Our Approach and Methodology
If there was a definitive way to detect a massive outbreak or breach at your
organization, you certainly would pursue that option, wouldn’t you? Fortunately,
that option exists in the form of endpoint security; which within most
organizations is considered the “first responders” of the war against breaches
or outbreaks.
First, SecureState engineers will test the current effectiveness of the
endpoint solution and identify potential flaws within the current security
program. Second, several different “payloads” and attack methodologies will be
created to test the effectiveness of the current solution. This will start with
the most rudimentary obfuscation techniques and gradually move deeper into more
advanced evasion, insertion, and networking attacks. These simulations will
provide the organization with an in-depth knowledge of what level of skill an
attacker would need to defeat the host protections.
Additionally, SecureState will perform isolated Penetrations Tests to the
overall Endpoint Assessment to identify to what extent the solution is providing
notification of malicious software being placed on the system during an actual
attack. This provides the organization with a true representation of the
effectiveness of any given solution, and its response notifications and
capabilities.
Hardening techniques are defined as general security controls placed on a
specific system that enhances the overall state of security. This provides the
organization with a level of assurance against focused attacks and threats.
Normal system hardening or configuration hardening of the operating system or
endpoint solution may prevent many of the performed attacks. These tests will be
conducted to gauge its effectiveness from all angles to ensure the organization
can fully evaluate the available options.
SecureState will test the end-point solution and the current configurations;
as well as offer assistance if a different solution is needed, or if
configuration changes within the overall hardening of the system and / or
software solution are necessary. More specifically, Endpoint Attack and
Penetration consists of the following:
- Active Attacks: Active attacks attempt to bypass
and penetrate defenses through direct access to the
host. SecureState directly targets services and
system functionality in an attempt to test the
endpoint’s capability of detecting privilege
escalation techniques
- Passive Attacks: Passive attacks target the
endpoint’s protection, and the logic behind it, as
well as how the detection engine attempts to
identify and contain any threats the user has
unknowingly obtained
- Evasion: Evasion techniques are some of the
primary tests within the end-point attack stages.
SecureState uses many common and advanced techniques
that malicious software employs such as system-call
hooking, memory injection and redirection, encoding
sections, import obfuscation and covert tunneling;
in attempts to bypass, or otherwise run undetected
- Insertion: This will test the ability of the
detection engines to alert on malware that
implements obfuscation or are piggybacked onto
legitimate programs.
- Brute-Force: It is possible to brute-force the
signatures and instructions that are flagged as
malicious by inspecting and narrowing down key
sections within malicious data to discover the
endpoint signature.
- Isolated Penetration Tests: SecureState will
perform isolated Penetration Tests in addition to
the overall virus review. The purpose of this test
is to identify to what extent the solution is
providing notification of malicious software being
placed on the system during an actual attack.
- System and Configuration Hardening: Hardening
techniques are defined as general security controls
placed on a specific system that enhances the
overall state of security