Combining cutting-edge technology, ultra-secure military-grade locations, and world class expertise to create a full-stack cybersecurity capability that is second to none, Cyberfort is making the world safer —  one organisation at a time.

From ultra-secure cloud and colocation services, MDR (Managed 

Detection and Response) to full-stack cybersecurity; Cyberfort has a breadth of expertise and experience to support organisations, big or small, with any element of their cybersecurity infrastructure.

We offer cutting-edge technology, ultra-secure military-grade locations, and world class consultancy expertise to create a full-stack cybersecurity capability that is second to none.

Cyberfort is proud to be accredited by the National Cyber Security Centre to provide Cyber Security Consultancy.

thumbnail_Cyberfort.jpg

Cyberfort.jpg

CYBERFORT

Providing strategy and consultancy services so that appropriate corporate governance is in place, enterprise risk is managed, and regulations are complied with.

Providing technology platforms that assist with GRC.

GRC - Governance, Risk, and Compliance

ISO 27001 is the globally recognised framework for information security, and protecting against cyber threats.

"ISO 27001 accreditation" relates to services that support companies in achieving accreditation, and also to services related to auditing and providing actual ISO 27001 accreditation.


ISO 27001 accreditation is a benchmark for achieving a good level of cyber resilience.
 
Increasingly, medium and large companies are requiring ISO 27001 or equivalent accreditation before they will do business with a potential supplier.

ISO/IEC 27001:2013 (also known as ISO 27001) is one of the most respected international standards for information security. The heart of ISO 27001 is an information security management system (ISMS).

ISO 27001’s addresses information security or cyber vulnerabilities that arise through people, processes or  technology failings

Once in place, the ISO 27001 framework  will help your company  “establish, implement, operate, monitor, review, maintain and continually improve an ISMS”.

ISO 27001 accreditation

From a cyber security perspective, more often than not, it is a supplier failing that is at the root cause of a cyber security breach.  Supply Chain or Third Party Cyber Risk Management enables visibility on how cyber resilient your suppliers are, where the risks are, and allows you to identify steps to mitigate those risks. 

Third Party risk management is essential for maintaining cyber security resilience.  

Supply Chain Cyber Risk Management

Understanding your data, managing your data, and ensuring that your data, whether it be personal, sensitive, or commercially confidential, is kept secure, accessible only by permitted persons, used for the right purposes, retained as required, deleted when required by data policies, and at the right stage in your business cycle.  Delivering data compliance for all relevant global standards, including GDPR. 

Data Privacy

Providing the critical online or face to face training that helps staff protect themselves and the company against cyber crime. 

No matter how good your company cyber security technical defences are, your cyber security posture is weak at best, if you do not have Cyber Security Training in place for your staff.

Cyber security training can include face to face, online video training, awareness questionnaires, and attack simulation, including simulated phishing attacks, where employees are tested with regard  to their ability to spot and report phishing attempts.





Cyber Security Training

A platform, technology and service that monitors network and application activity, and immediately reports events that could be representative of a cyber security attack on your company, either from within or from outside your network.

SIEM - Security Information and Event Management

Vulnerability management starts with detecting vulnerabilities, progresses to assessing the level of threat, the likelihood of exploit, and the priority of remediation.

Easy to understand reports on remediation status, current level of risk, and the overall remediation program are included as part of a typical vulnerability management platform.

Vulnerability management covers all elements of IT including networks, devices, applications, infrastructure, in both private and public cloud and on premise.

When a vulnerability is discovered, it will be identified and given a CVE (Common Vulnerability and Exposure) number and listed on the MITRE vulnerability database.   Each vulnerability is evaluated by the National Vulnerability Database / NVD team (part of NIST, the US National Institute of Standards and Technology), and then, once evaluated, is given a threat level score, using the Common Vulnerability Scoring System (CVSS).



Vulnerability Management

Penetration testing is the ethical testing of a company's cyber security defences.

Penetration testing can be for a company's entire IT cloud and IT infrastructure, a single application, or for an IoT (Internet of Things) device.
 


A penetration test or "pen test" will emulate the full set of actions that are performed by cyber criminals.  These actions are identified in leading cybersecurity frameworks - and most clearly in the MITRE ATTACK framework.

The objective of a pen test is to report on vulnerabilities that could be exploited, and then report them back to the company, so that the vulnerabilities can be addressed before they are exploited by a cyber attacker.

Penetration testing can be restricted to testing the level of cyber resilience from a technology perspective, or can extend to simulated email phishing tests, where employee cyber awareness and resilience is tested.

Beyond Penetration testing, there is Red Teaming, where a team will test all elements of corporate security defences, including physical security, site access, cyber security, and social engineering elements.  Red Teaming is viewed either as additional to penetration testing, or as an advanced, next level form of penetration test.


Penetration testing

Services to ensure that your business applications are built securely, using accredited appsec methodologies, and that your developers code with security first in the software development life cycle (SDLC), i.e. employing a Secure Software Development Life Cycle (SSDLC) methodology.

The core SSDLC development methodology is OWASP.

The Open Web Application Security Project® (OWASP) is a non-profit foundation that works to improve the security of software. Through community-led open-source software projects, hundreds of local chapters worldwide, tens of thousands of members, and leading educational and training conferences, the OWASP Foundation is the source for developers and technologists to secure the web.

AppSec - Application Security 

There are two categories of application security test.  Firstly, scanning application code "at rest" to discover code that poses a security risk - known as SAST (Static Application Security Testing).

Secondly, there is the penetration testing of an application as it runs in a live or test environment - known as DAST (Dynamic Application Security Testing).