Indicator of Compromise
Assessment

PRIMARY CONTACT: Carl N. Kriebel CISSP

Our indicator of compromise assessment utilizes our extensive experience within cybersecurity to identify potential malicious compromise signatures that may already exist within your network and systems. This allows us to give you key insights into your environment to assess whether your organization may have already been the victim of a cyberattack.

Our team employs a comprehensive approach to cybersecurity and proactive incident response services that are part of our overall strategy to secure our clients’ networks and key systems. Below are some of the checks that are provided with an indicator of compromise (IOC) assessment:

• Antivirus log analysis
• Network device log analysis
• Web filter log analysis
• Windows event log analysis from key servers or endpoints
• Forensic artifacts review of critical Windows systems
• Cloud log analysis (e.g., Azure, AWS, or O365)
• Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) log analysis
• Security Information and Event Management (SIEM) log analysis
• Email security appliance or software log analysis
• Network device firmware integrity checks
• Access point (AP) log analysis
• Sensitive application/web security log analysis

While the primary goal of the assessment is to determine if there is already a compromise of critical systems, Schneider Downs will also provide a security architecture review and recommend improvements to improve the multiple layers of security protecting your organization. This includes reviewing the following items, leveraging our extensive client experiences:

• Web filters
• Antivirus products
• SIEM products
• IDS/IPS (integrated firewalls or standalone devices)
• Data Loss Prevention (DLP) Software
• Email Security Products
• Cybersecurity User Education
• Network Architecture
• DMZ Architecture
• Patch Management
• Windows Event Logging Analysis