CONTACTarrow

Cyber Security

Keep your company’s information and assets secure from cyber threats

In today’s connected world, the threat landscape is becoming increasingly complex with attacks that are more specific, agile and sophisticated in nature. Cyber security threats continue to challenge the operation of your business, employee safety and the protection of your digital assets and intellectual property.


The growing sophistication of cyber criminals demands even greater advances in information security practices, which drives the increased need for qualified information security staff.

The challenges are daunting, whether you are developing or maintaining a mature cyber security approach. Are you embracing the latest security standards and regulations? How robust is your security architecture, controls and practices? Are your regularly reviewing your technology implementation, and most importantly, can you defend against a targeted attack by skilled adversaries?

Keeping up with security program demands, preparing for compliance audits can overwhelm any security staff.

To be confident that critical assets are properly protected, an organization must ensure that its information security measures provide the best defense against cyber attacks. Every organization is different, each with its own unique risks and threats, which requires a comprehensive security program that is tailored to the environment.

Premier provider of cyber security services


True North Solutions and our partner BAE Systems has a proven track record in delivering high quality cyber security services for commercial and government clients around the globe. BAE’s Security Operations Centers, staffed with uniquely qualified specialists, make us one of the leading cyber security service providers with unparalleled insight into the latest cyber threats.

We understand that the demands placed on information security programs and teams are significant and constantly changing. We know how difficult it is to fully address these security demands in today’s fast-paced business environment. You need help, and we have solutions.

We can provide the resources and expertise you need to maintain your organization’s security as part of our high-value security development and maturity programs—all with a risk and business focused approach.

Operational Technology Cyber Risk Assessment


Operational Technology (OT) is at the heart of the industrial control systems (ICS) and the critical infrastructure that is fundamental to our daily lives. Securing these systems against a cyber attack is vital to ensure safe and reliable operations.
Today’s increased risk of cyber threats calls for increased security


Our OT Cyber Risk Assessment gives organizations the tools to understand:

OT Cyber Risk Assessment benefits

The OT Cyber Risk Assessment is a simple, scalable method to help clients identify the maturity of management, operational and technical controls, agree on a target level of maturity for your organization and understand how to resolve any gaps.

This repeatable process allows for benchmarking and future progress to be demonstrated to senior management and board-level sponsors, and the outputs of the assessment can be used to streamline future risk assessment work.

A common Maturity Scale is used across all our assessments to compare against both repeat performances and benchmarks, and can help identify the ongoing impact of any changes.

What you’ll receive in your OT Cyber Risk Assessment

Controls Matrix


MANAGEMENT CONTROLS OPERATIONAL CONTROLS TECHNICAL CONTROLS
Establish ongoing governance Governance systems Asset inventory
Manage the business risk Management frameworks System architectures
Manage the lifecycle Risk Management Malware protection
Improve awareness and skills Awareness training System hardening
Implement security controls Change management Network configuration
Manage vulnerabilities Vulnerability management Access management
Manage third party risks System monitoring Remote access
Establish response capabilities Threat intelligence Removable media
Third party engagement Security testing
Personnel security Physical security

Green line Cyber Advisory Services Green line



Security program development

The first step in ensuring the security of your organization is to have a security program. It is rare to find an organization without some sort of cyber security program today, but unfortunately, but many programs are incomplete and weak. Depending on your needs, our consultants can either develop programs from the ground up or update and improve existing programs to reflect the current environment.
IT risk assessment

In an age of Internet and business-to-business connectivity, there are a multitude of threats that must be dealt with including:

  • Email viruses
  • Web viruses
  • Identity theft
  • Hackers
  • Spam
  • Phishing scams
  • Spyware

What threat do these pose to your organization? Our IT Risk Assessment experts work with you to assess your information environment, risks and recommend the most appropriate security controls for your organization.
Controls review

Your security program identifies the security controls appropriate to your organization. However, do they continue to provide adequate protection? The objective of an IT Controls Review is to evaluate and assess the various management, operational, and technical controls in place within the organization’s key assets with respect to how information and IT assets are secured and to make recommendations for improvement.
Compliance readiness review, audit & alignment

Are you in compliance with today’s laws and regulations? Compliance should be a by-product of an effective security program. Our readiness review will help you understand how you can best achieve compliance within your existing security program.

With expertise across various compliance frameworks such as FFIEC, PCI DSS, GLBA, FISMA, ISO, HIPAA and others, we can provide most of your audit requirements with regards to the current environment in Canada and USA. We will work with your management and internal auditors to ensure a smooth path to compliance.
Chief Information Security Officer advisory service

A Chief Information Security Officer (CISO) advisory service is a cost effective solution to augment your business with overall security and risk management leadership. The CISO Advisor becomes an integral part of your team, on a monthly basis or as needed, working through your current management structure to deliver the information security systems your company needs.
Information security policy development & alignment

A carefully designed and implemented information security policy is essential to properly and effectively managing risk in your enterprise. We can help seamlessly design and integrate these policies into your organization’s operational and business processes with the flexibility and scalability to allow for changes as your organization evolves. The end result will be security policy document that is complete, accurate, appropriately reflects the current environment, is in line with best practices, and complies with any specific legal mandate or regulation that the organization is subject to.
Security architecture review

Your security architecture must be flexible, yet finely tuned enough to allow for your organization to grow and still keep your information secure. We follow a proven methodology for developing business-driven, risk and opportunity focused security architectures at both enterprise and solutions level that support business objectives. The result will be a design that works with your current and future business plans.
Physical security review

The best security infrastructure to prevent external threat actors is worthless if someone can walk in off the street and plug into the network or walk out with your server. Our physical security review will evaluate and assess the various management, operational, and technical controls in place within the organization’s key assets with respect to how information and IT assets are secured physically. We will highlight areas and make recommendations for improvement.
Security program development

The first step in ensuring the security of your organization is to have a security program. It is rare to find an organization without some sort of cyber security program today, but unfortunately, but many programs are incomplete and weak. Depending on your needs, our consultants can either develop programs from the ground up or update and improve existing programs to reflect the current environment.
IT risk assessment

In an age of Internet and business-to-business connectivity, there are a multitude of threats that must be dealt with including:

  • Email viruses
  • Web viruses
  • Identity theft
  • Hackers
  • Spam
  • Phishing scams
  • Spyware

What threat do these pose to your organization? Our IT Risk Assessment experts work with you to assess your information environment, risks and recommend the most appropriate security controls for your organization.
Controls review

Your security program identifies the security controls appropriate to your organization. However, do they continue to provide adequate protection? The objective of an IT Controls Review is to evaluate and assess the various management, operational, and technical controls in place within the organization’s key assets with respect to how information and IT assets are secured and to make recommendations for improvement.
Compliance readiness review, audit & alignment

Are you in compliance with today’s laws and regulations? Compliance should be a by-product of an effective security program. Our readiness review will help you understand how you can best achieve compliance within your existing security program.

With expertise across various compliance frameworks such as FFIEC, PCI DSS, GLBA, FISMA, ISO, HIPAA and others, we can provide most of your audit requirements with regards to the current environment in Canada and USA. We will work with your management and internal auditors to ensure a smooth path to compliance.
Chief Information Security Officer advisory service

A Chief Information Security Officer (CISO) advisory service is a cost effective solution to augment your business with overall security and risk management leadership. The CISO Advisor becomes an integral part of your team, on a monthly basis or as needed, working through your current management structure to deliver the information security systems your company needs.
Information security policy development & alignment

A carefully designed and implemented information security policy is essential to properly and effectively managing risk in your enterprise. We can help seamlessly design and integrate these policies into your organization’s operational and business processes with the flexibility and scalability to allow for changes as your organization evolves. The end result will be security policy document that is complete, accurate, appropriately reflects the current environment, is in line with best practices, and complies with any specific legal mandate or regulation that the organization is subject to.
Security architecture review

Your security architecture must be flexible, yet finely tuned enough to allow for your organization to grow and still keep your information secure. We follow a proven methodology for developing business-driven, risk and opportunity focused security architectures at both enterprise and solutions level that support business objectives. The result will be a design that works with your current and future business plans.
Physical security review

The best security infrastructure to prevent external threat actors is worthless if someone can walk in off the street and plug into the network or walk out with your server. Our physical security review will evaluate and assess the various management, operational, and technical controls in place within the organization’s key assets with respect to how information and IT assets are secured physically. We will highlight areas and make recommendations for improvement.

Green line Cyber Technical Services Green line



Cyber exposure profiling

Cyber risks are growing and many organizations lack understanding of where they’re most vulnerable. Our cyber exposure profiling service documents your digital footprint and outward facing exposure, using social media analytics as well as our own tools for identifying vulnerabilities, so you can mitigate and demonstrate that you have implemented improved security measures.
Vulnerability testing

Are all of your systems and applications up-to-date with the latest patches applied? Can you be completely sure that your perimeter devices have been correctly configured? Our vulnerability testing services provide that verification, and our reports highlight and prioritize issues so that the most severe problems can be addressed first.
Infrastructure penetration testing

Vulnerabilities may exist from improper configuration, flaws in the system, application code, hardware flaws or weaknesses in operational/technical processes. But what does that mean for you? Are these vulnerabilities posing a severe risk to your organization? How did they arise? What happens if someone exploits these vulnerabilities? What can be done to help ensure that such vulnerabilities do not arise in the future? Our penetration testing services can answer these questions.
Web application penetration testing

A web application is your doorway to the Internet thus allowing your customers, suppliers and shareholders access to your products, services and information. It is also a window to your organization for cyber criminals. How secure is your application? Applications should never be deployed to the Internet before being thoroughly tested for security issues. Our proprietary Internet intrusion analysis and testing methodology will give you the confidence that your applications are secure today from the latest cyber intrusion methodologies.
Mobile attack resistance assessment

Mobile devices have become a normal business accessory today, however, this introduces new risks and vulnerabilities. Our mobile attack resistance assessment identifies possible ways to simulate all of the common mobile attack scenarios in a manner that could be employed by a real attacker to access and exfiltrate sensitive information from your network, without being detected.
Social engineering testing

The weakest link in the security of your organization will always be your people. But how vulnerable are your people to social engineering attacks? Our social engineering test emulates all of the common techniques and methods used by modern day hackers. Our consultants are well versed and experienced in the ‘art’ of social engineering and the tricks of the trade that are used to gain the trust of end users. The results of a social engineering test will help you design a more effective education campaign for your staff and identify potential attack points in the organization.
Network and wireless security assessment

Your IT environment rests on your wired and wireless networks. How vulnerable are they to intrusion? A security assessment performed by BAE Systems Applied Intelligence consists of analyzing, assessing, and testing the overall design and integrity of the network and critical information technology assets, such as servers and devices, to uncover and identify potential security weaknesses and flaws.

Our analysis of these areas is compared against security industry best practices and recommendations are made on the basis of those comparisons.
Firewall and infrastructure configuration reviews

Firewalls are the front line of your perimeter defence. A simple misconfiguration can open you to attacks that put your entire infrastructure at risk. A review of your firewalls and infrastructure by BAE Systems Applied Intelligence would include configurations in accordance to vendor guidelines, industry regulatory requirements and best practices.
Cyber exposure profiling

Cyber risks are growing and many organizations lack understanding of where they’re most vulnerable. Our cyber exposure profiling service documents your digital footprint and outward facing exposure, using social media analytics as well as our own tools for identifying vulnerabilities, so you can mitigate and demonstrate that you have implemented improved security measures.
Vulnerability testing

Are all of your systems and applications up-to-date with the latest patches applied? Can you be completely sure that your perimeter devices have been correctly configured? Our vulnerability testing services provide that verification, and our reports highlight and prioritize issues so that the most severe problems can be addressed first.
Infrastructure penetration testing

Vulnerabilities may exist from improper configuration, flaws in the system, application code, hardware flaws or weaknesses in operational/technical processes. But what does that mean for you? Are these vulnerabilities posing a severe risk to your organization? How did they arise? What happens if someone exploits these vulnerabilities? What can be done to help ensure that such vulnerabilities do not arise in the future? Our penetration testing services can answer these questions.
Web application penetration testing

A web application is your doorway to the Internet thus allowing your customers, suppliers and shareholders access to your products, services and information. It is also a window to your organization for cyber criminals. How secure is your application? Applications should never be deployed to the Internet before being thoroughly tested for security issues. Our proprietary Internet intrusion analysis and testing methodology will give you the confidence that your applications are secure today from the latest cyber intrusion methodologies.
Mobile attack resistance assessment

Mobile devices have become a normal business accessory today, however, this introduces new risks and vulnerabilities. Our mobile attack resistance assessment identifies possible ways to simulate all of the common mobile attack scenarios in a manner that could be employed by a real attacker to access and exfiltrate sensitive information from your network, without being detected.
Social engineering testing

The weakest link in the security of your organization will always be your people. But how vulnerable are your people to social engineering attacks? Our social engineering test emulates all of the common techniques and methods used by modern day hackers. Our consultants are well versed and experienced in the ‘art’ of social engineering and the tricks of the trade that are used to gain the trust of end users. The results of a social engineering test will help you design a more effective education campaign for your staff and identify potential attack points in the organization.
Network and wireless security assessment

Your IT environment rests on your wired and wireless networks. How vulnerable are they to intrusion? A security assessment performed by BAE Systems Applied Intelligence consists of analyzing, assessing, and testing the overall design and integrity of the network and critical information technology assets, such as servers and devices, to uncover and identify potential security weaknesses and flaws.

Our analysis of these areas is compared against security industry best practices and recommendations are made on the basis of those comparisons.
Firewall and infrastructure configuration reviews

Firewalls are the front line of your perimeter defence. A simple misconfiguration can open you to attacks that put your entire infrastructure at risk. A review of your firewalls and infrastructure by BAE Systems Applied Intelligence would include configurations in accordance to vendor guidelines, industry regulatory requirements and best practices.

Green line Incident Response Services Green line



Planning for an incident

Being well prepared for a cyber incident is essential to ensure your incident response team can successfully navigate the tasks required to recover successfully. An effective cyber incident response relies on an agile and up-to-date incident response plan that is tailored to the organization’s environment, as well as access to experienced resources to supplement your in-house capabilities.

Our incident planning service provides a detailed evaluation of the current state of your organization’s threat detection and incident response program against Applied Intelligence’s best practices, national and international standards and understanding of current attacker methodology. The resulting information provides the foundation for creating an updated incident response plan that includes guidance on preparation, anomalous behavior detection, incident management, technical response and communication plans.
Preparing for an incident

Practice makes perfect is especially true when it comes to being prepared to successfully execute an incident response plan. Understanding the plan and team member roles and responsibilities is critical. Your team must routinely execute the plan against a variety of scenarios to develop the “muscle memory” required to perform well in a potential crisis situation.

Whether a tabletop exercise or a mock attack, our experts lead the exercise that brings together all the required resources involved in the incident response plan, including senior management. Our incident exercises are tailored to your organization, business sector and specific internal teams and skill sets. We provide a way for all relevant team to experience the reality of cyber attack and prepare themselves to ensure they can respond successfully when it matters.
Responding to an incident

When facing a major cyber incident, your organization must be prepared and staffed to respond effectively. Appropriate resources must be pre-arranged and readily available to ensure a swift and successful response without unnecessary delay and potential chaos.

We can help with resources and procedures to ensure successful containment, remediation and recovery of a data breach. Our incident management process addresses requirements for investigation, communications, briefings and stakeholder engagement activities.
Planning for an incident

Being well prepared for a cyber incident is essential to ensure your incident response team can successfully navigate the tasks required to recover successfully. An effective cyber incident response relies on an agile and up-to-date incident response plan that is tailored to the organization’s environment, as well as access to experienced resources to supplement your in-house capabilities.

Our incident planning service provides a detailed evaluation of the current state of your organization’s threat detection and incident response program against Applied Intelligence’s best practices, national and international standards and understanding of current attacker methodology. The resulting information provides the foundation for creating an updated incident response plan that includes guidance on preparation, anomalous behavior detection, incident management, technical response and communication plans.
Preparing for an incident

Practice makes perfect is especially true when it comes to being prepared to successfully execute an incident response plan. Understanding the plan and team member roles and responsibilities is critical. Your team must routinely execute the plan against a variety of scenarios to develop the “muscle memory” required to perform well in a potential crisis situation.

Whether a tabletop exercise or a mock attack, our experts lead the exercise that brings together all the required resources involved in the incident response plan, including senior management. Our incident exercises are tailored to your organization, business sector and specific internal teams and skill sets. We provide a way for all relevant team to experience the reality of cyber attack and prepare themselves to ensure they can respond successfully when it matters.
Responding to an incident

When facing a major cyber incident, your organization must be prepared and staffed to respond effectively. Appropriate resources must be pre-arranged and readily available to ensure a swift and successful response without unnecessary delay and potential chaos.

We can help with resources and procedures to ensure successful containment, remediation and recovery of a data breach. Our incident management process addresses requirements for investigation, communications, briefings and stakeholder engagement activities.

Service Engagement Model


RETAINED PREPARED EMERGENCY
Retained service contract with priority response Framework contact in place with experts on standby Rapid response with no previous contract in place

Managed incident readiness service


Routine reviews and updates are essential to keep pace with the cyber threat landscape and organizational dynamics. The Management Incident Readiness Services (MIRS) combines incident planning and preparing components into an annual service that ensures your organization is reviewed and improved annually. Additional benefits include a prearranged incident response framework and the comfort of knowing that our talented and experience incident responders are available for the organization at a discounted rate.

Talk to us to take your cyber security to the next level »
CONTACT US TODAY
LinkedIn Connect on LinkedIn
Canadian Headquarters

7180 - 11th Street SE
Calgary, Alberta T2H 2S9


Phone 403.984.2000
Fax 403.259.2243
American Headquarters

8822 South Ridgeline Blvd, Suite 240
Highlands Ranch, CO 80129

Phone 303.740.7555
Fax 303.738.9777
CONTACT US TODAYarrow

LinkedIn Connect on LinkedIn
Thank you for your interest in True North Solution’s FAST Plant Brochure

Fill out the form below and we will email you a copy.
Thank you for your interest in True North Solution’s ICCS / SIMOPs webinar.

Fill out the form below for instant access to the recording.
Thank you for your interest in True North Solution’s ICCS Brochure.

Fill out the form below and we will email you a copy.