Services that fit your needs

Security Policy Development

Many businesses do not have an information security policy, even though due diligence says all organisations must. Unfortunately, it’s the impact of an cybersecurity incident that usually provokes the wake-up call.

It may sound intimidating, but the important thing to remember is proportionality – your needs will be dictated by the size of your business and the sector it operates in. It’s never too late to build the policy that’s bespoke to you.

If you already have an information security policy – congratulations! That means you know just how important it is to periodically review it. (read more)

Risk Assessment

Risk assessments are central to implementing an cybersecurity strategy. In fact, an initial risk assessment is a great way to lay the foundation for an organisation’s information security policy.

The level of detail incorporated in a risk assessment can vary greatly – from a qualitative format that focuses only on the high-value assets, to a quantitative form that requires the involvement of all teams. Hitting the right balance that is aligned with your business objectives will have a positive impact on the investment’s return. (read more)

Security Controls Implementation

So you know what risks threaten your organisation. Security is a balancing act, rather than an end-goal in itself – some risks will be deemed acceptable, some will be transferred (e.g. via insurance), others may even be avoidable; for everything else, there’s mitigation (wordplay intended).

Security controls are all about lowering risk to an acceptable level. It’s unfeasible, if not impossible, to implement measures that eliminate all risks. The best way to stay ahead of the game is to incorporate a practice of continuous improvement in your long-term plan. (read more)

Training

While there are many facets to this essential activity within an organisation, my expertise lends itself to two directions: technical knowledge transfer and cybersecurity training for all staff.

And if the strategy you adhere to is that trainers shouldn’t be subject-matter experts, you could either opt for the train-the-trainer model or ensure high-quality in the instructional materials through my involvement in their development phase.

Whichever approach you take, an emphasis on self-sustainability is critical for the success of such an investment. (read more)

Auditing

Having a plan in the form of a security policy and an implementation of recommended controls, which reduce risk to an acceptable level, may be everything you need.

But if you would like to go one step further in the protection of your organisation, regular audits of the systems' security, including their protective measures, provide an additional fail-safe towards risk mitigation. In fact, they are considered best-practice simply because mistakes can creep in and it is the management team’s responsibility to anticipate this deficiency. (read more)

Incident Response Management

Perfect security doesn’t exist – this makes an Incident Response Plan an integral and highly valuable part of an Information Security Policy. Without one, emotions and stress could lead to less-than-optimal decisions.

If you find yourself in the midst of an information security incident, whether it’s a data breach through ransomware or a DDoS attack affecting operations, you should have the ability to rely on the advice of a clear-headed professional, especially one who has encountered these situations before. (read more)

Securing Hybrid Architectures

Cloud-native technologies bring considerable benefits, in terms of scalability, agility, standardisation and, potentially, infrastructure cost reductions. Unfortunately, a commonly cited barrier is that an effective implementation requires specialised skills.

On the other hand, on-premises solutions can leverage existing deployments to reduce costs, provide complete control (which can benefit specific applications) and lessen the impact of third-party dependence and vendor lock-in.

The two approaches have, in some regards, different cybersecurity considerations, which should be taken into account as part of any analysis. Navigating them requires a through understanding of the underlying technologies. (read more)

Consultancy

A subject-matter expert can make the difference between a stalling project and one which is successfully delivered, even without being a full-time member of your team.

Sometimes, you just need to be able to rely on a trusted professional to provide guidance. At the same, facilitating a culture of personal growth within an organisation will ensure that your staff are not left behind constant technological advancements. (read more)