Frequently Asked Questions - FAQ's

A Penetration Test, also known as a Pen Test, is a simulated cyberattack against your Web Application or System Infrastructure and Network to check for exploitable vulnerabilities. Pen Testing aims to identify vulnerabilities and risks which may negatively impact the Confidentiality, integrity, Availability, Security and Privacy of data and information assets.

Ransomware is malicious software (malware) used in a cyberattack to encrypt the victim’s data with an encryption key that is known only to the attacker, thereby rendering the data unusable until a ransom payment (usually cryptocurrency, such as Bitcoin) is made by the victim.

Ransomware is not a new threat. The earliest known ransomware, known as PC Cyborg, was unleashed in 1989. Since that time, ransomware has evolved and become far more sophisticated.
Ransomware has also become more pervasive and lucrative with developments such as the following:

• Ongoing digital transformation: As more organizations digitize their operations and employees use email, cloud apps, and mobile devices to get work done, the number of potential entry points for attackers increases exponentially. After a network has been breached, infections can spread more quickly when critical systems are connected.
• The rise of cryptocurrency: Currency (such as Bitcoin) enables easy and virtually untraceable payments to anonymous cybercriminals. As cryptocurrency speculation continues to push prices higher, the potential for large ransoms grows proportionally.
• The emergence of Ransomware-as-a-Service (RaaS): RaaS (ransomware that can be purchased for a small fee and/or a percentage of the ransom payment) makes it easy for practically anyone to use ransomware which is concerning.

A cybersecurity program is a documented set of your organization’s information security policies, procedures, guidelines, standards and operating procedures. The security program includes a roadmap, plan and milestones for effective implementation of security management best practices and controls.

Email security is the process of ensuring the availability, integrity and authenticity of email communications by protecting against the risk of email threats.

"With over 90% of attacks on organizations starting from a malicious email, relying on your built-in security might leave your organization open to cyber criminals that constantly capitalize on the number one attack vector: exploiting human nature and the lack of tight security.

• The Phishing Threat

  A phishing email is designed to use social engineering to exploit your organization’s employees. If an attacker can get a user to click on a malicious link or open an infected attachment, they can steal login credentials and other personal data or install malware on the employee’s computer. From there, the cybercriminal can expand their access on the corporate network to steal sensitive data or perform other attacks.

  Over 90% of cyberattacks begin with a phishing email, and the reason for this is that phishing emails are effective. It is often much easier to convince an employee that they need to take action on their Netflix account or send a payment to a vendor than to identify and exploit a vulnerability in a company’s systems.

• Exploiting Cloud Email

  The rapid adoption of cloud computing has only made it easier for cybercriminals to exploit email. The growing use of cloud-based email and document sharing solutions – such as Google Drive and Microsoft 365 – have opened up new attack vectors for cybercriminals.

  An attacker will commonly send a phishing email masquerading as a legitimate shared document. Upon clicking on the link, the target will be prompted to enter their credentials for the service to view it, which sends these credentials to the attacker. If the organization has not configured their cloud infrastructure to provide visibility into account usage and implement access control, an attacker can use these stolen credentials to access sensitive data throughout the company’s cloud.