Security Program Development

Vulnerability Management Program Development

The Vulnerability Management Program Development offering is intended to help customers build strong vulnerability management practices that ultimately prevent the exploitation of security vulnerabilities that exist within their organization. By tailoring each engagement and collaborating with our customers on goal definition, the Vulnerability Management Program Development offering is completely tailored to any organization regardless of its maturity or overall program needs.

The Vulnerability Management Program Development offering specifically focuses on the following key areas:

Red Team Program Development

Red teaming helps ensure your network and physical and social attack surfaces are secured. Red team programs typically consist of mission-oriented, adversarial threat simulations designed to test your readiness to withstand and detect targeted attacks. Rapid7 experts can help your organization build a red team program that can help you answer the question, “Are you prepared for an attack?”

Rapid7 Red Team Program Development engagements include:

• An evaluation of existing capabilities, technology, people, and artifacts surrounding existing penetration testing, threat detection, and incident response programs and goals.
• A review and classification of business processes, assets, users, and data to facilitate incident testing, and threat and response prioritization.
• The development and documentation of a Red Teaming Methodology, including:
• Red Team Framework
• Red Team Process Design Diagram
• Gap Analysis & Recommendation Report
• The delivery of reports, collateral, and presentations required to bridge the gap between current capabilities and target Red Team and Response program goals.
  
  

Incident Response Program Development

Attacks and attackers are constantly evolving. To ensure you’re always prepared, you need a plan—and you need to review it regularly. Our experts will evaluate your environment—from technology to assets to people, process, and policy—to rate your capability and offer relevant, business-based recommendations to help you meet your incident response program goals. Need to build your program from the ground up? We can help with that, too. Our Incident Response Program Development offering can be customized to help build or improve your capability in any area of the Security Program Lifecycle (Preparation, Prevention, Detection, Response, Remediation, Cleanup, Lessons Learned).

Learn more about our Incident Response Program Development service.  

Vendor Management Program Development

While many organizations outsource vendor software or services to reduce costs and enhance business processes, it is important to understand the risks that go along with this. Several security breaches in recent history have been due to a compromise at an outsourced vendor. A robust vendor/3rd party management program is essential to any security program. To properly mitigate risk, organizations must develop a comprehensive program that governs the risks associated with using these providers. It is important to note that a comprehensive program is significantly more complex than utilizing a vendor security questionnaire or checklist. Rapid7’s Vendor Management Program Development offering helps organizations build a program inclusive of the following areas:

• Risk Assessment Methodology
• Vendor Selection and Due Diligence
• Contract Review Provisions
• Ongoing Monitoring