Risk Assessment
To effectively manage risk, it is critical to identify all assets and data in your company. You cannot protect what you don’t know you have. From outdated operating systems to being in a high floodering area, a risk assessment will identify, assess, and prioritize the risk affecting most critical functions of your company.
Gap Analysis
After a risk assessment you will know your critical infrastructure and each associated risk. A Gap Analysis will identify whether there are adequate controls implemented to address the risks and determine whether they stack up to regulations and common standard. Performing a Gap Analysis on your organization lets you know where you stand, identifies areas requiring improvement to the overall security posture of your organization, and what controls are missing.
IT Third Party Assessments
After a Gap Analysis, you will know what controls to put in place. Once those controls are implemented, are they consistently being followed? Does each employee know the policies and procedures put in place? An IT Audit will test the controls and make sure they are effectively protecting the organization.
Penetration-Testing
After the IT Audit provides the assessment of whether your policies and procedures are enforced and effective, you should perform penetration testing to determine how well the technology works. A Penetration-Test will test for weaknesses and vulnerabilities in your network and throughout the organization. From testing social engineering to physical access, a Penetration-Test will bring all weaknesses out of the shadows.
Incident Response
Audits and Penetration-testing help keep the bad guys at bay and make you a harder target to infiltrate. However, even after all the tests and audits, the bad guys might still find a way in. Sometimes the fears come true, whether it is a Zero-Day attack, or an employee that just clicked the wrong thing in a Phishing email, Incident Response is critical to contain and remediate any breach.
Digital Forensics
After a breach can be a scary time but being attacked again is even scarier. Find out how the event happened and how to prevent it from happening again. Was it an inside job? Was it a Nation-State-Actor? What did they take? How did they take it? How long did they have access to my systems? Digital Forensics can answer all these questions and help with any legal issues that may arise as a result of a breach. Digital Forensics can make or break a case!
Security & Awareness Training
When your organization needs to establish a training program to meet regulatory compliance and is ready to establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise, we can provide customized live in-person or remote training to meet all your training needs.
CISO and VCISO
Stetson's team of Certified Chief Information Security Officers adds experience and knowledge to your organization without the cost of a full-time cybersecurity employee. Stetson's team is available for monthly and quarterly programs to assess and develop your cybersecurity program starting with governance, understanding the business mission, stakeholders, risks to your business units, technologies, and regulatory requirements.
Resources
