Consultancy

Reduce your workload, delegate time-consuming technical and complex tasks, and make the most of limited cyber security budgets with our complete range of cyber security consultancy services. Choose to engage with us on the basis that suits yours and your organisation’s changing needs, and mix and match services to create an overall solution guaranteed to strengthen security posture.

No disruption to business as usual, rapidly improved understanding of cyber risk, and the best use of available cyber security resources.

Cyber Security Consultancy

See your risk profile more clearly than ever. Work with us and capitalise on our many years’ of industry experience – we’ll help simplify your risk profile and break down each element in a way that everyone across the business will understand. Armed with a strong understanding of current risks, you can quickly and efficiently accelerate next steps towards deciding on and implementing changes to support your organisation’s security posture.

Your cornerstone for cyber security

Few things are certain, but an effective cyber security strategy always begins with risk management. Before any controls designed to mitigate risk are implemented, achieving a good enough understanding of your business and your systems is essential to inform where vulnerabilities exist and exactly what is required to minimise exposure to cyber threats.

Risk management is a key pillar within any overall governance and compliance consultancy service that we offer. It underpins every cyber security related policy, practice and process implemented to enable businesses to operate safely, and to thrive, and is embedded into everything we do.

Let’s embark on your risk management journey together. We promise impartial expertise and advice to manage people, process and technical risks according to the maturity of your organisation.

Collaborate. Assess. Report. Evolve.

Effective risk management relies on a mix of technical controls, Board-level engagement and commitment to minimise risk, practical policies and processes, incident management, business continuity planning and tools in place to identify weaknesses as they emerge.

Ask us about our proprietary CARE methodology, designed to ensure your investment in risk assessment is and risk management continues to generate value long-term.

ISO27005 information security risk management implementation

Tailored risk assessments focussing on specific categories of risk, e.g. privacy risk assessments undertaken as part of a General Data Protection Regulation (GDPR) readiness assessment

Legacy HMG Information Assurance Standard No. 1 technical risk assessment method

OCTAVE Allegro, Attack Trees, or other methods on request

We work with organisations large and small and offer various options based on the culture, context and regulatory environment of your organisation. Smaller organisations benefit most from the IASME standard (Information Assurance for Small and Medium Sized Enterprises). All risk assessments are developed based on up-to-the-minute threat intelligence feeds and renowned knowledge sharing resources.

Is your IT environment built to last?

Optimise security spend, dramatically reduce risk, minimise disruption and enhance stakeholder satisfaction when you get proactive about assessing and addressing potential risks in new scenarios or environments.

Security Architecture refers to the process in which security features in the design of systems, and you’ll also hear it referenced as secure-by-design. Building security into the design of systems and products is proven to be much more effective than applying retrospective changes, patches or updates to solve security issues on a case by case basis. And due to the highly reproducible nature of Security Architecture, investing in this process once will set you up for limitless implementations in the future.

We’ll work closely with you to clearly document in-depth security control specifications recommended to optimise the security of your systems from the outset.

Our four-step Security Architecture process includes an initial risk assessment, security architecture and design, implementation, and ongoing monitoring and management of threats and vulnerabilities.

Is your head in the Cloud?

For the majority of organisations, the Cloud represents a great deal of promise and possibility. More flexibility, lower costs, more freedom for the hybrid workforce to thrive.

Cloud migration certainly comes with many benefits, but it’s more important than ever to ensure the cost of a potential data leak or breach doesn’t outweigh the convenience. The NCSC came up with 14 Cloud Security Principles. Learn about them here.

Work with us to ensure third party related risks are minimised, managed and mitigated, contribute towards boosting overall productivity, and enable everyone else to get on with their work wherever they’re most comfortable.

Our consultants are ISO27001 lead implementers and assessors for the Cyber Essentials Certification Scheme, equipped with the expertise to audit technical controls including cloud systems.

Stratia Cyber is trusted by Her Majesty’s Government to advise on and deploy cloud solutions.

We’re certified by the National Cyber Security Centre to deliver Security Architecture and Risk Management consultancy to their exacting standards. We’re proudly independent and promise to provide impartial recommendations every step of the way. We stick to a no jargon policy in all reports, documentation and outputs we deliver.

Cyber Security Testing and Assessments

Let’s start at the beginning. Test your systems, including advanced infrastructure and application health checks, to understand current levels of cyber risk and create your benchmark for improvement. Use testing outcomes and reports to communicate your business case for cyber security to stakeholders, budget holders and decision makers.

Identify unknown vulnerabilities to enhance prioritisation of cyber security resource

Gain confidence in the security of your IT environments with a comprehensive view of actual cyber risk

Make smarter budget decisions with the information you need to allocate resource most effectively

CREST accredited Penetration Testing Services

Find system weaknesses vulnerable to exploitation and mitigate the risk of unauthorised access to your IT systems and information assets.

Our expertise covers:

Infrastructure vulnerability and penetration testing
Web applications vulnerability and penetration testing incl. OWASP domains
Mobile device and applications penetration testing
ICS and SCADA systems assessments

Our rigorous testing adheres to industry standard scoring (Common Vulnerability Scoring System) and uses a blend of tools and techniques to assess the following:

Risk assessments based on vulnerability and penetration testing
Business processes
Physical security of buildings and boundaries

Colleague awareness of cyber security risks, cyber security culture and colleague behaviours relating to cyber security

Combination manual and automated, static security code review

Most application-level attacks are focused on abusing the processing of user input to force execution that was not originally intended and, potentially, exposing sensitive data. A review of the application source code can reveal potential weaknesses and vulnerabilities that are significantly harder to detect as part of a live, active test of the service.

Our approach follows major best-practice guidelines such as OWASP, encompassing:

Automated static analysis tools
Manual verification and validation
Further manual inspection processes for identifying unique weaknesses in your specific application structure
Manually written examples of code samples that satisfy remediation recommendations
Written in the context of applicable CWEs (Common Weakness Enumerations)

By reviewing your application’s source code, we can identify exactly how application flow and user data are managed from end to end. This level of insight is invaluable for identifying unique vulnerabilities that are specific to your implementation.

Manual, scheduled or continuous vulnerability scans

Vulnerability scanning can be performed as a one off testing activity, or as an ongoing process to continuously test and improve your systems.

Continuous scanning for vulnerabilities is the most dynamic way to keep pace with the ever-changing threat landscape and the people-related risk.

Ongoing vulnerability scanning is included in our Cyber Security-as-a-Service option.

We will supply and source qualified teams and individuals to the CREST, SANS, ISC2 and Cyber Essentials standards, based on your individual needs. Our Cyber Security Testing and Assessments services include advanced infrastructure and application health checks.

Case studies

Flatiron Health UKView / Download pdf

Medic BleepView / Download pdf

The Nichols GroupView / Download pdf

Student Loans Co.View / Download pdf

Critical Infrastructure

Securing critical infrastructure is vital to maintaining economic stability, public health and safety, and normalcy in day to day life. Ensure compliance, protect our society, and keep the world moving with the support of our certified team of cyber security experts.

You need to know about NISD

All businesses considered as part of critical sectors including financial services, health, water, energy, transport and telecommunications are required to regularly assess risk and ensure appropriate controls are in place.

This Directive also applies e-commerce platforms such as online marketplaces, an online search engines and cloud services providers*.

Operator of Essential Services	Digital Service Providers
	The scope of those who have to comply with NISD is limited to "those companies whose loss of service could have the greatest impact on the UK economy, either directly or through impact on other companies". This includes Software as a Service companies but excludes micro and small businesses.
OESs and DSPs are responsible for ensuring that their suppliers have appropriate measures in place to ensure they are compliant.

It’s mandatory for OESs to be assessed against the NCSC NISD Cyber Assessment Framework (CAF)

Still unsure whether NISD applies to you? If you’re part of the supply chain of any of these types of providers, it may also be relevant to your business.

Demystifying compliance requirements like NISD can be a mind-boggling, stressful and resource-hungry task. We’ll support you with any actions you need to take to achieve compliance with the NCSC NISD Cyber Assessment Framework.

For more insights into the Cyber Assessment Framework, Sanctions and enforcement around implementing the NISD and reporting, read more in our News & Insights section.

*unless you are subject to sector specific regulation.

Attackers only need one way in

SCADA enables easy management of remote sensors and actuators, and has become an essential part of National Infrastructure.

A vast list of applications form part of the Supervisory Control and Data Acquisition (SCADA) system, from water level sensors in a water plant to heating controls in an office. It’s important to remember that the SCADA architecture is based on hierarchy with one central command point sitting at the top. Immensely convenient and efficient for organisations, one single target for attackers to exploit.

Our consultants specialise in ICS and SCADA security, and are fully compliant with the US NERC Critical Infrastructure Protection (NERC CIP) Standards. Our experience covers everything from telemetry systems to power generation, including UK Civil Nuclear.

Cyber Security as a Service (CSAAS)

Get the level of assurance you need to be able to focus your efforts on doing business, and let us take care of the rest.

Cyber security is essential for all types and sizes of organisation, but not everyone needs or has the resources for an in-house cyber security function. Choose Cyber Security as a Service to benefit from expert consultancy trusted by HM government without the risky investment in building and maintaining your own security team.

The flexible and financially smart option for engaging with the Board on cyber security

Increasingly aware of your responsibility to protect your organisation from cyber threats? Relieve the pressure and look to us as your virtual CISO to determine your cyber security strategy and how your organisation will achieve its security objectives.

Improve security posture in an instant - we’ll put cyber security on the table in front of Board members and other key stakeholders with a responsibility to investors, shareholders, its employees and the public, to ensure that relevant provisions are put in place to minimise the risk and consequences of cyber-attack, and to observe relevant governance.

Clear communication as standard - rely on our specialists to communicate complex, technical cyber security topics in plain language and achieve maximum engagement with senior stakeholders and decision makers. We’re experts at influencing others to adopt a positive attitude towards cyber security, and guarantee it will remain on the Board’s agenda for the duration of our engagement.

Optimise security spend - vCISO services are the best option for organisations keen to minimise cyber risk without capacity to finance and build an in-house security function.

Accredited and impartial advice - we’re certified by the National Cyber Security Centre to provide cyber security consultancy, we’re trusted by HM government to provide advice and secure IT systems, and we’re proudly independent. All our recommendations are product and vendor agnostic, and that will never change.

Rest assured that security is a priority throughout your entire supply chain

Tackling third party risk assessments can feel like a daunting and complicated task. Take advantage of our expertise and accredited portfolio of services, and hand the challenge over for ultimate peace of mind.

Based on each customer’s specific third party risk management requirements, we’ll recommend a series of steps to bring vendors and other service providers in line with the security frameworks and standards that you work hard to comply with.

Rely on us to combine recommendations and guidance based on industry best practice and certified knowledge of the major security frameworks. We’ll work closely with you to develop a security toolkit to incorporate the standards and frameworks, such as the NCSC Cyber Assessment Framework or ISO27001, required for compliance. For organisations in Defence, we can support you with achieving compliance with the Defence Cyber Protection Partnership (DCPP) MOD standard.

Evidencing compliance becomes straightforward, accompanied with meaningful analysis and remediation reports.

Instil greater confidence in your organisation’s security posture

Want the secret to restoring trust?

In the event your organisation does experience a cyber security incident, just figuring out where to begin with resolution and recovery is enough to create further chaos. Protect your organisation’s future when you put your customers at the heart of your response and recovery strategy. We’ll support you closely with the recovery element to ensure you’re in the best possible position to get back to business as usual, as fast as possible.

Our approach aligns with CREST Incident Response standards, and includes guidance as well as hands-on incident support

Our proven implementation process delivers two phases aligned with the CREST CSIR Framework:

Initial incident investigation and infrastructure scoping
Cyber incident response plan covering threat discovery, analysis, containment, eradication and recovery

Government, defence and industry continue to trust us to provide cost-effective and complete Cyber Readiness and Response services, designed and based on our collective years of highly valuable experience.

We’ll recommend configuration changes where issues are detected to support your overall efforts to manage and mitigate the risk of a breach.

Pinpoint where your systems need to be stronger

We use trend analysis, Zero-Day and Patch impact predications to identify the most serious business risks, and deliver plain-speaking reports and recommendations to facilitate smooth and prompt remediation.

Improve your visibility and understanding of your network security with a Vulnerability Assessment. Remediate vulnerabilities faster, enable smarter decisions based on thorough risk assessment of identified weaknesses and allocate security resources more efficiently with the help of highly accurate and specific data.

Our capabilities span manual, scheduled and continuous scanning using industry standard physical scanning tools deployed on premise, or virtual deployment from our secure cloud console. Our vulnerability scans include your perimeter, your internal network, and your cloud environments (such as Amazon, Azure). You’ll have the option to generate multiple custom reports based on deep scanning, tailored to the level of insight required by various stakeholders. All our reports include context for critical issues identified based on industry-leading knowledge bases. In the event of an anomaly, you’ll have the information you need to manage the situation in accordance with your organisation’s risk appetite.

Gain maximum visibility of existing and emerging vulnerabilities:

Scan complex internal networks, even with overlapping private IP address spaces
Identify which OS, ports, services and certificates are on each device on your network
Minimise false positives thanks to Six Sigma accuracy rate
Avoid redundant data - get a comprehensive examination of your network’s vulnerabilities based on data generated at various points in time and levels of detail

Comply with the law, protect everything you’ve worked hard to achieve

General Data Protection Regulation (GDPR)

The GDPR applies to the processing of personal data. Personal data (or Personally Identifiable Information (PII)) can be anything from a name, an email address, an IP address, and financial information, to information about political, sexual or religious preferences. It’s an extensive piece of legislation requiring organisations that store, or otherwise process data belonging to EU citizens or residents to abide by a set of data protection rules and principles and is applicable to any company or (government) organisation, no matter its size.

GDPR for businesses outside of the EU

Under certain conditions, the GDPR applies to businesses outside of the EU. When non-EU companies offer goods and services to European Data Subjects or monitor their behaviour, the GDPR applies. This is because the aim of the GDPR is to protect data belonging to EU citizens and residents, or European Data Subjects. This translates into the rule that the GDPR applies regardless of where the data processing takes place.

Mind the gaps with a GDPR Gap Analysis

The best way to achieve compliance with the GDPR is to begin with the basics. We’re experts at helping businesses to understand what data you hold, where it is, and who’s using it or has access to it.

Data mapping empowers organisations to audit how their data is currently processed, and whether these processes meet the GDPR legislation.

Gap Analysis provides you with a clear strategy for working towards achieving full compliance, based on risk criteria including financial loss, impact on data subjects, and reputation.

UK Data Protection Bill

Introduced to replace the Data Protection Act 1998, this bill includes stronger sanctions for non-compliance based on a more comprehensive framework for data protection in the UK.

What’s the difference between the UK Data Protection Bill and the GDPR?

The Bill is a complete data protection system. In addition to governing general data subject to the GDPR, it covers all other general data, law enforcement data and national security data. Furthermore, the Bill exercises a number of agreed modifications to the GDPR to make it work for the benefit of the UK in areas such as academic research, financial services and child protection.