ServicesDraft 2

Strategic Cybersecurity SERVICES with Linea Secure

We specialize in creating personalized services designed to protect your organization from cyberattacks. Our clients come to us at varying stages of cyber maturity and we identify the best approach for each unique situation.

Assessment

Key Control & Policy Audit

Linea has tailored 20 control families that satisfy National Institute of Standards and Technology (NIST).

This includes processes such as:

Privacy of participant records
How participant records are secured electronically and on paper
Financial systems security controls
Network segmentation
Database encryption
Security of integration points
Cloud computing exposure and countermeasures
Third party services such as actuaries and custodial banks

Penetration Test

Linea adopts a multi-step approach to penetration testing, including:

Sensitive Information Discovery
Manual Testing
Network Landscape Discovery
System Exploitation and Penetration
Application-Level Penetration Testing
Escalation and Lateral Movement
Reporting

The goal is to evaluate the type of damage that can result from a compromise and to determine what information can be accessed by an outside threat actor or motivated insider with no privileges or granted privileges on both the external and internal networks. The penetration test will approach your systems as an adversary would, considering vulnerabilities, incorrect system configurations, trust relationships between systems, and architectural weaknesses in the environment under the test.

Code Review

Code Review aims to identify security weaknesses in an application through testing of the application’s external interfaces. This assessment will include testing for security weaknesses relevant to the type of application. These may include weaknesses such as those related to cross-site scripting, SQL injection, OS command injection, improper authentication and access control, cross-site request forgery, improper error handling, encryption issues, or open redirects. All external facing applications are scanned for the OWASP Top 10 and CWE/MITRE Top 25.

We will begin by reviewing provided documentation, holding meetings with personnel familiar with the application, and developing knowledge about how the application functions under normal conditions. We will then assess the application’s response to various inputs and conditions using appropriate security testing tools.

‍

Incident Readiness Response

The organization’s ability to manage and recover from an incident is reviewed to understand incident handling capabilities, that includes detection, analysis, containment, recovery, and reporting.

‍

Operational Needs Assessment

We have reviewed the cybersecurity capabilities of many large organizations. For the purpose of the operational needs assessment, we will review the technology deployed and understand its vulnerabilities as well as develop cybersecurity requirements that will be included in the general system requirement, ensuring architecturally the new PAS system will be configured with cybersecurity considerations embedded.

Cloud Security Assessment

Linea recognizes that many organizations not only have a presence in the Cloud but operate in a multitude of Cloud environments. This creates additional layers of complexity when integrating all these Cloud environments to on-premises implementations. Linea performs Cloud assessments that certify federated identity management, access control, and many other cloud security compliance assurances. These services extend an organization’s security controls to wherever operations occur and wherever sensitive information resides.

‍

Solution Design
& Execution

Security Requirements

Linea consultants also gather the cybersecurity needs and requirements for modernization. We consider technical requirements, compliance requirements, and best practice standards for protecting personally identifiable information, and the technical and business impacts if systems were to be breached, modified, or unavailable.

We cannot emphasize enough how important gathering cybersecurity requirements are, and how important it is to identify them before a solution option has been selected. Security will affect system architecture, design, vendor selection, and changes to both business and technical processes. Waiting until after design, configuration, or implementation to address security can be much more time-consuming, costly, and risky. Because Linea has both cybersecurity and pension expertise, we know which processes and systems will require the most attention, we have a better understanding of threat severity levels and inherent risk for our industry, and we already have knowledge of both the available solutions and the other third-party vendors with which clients will interface. This gives us great advantage over cybersecurity vendors who do not have our industry expertise

Technical Requirements

Technical requirements are the backbone of any system implementation. They help to define the platform, both physical and logical, on which the new system will run. The hosting infrastructure (cloud vs. on premises) that an organization desires to use, and the resulting system architecture, have a significant impact on how the security needs of an organization can be met. These discussions stem from the initial gathering of technical requirements which includes analysis and documentation of the following components:

Current State

IT organizational structure within the organization including departments and detailed roles
Current systems and tools in use by the organization
Description of all system interfaces, both inbound and outbound, critical to the system

Future State

Key rules and technical requirements that document the vision for the system implementation

In addition, technical requirements lay the groundwork for the common components that will support and enable the system to ultimately meet its business needs. Examples include Workflow, Electronic Content Management (ECM) and Customer Relationship Management (CRM) functions, constituents of a system which must integrate and communicate effortlessly with each of the applications involved.

Linea does not take a “one size fits all” approach; each organization has its own set of unique circumstances and needs, and Linea tailor’s technical requirements appropriately by performing thorough research and conducting detailed requirements gathering workshops with clients. It is only first by gaining an in-depth understanding of the current state that Linea can sketch out a realistic future state.

Given Linea’s breadth of clients across the industry, we are always reviewing best practices and staying up to date on the latest technological developments. Both best practices and the latest technologies are integrated into our technical requirements to keep them current. In addition, Linea is forward looking and extrapolates trends across other industries to anticipate future organizational needs and capture them in advance, keeping our clients on the cutting edge.

Agile Testing and Design

During the process of design confirmation, we focus on implementing sound cybersecurity standards and integrating them in the proposed system at the time of architecture and implementation, rather than retroactively. Our consultants will use methodologies such as Agile during this process. For example, these are the areas we focus on:

Does the organization need to comply with federal, state, or local jurisdictional cybersecurity policies?
What level risk management is the system classification: Low, Medium, or High?
What type of cybersecurity standards has the client prefer adopted?
Which business processes does the client perform?

Additionally, the consultants will discuss cybersecurity around the following, as examples: Network segmentation, database encryption, application code review, integration methodology, hardware hardening, virtualization, user account level classification, interface security, continuous monitoring of security events.

Planning

IT Strategic Planning

Linea performs organizational structure analysis to assist our clients in determining if their current structure is aligned with their business and IT objectives. Our consultants analyze the composition of each department, including the department’s functional role in the organization, and the roles and staffing levels within each department. We determine how critical IT processes are supported by the current structure and analyze departmental hand-offs. We also examine the major IT systems and examine to what extent they are aligned with the current structure.

Our staffing analysis includes a comparison of the organization to peer organizations, by skill and compensation levels. We perform an overall skills inventory of the organization. Finally, we make a series of recommendations related to changes in organization and department composition, staffing, and skill levels.

Cybersecurity Roadmap

The roadmap is a strategic plan for an organization’s approach to cybersecurity. The plan categorizes areas of cyber risk, classifies data as either high, medium, or low, and identifies an appropriate standard for compliance. It will consider applicable statutes, regulations, and best practices for inclusion. The roadmap will identify the horizon and pathway the organization will take to build, implement, and improve its cybersecurity maturity.

Architectural Services

With the implementation of any system, cybersecurity protections should be considered, along with any technical or business capabilities. We identify the network segmentation, access controls, identity, and authentications capabilities that the system or network should have. We align a system’s architectural security with appropriate and recognized standards from the conception of the system and identify any gaps. We work with organizations to do this proactively and to retrofitting cybersecurity after the system is implemented.

SSPs (System Security Plans)

The System Security Plan (SSP) document is a simple, easy-to-reference document that covers pertinent information about the specific system that is being protected. This is a “living document” that is meant to be updated as conditions change. The goal of this document is simple - anyone not familiar with the protected environment should be able to read it and gain a fundamental understanding of the systems involved, the risks, and the security controls required to maintain an acceptable level of security. This document provides a centralized repository for knowledge that is specific to that environment and its applicable security controls. The SSP reflects input from those responsible for the systems that make up the environment in question, including information owners, system operators, and other stakeholders. Typical SSPs for pension or benefits organizations include a line of business SSP, an image capture/storage SSP, and a financial system SSP.

Incident Response Plan

The Incident Response Plan and Procedures (IRP) provide a well-defined, organized approach for handling any potential threat to computers and data, as well as the actions to be taken when the source of the intrusion or incident is a third party. The IRP supports the organization’s incident management policies, and any policies regarding the handling of personally identifiable information. The Plan identifies and describes the roles and responsibilities of the Incident Response Team (IRT). The IRP shall align with the mission, goals, and strategies of the organization and designates who is responsible for putting the plan into action.

Cybersecurity Playbooks

We provide customized playbooks that are a representation of a cybersecurity incident that you may encounter. These include Data Theft, DDoS, Virus Outbreak, Ransomware containment, Phishing, Elevation of Privileges, Malware Outbreak, Improper Computer Usage, Unauthorized Access, and Root Access. We develop scenarios similar to commonly experienced cybersecurity attacks from threat actors and develop a stem-wise approach for that incident. These playbooks include examples such as:

How you would prepare for a specific event
How you would detect and analyze threats
The process a defender should take to contain, eradicate, and recover from an incident
The post incident handling process

Compliance with State Statutes

Linea will do the due diligence to ensure your security controls are in compliance with all applicable State laws, rules, and regulations.

‍

Disaster Recovery

Linea can help develop the Fund’s standard business interruption scenarios as an initial effort to review the option paths. We will also assess if there are additional scenarios that need to be documented and included in the plans. The scenarios reference whether the primary impact is to staff, the physical infrastructure, the technical infrastructure, or combinations thereof, and assess whether the impacts are short-term, medium-term, or long-term. Each combination becomes a different scenario and initiates a different communication and action process.

We will examine the documentation of the inventory of assets, the recovery options, including the Recovery Point Objective and the Recovery Time Objective (RPO and RTO, respectively). The RPO and RTO should be goals or targets, not statistics. The plan should lay out the methods for technical resumption of the various systems to meet the RPO and RTO targets.

Maintenance
& Continuous Support

Tabletop Exercises

The tabletop exercise will evaluate the processes, tools, and ability to respond to a cyber-attack. This is done from both an executive and technical perspective. We simulate multiple scenarios as examples of real-life cyber-attacks and observe the organization’s use of its incident response plans. We document divergence from the plan and provide recommended modifications to accommodate for real life situations

3rd Party Vendor Compliance

We help mitigate the risks from vendors by expanding an organization’s compliance to them. We help develop cybersecurity policies specifically addressing 3rd party risk and mitigation requirements. The policies typically become part of standard contract language, requiring vendors to comply with Federal, State, and Local statutes, and the best practices adopted by the organization. We also review artifacts and reports provided by 3rd party vendors, as required by the updated contracts.

Technology Implementation Assistance

Linea will provide project management and guidance during the selection, procurement, and implementation of new cybersecurity technologies, working with an organization to ensure the correct tools are selected to provide a layered approach to protecting assets. We will help define requirements and outcomes, evaluate options, and select the appropriate configuration. We work with the vendor and organization staff to execute the implementation of the tool and test its effectiveness.

‍

Awareness & Training

Linea believes it is critical that cybersecurity awareness & training are included as an integral part of the planning and preparedness of the organization for the implementation of any new system. These are important components of governance and managing the risks associated with a system implementation, and any new vulnerabilities that may be introduced because of the new technology and capabilities of the system. As cybersecurity threats evolve and spread to all phases of using, managing, and operating a system, the challenge of recognizing and avoiding threats become greater. Arming your staff with the knowledge of what the likely threats are, how their actions, inactions or behaviors may contribute to likely threats being realized and preparing them to recognize a threat when it presents itself and the steps to take to avoid and report them. Our approach is to work with staff on areas of protecting personally identifiable information, privacy, dos and don’ts and explain their responsibility to report suspicious activity.

CISO-as-a-Service

Retainer services give organizations the ability to access Linea services and personnel at pre-negotiated rates. Our personnel could be used to perform training, provide consulting services, and facilitate meetings. Additionally, Linea could be retained to facilitate an incident response if an event occurred. These pre-negotiated hours and rates are a great way to perform annual planning in an uncertain world where threats evolve daily.

Staff Security training

Linea will craft training programs that are specific to an organization’s needs. We facilitate workshops for an organization focusing on compromise avoidance and the practice of good cyber hygiene. The training will allow a board and staff to identify threats, understand how adversaries seek to compromise the organization, and actions and practices to counter these threats.

Assessment

Solution Design
& Execution

Planning

Maintenance
& Continuous Support

20 years of expertise

Let's Talk

Assessment

Solution Design & Execution

Planning

Maintenance & Continuous Support

20 years of expertise

Let's Talk

Solution Design
& Execution

Maintenance
& Continuous Support