INFORMATION SECURITY AWARENESS & TRAINING

Cyber Gate Defense Consultant delivered a one day a customized awareness training session for a team of engineers who have joined a utility company within the last one year. The training covered basic principles and technologies about OT security, the importance of security operation principles, and what makes an operation secure.  The training concluded with the students undertaking a security assessment, to enforce the learning.

ACCESS MANAGEMENT & AUTHORIZATIONS

Delivered and executed a plan for migrating a number of separate Access Control Systems into a single centralized platform based on physical security information management (PSIM) technology. The task also involved our consultant to analyze existing access control related policy by conducting a Gap Analysis which has identified key opportunities for improving the incident escalation procedures which involves third party suppliers’ support.

BUSINESS CONTINUITY DISASTER RECOVERY

Our client is a company with a worldwide presence. IT Disaster Recovery Plan forms part of their overall business continuity plan. The Business Continuity plan was developed to help protect the client’s critical assets including their IT systems, core communications and business information systems. The systems within scope included CRM, email, file servers, HR and finance. The solution was a cloud based and designed to allow the client to continue operation during an interruption or when access to the site is prohibited. Testing results demonstrated the solution conformed within the KPI target set by the client.

INFORMATION SECURITY COMPLIANCE

The customer is a utility company required an independent assessment of its current Process Control Domain (OT) security standard and procedures including the current security operating model against relevant standards including but not limited to:

The primary objective of the project was to perform an independent risk based audit to assess OT security governance, security processes and procedures, security configuration controls implementation in the systems being used and the physical area of where these controls are implemented and propose an improvement. A strategy comprising a design of a new or improved controls that comply with ISA 62334, relevant standards and ensure robust and resilient operation. The result of this audit discovered weaknesses/gaps with respect to security best practices and standards in OT security governance including policies and procedures; weaknesses in security configuration controls in operating systems, network devices, and the system that are being used; business continuity management; and physical security of the control areas. The audit team followed the ISACA’s IS Audit and Assurance Standards; Professional Practices Framework for IS Audit/Assurance. Cyber Gate Defense team also proposed a strategy for:

In addition to the audit and recommendation, we also ensured that all processes, procedures and tools which were created during the audit repeatable utilized and knowledge was transferred to relevant teams. A wider and systematic knowledge transfer process was created for all staff.

SECURITY TOOL

An Cyber Gate Defense security consultant recently worked with a customer to develop a tool for controlling and monitoring critical systems for their 24 x 7 Network Operations Centre (NOC). The consultant worked with key stakeholders including end user and design architect to guide the engineers and developers to determine what requirements were necessary to ensure a secure and functioning product which needed to reside on the network. The tool enabled the client to create digital certificate easily without the need to use KeyTool included in Java Components. The KeyTool is very useful but do not have the GUI application, so users felt uncomfortable using it. We developed the GUI application which works on KeyTool.

ELECTRONIC DOCUMENT & RECORDS

Private memos, letters, diplomatic communications, strategic plans and roadmaps, are some of the many official documents found insecure in various organizations. Cyber Gate Defense security experts designed, developed and managed the rollout of an Electronic Document and Records Management system (EDRM) for a large bank. Our consultant provided advice and support during the development of a customized information handling model that safeguarded information flow between authorized users/systems. The model also prevented information to flow to unauthorized users/systems. Digital watermark technology was used to help identify key words in the process. A baseline for data security and the requirements for a standard user were identified. In addition, an access control level database was designed to integrate with Active Directory. This solution ensured that information was labelled and classified. Access was only restricted to authorized users.

INFORMATION SECURITY RISK MANAGEMENT

Working within an Oil & Gas company, Cyber Gate Defense Consultants developed a cyber security framework aligned with, and prioritized, according to client business needs. A simple risk assessment that looked at the operational environment was conducted in order to determine the likelihood of a cyber-security event and the impact that the event could have on the organization. Detailed risk assessments on individual facilities however follwed once the framework has been developed. This step enabled the project to build the business case for the framework and act as a reference point when prioritizing security controls, implementation, milestones and enable the business to answer ‘why are we doing this, what risk is it mitigating?” when new measures are challenged.

Cyber Gate Defense consultant formed a team to conducted a detailed risk assessment addressing physical and cyber security threats, internal and external threats and consider hardware, software, and information as sources for vulnerabilities. Considering all aspects of the client’s assets, including unintended changes in system configuration brought about by maintenance, temporary supplier connections to the system for support and even subtle changes in supplier design that could introduce new vulnerabilities through spare parts or upgrades, which should be considered and/or tested in the same manner as the original system components. We applied the methodologies documented in IEC 62443 series taking into consideration the client specific framework: Essentially the objective was to provide a repeatable process capable of determining and implementing the appropriate security requirements.