Security Controls for Federal Information Systems.

The organization must establish a continuous monitoring strategy and implement a continuous monitoring program, which includes, reporting on the security state of the system to appropriate organization officials on a predetermined frequency.

– According to NIST SP 800-53 compliance

  • 70% of web attacks point to a secondary victim

    A website is hacked to serve up malware to visitors in hopes that the actor’s true target will become infected. The actors have no real interest in the owner of the website other than using the owner to further the real attack.
    2015 Data Breach Investigations Report Verizon
  • Most affected industries for Web App attacks: Information, Financial Services, and Public

    Over 95% of sampled incidents involve harvesting creds from customer devices, then logging into web applications with them.
    2015 Data Breach Investigations Report Verizon
  • In 60% of cases, attackers are able to compromise an organization with minutes

    75% of attacks spread from Victim 0 to Victim 1 within one day (24 hours). Over 40% hit the second organization in less than an hour.
    2015 Data Breach Investigations Report Verizon
  • Ten vulnerabilities account for almost 97% of all exploits observed in 2014

    99.9% of exploited systems were compromised more than a year after the vulnerability was published.
    Everybody's online, and Everybody's vulnerable.
    2015 Data Breach Investigations Report Verizon
  • How Much Confidence Do You Have in Your IT Security?

    A Penetration Test will simulate real world attacks to identify weaknesses in your security.
    Everybody's online, and Everybody's vulnerable.
    President Barack Obama
  • One thing is clear: Cyber has escalated from an issue of moderate concern to one of the most serious threats to our national security.

    Now, the entire country could be disrupted by the click of mouse.
    General Martin E. Dempsey
  • Disruptive and destructive cyberattacks

    are becoming a part of conflict between states, within states, and among nonstate actors. The borderless nature of cyberspace means anyone, anywhere in the world, can use cyber to affect someone else.
    General Martin E. Dempsey
  • Phishing was associated with over 95% of incidents attributed to state-sponsored actors.

    One of the most effective ways you can minimize the phishing threat is through awareness and training.
  • Errors made by internal staff, especially system administrators, were the prime actors in over 60% of surveyed incidents in 2014

    Errors include sensitive information reaching incorrect recipients, publishing nonpublic data to public web servers, and insecure disposal of personal and medical data.
    Verizon Data Breach Investigations Report
  • Users leave footprints wherever they go on the network, and their activities are—or can be—captured in a myriad of logs.

    The key is to collect and collate these data sources into a place where they can be analyzed.

How we can help assess your organization with the FedRAMP.

FedRAMP NIST RMF Risk Assessment

A risk assessment will evaluate the effectiveness of your entire security program and test your internal and external defenses using real-world attack scenarios.

Readiness Assessment Report

A controls gap assessment is designed to test your organization against each of FedRAMP security controls and prepare your organization for audit.

FedRAMP Penetration Test

Designed to fully meet the requirements of FedRAMP, our network and web application penetration testing will validate the effectiveness of your security program by testing it against real-world attack scenarios.

Continuous Monitoring

We work with your technical teams to help develop a plan to meet your continuous monitoring requirements, and help you stay on top of your 30-60-90 day patch cycles.

Custom Framework Mapping

NightLion has developed proprietary compliance framework mapping tools to help your organization satisfy multiple audits without wasting redundant business resources.

Project Planning, Program liaison support, SSP and document development

We will work with you and your organization to develop a technology agnostic managed security program to help satisfy control requirements.

HAVE QUESTIONS? WE ARE READY TO SCHEDULE YOUR FREE CONSULTATION

Call us today:
314-669-6569

In the media

Oops, something went wrong.

Get in touch