Recognise and Reduce Risk with a Network Security Health-Check

Transcription

1 Recognise and Reduce Risk with a Network Security Health-Check Would you like to? understand the health of your network to protect against security risks and to develop an action plan to prioritise improvements?

2 Logica is now part of CGI, a leading business and technology services company with 72,000 professionals operating in more than 40 countries across the Americas, Europe and Asia. We have the presence, expertise and complete IT services to meet clients business needs anywhere, anytime. Our innovative thinking, deep industry expertise, and end-toend consulting, systems integration and outsourcing services enable us to serve as clients full-service provider in improving all facets of their business and technology operations. More information is available at

3 Contents 1. Introduction Foreword Cloud Security Why this Service? 5 2. Service Overview Secure Networking Health Check Approach One Day Workshop Technical Risk Assessment Executive Summary Report Phase 2 Consultancy Packages Network Discovery Penetration Testing Web Application Testing Firewall Rulebase Assessment Application Assessment Secure Code Review Database Activity Monitoring Mobile Worker Assessment Unified Comms Assessment 9 3. Information Assurance 9 4. Level of Backup/Restore On-boarding and Off-boarding Processes 10 Page 3 of 22

4 6. Service Pricing Basic Price Options Service Management Details Service Constraints Service Levels Financial Recompense Model Training Ordering and Invoicing Process Termination Terms Data Restoration / Service Migration Consumer Responsibilities Technical Requirements Trial Service Other services available 13 Page 4 of 22

5 1. Introduction 1.1 Foreword In 2013 the UK s central government departments, local authorities, NHS trusts and police authorities continue to face huge cost challenges, so it s as important as ever to ensure value for money. ICT services can help to create that value. But to do so, they should be competitive, readily accessible, and should impose only minimal procurement costs. For these reasons, Logica (now part of CGI) applauds the continued energy which the UK government puts into its CloudStore programme. We re playing our part by offering a more comprehensive set of CloudStore services than ever before. We continue to offer leading cloud infrastructure and application services, often through product partnerships with suppliers such as Microsoft, SalesForce, IBM, Oracle and SAP. But cloud is not a technology. It s primarily a commercial model allowing payment based on consumption, and is rapidly becoming the default model for ICT services. So from 2013 we are also offering a wide range of advisory and assessment services which will apply equally well in support of both cloud and non-cloud solutions. We share your interest in ensuring that the public sector derives significant value from the CloudStore. So please do browse our portfolio of services, then let s discuss those which could address the challenges you face. If you can t find what you need, please let us know, and we ll work to offer a suitable service in future. 1.2 Cloud Security This consultancy engagement from Logica is part of a series that concentrate on the issues surrounding the security impact of cloud computing for public sector organisations. 1.3 Why this Service? Preserving the integrity, confidentiality and availability of information and computing resources is a leading priority for every organisation. Failure to identify vulnerabilities and validate the effectiveness of security controls could compromise the very future of a business. The Logica Secure Networking Assessment service enables organisations to assess their network security rapidly, identify weaknesses and then take cost-effective remedial and preventative measures. The service is based on experience and knowledge, assisting a number of organisations including our work with Crown Prosecution services, our support as security partner for the UK Census 2011 programme and our work with other local and central government organisations such as the Ministry of Justice. Page 5 of 22

6 2. Service Overview 2.1 Secure Networking Health Check Network security is changing, with attacks on businesses no longer motivated simply by a desire to cause damage and disruption. Recent years have seen the growth of a professional cybercrime industry, with financial gain and political gain a strongly increasing motive. We have also witnessed the rise of hacktivism, and the entry of nation states as cyber warfare makes an impact. The damage goes well beyond the purely financial. Other concerns include damage to an organisation's reputation, legal action stemming from a failure to protect customer information, lost productivity as employees are deluged by spam or held up by a slow network, and compromised assets like wasted bandwidth and damaged hardware. In addition organisations are facing the issues of mobile computing and Bring Your Own Devices, which blur the boundaries of the organisations network. As a result of its work with its customers, Logica has developed the Secure Networking Assessment to assess the customer s current security level against known vulnerabilities and best security practice procedures including IS27001, IS1/IS2. The Secure Networking Assessment will: Provide valuable recommendations on ways to improve or fix any weaknesses found. Give advice and offer solutions to equip your business to manage network security more effectively in the future. Assure and give confidence to your organisation, its citizens/customers and shareholders that the business is secure from external attacks, including the potential financial loss and loss of goodwill that comes with them Approach The Secure Networking Health Check enables Logica to identify the areas of your environment that require security assurance. This is achieved through a one day workshop session and a follow on technical risk assessment. The outcome allows Logica to create a high level security assessment strategy, taking into account your organisations objectives, asset criticality and long-term security goals. Customers typically begin the Assessment service by completing a simple checklist on their current network security status. This enables a high level discussion to take place between customers and Logica, which helps establish the most appropriate starting point for the Assessment service. The checklist does not require technical input but should be completed by a senior member of staff who is aware of the current network security provisions and status. Page 6 of 22

7 2.1.2 One Day Workshop This is an interactive question and answer session to identify business drivers and security objectives for the short to medium term. Logica's standard template based tool collates the information and is used to quantify the potential risk posed to your organisation Technical Risk Assessment Network Mapping A network discovery exercise enables Logica to confirm your organisation s internet presence, providing a visual representation of which devices from your organisation s network are visible online. The intention is to identify potential intrusion points on which to focus attention. At a basic level, this process identifies known and potentially unknown devices on the network. It also assesses the network s segregation to make sure external boundaries are protecting the network as intended Vulnerability Assessment Using the results from the network mapping, Logica assess the critical devices to find the vulnerabilities in your environment, and recommend fixes Risk Modelling This allows the customer to visualise the network, verify access policy compliance and routing rules and discover root causes of violations. It also helps you to use "what if" scenarios to simulate attacks on the network, model the effect of implementing alternative controls and understand the business impact of threats. By taking this approach Logica allows organisations to focus on the type of threats that are potentially the most destructive Executive Summary Report The output deliverable from the Assessment is an executive summary report outlining the findings and priority areas identified for further action. The report and recommendations are presented to the customer is a final "wash - up" workshop. This report may recommend further "Phase 2" consultancy packages where these will benefit the customer. Final deliverables will be fully agreed during workshop with the customer and the Logica Business Consulting representative as per the workshop methodology. Page 7 of 22

8 2.2 Phase 2 Consultancy Packages The Phase 2 consultancy packages will be identified and proposed as part of the report from the Phase 1 package. The particular requirements for consulting time and automated tools will vary from project to project and for this reason these packages are offered initially on a Time & Materials basis. Once more information is available about a particular customer then a full proposal can be produced Network Discovery Logica will produce a Network map showing all of the devices, known and unknown that are connected to the customer's network. Unknown equipment, in particular the rogue unmanaged wireless devices are a major source of vulnerabilities. A comprehensive network map can help identify these. As this map will display the network as is, it allows our customers to be sure that the network is actually configured as planned, in terms of segregation, firewalling etc Penetration Testing Logica's consultants can perform a range of penetration tests to uncover areas that need attention. Penetration test can be either Black Box - where the consultants have no knowledge of the system they are looking to penetrate or White Box - where they are given full details. They can also be performed from inside the network of from outside on the internet Web Application Testing A very common area of attack is through vulnerabilities is web applications. Developers can unintentionally leak application vulnerable to attacks like SQL Injection and crosssite scripting. Our consultants can look at individual applications and test for vulnerabilities using proprietary scanning tools and manual checks Firewall Rulebase Assessment Through multiple changes firewall rulebases can become incompliant with an organisation s security policy and introduce unwanted features. In particular the order of firewall rules can make an impact on both performance and security. Regular Firewall rulebase assessments are a requirement of the PCI-DSS regulation. Our consultants are able to use automated tools to simplify the process of regularly performing these tests. Page 8 of 22

9 Application Assessment Logica's consultants will run a test of the traffic into and out of an organisation via a Cloud based security service. The output report will identify the levels of spam malware and other unwanted in use. By looking for keywords and phrases the amount of sensitive unsuitable for traffic can also be estimated Secure Code Review Logica's consultants perform test on software code to identify coding errors than can introduce security vulnerabilities Database Activity Monitoring Databases that hold the most sensitive and valuable data can benefit from defence in depth beyond traditional network security from firewalls and IPS. Database activity monitoring can detect suspicious and unauthorised database activity Mobile Worker Assessment The growth in mobile and home working via VPN technology and mobile devises potentially introduces a large number of vulnerable points in a customer's network. Our consultants will take a risk based approach and review the customer environment looking at areas including laptop encryption, device hardening, VPN access the use of 2 factor authentication Unified Comms Assessment The growth of enterprise Unified Communications services from vendors such as Microsoft, IBM and Cisco and the use of consumer IM services (either through federated authorised use or unauthorised rogue activity) has potentially grown beyond the capability of an organisation to control and secure these environments. Our consultant can review customer s deployments and look to deploy UC compliance and security solutions. 3. Information Assurance The service is based on experience and knowledge, assisting a number of organisations including our work with Crown Prosecution services, our support as security partner for the UK Census 2011 programme and our work with other local and central government organisations such as the Ministry of Justice. Page 9 of 22

10 Our accreditations include: ISO9001, ISO27001 and ISO20000 TickITplus, CMMI-Dev+IPPD v1.2 Maturity Level 3 rating ISO/IEC 27001:2005 Audit and Certification SSAE 16/ISAE 3402 Attestation E.U. Data Protection Directive - (95/46/EC) 4. Level of Backup/Restore Not applicable. 5. On-boarding and Off-boarding Processes Not applicable. 6. Service Pricing 6.1 Basic Price The Phase 1 service is offered on a Time & Materials basis for a typical charge of 6,500 on the basis of the G-Cloud III SFIA Management Consulting Rate Card Table 2. In the event of extreme complexity, we may need to review the fixed charge, and this would be highlighted at the earliest opportunity. This price does not include VAT or expenses (travel, lodging or other) incurred by consultants as they relate directly to the project. This price is valid for a period of 12 (twelve) months and are then subject to review. Prices and Service Descriptions are subject to the G-Cloud III supplier terms and conditions. Page 10 of 22

11 6.2 Options Specific options required by your organisation plus any customisations of the study will be priced separately. 7. Service Management Details Not applicable. 8. Service Constraints None identified. 9. Service Levels Not applicable. 10. Financial Recompense Model Not applicable. 11. Training Not applicable. 12. Ordering and Invoicing Process Ordering is via purchase order with invoices produced monthly in arrears. Page 11 of 22

12 At the end of each calendar month Logica shall submit an invoice in respect of the charges arising during that month. The Client shall pay each invoice within thirty (30) days of the date of issue. Following interest in this offering, a Practice Manager will discuss this with you and agree any necessary tailoring or customisation. 13. Termination Terms Given that this is a short consultancy assignment we do not anticipate that the customer should want to terminate the services, however, were this to be the case the terms of the G-Cloud III supplier terms and conditions shall apply. 14. Data Restoration / Service Migration Not applicable. 15. Consumer Responsibilities Logica will require that the client provides: Reasonable access and permissions to systems and data during the engagement. The participation of key technical and non-technical stakeholder and decisionmaker input or other participation in specific activities. Logica will ensure the necessary security clearance for any consultants working with sensitive information. When working on government premises, Logica will require reasonable working space for its consultants and their work materials (e.g. desks, meeting rooms, power sockets for laptops, means to access the Internet, etc.). Page 12 of 22

13 16. Technical Requirements Not applicable. 17. Trial Service Not applicable. 18. Other services available In the G-Cloud entry we have identified that Logica has appropriate skills in a number of disciplines. We outline this capability in this Section, and draw the reader s attention to further details which are available through your Logica Account Manager or else via gcloud@logica.com. The following disciplines are covered in this section: 1. Design Authority 2. Programme Manager 3. Project Manager 4. Business Analysis 5. Design and Development 6. Testing 7. Project Specification and Selection 8. Service Integration 9. Deployment 10. Transition Management 11. Service Management 12. User Management 13. Training and Learning management 14. Application Management and Support Page 13 of 22

14 15. Strategy and implementation services 16. End user device support services 17. Application Lifecycle Services 18. Agile development Discipline UK World Illustration of competencies 1. Design Authority With over 140 staff in Logica in the UK skilled in this discipline, Logica has considerable capability in this aspect of IT. Involving the overseeing of the technical strategy across the client, ensuring that programmes and projects comply with the client s standards for technology, Logica has performed this role for most of the FTSE 100 companies as well as in the Government arena, with large scale programmes in Justice, Policing and Central Government. 2. Programme Manager With over 2000 staff in Logica skilled in this discipline, Logica has considerable skills in depth in this aspect of IT. Typically our programme managers: Are empowered to make decisions on behalf of the client for the overall programme/project Report into the Executive Steering Group Manage the client s commitments to the programme/project. Change Approval Provide high level management of dependent third parties Provide an escalation point for any resourcing issues. Ensure that deliverables are produced in a timely manner. Escalate issues within the client as appropriate. Represent Logica on the project steering group. Attend contract meetings Brief Senior management Logica has performed this role for most of the FTSE 100 companies as well as widely in the Government arena. 3. Project Manager 1700 >2500 As a large system integrator, project management is a major skill at Logica, with over 1500 with this skill in the UK alone. With PRINCE2 as a standard qualification, Logica manages projects in the Public Sector and Page 14 of 22

15 Discipline 4. Business Analysis 5. Design and Development UK World Illustration of competencies Private Sector alike. The management covers projects associated with developments of applications, infrastructure and business change. In this we hand over to support arrangements associated with the effects of the project, whether this is performed by Logica, the client or third parties acting on behalf of the client >2500 Our Business Analysts and Business Consultants provide the expertise on how best to implement business and process change. This takes into account the need for minimal disruption to the normal operation of the business, including advice on phasing of the individual capabilities and methodologies which could be employed to maximise the efficiency of any required communications. With our client knowledge, this is a discipline in which Logica has considerable expertise. 750 >2500 Following on from the Business Analysis, Design and Development are core offerings that Logica has to offer. This covers all forms of development from Waterfall to Rapid Development and all points in between, according to client requirements. We can provide this through Logica s UK or offshore teams working onsite or offsite. When we blend onshore and offshore resources, for example, we can produce two benefits to our customers: More work can be performed in a standard working day through a follow the sun model. This may be particularly useful for urgent projects. The labour arbitrage of using offshore resources can provide our customers with reduced costs. 6. Testing 560 >2500 Logica has long championed Testing, with capabilities across the board in Test Strategy through to Execution and Managed Testing as a service. A major element in this is ensuring that an independent test is undertaken, basing the test scenarios on the key business requirements. Important within this is ensuring that the client s staff have understood, communicated and clarified their requirements, so that tests can be constructed to meet the day to day business needs. As well as strong practitioners in the discipline, Page 15 of 22

16 Discipline 7. Project Specification and Selection 8. Service Integration UK World Illustration of competencies Logica s consultants have also produced books on the topic, including Risk and Requirements Based Testing. As with the Design and Development discipline described above, we can provide this through Logica s UK or offshore teams working onsite or offsite. When we blend onshore and offshore resources, for example, we can produce two benefits to our customers: More work can be performed in a standard working day through a follow the sun model. This may be particularly useful for urgent projects. The labour arbitrage of using offshore resources can provide our customers with reduced costs >2500 As an external organisation we regularly need to agree tight specification in our assignments. It is fundamental to our customer engagement, and has been for nearly 50 years. Where projects involve product selection, our project managers work closely with business and technical analysts to propose appropriate candidates are presented, taking account of cost, quality, time and security. We are an independent organisation and are not tied to particular products. Indeed, our workforce has experience against most COTS (Commercial off the shelf) products in the marketplace Service Integration and Management is growing in popularity amongst organisations these days, and we are at the forefront of this new delivery model. Often working very closely with outsourcing advisers, we are increasingly performing this function throughout Europe to great acclaim. We predict that this activity will increase over the next 5 years. 9. Deployment Our approach is not to supply just a theoretical or management service. When engaging with Logica, you will find that we take ideas all the way through to implementation and deployment. The Logica Shared Change and Deployment Management team co-ordinates and controls the Change Management processes of over 100 clients and handles on average 1,100 change requests per month. Page 16 of 22

17 Discipline 10. Transition Management 11. Service Management UK World Illustration of competencies Team members are ITIL qualified with certifications ranging from ITIL Foundation to ITIL Managers certificates. Their role encompasses recording RFCs, coordinating impact assessments, obtaining approval, planning and execution of consistent, successful change and release across all service streams and the co-ordination of the Change Advisory Board Our approach to Transition Management is to cover the client s Infrastructure requirements, support organisation and processes and application installation. Transition Management is responsible for successfully managing the handover of the service from the Implementation team to the Managed Service support teams IT Service Management (SM) is one of our core competencies. We believe that realistic repeatable processes provide the right structure to deliver continually improving services to release increased value. Our SM approach applies to all service streams, whether supplied by ourselves, our partners, sub-contractors or other third parties. Clarity of roles and responsibilities will help to ensure a consistent quality of service across all streams. We have developed a centralised Service Management delivery capability the ITIL Shared Service team. This team is responsible for the co-ordination of the operational delivery of Service Management and works closely with all production units (e.g. Application Management, Infrastructure Management, Telecommunications) including third parties, and the customer facing Service Management team. This ITIL service will minimise cost through best practice and maintain consistent quality of service throughout. This enables our customers to be able to rely on IT, and will help to make IT a business enabler (e.g. bringing new products to market) rather than an inhibitor. We have vast experience as a service integrator, successfully delivering quality seamless services for our clients in large and complex environments. With emphasis on continual service improvement and client intimacy, the service Page 17 of 22

18 Discipline 12. User Management 13. Training and Learning management UK World Illustration of competencies delivers efficient and effective processes to provide low cost, high value, consistent and repeatable services. The ITIL shared service process teams: Provide process management and governance for technical teams, ensuring we offer a consistent service and we meet our contractual obligations and SLA targets. Manage Major Incidents to ensure there are optimised communication and the coordination of multiple technical teams to resolve incidents in the business. Manage Change so that there are no unauthorised changes released into live. Proactively manage processes such as Problem Management and Availability/Capacity Management to reduce incidents occurring and to stabilise the IT estate. Report on the service s KPIs to advise how the service is performing Logica has found itself involved in providing management services to both IT and user staff on many occasions. Our business knowledge has brought us into the user management role, especially with the gradual blurring between the lines of the IT and user function. This blurring is due to: The growth of commercial off the shelf products The adaptation of rapid application development approaches Often involving a user-led team The increased focus in sweating the application assets necessitating extended end-user testing Logica has a wealth of training and development experience. We first provided training solutions as far back as 1979 and have steadily grown to become one of the leading providers of bespoke IT training propositions in the UK. We provide training solutions that balance cost and time against outcomes and achievements. As part of a broader offering within our Training & Learning capability we offer services for design, development, management, delivery and evaluation of learning and development. We provide a wide array of expertise and this includes innovative solutions Page 18 of 22

19 Discipline 14. Application Management and Support 15. Strategy and implementation services 16. End user device support services 17. Application Lifecycle Services UK World Illustration of competencies including mobile learning, serious games technology, Augmented Reality, collaborative working and virtual worlds. Our practice is to: first consult you on your training needs within their business context; secondly, to develop solutions to meet your specific needs; thirdly, to deliver by the most appropriate means the training programme designed to generate your business change and your people development plans; fourthly, to evaluate with you the effectiveness of the training and development programme against the business model. We aim to provide you with a training solution that is customised to fit your need, giving each individual what they need when they need it Support and Maintenance is an expanding part of Logica s portfolio of services, with application management and support being major elements of that work. As the largest European supplier of these disciplines this is a core skill across Logica, and is recognised by Forrester and Gartner. Logica is regularly placed in the top quartile in this discipline Whilst these are at opposite ends of the V model, they are closely related due to the need for strategy to be implementable. We use our business consultants to support our clients with their strategy, always with a mind to the future and the deliverability of the strategic decisions Our Service Desk is much lauded in the press, and rightly so. We continue to receive awards for this part of our end user device support, with most desktop / laptop related problems resolved by the desk at first call. Where we are unable to fix problems over the internet, we call on our partner Computacenter to provide local support Logica has been involved in application management since our inception nearly 50 years ago. Consequently we have created lifecycles for varying types of application development over the years, from waterfall through the various flavours of rapid application development and product amendment. This is core to our business and therefore we have honed the lifecycles into services to optimise the application Page 19 of 22

20 Discipline 18. Agile development UK World Illustration of competencies management function. In this function we consider activities such as (but not limited to): Functional Design Technical design Code development Unit Test Scripting and Execution System Test Scripting and Execution Integration Test Scripting and Execution Code Build and Release Configuration Management Software Delivery Management and Planning Test Management and Planning Defect Management and Resolution Logica s standard framework for providing application support services is ITIL based. Our approach combines deep industry and domain expertise with application lifecycle management competencies and strategic relationships with our customers. We take on the ongoing support of existing applications rapidly and without disruption of service, and then work with our customers to increase the value of the outsourcing to their organisations Logica has been developing and using Agile for many years and as such, is a founder member of DSDM (Dynamic Systems Development Method) and has made significant contributions to its development throughout the years. As appropriate, we have been using agile software development since late 1990 s. Logica has experience in a range of recognized, best in class, agile methods, chosen to match the circumstances: Scrum is the most commonly used; however, XP (extremeprogramming), and MSF (Microsoft Solutions Framework) are used on Microsoft projects. We also used Homebrew in our automated testing. As a long term practitioner of Agile, we have adapted such techniques with waterfall projects where appropriate to deliver greater business benefits. Our approach is governed by our quality management system which includes a menu of development lifecycles including agile software development. We expect strong collaboration and co- Page 20 of 22

21 Discipline UK World Illustration of competencies operation from our customers throughout the project lifecycle in defining and prioritising the business requirements. We welcome requirement changes during development which enhances competitive advantage for our customers. We use Timeboxing to keep the scope within budget with prioritisation by our customer. Each task is assigned a priority and an estimated cost-tocompletion. Priorities and estimates are reassessed regularly to ensure high value requirements are delivered in time. Our commercial approach is flexible which encourages collaboration with our customers. Page 21 of 22

22 Logica UK Limited / 250 Brook Drive / Green Park / Reading / RG2 6UA / TEL: Logica is now part of CGI, a leading business and technology services company focused on helping clients achieve results. Since our founding in 1976, we've operated upon the principles of sharing in clients' challenges and delivering quality services to address them. With 72,000 professionals in more than 40 countries, we have the presence, expertise and complete IT services to meet clients business needs anywhere, anytime. We provide the responsiveness and accountability of a true local partner while offering the global scale, talent and services needed to meet your evolving needs. More information is available at and The address of its registered office is 250 Brook Drive, Green Park, Reading RG2 6UA, United Kingdom. Copyright statement: This document contains information which is confidential and of value to Logica. It may be used only for the agreed purpose for which it has been provided. Logica s prior written consent is required before any part is reproduced. Except where indicated otherwise, all names, trade marks, and service marks referred to in this document are the property of a company in the Logica group or its licensors.