CanSecure © – Penetration Testing, Active Vulnerability Testing and Forced Configuration Compliance

Unique in the market – the only true enterprise-wide, heterogeneous environment, to perform all these functions.

CanSecure is a risk management approach for continuous security monitoring. This software, utilized in conjunction with Cognoscenti, creates a baseline (BSL) and current-state model (CSS) to identify changes in the organization’s security posture. It conforms to NIST Interagency Report 7756. Baseline settings can be “enforced”. An enforced baseline value will ensure that when system components or data associated with those component changes, it is flagged, notifying that the system/component has deviated from the baseline. When this occurs, the component being enforced will be restored to the baseline state. This is useful for ensuring applications run under a known accepted state. This ensures that unauthorized software is removed, ports are turned off or on and operational configurations are maintained according to expected standards.

The software also leverages open and closed source applications for penetration testing to ensure the non-vulnerability of systems running on the network. CanSecure uses white hat methods. Test attacks are delivered both internal and external to the running device. The software will identify what penetration tests need to be exercised as well as aid in setting up and running the tests. In accordance with DHS guidelines and NIST standards for risk management (NIST Special Publication 800-37), CanSecure provides the final link in Continuous Asset Evaluation, Situational Awareness and Scoring Reference Architecture (CAESARS), as documented in DHS-MP100146. It determines the actual state of IT assets, identifies gaps between the original baseline or Current-System-State (CSS) with the desired baseline, assesses gap risk, provides scoring reflecting aggregate risk, and provides management reports and dashboards to make critical decisions concerning vulnerabilities, mitigation strategies, and asset and configuration management.