Annual Penetration Testing and Risk Assessment Requirements

At a minimum, each financial services organization must perform annual Penetration Testing of Information Systems determined each given year based on relevant identified risks in accordance with the Risk Assessment.

– According to New York Department of Financial Services

  • 70% of web attacks point to a secondary victim

    A website is hacked to serve up malware to visitors in hopes that the actor’s true target will become infected. The actors have no real interest in the owner of the website other than using the owner to further the real attack.
    2015 Data Breach Investigations Report Verizon
  • Most affected industries for Web App attacks: Information, Financial Services, and Public

    Over 95% of sampled incidents involve harvesting creds from customer devices, then logging into web applications with them.
    2015 Data Breach Investigations Report Verizon
  • In 60% of cases, attackers are able to compromise an organization with minutes

    75% of attacks spread from Victim 0 to Victim 1 within one day (24 hours). Over 40% hit the second organization in less than an hour.
    2015 Data Breach Investigations Report Verizon
  • Ten vulnerabilities account for almost 97% of all exploits observed in 2014

    99.9% of exploited systems were compromised more than a year after the vulnerability was published.
    Everybody's online, and Everybody's vulnerable.
    2015 Data Breach Investigations Report Verizon
  • How Much Confidence Do You Have in Your IT Security?

    A Penetration Test will simulate real world attacks to identify weaknesses in your security.
    Everybody's online, and Everybody's vulnerable.
    President Barack Obama
  • One thing is clear: Cyber has escalated from an issue of moderate concern to one of the most serious threats to our national security.

    Now, the entire country could be disrupted by the click of mouse.
    General Martin E. Dempsey
  • Disruptive and destructive cyberattacks

    are becoming a part of conflict between states, within states, and among nonstate actors. The borderless nature of cyberspace means anyone, anywhere in the world, can use cyber to affect someone else.
    General Martin E. Dempsey
  • Phishing was associated with over 95% of incidents attributed to state-sponsored actors.

    One of the most effective ways you can minimize the phishing threat is through awareness and training.
  • Errors made by internal staff, especially system administrators, were the prime actors in over 60% of surveyed incidents in 2014

    Errors include sensitive information reaching incorrect recipients, publishing nonpublic data to public web servers, and insecure disposal of personal and medical data.
    Verizon Data Breach Investigations Report
  • Users leave footprints wherever they go on the network, and their activities are—or can be—captured in a myriad of logs.

    The key is to collect and collate these data sources into a place where they can be analyzed.

How we can help assess your organization with 23 NYCRR 500.

Risk Assessment

A risk assessment will evaluate the effectiveness of your entire security program and test your internal and external defenses using real-world attack scenarios.

NYSDFS Penetration Test

Designed to fully meet the requirements of 23 NYCRR 500, our network and web application penetration testing will validate the effectiveness of your security program by testing it against real-world attack scenarios.

Custom Framework Mapping

NightLion has developed proprietary compliance framework mapping tools to help your organization satisfy multiple audits without wasting redundant business resources.

Continuous Monitoring

We work with your technical teams to help develop a plan to meet your continuous monitoring requirements, and help you stay on top of your 30-60-90 day patch cycles.

HAVE QUESTIONS? WE ARE READY TO SCHEDULE YOUR FREE CONSULTATION

Call us today:
844-HACK-911

In the media

Get in touch