Cyber Security and Information Assurance

The growth of complex Information Technology systems coupled with increased internal and external threats to networks and their associated clients continue to fuel the need to provide overarching information assurance and cyber security in terms of confidentiality, integrity, and availability, which in turn depend on robust system security architectures and their associated controls and procedures. With our systems engineering base, coupled with a strong human factors input and qualified system security personnel, the Redhorse Corporation approach is to bring together multiple disciplines to produce robust, cost–effective, and useable cyber security solutions.

Capabilities

• Identity Access Management(IAM) implementation, management, and user provisioning
• Biometrics
• Information Security Assessment, including industry-specific assessments such as HIPAA and PCI
• Network architecture design
• Information Security Organization Structure and Strategy Assessment
• Review of Information Security Policies and Standards
• Review of compliance with laws
• Attack and penetration testing services for both networks and infrastructure
• Black box and Grey box assessment for web-facing applications
• Security reviews of business critical applications
• Data protection, backup, and storage
• Cyber security initiatives preventing, detecting, and responding to attacks
  • Comprehensive risk analysis
  • Software security training
  • Software testing best practices and automation
  • Software development resulting in secure software
• Business continuity planning and disaster recovery

People

Our team averages more than 25 years experience in all aspects of cyber security and information assurance, network design, and hardware and software implementation. We understand the threat and the regulations necessary to support federal and commercial customers. Our staff holds advanced degrees and many years of experience along with multiple industry certifications, to include Cisco CCNA, CCNP & CCIE; CISSP; SANS-GIAC; MCT; MCSE 2000/2003; PMP; and GIAC Certified Forensics Examiner (GCFE).

Services

We understand that the strength of an organization’s security program is only as strong as its weakest link. We are information security experts who employ a holistic approach to system security. The Redhorse team specializes in helping organizations strengthen the weakest links in their security program by providing cost-effective solutions through automation and alignment of security programs to complement your audit, regulatory, and compliance goals. Redhorse delivers cost-effective, innovative solutions in information security, privacy, business continuity, disaster recovery, IT audit, regulatory compliance, and IT risk.

• Information Security Assessment
  • Review of Network Security Architecture
  • Assessment of current network security measures to get a clear picture of the current security state
  • Review of Security Policies, Procedures, and Practices
  • Evaluation of current security processes in relation to ISO 17799, 27001, and 27002 standards, industry best practices, and business objectives
  • Review of Technical Security Controls and Mechanisms
  • Review of the effectiveness of existing security practices and mechanisms to recognize needed improvements
  • External Vulnerability Testing
  • External network scan to understand network security posture and identify vulnerabilities
  • Internal Vulnerability Scan and Testing
  • Internal network assessment to provide details on the vulnerability of critical assets
  • Threat assessment
  • Collection of data regarding current attacks and threats within the network
  • Social Engineering Assessment
  • Physical Security Assessment
  • Determination of how physical security can affect overall data and system security
  • Wireless Penetration Test
  • Application security assessment
  • Comprehensive review of custom client/server applications to obtain details on vulnerabilities
  • Identification of vulnerabilities within the mainframe environment
• Security System Design
  • Systems design in accordance with the CIA principles and defense in depth
  • Compartmentalization of information and principles of least privilege
  • Security Zones, including design and placement of IPSs, IDSs, Firewalls, VLANS, SSL, and data at rest and in transit encryption
  • Identity access management and implementation
  • Design single sign-on
  • Design PKI architecture
  • Biometric systems design
  • Security awareness training
• Security Policies and Standards Certification and Accreditation Support
  • Developing and promulgating IA standard operating procedures (SOPs)
  • Experience with PCI, SOX, HIPAA, FIPS, NIST 800, DIACAP, and other regulatory compliance
  • Providing IA Program, Policy, and Compliance support services to Department of Defense (DoD) customers
  • Federal Information System Controls Audit Manual (FISCAM)- and Financial Audit Manual (FAM)-based IT general controls and application audits and control reviews