NERC Compliance
A regional public power utility undertook a voluntary cyber security improvement program tied to the NERC 1200 recommendations for systems critical to the BES. As part of this effort IDMA3 was retained to assess the current network infrastructure and to provide recommendations for improvement. The client was also able to capitalize on our extensive experience in policy design as well as regulatory compliance to successfully implement against NERC 1200.
The client continued to work with IDMA3 for ad-hoc security advisory services and when the NERC CIP requirements were formally issued the client engaged IDMA3 for a multi-year contract around NERC CIPs compliance. Over the course of the engagement IDMA3 assisted the client with all aspects of compliance including requirements interpretation, documentation, policy development, technical controls development, security analytics, and more.
As a result of the high value impact that IDMA3 was able to bring to the project other groups within the client organization also engaged IDMA3 to assist with aspects of their compliance efforts.
Infrastructure Assessment
As part of an IT re-organization project a large public school district engaged IDMA3 to conduct a security assessment of their IT infrastructure. Over the two week engagement IDMA3 undertook an in-depth review of systems architecture, device configuration, patch levels, wireless security, security analytics, and the physical security of IT assets within the district. A GAP analysis against NIST standards and applicable vendor best practices was developed and presented to management along with a prioritized recommendations report.
The analysis discovered weaknesses primarily in areas of process and procedure versus technical controls, leading client management to implement an IT governance program. IDMA3 was retained on a multi month contract to provide strategic advice and assistance in the development of this program.
Policy Framework
A regional financial industry organization had acquired a number of smaller competitors over the preceding 18 months and found itself trying to manage to a hodgepodge of conflicting policies.
During the initial two week on-site engagement IDMA3 reviewed the existing policies, observed daily procedures, and conducted interviews with various business units including IT, HR, and Legal to develop a comprehensive understanding of the organization and their goals.
In phase II of the project, conducted off site to provide cost savings to the client, IDMA3 developed a complete Policy Framework designed to close coverage gaps, resolve the inter-organizational conflicts, increase procedural efficiencies between departments, and to utilize existing polices where possible. In addition the adoption of a unified policy framework contributed to a smoother transition process in ensuing acquisitions.
The final phase was conducted on-site over three days to deliver the complete framework package, provide training to department heads on how to best utilize the new tools, and to deliver an executive briefing to the management team and board of directors.
Intrusion Detection Tuning
A midsized SaaS (software as a service) provider felt that their existing intrusion detection infrastructure used to help protect Internet facing customer data was not being fully utilized.
IDMA3 conducted an in-depth review of the IDS infrastructure along with the associated network & security elements. The resulting GAP analysis and recommendations report enabled the client to realize a 53% decrease in false positives, a 17% increase in sensor processing efficiency, and confidence in their system prior to an impending compliance effort.