We align your network and processes with state-of-the-art cybersecurity frameworks, to strengthen configuration and streamline business IT processes. The ultimate goal is to prevent your data from loss of confidentiality, integrity, or availability.

Risk Assessment

We will begin with an in-depth risk assessment, where we help you answer the following questions about aspects of your organization.

Assets—what is valuable to your organization, and especially what information is valuable? Think intellectual property, Personally Identifiable Information (PII), etc…

Information technology—what assets do you have arrayed to process, store, transmit, and protect your valuable information, and how securely are they configured? Keep in mind IT isn’t just desktop PCs and wireless routers, it’s mobile devices, printers, everything…

Managerial processes—what processes do you have in place to manage your information, the technology, and the people that use that technology? Without buy-in from the highest echelons in the organization, any cybersecurity activity is doomed to fail…

Operational processes—how does your organization interact with your assets, especially your valuable information? An acceptable use policy is a good place to start…

Threats—what scenarios exist by which your assets, especially valuable information, may be compromised? Cybersecurity isn’t just about stopping hackers from getting at your data, it’s also about preventing accidents, and recovering from the inevitable…

Once we have the answers to these questions in hand, we can execute a risk assessment calculation (asset value x probability of compromise), to determine the potential cost to your organization should a breach occur. Then you’ll have a reasonable idea of what your organization should be spending on cybersecurity 1. Then you’ll probably want to dedicate some of those funds on the main aspect of Hardening, which is:

Secure Configuration

Once we’ve taken stock of your organizational IT risk 2, we can usually find some relatively simple first steps to drastically reduce this risk. These first steps include securely configuring your organization via:

Policy—cybersecurity needs support from executive management to be effective. That support starts by communicating intent via policy to all stakeholders.

Training—your users usually represent the highest risk to your organization, either through malicious intent, unintentional misuse, benign neglect, or just plain not knowing better. Cybersecurity training is a cost-effective way to “reconfigure and realign” your users with your cybersecurity policy.

Defense-in-depth posture—having your network behind a firewall is not enough. Think of a castle: does a king rely solely on the moat to stop an attacking army? No. Neither should you rely on one protective device to secure your valuable assets. We’ll work to strengthen your IT castle with devices like intrusion detection, endpoint security, email spam/phish blocking, etc.

Secure IT baselines—depending on the level of risk posed by your IT assets, Haight Bey can configure your assets with various levels of integrated security features. For instance, we can really “lock down” a desktop to US Department of Defense standards, or alternatively we can employ less-stringent Center for Internet Security (CIS) best practices. It’s all about the risk…

Configuration Management—if your organization doesn’t already have robust configuration and change management processes in place, we’ll help you develop and implement them. As we like to say: Cybersecurity starts and ends with configuration management.

Resilience—a cybersecurity breach of your organization is inevitable. By preparing your organization—through processes like asset and information backup, and incident response and contingency planning/practice, we can reduce the time it takes to recover from the breach, and minimize the damage done.

Once we’ve set up the defensive barriers listed above to help secure the configuration of your assets, we’ll craft your organization’s cybersecurity “weapons” and enter into the next phase in the Haight Bey cybersecurity cycle: Hunt.

You can actually do a quick calculation to get an order-of-magnitude estimate of your cybersecurity budget: ask yourself “What would we be willing to pay should we become locked out of our network by ransomware?” The amount you’d be willing to pay to unlock your assets from ransomware should be the first deposit in your cybersecurity fund. Keep in mind the earlier in your organization’s lifespan you start thinking about cybersecurity, the cheaper things will be. It’s always less painful to “build it in” from the beginning, as opposed to “bolting it on” at the end.

_{1: You can actually do a quick calculation to get an order-of-magnitude estimate of your cybersecurity budget: ask yourself “What would we be willing to pay should we become locked out of our network by ransomware? The amount you’d be willing to pay to unlock your assets from ransomware should be the first deposit in your cybersecurity fund. Keep in mind the earlier in your organization’s lifespan you start thinking about cybersecurity, the cheaper things will be. It’s always less painful to “build it in” from the beginning, as opposed to “bolting it on” at the end.}

_{2: Keep in mind it’s all about managing RISK—we don’t want to throw money around fruitlessly. Risk management includes measuring success of risk mitigation efforts via realistic metrics.}

Cybersecurity is a critical business skill for any organization. For-profit companies, government agencies, and non-profit organizations all require IT security professionals who are technologically proficient. At Haight Bey & Associates, our skilled experts will provide custom cybersecurity solutions that can help you stay one step ahead of cyber attackers and protect critical company and customer information.

Business Cybersecurity Training

Cybersecurity training is one of the most important steps an organization of any size can take to improve its security. Our cybersecurity training covers a wide range of topics, including:

• HIPAA Compliance
• PCI Compliance
• Data Loss Prevention
• Information Confidentiality
• Thwarting Ransomware
• Phishing Awareness
• Social Engineering

If your business is subject to regulatory compliance mandates like HIPAA, you may be required to train your employees on cybersecurity awareness. We’ll help empower employees to recognize common cyber threats and understand vulnerabilities in business operations. New-hire training and regularly scheduled refresher training courses will improve your organization’s cybersecurity.

Partner with an Organization that Understands Your Needs

Whether you’re a medical and dental office, CPA, or financial institutions, our active approach to security will help keep your existing system secure while delivering quick breach detection and remediation. Our custom solutions will fit in your risk management budget, and our solutions will emphasize proactive “hunting” of the adversary. Let our cybersecurity experts help you support your organization’s mission by securing your IT systems and managing your IT risk. We’ll help you learn to assess cyber threats and protect business information assets.