Nation-State Grade Methodology

Nation-state and nation-state grade attacks have been gaining steam in cybersecurity. Our methodology is based around modeling your cybersecurity strategy to be geared toward thinking like one of those attackers.

'We think like a nation-state attacker'

SIMULATED ATTACK

In designing your cyber defense plan, we think like an attacker

As we get into the mind of attackers, we can effectively prioritize and handle vulnerabilities by exhausting attackers so they just move on to the next target

ORGANIZATIONAL DEFENSE

We pursue new offensive techniques to challenge our defense tactics

What would a typical engagement look like?

Regardless of where you are at in your cyber defense journey, our nation-state professionals are here to help.

1-2 Months

2-6 Months

Annual Ongoing

CYBERSECURITY ASSESSMENT

Risk Assessment
Penetration Test
OFM Sampling

CYBER DEFENSE STRATEGIC PLAN

Network Security
Topology
Application Security
Simulations

ONGOING MATURITY LEVEL

Security Monitoring
Annual Strategic Programs
Response Team
Multi-Year Defense Plans

What's the difference between nation-state and nation-state grade cyber threats?

More and more the cybersecurity industry has been hearing about these two topics. They are often used interchangeably, but in fact – there is a large difference between these two terms. While they have similar roots, there is some notable differentiation.

The nation-state threat

As the name implies, this is based more around actual nation-states. This is what the industry is most familiar with. It implies that a nation-state attack group targets another country and runs attacks against them. This can apply to both the private and public sector. These are highly sophisticated attack groups (Russia’s APT28/FancyBear or North Korea’s Bureau 121 for example) that are funded and technically supported by the government itself. They have been responsible for some of the most notable attacks that we’ve seen.

The nation-state grade threat

This threat is discussed much less than the above. The nation-state grade threat is based around attackers with or without nation-state backing, but using the same level of attack tools. There have been nation-state level attack tools that were released into the darknet which are available for purchase to anyone with access to it. On top of this, people, not attackers, can simply buy the service and have the attack run for them. They’re just as easy to procure as buying anything online as you can see below. This means the same level of cyber tools that are used by nation-states to attack other nation-states. Most of the enterprise is not equipped to defend against this level of attack, and the expertise that is needed is extremely expensive.

Who is a target for nation-state or nation-state grade attacks?

The truth is anyone, anywhere is a target for a nation-state or nation-state grade cyber attack. It used to be that nation-states only attacked nation-states. That has changed completely in recent years. Due to everything being digital these days, it’s become a new “warzone” so to speak. Cyber warfare has the potential to do some real life damage, especially in industries like finance, healthcare, and utilities. We saw this firsthand in both the FireEye breach as well as SolarWinds. Beyond this, there is financial gain and reconnaissance to be had from attacking the private sector. It is much more efficient to break down barriers built in the enterprise than the government considering the level of expertise discussed above. This is why it’s important to have someone in your corner who has been on the other side. We can help you understand the modus operandi of a nation-state attacker and make your cybersecurity strategy all the more resilient.

Cyber defense: going beyond cybersecurity

Cybersecurity is a wide-ranging industry. It touches every element of the network and beyond, thanks to cloud and SaaS apps. With the skills gap like it is, the defenders are having a hard time keeping up, despite valiant effort. Because of this, we as an industry need to have a reset on how we think about cybersecurity, and move more towards cyber defense. We need to think like the adversary so we can stay one step ahead of them. That’s why we’re here. You can hear our CEO and Co-Founder, Brig. General Ran Shahor discussing this here on the left-

Want to learn more?

Check out these videos about our nation-state grade cyber defense methodology.

Strategic and consulting services

Security assurance services

cyber Incident response