Compromise Assessment
Detect and Respond to Attacks with Confidence
As the IT landscape continues to increase in complexity, organizations like yours find themselves
struggling to detect and respond to threat actors who are targeting sensitive information andcustomer data. Attackers may spend months gaining footholds and learning about the environment
before executing an attack, whether it be a fraudulent wire transfer, theft of large amounts of data, aransomware attack, or a combination of these or other threats.
Combined with more focus from boards and audit committees, you arelikely being asked to answer tough questions about the state of
security controls: Would we know if we were being attacked? Has ournetwork been compromised? Are we ready?

Protiviti helps you answer these tough questions and more by
conducting a Compromise Assessment. This assessment helps clarify
the potential threats to your organization, examines your network forindicators of compromise and provides guidance on how to respond if
malicious activity is detected.

Are you ready torespond in theevent of acompromise?

Our Approach
Gather Information and Understand Your Security PostureProtiviti will gather information about your organization through facilitated sessions with key stakeholders,
information security personnel and application owners. Using this information, we will structure theassessment to focus on the critical components of your environment and the systems and data that would
most likely be targeted by an attacker.

Evaluate Detection Capabilities and Perform Threat Hunting
Protiviti’s incident response team will perform technical configuration reviews of security devices, examine
relevant threat intelligence and dark web information, and perform automated and manual targeted threat
hunting in the environment to assess your approach to detection and response.

Report and Debrief
Leveraging the information obtained from the assessment, we will develop a summary memo detailing therisks identified, potential impact to the business and guidance for remediation. We will simultaneously workwith your technical leaders to conduct a detailed debriefing of the technical gaps and any threats identified
during hunting activities.

INNOVATE. TRANSFORM. SUCCEED.

Compromise Assessment
Threat Modeling

Detection Capability Review• Perform a high-level threat modeling exerciseto identify the most likely threat actors whowould target the organization and thetechniques most likely to be used during anattack• Identify the various detection systems in use
in the environment, such as Intrusion
Detection/Prevention Systems (IDS/IPS) and
Security Information Event Management(SIEM) tools to identify potential gaps innetwork visibility• Identify the critical systems, applications anddata that would be targeted by attacks• Leverage the information obtained todetermine the most likely attack techniquesfrom the MITRE ATT&CK framework• Perform configuration reviews of IDS/IPS andSIEM systems to evaluate the organization's
ability to detect threats and respond toincidents

Threat Intelligence Analysis

Incident Response Procedure Review• Identify potential threats using Protiviti’s
threat intelligence feeds, open source
information and dark web accesses• Review the organization’s incident response
policy and any associated playbooks andcompare them to industry standards• Provide information on any intelligencelocated on the dark web or evidence of threat
activity• Interview key incident response teammembers to understand processes forhandling malicious threat actors

Threat Hunting Exercise

Reporting and Debrief• Deploy an industry-leading tool, Carbon
Black EDR/Enterprise EDR, to systems in theenvironment• Deliver an executive summary memo
outlining the identified issues, risks andremediation guidance• Perform automated hunting leveraging
Carbon Black’s Predictive Security Cloud• Deliver a detailed readout of hunting
activities performed• Execute manual hunting using the threat
modeling information to attempt to identify
any malicious activity on the internal network• Conduct a debrief session with client
management and technical leadership tooutline the testing performed and results

Schedule a Compromise Assessment today by contacting us at TechnologyConsulting@Protiviti.com.
Protiviti.com/TechnologyConsulting

TechnologyConsulting@Protiviti.com

TCblog.Protiviti.com

Protiviti (www.protiviti.com) is a global consulting firm that delivers deep expertise, objective insights, a tailored approach and unparalleled collaboration to
help leaders confidently face the future. Protiviti and our independent and locally owned Member Firms provide consulting solutions in finance, technology,operations, data, analytics, governance, risk and internal audit to our clients through our network of more than 85 locations in over 25 countries.
Named to the 2021 Fortune 100 Best Companies to Work For® list, Protiviti has served more than 60 percent of Fortune 1000® and 35 percentof Fortune Global 500® companies. We also work with smaller, growing companies, including those looking to go public, as well as with government agencies.
Protiviti is a wholly owned subsidiary of Robert Half (NYSE: RHI). Founded in 1948, Robert Half is a member of the S&P 500 index.
All referenced of trademarks are the property of their respective owners.
© 2022 Protiviti Inc. An Equal Opportunity Employer M/F/Disability/Veterans. PRO-0120
Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on
financial statements or offer attestation services.