.

Modifying the components of the IT environment may cause the appearance of new security weaknesses.

There’s always a possibility that new vulnerabilities will occur after the changes are implemented in the customer’s network, application, etc. With a view of it, BWC’s security engineers are willing to provide you with vulnerability assessment services after each major update or release to be sure the modifications you implement do not open new ways for intruders to attack your infrastructure.

Modern hyper-connected solutions are highly susceptible to evolving cyber threats.

There is a range of modern integrated solutions that exist in conjunction with each other. Therefore, a vulnerability in one system may compromise the protection of all the other systems connected to it. A good example of a modern solution combining a variety of elements is an ecommerce ecosystem that typically includes an ecommerce platform, a website, marketing tools, a payment gateway, a marketplace, CRM, etc. BWC’s security testing team looks at the process of vulnerability assessment from different perspectives and asses the security of all the possible vectors the attackers may choose to get into complex solutions.

Reveal Your Security Vulnerabilities Promptly

Increase the security level of your company by turning to BWC’s security testing team that will help you reveal the flaws in the protection of your network, application, etc. Equipped with expertise and more than 15 years of experience in the information security area, our specialists are here to identify your company’s security loopholes and find ways to make them strongly secured.

If you want to know even more about the advantages you get when opting for vulnerability assessment services, do not hesitate to contact us. BWC’s information security experts are ready to answer any question to help you take a final decision.