Home » Information Security Consulting » ISO/IEC Security Assessment
Download this Page as a PDF
“The first step in any journey is understanding your starting
point.”
“A holistic ISO17799 based assessment provides you with a high value
full understanding of your security posture.”
Matching Risk to Reward
The pace of technology has outpaced the IT manager’s ability to keep
up with the security of the enterprise. Often, marketing and sales
implement their own web sites and on-line applications without the
guidance and expertise of the information technology team. Product
development becomes the production environment, without the benefit of a
careful review to ensure security holes are closed and affected systems
are secure. Above all, customer privacy is at stake. Names, addresses, and
even personal financial information are all stored on electronic media,
often within reach of the Internet hacker.
Controlling these risks becomes more difficult in light of the very
competitive nature of business today. “First-to-market” is on
every analyst’s lips and every organization must make it to the web.
Customer delight hinges on instant and accurate access to information, and
the ability to do commerce on the Internet at any time. Success depends
upon meeting these objectives while avoiding the pitfalls posed by faulty
security.
Striking the Balance
Doing business well is about setting priorities and executing to them.
Planning, including a good security policy, design, and the procedures to
implement them must address the most credible and likely threats.
Operations must realize the design and faithfully carry out the procedures
to ensure that no vulnerabilities are created. Constant re-evaluation is
the only way to gauge the accomplishment of this continually shifting
equilibrium.
THE SECURITY EQUATIONS
- THREAT = VULNERABILITY+ADVERSARY
- RISK = LIKELIHOOD x IMPACT
The Assessment Process
Network & Security Technologies consultants apply expert knowledge to
the challenges of your business. The electronic marketplace is a networked
marketplace. Only Network & Security Technologies can deliver the
right combination of veteran network expertise with a firm grasp of the
security principles to keep online commerce safe.
The security assessment is a three-phase process:
- Gather information about technology and processes through interviews,
document review, hands-on evaluation, and testing.
- Analyze and quantify the risk posed by the vulnerabilities identified in
terms of both likelihood and impact.
- Produce a plan for reducing the risk to an acceptable residual through
actionable recommendations.
The output of the assessment is a report that permits the IT manager and
business executive to understand the probable impact of the
vulnerabilities in their technology and processes, as well as the
likelihood that the vulnerability will be exploited by an attack. While
every organization’s needs are different, Network & Security
Technologies security and network consultants review the full spectrum of
security controls. These include:
- Personnel:
- Staff background and capabilities
- Physical:
- Facility and equipment protection, as well as handling of media or printed
matter
- Network:
- Firewalls, virtual private networks, intrusion detection systems, packet filters, and secure configuration of network elements
- System:
- Configuration and management of workstation, server, and mainframe
operating systems
- Application:
- Configuration of off-the-shelf and custom developed software
- Database:
- Management and configuration of data storage and processing
Each of these areas includes evaluation of both technology and procedures
necessary to ensure security and privacy policies are maintained. Network
& Security Technologies security and network experts possess the
experience and expertise to evaluate a wide range of vendors and products.
Where a novel solution is in use, Network & Security Technologies
consultants have the hands-on knowledge in secure product development to
analyze software and configuration to identify weaknesses and pitfalls.
Knowledge is Power, Power is Money
Network & Security Technologies security and network experts
understand that no organization is well served by costly and drawn-out
evaluation processes. Resources are best used to build plans and implement
changes, not to analyze. Thus, Network & Security Technologies experts
focus their attention on the highest network and security risks facing
your organization. The assessment is a starting point; a roadmap to get on
track while spending the least money. It is the modest investment that any
good manager must make to guarantee a well-run business will not face a
crisis of confidence by its customers or stockholders.
Download this Page as a PDF