Security

Every business is a target, most are soft ones, and the attackers have automated. Ransomware crews don’t choose you — a scanner does, the moment a firewall goes unpatched or a password gets reused. Proactive is the only posture that works; once your environment is compromised, every remaining option is bad and expensive. Security is square one.

And no one defends everything alone anymore. The real questions are which layers you run in-house, which you buy managed, and who is watching the alerts at 3 a.m. — because a SIEM nobody reviews isn’t a defense, it’s a diary of the breach.

Security is a market of three-letter acronyms and vendors selling fear. We sort must-have from nice-to-have against your actual compliance load and risk tolerance, then compare the managed providers who can genuinely run it — SOC coverage hours, response SLAs, and what happens when the alert fires at 3 a.m. If your posture is already sound, we’ll say so.

• Pen Test — an attempt to gain access to a network or application via simulated attack; often required for compliance such as PCI
• Risk Assessment — the practice of evaluating an organization’s or IT environment’s current security posture with suggested recommendations for improvement; often performed in reference to a specific security standard or compliance regulation
• Managed SIEM — a real-time, managed solution for Security Information & Event Management, designed to provide a holistic view of a customer’s environment and correlate various data sources to identify threats
• DDoS Mitigation — a solution designed to block Distributed Denial of Service attacks from taking down a network or online application; especially relevant when your revenue arrives through a website
• Access Control — a technique to regulate who or what can use resources or applications on a network; can include Single Sign-On and Identity Access Management
• Perimeter Security — a broad approach to fortify the boundaries of a network; may include firewalls, Virtual Private Networks, intrusion detection, and intrusion prevention
• Endpoint Protection — a unified solution to protect desktops, laptops, and mobile devices; features include anti-virus, anti-spyware, and personal firewall
• Incident Response — an organized, forensic approach to investigate and remediate a security breach; can be on-demand or via monthly retainer

• What security or compliance regulations do you need to adhere to?
• How often do you undergo a third-party security assessment? Do you know what your weak spots are, and how to address them?
• In the event of a breach or attack, what policies and procedures do you have in place?
• What are the hours of operation for your internal or external security resources?
• Do you have a SIEM or log management system in place? If so, who reviews and correlates the alerts?
• How do you secure access to IT infrastructure and applications for remote users, BYOD employees, contractors, and third parties?
• How do you identify suspicious or abnormal behavior on your corporate network?
• Do you have any public-facing web applications or sites? What is the financial implication if those go down for an hour or a day?