BT Security Consulting Cyber Maturity Assessment

BT Security Consulting Cyber Maturity Assessment

How serious will your next security breach be? Nearly a third of CEO s list cyber security as the issue that has the biggest impact on their company today, yet only half feel prepared for a cyber attack (BT-KPMG Taking the offensive: Disrupting Cyber Crime 2016). More than half of CIO s state that Cloud is the most disruptive technology change. But 49% are battling to migrate to cloud and benefit in full due to security concerns (The BT CIO report 2016). No company is safe Security is our business Our job is to stay ahead of the changing security landscape so that our customers can focus on their core business activity. Using our in-depth understanding of the malware used by criminal and state-sponsored groups, we can assess risks to your business and work out how to tackle any potential threats. We can analyse malware and attack tools, identify digital signatures and provide enhanced defences where necessary. Working with us, you can stay ahead of threats, while reducing the uncertainty and complexity of security. We provide end-toend consultancy to help organisations transform their approach to security from reactive to proactive. We work with 7,000 organisations in over 170 countries 1,000 of them security customers. They're advised by a global team of 2,500 security practitioners and a professional services team of over 500 security specific consultants (including architecture design specialists). A cyber attack won t announce itself or happen when it s convenient for you. It s far more likely that you ll be unaware of it until a supplier or customer notices a problem and raises the alarm. Chances are, you ll then discover the source of the problem has been hidden deep within your organisation for months, or even years. Responding to new threats With your security constantly evolving to meet new threats, it can be easy to lose track of what s in place, or where your weak spots are. Your business could be open to serious risk and you might not even know it. Even when you re aware of the risks, you might not have the right solution. While you can never remove risk completely, you can manage it, get the measure of it and spot what s coming next. Staying secure is about staying one step ahead.

Our approach We have advanced security awareness across our organisation, which means it takes less time to identify threats and implement mitigation plans. Focusing on dynamically managing business risks across your whole organisation, we work with you to conduct a Cyber Security Maturity Assessment which will: identify the key threats to your organisation map out security threat scenarios to help you with planning and future analysis determine the current maturity of security controls in relation to your threat landscape. The diagram below illustrates the approach that we ve devised to: assess your end-to-end cyber security capabilities; identify shortfalls; and provide effective solutions. Figure 1 - BT's strategic approach to cyber security Business assessment Security landscape assessment Solution and service assessment Current risk and threat landscape Controls assessment Operating model design Current service provision Capability assessment Capability strategic roadmap Current business strategy Risk and threat ranking and base-lining Risk and threat assessment(s) Security service design This method focuses on controls and threat assessment. You let us know your current threat landscape, service provision and business strategy and we use that to inform the other assessments. We can also work to build risk and threat landscapes for you if needed.

How mature is your cyber security? A Cyber Security Maturity Assessment will help support your security posture and cyber defence capabilities. Specifically, this assessment lets us: define your threat landscape create a high-level view of the threat your organisation faces; which allows you to focus on how to deal with it create threat scenarios that detail where threats are coming from, their likely impacts and how they can be dealt with provide advice in how you can use threat scenario planning to feed into strategic security control development For the Security Control Analysis, we recommend using an industry standard framework to understand the maturity of your cyber security strategy. SANS Top 20 Critical Security Controls or NIST Cyber Framework are both strong choices. Using these two assessments will allow your organisation to take control of your cyber security governance, management and operations. Take a look at the table below to see the results of assessment activities: complete a Security Control Analysis. Scope Activity Output Review of current security controls A time-boxed review to: identify required controls and processes against known threats provide a gap analysis of controls against industry best practice. A report of the current maturity of the Top 20 Critical Security Controls with a set of prioritised recommended mitigations. Review and analysis of threat landscape A time-boxed review to: determine as-is cyber defences determine baseline assets, actors, topology and volumes. For the physical estate: an agreed number of documented targeted threat assessments and key threat scenarios against critical services and channel gaps. Executive report A final report outlining BT s findings and observations. A report providing our recommendations, an overall maturity level assessment for the organisation, a strategic plan detailing how gaps should be addressed and a high level roadmap showing how the strategy would be deployed.

Why choose us? Access a huge pool of security talent. With more than 4,500 consulting professionals globally, you ll have access to specialists across our solutions, programme and technical groups as well as experts in Managed Security Services (MSS). Our BT Security Consutling team has in-depth technical expertise and is available all day, every day. Work alongside a partner with professionally proven credentials. We have an excellent track record with security consulting customers across the globe, from both private and public sector organisations. We offer significant knowledge in the finance, manufacturing, retail, government and healthcare sectors. We have long-term relationships with many of our customers. Really understanding their business challenges helps us improve our solutions. Utilise government-level security expertise. We re trusted to protect critical infrastructure. NATO relied on us to keep communications 100 per cent secure at its 2014 summit. Our security for the London 2012 Olympic and Paralympic Games stood firm despite as many as nine million attacks a day. And we work with the UK s Ministry of Defence, who demand the highest level of protection. Make the most of a dedicated partner with global reach. Our dedicated teams work with regional security staff and in-country authorities including the Centre for the Protection of National Infrastructure (CPNI) in the UK. We are a founding member of the UK Cyber Information Sharing Partnership (CISP), providing technical expertise and analyst resources. This means we re well placed to share this learning and information with our customers. Benefit from shared insight and experience. We work closely with our many key vendors sharing insight and approaches so we get a real understanding of the technology involved in cyber security. Every day some 250 billion of financial transactions flow over our networks and we secure 20 million card payments. That s valuable experience we can draw on to meet your needs. Discover more www.bt.com/security

Offices worldwide The telecommunications services described in this publication are subject to availability and may be modified from time to time. Services and equipment are provided subject to British Telecommunications plc s respective standard conditions of contract. Nothing in this publication forms any part of any contract. British Telecommunications plc 2016 Registered office: 81 Newgate Street, London EC1A 7AJ Registered in England No: 1800000 PHME 75520