Services
A good security program provides the big picture for how you will keep your company’s data secure. It takes a holistic approach that describes how every part of your company is involved in the program.
Cyber Security Assessment
As the economy begins to recover, the need for cost cutting continues and increasingly complex business risks are creating new pressures. CIO and IT Risk organizations face new demands. They must be accountable for their organizations’ IT governance systems, and can expect independent challenges from shareholders, unprecedented regulatory scrutiny, and new criteria for performance. In response to these new pressures, organizations may respond to these challenges in a piecemeal or uncoordinated manner because the demands compete for management’s time and available resources.
The result is a patchwork of process monitoring and regulatory reporting tools that potentially increase the costs and risks associated with these activities. ARCA recognize that by combining process monitoring and regulatory reporting tools we can eliminate tools, streamline and automate testing, and take cost out of compliance to increase the effectiveness of an organisation’s threat and vulnerability management, ARCA professionals deliver integrated end-to-end services that address prevention, detection and correction .
An alternative to a piecemealed approach to governance, risk, and compliance (GRC) is to architect an IT enterprise tool set model that brings together ITIL process management with risk and compliance activities to streamline these efforts efficiently. Such a model enhances the speed of communication, instills agility into critical governance efforts, points the way to emerging risks, and helps clarify the organization’s IT strengths and weaknesses Basically, a GRC system allows you to pull together policy, compliance, risk, remediation, data archiving, and reporting information all into one tool.
A GRC system can help in inventorying and classifying data, and in documenting and monitoring the required security controls. Such a tool can help aid in a more efficient and effective approach to privacy and information security, organization-wide; and ultimately can help lessen the burden of the end-user and/or information technology staff.ARCA GRC Holistic Model provides a structure for aligning risk management and compliance activities with governance efforts
Governance, Risk, and Compliance (GRC)
Security Services
-
Security policy and standards guidance
-
supplier and third-party vendor assessments.
-
Strategy – our security program strategy services provide clarity around security strategy and policy design
-
Architecture – our security architecture and Implementation services help navigate complex environments, apply methodologies and incorporate leading practices to ensure success
-
Risk – our enterprise risk and compliance services help to address gaps, manage risk and allocate resources to better protect your organization
-
Threats – our threat and vulnerability management services help uncover intermediate threats and address the root cause of weaknesses
-
Identity – our identity and access management services help improve business operations and end-user experiences, and transform access requirements into an information advantage
-
Incident Management – our enterprise incident management services and network security solutionshelp to secure systems, limited exposure, respond effectively and resolve security incidents of all kinds.
The Payment Card Industry Data Security Standard (often shortened to "PCI DSS" or just "PCI"), is a set of data security requirements established and governed by Visa®, MasterCard®, American Express®, and Discover® to protect cardholder account information. PCI DSS includes best practices to identify vulnerabilities in processes, procedures, and web site configurations. These practices help businesses protect themselves against security breaches, safeguard customer data, and protect the integrity of electronic payments.
-
Assess compliance with the PCI DSS. ARCA can assess the level to which the organisation complies with the 12 PCI DSS requirements. The DSS includes a range of policy, procedural, personnel, physical and technical requirements, and the assessor must gather evidence to show either that the requirements have been met, or that compensating controls are in place.
-
Provide advice as to how to become compliant with the PCI DSS.
-
ARCA can provide advice and/or direction regarding the steps that an organisation must take in order to become compliant with the PCI DSS.
PCI-DSS
SCADA
Supervisory control and data acquisition (SCADA) networks contain computers and software that perform critical tasks and provide essential services within critical infrastructure. They’re considered by cyber strategists to be the backbone of any country. Critical infrastructure, and in particular control systems, require protection from a variety of cyber threats that could compromise their ordinary operation.
Many of those critical components that operate today do so in a context that’s completely different from the one they have been designed for. They’re exposed on Internet with obvious security risks.
As a result, almost every SCADA performs well. They’re reliable and flexible, but often lack security. The impairment of SCADA networks could cause interruption of critical services, process redirection, or manipulation of operational data that could have serious consequences for the population.
What are the best practices to implement to improve the security of SCADAs? What actions need to be taken to secure legacy systems? ARCA will provide a few suggestions to improve the security of SCADAs.
