Services Overview
In today’s world Cyber security keeps CIOs and many business leaders awake. There is a lot to be concerned about in the field, from internal vulnerabilities, external threats, the controls to be deployed, enhancing employee awareness, data security, reviewing legacy systems, architecting cloud moves, securing networks, planning for disasters, audits and compliance, security testing, operational technology security and security operations.
DQ breaks these challenges into small chunks and offers organisations simple and best practice led suggestions to make the digital work place more secure. Each of these individual services are tailored to take lesser than 2 weeks to complete at a fixed price.
UK government’s National Cyber Security Centre (NCSC) drives DQ whose professionals come with years of experience in various areas of Cyber security and industry leading certifications such as the CISSP and CESG.
We have been selected to the UK Public sector DOS and G-Cloud frameworks to offer these services
Security governance
- Develop, document & implement an organisation specific security policy including standards, guidelines and procedures
- Security policy compliance review
- Security governance & organisation set – up
- 3rd party security governance review
Deliverables:
- Security policy, standards, baselines, guidelines and procedures
- Review report with recommendations
- Organisation chart, roles and responsibilities
Security risk management
- Security Information Risk Advisory
- Cyber security risk management
- Security risk and vulnerabilities’ assessment
- Vulnerability reporting
- Security control review and recommendations
- Threat Analysis for the organisation
Deliverables:
- List of risks, vulnerabilities, threats and mitigating actions
- Hybrid – (Qualitative and Quantitative) risk assessment
- Prioritised list of threats and suggested defense
- Residual risk and Countermeasure benefit evaluation report
NETWORK SECURITY
- Network vulnerabilities and controls review(firewall, IDS, encryption, protocols)
- Implementation of Encryption, certificate & key management (for data at rest, in transit and in use)
- Denial of Service (DoS) awareness and protection
- Acquiring, managing and disposing of network devices
Deliverables:
- Network controls recommendations
- Encryption best practice recommendations
- Certificate and key management reports
- DoS protection best practice
DATA SECURITY
- Data remanence & life cycle management
- Data Governance establishment
- Data Privacy impact Assessment
- Data and asset classification
- Database security management
Deliverables:
- Data lifecycle assessment report
- Data governance organization chart with roles and responsibilities
- Data privacy impact and recommendations report
- Data classification report
- Database vulnerabilities report
SECURITY ARCHITECTURE
- Security solution design, architecture, development & maintenance
- Security architecture service(implementing defence in depth)
- Software design review
- Security documentation review – NDA, NCA, MOU, SLA, policies
- Digital service security review
Deliverables:
- Cyber security design principles
- Secure development and deployment principles for software
- Security architecture anti-patterns
- Security document templates
Security assessments and audits
- Security review of mergers & acquisitions
- GDPR compliance review
- ISO security audit ( NCSP CAF 2.0)
- Web application penetration testing (OWASP)
- Software code security review
- Product and service security assessment
- Email security review
- Security operations review
- Security testing reviews & follow ups
- Security tool review
- Product security evaluation (using common criteria)
Deliverables:
- Comprehensive review reports
- Audit reports
- Security improvement recommendations
- Penetration test reports
- Network vulnerabilities’ report
- Performance test reports
COMPANY ASSET SECURITY
- Review of software, hardware, people and physical assets’ security
- Formulation of asset strategy
- Asset classification and prioritization for security
- Configuration management review
- Capacity management review
- Personnel security recommendations
- Secure sanitization of storage media
- Mobile device security management
- End-user device security
Deliverables:
- Comprehensive review reports with improvement considerations and evaluation
- Asset strategy
- Configuration management strategy
- Capacity management strategy
- Secure asset database design
Planning to recover from disasters
- DR & BCP – planning & review
- System resilience review
- Business Impact Assessment
- Major security incident review process
Deliverables:
- Business continuity plan
- Disaster recovery plan
- DR/BCP organization structure, roles and responsibilities
- Review and assessment reports with recommendations
- Implementation of Security incident review process
Security of operational technology (OT)
- Security management of industrial control systems
- Cyber-physical, Embedded systems, Firmware security review
- IoT systems security review
- Connecting OT and Enterprise systems securely
Deliverables:
- DoS protection guidance
- Review and assessment reports with recommendations
- OT security policy
- API Security assessment report
Security processes
- Identity & Access Management reviews
- Joiners, movers and leavers process reviews
- Change management review
- Secure password administration
- Security incident management
Deliverables:
- Identity and Access management best practice recommendations
- Privilege creep, Excess privileges and other vulnerabilities’ assessment
- Best practice security processes guidance
- SIEM process implementation
CYBER ATTACK PREVENTION
- Preventing attacks & defence
- Threat profile
- Logging monitoring & audit set-up
- Security Awareness Training (Execs, Managers, End-users)
Deliverables:
- Organisation cyber attack potential, profile and defense suggestions
- Tailored awareness, training and education
SECURITY IN THE CLOUD
- Cloud contracts review
- Cloud security review
- Cloud migrations & suitability assessments(security focussed)
- SaaS, PaaS and IaaS service security review
Deliverables:
- Cloud security best practice
- SaaS security best practices
- PaaS and IaaS security best practices
- Connecting cloud services securely guidance
- Cloud migration checklist
- Organisation cyber attack potential, profile and defense suggestions
- Tailored trainings
CYBER SECURITY CURRICULUM AND COURSE
- Tailored around (ISC)² internationally acclaimed cyber security courses
- Prepares participants to get certified as an Associate CISSP
- Two courses – basic and advanced
- Tailored for university students and professionals
- Courses delivered both online and in classroom
- Assessment included
Deliverables:
- Tailored Cyber security curriculum and delivery