Consultancy

Your cornerstone for cyber security

Few things are certain, but an effective cyber security strategy always begins with risk management. Before any controls designed to mitigate risk are implemented, achieving a good enough understanding of your business and your systems is essential to inform where vulnerabilities exist and exactly what is required to minimise exposure to cyber threats. 

Risk management is a key pillar within any overall governance and compliance consultancy service that we offer. It underpins every cyber security related policy, practice and process implemented to enable businesses to operate safely, and to thrive, and is embedded into everything we do.

Let’s embark on your risk management journey together. We promise impartial expertise and advice to manage people, process and technical risks according to the maturity of your organisation. 

Collaborate. Assess. Report. Evolve.

Effective risk management relies on a mix of technical controls, Board-level engagement and commitment to minimise risk, practical policies and processes, incident management, business continuity planning and tools in place to identify weaknesses as they emerge.

Ask us about our proprietary CARE methodology, designed to ensure your investment in risk assessment is and risk management continues to generate value long-term.

We work with organisations large and small and offer various options based on the culture, context and regulatory environment of your organisation. Smaller organisations benefit most from the IASME standard (Information Assurance for Small and Medium Sized Enterprises). All risk assessments are developed based on up-to-the-minute threat intelligence feeds and renowned knowledge sharing resources.

Is your IT environment built to last? 

Optimise security spend, dramatically reduce risk, minimise disruption and enhance stakeholder satisfaction when you get proactive about assessing and addressing potential risks in new scenarios or environments.

Security Architecture refers to the process in which security features in the design of systems, and you’ll also hear it referenced as secure-by-design. Building security into the design of systems and products is proven to be much more effective than applying retrospective changes, patches or updates to solve security issues on a case by case basis. And due to the highly reproducible nature of Security Architecture, investing in this process once will set you up for limitless implementations in the future.

We’ll work closely with you to clearly document in-depth security control specifications recommended to optimise the security of your systems from the outset.

Our four-step Security Architecture process includes an initial risk assessment, security architecture and design, implementation, and ongoing monitoring and management of threats and vulnerabilities.

Is your head in the Cloud? 

For the majority of organisations, the Cloud represents a great deal of promise and possibility. More flexibility, lower costs, more freedom for the hybrid workforce to thrive.

Cloud migration certainly comes with many benefits, but it’s more important than ever to ensure the cost of a potential data leak or breach doesn’t outweigh the convenience. The NCSC came up with 14 Cloud Security Principles. Learn about them here.

Work with us to ensure third party related risks are minimised, managed and mitigated, contribute towards boosting overall productivity, and enable everyone else to get on with their work wherever they’re most comfortable.

Our consultants are ISO27001 lead implementers and assessors for the Cyber Essentials Certification Scheme, equipped with the expertise to audit technical controls including cloud systems.

Stratia Cyber is trusted by Her Majesty’s Government to advise on and deploy cloud solutions.

CREST accredited Penetration Testing Services

Find system weaknesses vulnerable to exploitation and mitigate the risk of unauthorised access to your IT systems and information assets.

Our expertise covers:

• Infrastructure vulnerability and penetration testing
• Web applications vulnerability and penetration testing incl. OWASP domains
• Mobile device and applications penetration testing
• ICS and SCADA systems assessments

Our rigorous testing adheres to industry standard scoring (Common Vulnerability Scoring System) and uses a blend of tools and techniques to assess the following:

• Risk assessments based on vulnerability and penetration testing
• Business processes
• Physical security of buildings and boundaries

Colleague awareness of cyber security risks, cyber security culture and colleague behaviours relating to cyber security

Combination manual and automated, static security code review 

Most application-level attacks are focused on abusing the processing of user input to force execution that was not originally intended and, potentially, exposing sensitive data. A review of the application source code can reveal potential weaknesses and vulnerabilities that are significantly harder to detect as part of a live, active test of the service.

Our approach follows major best-practice guidelines such as OWASP, encompassing:

• Automated static analysis tools
• Manual verification and validation
• Further manual inspection processes for identifying unique weaknesses in your specific application structure
• Manually written examples of code samples that satisfy remediation recommendations
• Written in the context of applicable CWEs (Common Weakness Enumerations)

By reviewing your application’s source code, we can identify exactly how application flow and user data are managed from end to end. This level of insight is invaluable for identifying unique vulnerabilities that are specific to your implementation.

Manual, scheduled or continuous vulnerability scans

Vulnerability scanning can be performed as a one off testing activity, or as an ongoing process to continuously test and improve your systems.

Continuous scanning for vulnerabilities is the most dynamic way to keep pace with the ever-changing threat landscape and the people-related risk.

Ongoing vulnerability scanning is included in our Cyber Security-as-a-Service option.

You need to know about NISD 

All businesses considered as part of critical sectors including financial services, health, water, energy, transport and telecommunications are required to regularly assess risk and ensure appropriate controls are in place. 

This Directive also applies e-commerce platforms such as online marketplaces, an online search engines and cloud services providers*.

It’s mandatory for OESs to be assessed against the NCSC NISD Cyber Assessment Framework (CAF)

Still unsure whether NISD applies to you? If you’re part of the supply chain of any of these types of providers, it may also be relevant to your business.

Demystifying compliance requirements like NISD can be a mind-boggling, stressful and resource-hungry task. We’ll support you with any actions you need to take to achieve compliance with the NCSC NISD Cyber Assessment Framework.

For more insights into the Cyber Assessment Framework, Sanctions and enforcement around implementing the NISD and reporting, read more in our News & Insights section.

*unless you are subject to sector specific regulation.

Attackers only need one way in

SCADA enables easy management of remote sensors and actuators, and has become an essential part of National Infrastructure.

A vast list of applications form part of the Supervisory Control and Data Acquisition (SCADA) system, from water level sensors in a water plant to heating controls in an office. It’s important to remember that the SCADA architecture is based on hierarchy with one central command point sitting at the top. Immensely convenient and efficient for organisations, one single target for attackers to exploit. 

The flexible and financially smart option for engaging with the Board on cyber security 

Increasingly aware of your responsibility to protect your organisation from cyber threats? Relieve the pressure and look to us as your virtual CISO to determine your cyber security strategy and how your organisation will achieve its security objectives.

• Improve security posture in an instant - we’ll put cyber security on the table in front of Board members and other key stakeholders with a responsibility to investors, shareholders, its employees and the public, to ensure that relevant provisions are put in place to minimise the risk and consequences of cyber-attack, and to observe relevant governance.

• Clear communication as standard - rely on our specialists to communicate complex, technical cyber security topics in plain language and achieve maximum engagement with senior stakeholders and decision makers. We’re experts at influencing others to adopt a positive attitude towards cyber security, and guarantee it will remain on the Board’s agenda for the duration of our engagement.

• Optimise security spend - vCISO services are the best option for organisations keen to minimise cyber risk without capacity to finance and build an in-house security function.

Accredited and impartial advice - we’re certified by the National Cyber Security Centre to provide cyber security consultancy, we’re trusted by HM government to provide advice and secure IT systems, and we’re proudly independent. All our recommendations are product and vendor agnostic, and that will never change.

Rest assured that security is a priority throughout your entire supply chain 

Tackling third party risk assessments can feel like a daunting and complicated task. Take advantage of our expertise and accredited portfolio of services, and hand the challenge over for ultimate peace of mind.

Based on each customer’s specific third party risk management requirements, we’ll recommend a series of steps to bring vendors and other service providers in line with the security frameworks and standards that you work hard to comply with.

Rely on us to combine recommendations and guidance based on industry best practice and certified knowledge of the major security frameworks. We’ll work closely with you to develop a security toolkit to incorporate the standards and frameworks, such as the NCSC Cyber Assessment Framework or ISO27001, required for compliance. For organisations in Defence, we can support you with achieving compliance with the Defence Cyber Protection Partnership (DCPP) MOD standard.

Evidencing compliance becomes straightforward, accompanied with meaningful analysis and remediation reports.

Instil greater confidence in your organisation’s security posture

Want the secret to restoring trust?

In the event your organisation does experience a cyber security incident, just figuring out where to begin with resolution and recovery is enough to create further chaos. Protect your organisation’s future when you put your customers at the heart of your response and recovery strategy. We’ll support you closely with the recovery element to ensure you’re in the best possible position to get back to business as usual, as fast as possible.

Our approach aligns with CREST Incident Response standards, and includes guidance as well as hands-on incident support

Our proven implementation process delivers two phases aligned with the CREST CSIR Framework:

• Initial incident investigation and infrastructure scoping
• Cyber incident response plan covering threat discovery, analysis, containment, eradication and recovery

Government, defence and industry continue to trust us to provide cost-effective and complete Cyber Readiness and Response services, designed and based on our collective years of highly valuable experience.

We’ll recommend configuration changes where issues are detected to support your overall efforts to manage and mitigate the risk of a breach.

Pinpoint where your systems need to be stronger 

We use trend analysis, Zero-Day and Patch impact predications to identify the most serious business risks, and deliver plain-speaking reports and recommendations to facilitate smooth and prompt remediation.

Improve your visibility and understanding of your network security with a Vulnerability Assessment. Remediate vulnerabilities faster, enable smarter decisions based on thorough risk assessment of identified weaknesses and allocate security resources more efficiently with the help of highly accurate and specific data.

Our capabilities span manual, scheduled and continuous scanning using industry standard physical scanning tools deployed on premise, or virtual deployment from our secure cloud console. Our vulnerability scans include your perimeter, your internal network, and your cloud environments (such as Amazon, Azure). You’ll have the option to generate multiple custom reports based on deep scanning, tailored to the level of insight required by various stakeholders. All our reports include context for critical issues identified based on industry-leading knowledge bases. In the event of an anomaly, you’ll have the information you need to manage the situation in accordance with your organisation’s risk appetite.

Gain maximum visibility of existing and emerging vulnerabilities:

• Scan complex internal networks, even with overlapping private IP address spaces
• Identify which OS, ports, services and certificates are on each device on your network
• Minimise false positives thanks to Six Sigma accuracy rate
• Avoid redundant data - get a comprehensive examination of your network’s vulnerabilities based on data generated at various points in time and levels of detail

Comply with the law, protect everything you’ve worked hard to achieve

General Data Protection Regulation (GDPR)

The GDPR applies to the processing of personal data. Personal data (or Personally Identifiable Information (PII)) can be anything from a name, an email address, an IP address, and financial information, to information about political, sexual or religious preferences. It’s an extensive piece of legislation requiring organisations that store, or otherwise process data belonging to EU citizens or residents to abide by a set of data protection rules and principles and is applicable to any company or (government) organisation, no matter its size.  

Mind the gaps with a GDPR Gap Analysis

 The best way to achieve compliance with the GDPR is to begin with the basics. We’re experts at helping businesses to understand what data you hold, where it is, and who’s using it or has access to it.

Data mapping empowers organisations to audit how their data is currently processed, and whether these processes meet the GDPR legislation.

Gap Analysis provides you with a clear strategy for working towards achieving full compliance, based on risk criteria including financial loss, impact on data subjects, and reputation.

UK Data Protection Bill

Introduced to replace the Data Protection Act 1998, this bill includes stronger sanctions for non-compliance based on a more comprehensive framework for data protection in the UK.

What’s the difference between the UK Data Protection Bill and the GDPR?

The Bill is a complete data protection system. In addition to governing general data subject to the GDPR, it covers all other general data, law enforcement data and national security data. Furthermore, the Bill exercises a number of agreed modifications to the GDPR to make it work for the benefit of the UK in areas such as academic research, financial services and child protection.