Implement and document information and IT security on a technical and organizational level with the support of our experienced and certified security consultants.
Develop, implement and document information and IT security
IT governance often requires documenting IT security. Developing security concepts and writing respective policies and guidelines can be a time-consuming and demanding endeavor, especially if you have to start from scratch.
We provide CIOs, CISOs / CSOs, compliance officers, data protection officers, IT governance, IT department heads and system engineers with best practice advice as well as tried and tested templates so they don’t have to reinvent the wheel.
- Tried and tested templates
- Best practice advice from over 2000 security projects
- IT and business university graduates
- Certified security experts (e.g. ISO Lead Auditor, CISSP, ITIL)
Below you find some examples of our security consulting activities:
A security roadmap is a planning instrument which defines individual security measures on a timeline of 1 to 3 years.
The security controls may have been defined in a previous risk assessment, penetration test or standard-based security audit (e.g. ISO 27001 or ISO 27002) and need to be scheduled according to their dependencies and prioritization.
We will support you in determining the right selection of security measures based on available resources, priorities, dependencies and cost benefit ratio. Usually, defining the security roadmap involves the following steps:
- Information gathering
- Draft timeline
- Workshop discussion
- Final roadmap
Data protection is a key pillar of IT compliance. Wherever personally identifiable and sensitive information exists (such as salary information, healthcare records, financial transactions), organizations need to make sure they protect such data according to applicable law.
In contrast, information protection deals with data which should be protected based on the organization’s own requirements (for example strategies, pricing models or manufacturing know-how).
Oneconsult has developed a tried and tested method to assess the data and information protection requirements and bring them together to define organizational and technical measures for implementation. Approach is mostly workshop-based.
Most information security standards require specific kind of documentation. For example in ISO 27001 and the respective controls of ISO 27002 (if selected) the following policies are mandatory:
- Information security policy
- Acceptable use policy (acceptable use of assets)
- Information classification policy
- Mobile device policy
- NDA (non-disclosure agreement)
- Clear desk and clear screen policy
Examples of concepts we may help you with in the form of reviews and second opinions are:
- Backup concept
- Incident response concept
- Security operations center (SOC) concept
- Data leakage prevention (DLP) concept
- Network zoning concept
One of our core areas of expertise is IT forensic readiness, which amongst others includes an IT forensics concept or digital forensics guideline.
Oneconsult also competently supports you in your decision-making process with product and solution evaluations that are optimally tailored to your requirements, with a special focus on information security.
Security Consulting Expertise
Our qualified consultants have performed a wide variety of consulting projects. Amongst other qualifications, they hold ISO 27001 Lead Auditor, CISSP, ITIL Foundation certificates. Our technical as well as conceptual expertise will help you get quick and practical results.
For definitions of information and IT security terms please refer to our glossary.
If a web application does not change the session token of a user when he logs in an attacker may use this property for a session fixation attack. Hereby he tricks a victim into using a given session token to login. After the victim has logged in the attacker may use the known token to take over the victim’s session. This is a form of session hijacking.
The brute-force attack is a very old type of attack on the user/password authentication where all kinds of character combinations are checked to guess a password. This is usually very time-consuming and triggers suspicious system behavior, which may be easily detected. A more advanced type of the brute-force attack is the dictionary attack. Instead of checking all character strings, only a specific set of words from a dictionary is used for the attack. This may considerably reduce the time needed to crack a password, but it may also result in a password not being found.
A WLAN audit is an intensive, unprivileged and privileged manual search for vulnerabilities in a WLAN network.
Depending on the scenario, different test vectors will apply for technical security audits: Remote testing (for example via Internet into the DMZ or via 3G/WLAN connection to a mobile device), within the DMZ, in the LAN / WAN, via interfaces. Tests carried out in the LAN / WAN may be conducted on-site or via remote access.
Reversal (Test Type)
IT security audits may be characterized according to the degree of information the testers and the administrators of the systems in scope have when the tests are carried out. The OSSTMM defines reversal as the audit type where the testers have full knowledge about the systems to be tested prior to the audit whereas the administrators of the tested systems are not aware of the security audit. The OSSTMM also refers to this type of test as Red Team exercise.