Risk Management: in good times and in bad times.

It is no secret that cybersecurity threats are ever increasing and that demand and expectations for a coherent strategy towards security in general are heightened. When we speak about security, this goes much broader than just cybersecurity. We help you map all security risks within your organisation; going from compliance over to identity management to infrastructure.

To mitigate the risk and damage associated with digital security, it is important to:

know how to assess these risks
know how to improve your defenses via security-by-design.
plan for what to do if (and when) things do go sideways.

Our approach

Lesterius is a plutinum level FileMaker partner

About

Our approach combines experienced professionals, modern technological solutions and proven strategies to provide solutions to modern-day security, safety and risk management issues.

Lesterius’ European resources and cross-industry expertise allow us to offer real-time assistance, proven solutions and strategic planning to help organizations navigate the most unpredictable of times with confidence.

Co-creation

Every organisation and case is different. Every risk management plan is tailored and co-created by your team and our consultants. Together we establish where the priorities, (budget)limits and ambitions are and work from there.

People

We’ll help you define responsibility and accountability for security tasks and processes as well as a continuous skill management, training, and awareness program.

Process

Operational-defined process for implementing, monitoring, measuring and improving security in order to reduce risk.

Product

Defense-in-depth technologies — properly configured, maintained and hardened — to mitigate risk.

Policy

Governance and regulation documentation— for confidentiality, integrity and availability topics — to specify and manage control.

Proof

Metrics or validation methods used to track control effectiveness.

The CIA model

The CIA triad is the respected model that forms the basis for the development of security systems and policies. The three letters in “CIA triad” stand for Confidentiality, Integrity, and Availability. It is widely used for the identification of vulnerabilities and methods for addressing problems and creating effective solutions.

The confidentiality, integrity, and availability of information is crucial to the operation of a business, and the CIA triad segments these three ideas into separate focal points. This differentiation is helpful because it helps guide security teams as they pinpoint the different ways in which they can address each concern.

When all three standards have been met, the security profile of the organization is stronger and better equipped to handle threat incidents.

Confidentiality

Confidentiality:

Confidentiality involves the efforts of an organization to make sure data is kept secret or private. To accomplish this, access to information must be controlled to prevent the unauthorized sharing of data—whether intentional or accidental. A key component of maintaining confidentiality is making sure that people without proper authorization are prevented from accessing assets important to your business. Conversely, an effective system also ensures that those who need to have access have the necessary privileges.

For example, those who work with an organization’s finances should be able to access the spreadsheets, bank accounts, and other information related to the flow of money. However, the vast majority of other employees—and perhaps even certain executives—may not be granted access. To ensure these policies are followed, stringent restrictions have to be in place to limit who can see what.

Integrity

Integrity:

Integrity involves making sure your data is trustworthy and free from tampering. The integrity of your data is maintained only if the data is authentic, accurate, and reliable.

For example, if your company provides information about senior managers on your website, this information needs to have integrity. If it is inaccurate, those visiting the website for information may feel your organization is not trustworthy. Someone with a vested interest in damaging the reputation of your organization may try to hack your website and alter the descriptions, photographs, or titles of the executives to hurt their reputation or that of the company as a whole.

Compromising integrity is often done intentionally. An attacker may bypass an intrusion detection system (IDS), change file configurations to allow unauthorized access, or alter the logs kept by the system to hide the attack. Integrity may also be violated by accident. Someone may accidentally enter the wrong code or make another kind of careless mistake. Also, if the company’s security policies, protections, and procedures are inadequate, integrity can be violated without any one person in the organization accountable for the blame.

To protect the integrity of your data, you can use hashing, encryption, digital certificates, or digital signatures. For websites, you can employ trustworthy certificate authorities (CAs) that verify the authenticity of your website so visitors know they are getting the site they intended to visit.

Availability

Availability:

Even if data is kept confidential and its integrity maintained, it is often useless unless it is available to those in the organization and the customers they serve. This means that systems, networks, and applications must be functioning as they should and when they should. Also, individuals with access to specific information must be able to consume it when they need to, and getting to the data should not take an inordinate amount of time.

If, for example, there is a power outage and there is no disaster recovery system in place to help users regain access to critical systems, availability will be compromised. Also, a natural disaster like a flood or even a severe snowstorm may prevent users from getting to the office, which can interrupt the availability of their workstations and other devices that provide business-critical information or applications. Availability can also be compromised through deliberate acts of sabotage, such as the use of denial-of-service (DoS) attacks or ransomware.

To ensure availability, organizations can use redundant networks, servers, and applications. These can be programmed to become available when the primary system has been disrupted or broken. You can also enhance availability by staying on top of upgrades to software packages and security systems. In this way, you make it less likely for an application to malfunction or for a relatively new threat to infiltrate your system. Backups and full disaster recovery plans also help a company regain availability soon after a negative event.

Case Studies

European player, Media Industry

Our client was concerned that the data in its solution had been misused for phishing.

It asked Lesterius to see if better password and user management could avoid the problem.

During a risk assessment, we looked at the whole application and how the users interacted with the software. We mapped out all the risks. We soon discovered that password and user management was not the basic problem. The prioritised action plan helped the company increase security and assures that the valuable data will not be used by users for the wrong purposes.

Swiss-based IT department , Industry: Pharmaceuticals,

The IT department of a Swiss pharmaceutical company hosts a low-code solution in their own infrastructure. The installation and setup is outsourced to Lesterius. While the IT knowledge internally about the infrastructure is high, there is too little knowledge about the low-code platform. In order to guarantee the continuity of the activities, Lesterius was asked to work out a business continuity plan and disaster recovery plan for this solution, in co-creattion with the customer. With the elaborated plan, the customer can now act independently in case of an incident and operational unavailability is reduced to a minimum.

Our Risk Management Experts

Koen Van Hulle

Short bio here…

Eric Paulin