Key Result Areas
Supporting Actions
Application Security Governance
Ensure Security test is conducted as per the scope agreed in timely fashion and deploy compensatory controls for all open risk from zero day of identification and closure of all vulnerabilities as per agreed timeline
VAPT and Security Config Audit of Network Devices, DMZ Assets, MZ Assets
Vulnerability Assessment (Automated), Security Config Audit and Penetration Testing (Manually) of all the systems Governance- Assistance in vulnerabilities closure to respective technical SPOCs.
Implementation of ASLC and DevSecOps Framework for ABCD and Application Security- Advisory
Governance of ASLC, DevSecOps at ABCD level. Conducting Seminars/Workshops/Training session on Application Security. Design and deploy framework to measure the effectiveness of these trainings. 100 % ASLC Documentation for all new & old Apps of ABCD. Monthly Reporting on the same to the CISO
Web Application Firewall- Technical Advisories and Governance
WAF evaluation, fine tuning of Web Apps, Technical governance at ABC level.
On boarding 100 % current Internet facing applications of ABC and 100 % current Internet facing applications of ABC from Day 1. Configure it on preventive mode within 2 weeks and monitor the logs and action the same.
Red Teaming Activity- Red Teaming activity (Blackbox) across all businesses of ABC
Red Team Assessments focus on giving your security team practical experience combating real cyber attacks. While avoiding business damaging tactics, these assessments use conventional and advanced attacker TTPs to target agreed-upon objectives.
The objectives are to compromise the Organization’s email boxes, critical information/data and the ultimate goal is to compromise the Active Directory which is considered as a critical component of any organization which stores data, ID and email, mailbox, login related information, etc.
An Attacker/Hacker who gets success in compromising the Active Directory can further breach int