Cyber Resilience, Information Security & Risk Management

CREDENTIALS

The current security threat landscape is replete with aggressive, tenacious and pernicious threats. Today’s attackers are typically highly trained, financially motivated and possibly in the employ of nation states. Our adversaries tend to have extensive monetary and human resources and the capability to deliver exceptionally well planned, fine-tuned and orchestrated attacks. Motivations now range from political influence, vandalism and theft of customer data and intellectual property to ransom and extortion on an industrial scale. Even more vexing are attacks aimed at subverting government processes that threaten our system of democracy.

Threats like these require an approach that can meet this challenge and the people to lead and deliver confidence in the face of adversity.

Sense of Security is appointed for our expertise, craft and excellence to ensure that our clients operate on foundations of resilience in the face of increasing cyber security threats.

Australia’s leading corporations and government bodies rely on Sense of Security through the

delivery of our comprehensive suite of cyber security products and services.

While traditional cyber security approaches have focused on preventative controls and compliance to standards, it is evident that a wider approach is required that minimises the susceptibility to attack by addressing security as close to the source as possible. This is the Shift Left philosophy where robust systems are built from the roots of integrity and confidence that enable us to prepare for, respond to and recover from cyber incidents and disruption.

Cyber resilience is essential to maintain business, enable continued service delivery, and retain the confidence of all stakeholders in the ecosystem, consumers, business and government alike.

Our experience demonstrates that clients implementing cyber security models that are based on the fundamentals of information and data security, are able to anticipate threats and respond to them more effectively.

Shift left

senseofsecurity.com.au2

Sense of Security is an industry recognised leader and trusted provider of cyber resilience, information security and risk management services.

Technical excellence, expert knowledge and outstanding attention to detail are at the heart of what we do at Sense of Security, and we’ve been wedded to that ethos since our inception in 2002.

Experienced & credentialed with context & understandingFor strong cyber security, organisations’ need a security partner with a heritage based on the foundations of technical fundamentals and a track-record for acting as a trusted advisor across the breadth and depth of our region’s most astute organisations.

Our professionals have a wealth of experience across the public and private sectors and hold the most sought-after certifications across the disciplines in which we operate. At the corporate level we are equally committed and demonstrate our diligence through external scrutiny. We maintain an independently audited ISO 27001 certification and have been long-term established partners on the PCI QSA, CREST and AWS Security Specialist programs.

While cyber security services are becoming more mainstream, and some service lines are becoming commoditised, we welcome the competition! This gives us the opportunity to showcase our capabilities and demonstrate our differentiating factors. We remain resolute to our values including maintaining a self-funded R&D function. Our research is renowned

worldwide, delivering thought-leadership to the community and positioning us at the cutting edge when it comes to defining services that are market leading, imperative and relevant.

Our clients are discerning and choose to engage with us because they seek the premium services we offer. Our services are aligned to undertaking engagements that are oriented to the context in which our clients conduct their business, demonstrating an understanding for their particular requirements in the context in which they operate. This is our ethos of ICU (Implication, Context & Understanding) and it underpins every aspect of our business.

With our expertise, we are engaged to develop cyber risk programs that address the strategic objectives and risk appetite of our client’s business. We are also appointed to scrutinise and test the effectiveness of solutions across the organisation, thereby validating the controls and delivering the highest degrees of assurance in the industry.

Trusted by governmentSense of Security supplies specialist information security and cyber risk management services to federal, state and local governments. We are eligible to serve these esteemed institutions through endorsements that we hold on all relevant supply and procurement panels across all jurisdictions in Australia. We are also one of only a few companies trusted to partner with the Australian Government to improve cyber security in the Indo-Pacific region.

Why Sense of Security

Sense of Security credentials 3

Benefits

Our culture is based on innovation and reinforced by integrity, ethics, quality, independence and value. We take our accountability to our clients seriously, and we work to conduct our business sustainably. Cyber security is an escalating long-term challenge that requires a continuous improvement program supported with appropriate resourcing, education and training. As industry thought leaders, we undertake a variety of social responsibility activities to educate the community on establishing and maintaining cyber resilience as a key objective.

When you partner with Sense of Security, you’ve taken the first step on a path to continued cyber resilience:

• We work with you to adapt your approach and strategy to the ever-changing requirements of cyber security to identify and understand key business risks and cyber-threat exposures.

• We tailor our services to you based on your security objectives and compliance needs in the context in which you operate.

• We establish the structures to deliver the strategic vision of the business, supported by effective cyber-risk reporting.

• We develop governance and risk management frameworks to support critical decision-making by your leadership team.

• We deliver managed services that enable our clients to operate with confidence.

• We have developed the most comprehensive repository of security advice covering all technologies and attack techniques backed by a standards, policies and procedures with proven success across all industry sectors.

• We offer the industry’s most comprehensive whole-of-business cyber security training program with coverage from the boardroom to the basement.

All sectors, all waysAs well as working with all levels of governments, we deliver security solutions for major Australian and international corporations across a range of sectors:

Banking and finance

Education

Food services

Government (Federal, State & Local)

Healthcare

Insurance

Resources

Retail

Service providers

Telecommunications

Technology

Utilities

Owners and operators of critical Infrastructure

senseofsecurity.com.au4

Our services

With the threat landscape intensifying, and new technologies being developed and deployed at speed, our services are highly sought after for their relevance and currency in a rapidly changing market. Whether your business is relying on online applications, big data, analytics, IoT, the cloud, and smart mobile devices our services will provide the coverage you need.

Cyber security advisory (Governance, Risk & Compliance - GRC)

Governance, Risk and Compliance (GRC) is a critical investment for your organisation’s long-term growth, value and sustainability. Proper governance and compliance will enhance your control, increase your profitability, and ensure you meet your legal and regulatory obligations.

GRC starts with assessing risks to your business and cascades from there. It’s an essential part of your long-term business planning.

Sense of Security will work with you to enhance your GRC performance and tighten your management system to deliver:

• a culture of risk management and awareness to support greater resilience to cyber security threats

• technical resilience to attacks across the ecosystem of people, suppliers and technologies in which you operate

• better risk-based decision making

• Information Security Management Systems that are operable, auditable and specific to the core of your business and your objectives

• supply chain security programs to bolster engagement with upstream and downstream partners

• systems that are auditable with adequate coverage for forensic activities where required

• computing environments to address all relevant legal and regulatory requirements and that will stand up to external scrutiny

• data governance programs to minimise the collection of data and maximise the protection of what is processed and stored

Security strategy and architectureSense of Security’s information security architecture service is designed to align with your enterprise architecture. We focus on ensuring that the security impacts of the business, information, application and technology architectures are addressed.

Our capabilities include:

• Conducting dynamic risk assessments to cover all attack vectors

• Implementing incident response strategies with playbooks for all current and emerging threats

• Validating identity, authentication and authorisation solutions to enforce privileged access management restrictions and role-based access controls.

• Developing frameworks of standards, guidelines, and best practices to manage cyber security-related risk

• Preparing strategies with actionable roadmaps to establish cyber security within the business, and to maintain a secure posture at all times through all business-as-usual activities and any incidents that may occur

• Cloud environments that are developed with a security first approach, baking security into DevSecOps activities and using automation to increase the speed of deployment and reduce friction across the agile service delivery lifecycle

• Developing and operating vulnerability management programs across infrastructure, cloud and application assets

• Assessing the security critical infrastructure deployments including SCADA Operating Environment.

5Sense of Security credentials

Technical assuranceCyber Security is becoming a high priority for most organisations as the range of Frameworks requiring both corporate and government compliance continues to grow. Sense of Security has the expertise to help organisations address required controls whilst validating the effectiveness of various security measures through the services offered by the Technical Assurance team. These include:

• Application and data security (thick clients, web applications, API’s and mobile applications)

• Cloud security (including microservices, containers and orchestration security for web scale deployments)

• Cyber threat and risk assessments

• Distributed Denial of Service (DDos) testing services

• Secure configuration assessments

• Enterprise rollout and endpoint security assessments (server and workstation)

• Human factor reviews

• Mobile and wireless security

• Operating system security

• Penetration testing

• Red team, blue team and purple team exercises

• Research and advisory

• SCADA security

• Secure application development practices

• VoIP security

Whole-of-business cyber security trainingSense of Security offers training at all levels of organisations, from operations through to Board advisory courses. Our programs include:

• Assessment services to develop and strategic whole-of-business awareness training program

• Board level foundations of cyber security courses and quarterly briefings

• Executive briefings

• Computer based training across all disciplines

• Simulated phishing attacks

• Gamified cyber risk modelling exercises

• Gamified denial of service resilience exercises

• Purple team exercises to simulate cyber-attacks and operational response

• Incident response training

• Supply chain attack simulations

• Gamified secure application development programs

• Secure web application development programs

• Secure mobile application development program

senseofsecurity.com.au6

Our core product suite

Technical Assessment and Assurance

• Penetration testing

• Application and data security

• Human factor tests

• Mobile and wireless security

• Configuration Assessments

• Cloud, infrastructure, container and orchestration security (DevSecOps)

• Red team, blue team and purple team exercises

• Bespoke hardware, software and IoT device reviews

• ERP platform reviews and penetration testing

Security Strategy and Lifecycle

• Cloud service provider security risk management framework

• Cyber threat and risk assessment

• Privileged Access Management, Authentication and Authorisation assessments

• Frameworks of standards, guidelines, and best practices to manage cyber security-related risk

• Security strategy and roadmap

• Dynamic Risk Assessment and Risk Management Frameworks

• Supply Chain Security Assessments

• Vulnerability Management Programs

Cyber Security Advisory (GRC)

• Cyber Resilience, Incident Response and Incident Management

• Security standards, assessments and compliance (ISM, PSPF, ASD Essential 8, APRA, VPDSS, NSW Cyber Security Policy, ISMF, IS-18, PCI DSS, IS27001))

• Cloud computing security governance

• Development of Information Security Management Systems (ISO 27001)

• Payment Industry Data Security Standard (PCI DSS) assessments

• Supply Chain Security Programs

• Data Governance

• Privacy and Personally Identifiable Information (PII) data security

Training

• Foundations of cyber security

• Board and executive briefings

• Computer based training across all disciplines

• Simulated phishing attacks

• Gamified training (risk, development and incident response)

• Incident response training

• Secure web and mobile application development programs

7Sense of Security credentials

CyberCX is a company that brings together Australia’s best cyber security professionals to deliver an end-to-end cyber security services platform for Australian enterprise and government customers.

With domain expertise covering Consulting & Advisory; Security Assurance; GRC; Integration & Engineering; Managed Services; Incident Response & Digital Forensics; Education & Training, CyberCX is an expert partner offering the most comprehensive cyber capability in Australia.

We are resolute in our mission of protecting and defending Australian enterprise and government from cyber security threats.

Sense of Security is a founding member company of CyberCX

Please call us today to discuss how our security solutions can help protect your most vital assets.