Our Services
Information Security solutions and Threat Risk Analysis
Health and safety consultancy
Enterprise Architecture
People Enablement
Physical security systems and threat Risk analyses studies
People Enablement
Understanding how a role in the organization is linked to goal, process, information and
systems leads to clear definition of the job duties and required skills. At consilium-
consulting Consulting, we believe that human capital is key for corporate success. When
an employee sees his role in the context of the business model, and he is well equipped
with right skills and resources, the employee becomes a driver for innovation and
excellence. consilium-Consulting relies on years of expertise in different industries to
craft customized training programs tailored to the role needs. Our experience shows that
generic trainings do not always address the specific needs of a role as each organization
is unique in its culture, goals and market context. consilium-consulting covers people
Enablement in the following areas:
- Enterprise Architecture
- Risk Management
- Physical threat and risk assessment
- Information Security
- Policing
- Healthcare
- Geospatial Information Systems
- Project Management
- IT service Management
- Physical Security
Information Security solutions and Threat Risk Analysis
Information Security
Being one of our customer you should not be worried about compliance requirements we
grantee that your network will never be vulnerable to cyberattacks, by adapting with wide
range of security audits conducted annually, Above Security’s certified consultants have
the necessary expertise to determine what is really needed to protect your organizations
against cyber threats and network intrusions.
With over 20 years of IT risk management consulting experience, Above Security is the
trusted adviser for many organizations around the globe. We offer a full range of
specialized consulting services around IT security and risk management. Our
consultants and security experts are helping organizations comply with internal
governance rules and external regulatory requirements, ensure that their network and
critical IT assets are protected, and that their staff is fully equipped to address external
and internal threats.
Threat Risk Analysis
We Provide full range of Threat Risk Analysis according to the Information Systems
Audit and Control Association (ISACA), a “Risk IT Framework fills the gap between
generic risk management frameworks and detailed (primarily security-related) IT risk
management frameworks”. The objective of a threat risk analysis is to provide
recommendations that will maximize the protection of the confidentiality, integrity and
availability of your organization’s critical information assets. Above Security has
developed its threat risk analysis offering in order to ensure that your IT-related risks and
opportunities are properly identified, analyzed, and presented in business terms.
Above Security’s threat risk analysis covers the following stages:
- Risk Response
o Risk Response Selection
o Risk Remediation
- Risk Analysis
o Likelihood Estimation
o Impact Estimation
o Risk Evaluation
- Risk Identification
o Risk Scenarios Definition
o Vulnerabilities and Threats Identification
- Security Controls Selection
- Risk Action Plan
Threat Risk Assessment
An Above Security TRA provides the foundation for a risk management program.
Assessments ensure that appropriate and reasonable methods are in place to protect
the confidentiality, integrity, and availability of stored, processed, or electronically
transmitted information.
Above Security performs numerous TRAs annually and works with a wide variety of
systems, applications, and security classifications which provides the breadth and depth
of experience to do a thorough assessment.
Web Application Assessment
An Above Security Web Application Assessment will help you fully understand the
vulnerabilities in your online applications, whether a public website serving your
customers or a third-party supplier interface into your corporate CRM. Our web
application assessment goes beyond a collection of automated tests and delves much
deeper into application logic and security controls, giving you peace of mind and not just
a compliance check mark.
Security Audit
We offer comprehensive “TSA”Technical Security Audits identify vulnerabilities on a
variety of your network devices, e.g. servers, appliances, applications and workstations,
and make sure that they don’t lead to further exploitation. At the end of each audit, you
will receive a comprehensive report that will provide you with an accurate and in-depth
view of your risk profile. Services include intrusion tests, vulnerability assessments,
security architecture and configuration reviews, code reviews, and social engineering.
Penetration Testing
Intrusion or penetration tests are designed to simulate a real attack against your
infrastructure in a controlled environment. It’s the first step to finding out how secure your
IT assets are.
The final test report will help understand your current security posture, and provide you
with recommendations on how to improve your defense against technological
vulnerabilities that can lead to intrusions, fraud and service interruptions.
Security Architecture and Configuration Reviews
Above Security’s security architecture and configuration reviews provide a detailed
analysis of the security architecture of your network, including network topology, installed
components, device properties, configurations, information exchange protocols, allowed
services, etc.
As a result of the review you will get a detailed report summarizing the current
configuration of your servers as well as the architecture of your IT network, and
recommendations of countermeasures and enhancements to enhance your security posture
Secure Code Review
Above Security’s secure code review approach is based on the SANS “Secure Web
Applications Technologies” (SWAT) best practice. The code review will also conform to
your security practices. In addition to reviewing the code, our security consultants can
lead secure coding workshops with your development team to make sure that they are
up to date on the latest methods of securing your in-house built applications.
Social Engineering
Above Security’s Social Engineering service allows you to detect weaknesses to better
address your staff-related security issues. An additional objective of a Social Engineering
mandate is to establish solutions to increase the global level of your corporate data
confidentiality, integrity and availability.
The result is a more secure working environment against fraud and data compromising
attempts, and a more security aware staff resulting in an improved overall security posture of your organization.
Information Assurance Audit
Above Security tailors the use of security architectures, frameworks, methodologies, and
models to meet your industry needs, legislative, and regulatory compliance
requirements. Above Security can perform assessments and audits for various size
organizations, from complex enterprises to small and medium businesses, as well as for
different industries with multiple regulatory requirements—such as financial services,
government, communications, healthcare, energy, oil and gas and retail.
Compliance and Regulations
Our customers are leveraging our Consulting Services to protect their critical IT assets,
but also to comply with internal and external regulations such as PCI DSS, HIPAA,
GLBA and others.
In addition to the current threat landscape, organizations are often required to meet
various compliance requirements specific to their verticals and business processes (e.g.
PCI-DSS, HIPAA, ISO 27001, GLBA). Failure to comply with these regulations may have
serious implications such as fines, legal action, remediation costs, lost revenues, and a
damaged brand.
Above Security can help you conduct analysis, deploy technology based on the
assessment of your requirements, and implement policies and procedures to achieve the
highest levels of compliance. Our consulting services are designed to help you address
regulatory requirements to safeguard your business and make sure you comply with your
industry’s regulations.
Does your organization need to comply with regulatory requirements such as PCI DSS
or HIPAA, but you don’t know where to start? With Above Security’s compliance
consulting services, we’ve got you covered! Above Security’s certified security
consultants will help bring clarity to what needs to be done for your organization to
achieve compliance, all while following recognized best-practice strategies in the
industry.With 20 years of experience in information security and IT risk management, our security
experts have the necessary expertise to walk you through the entire compliance process:
determining how information and the associated systems are being protected, assessing
the processes and policies in place, and recommending and implementing solutions
tailored to your business needs that will.
1- PCI DSS Compliance
All organizations that handle cardholder information are subject to mandatory
compliance with PCI DSS requirements. As a Qualified Security Assessor (QSA), Above
Security helps you address all PCI DSS requirements while reducing the associated
complexity and costs.
Above Security can simplify the implementation process by providing you with the
following cyber security technologies to ensure that cardholder data is not being
compromised:
- Security Event Log Management and Monitoring
- Firewall Management
- Intrusion Detection and Prevention System
- Internal Vulnerability Scanning
- External Vulnerability Scanning
- File Integrity Monitoring
2- ISO 27001
The ISO 27001 standard was created to manage the development and the
implementation of an Information Security Management System (ISMS), specifying
conditions to establish, implement, set up, manage, review, maintain and improve the
documented management of IT security systems for your organization. Whether it is to
prepare your organization for an ISO certification, an audit, or simply to better implement
the best practices defined by this standard, Above Security’s compliance consultants will
guide you through the necessary steps of the assessment and implementation of the five
ISO 27001:2005 control criteria:
1. Information Security Management System (ISMS)
2. Management Responsibility
3. ISMS Internal Audit
4. ISMS Management Review
5. ISMS Improvement
3- HIPAA
With the rise of dependence on electronic records, the provisions of the Health Insurance
Portability and Accountability Act (HIPAA) require the establishment of national
standards for electronic healthcare transactions and national identifiers for providers,
health insurance plans, and employers. As a leader in IT Risk Management and
Managed Security Services (MSS), Above Security can help your organization comply
with HIPAA, as well as define policies and procedures in order to comply with both
HIPAA provisions and internal regulations to protect you against external and internal
threats to patient information privacy:
- Managed Intrusion Detection & Prevention Services (ID/PS)
- Firewall Management
- Log Management/ Retention
- Endpoint Protection
- Vulnerability Management/ Assessment
4- GLBA
Under the Gramm-Leach- Bliley Act (GLBA) of 1999, financial institutions are required to
protect consumer financial information by establishing an information risk management
program. With its comprehensive set of security consulting services, Above Security has
been helping financial institutions since 1999 to comply with GLBA regulations, all while
ensuring the highest levels of data and IT infrastructure security:
- Maintain up-to- date and appropriate programs and controls to prevent
unauthorized access to customer information
- Manage your firewalls and other security devices to ensure the secure
transmission of customer information
- Know where sensitive customer information is stored and secure it
- Make sure that access to customer information is limited to employees who have
a legitimate business reason to see it
- Identify any vulnerability in access to sensitive information through our
vulnerability scanning service
- Develop and manage policies for the appropriate use and protection of laptops,
PDAs, cell phones, or other mobile devices
- Make sure that former employees no longer have access to customer information
5- Governance
Leverage Our Information Security Governance Expertise For Your Business
Does your organization need to implement and maintain an effective Information Security
Management System (ISMS)? If so, information security governance represents an
important and fundamental component. Through a set of multi-disciplinary policies,
structures, processes, procedures and controls, developed and applied to manage
information at an enterprise level, IT security governance provides guidance on how to
determine information security objectives and how to measure the progress towards
achieving them.
With 20 years of experience in information security and IT risk management, our security
experts have the necessary expertise to walk you through the entire governance
process. Above Security’s governance consulting services ensure that IT risk
management practices are properly embedded in your organization, enabling you to
secure an optimal risk-adjusted return
Physical security systems and threat Risk analyses studies
Our Physical main security services contain:
Qualitative Security Threats and Risks Assessment (Ql-STRA).
Quantitative Security Threats and Risks Assessment (QN-STRA).
Totally built on the RIIOT methodology
Security System Design
1.1. Concept design
1.2. Schematic design
1.3. Detailed performance design
1.3.1. Control room.
1.4. Tendering support.
1.5. Construction phase supervision.
1.6. Test & commissioning T&C.
1.7. Project management
1.8. Training
We applied Standards, Rules, Regulations and Guidelines
The top priority is for the local authorities’ laws and regulations. The proposed set of
services requires a number of activities to be performed in a logical sequence at most of
its successive stages. Different international codes of practice and standards will be
adopted in each.
Uncertainty of financial loss, the variation between actual and expected results, or the
probability that a loss has occurred or will occur, is the fundamental definitions of risk in
our scope. In short words, it is the possible of occurrence of an undesirable event.
1. Local codes and standards to be based on Law24: 2008 and Law 10:2014 issued by
DPS the competent department in Dubai police.
2. API/NPRA Security Vulnerability Assessment 2004 methodology.
3. US Department of Homeland Security – Federal Emergency Management Agency –
FEMA 452: 2005, particularly relating to determining Design Basis Threats.
4. US Department of Defense’s (DoD) C.A.R.V.E.R. target analysis methodology for
considering the attractiveness of potential targets, adapted from Joint Publication 3-
05.1 Joint Special Operation Task Force Operations 2007.
5. The UK Home Office Scientific Development Branch’s guidelines on developing
Operational Requirements for security, 2009.
6. Our risk assessment procedures and reporting are totally in compliance with the
international standards like ISO-31010: 2009, ISO/TR-31004:2013(E) and ISO-
31000:2009(E).
7. The facilities physical security measures are based on ASIS/GDL- FPSM: 2009
guidelines.
8. The threat advisory system response is based on ASIS/GDL- TASR04: 2008.
9. Security management standard of the physical asset protection ANSI/ASIS PAP.1-
2012.
10. ANSI/ASIS SPC.1-2009 is associated with the organizational resilience, security
preparedness, and continuity management systems – requirements with guidance for
use.
11. ISO guide 73:2009, risk management – vocabulary.
12. BSI-BS8549: 2011(R), Security consultancy - Code of practice.
13. BSI-BS7858: 2012, Security screening of individuals employed in a security
environment - Code of practice.
14. BSI-BS8220- 3: 2011(R), Guide for security of buildings against crime - Part 3:
Storage, industrial and distribution premises.
15. BSI PD CLC/TR 62541-2:2010, OPC Unified Architecture Part 2: Security model.
16. BSI BS EN 50132-5- 3:2012, Alarm systems - CCTV surveillance systems for use in
security applications, Part 5-3: Video transmission - Analogue and digital video
transmission.
17. BSI BS EN 50132-5- 1:2012, Alarm systems - CCTV surveillance systems for use in
security applications, Part 5-1: Video transmission - General video transmission
performance requirements.
18. BSI BS EN 50132-5- 2:2012, Alarm systems - CCTV surveillance systems for use in
security applications, Part 5-2: IP Video Transmission Protocols.
19. BSI BS EN 50132-7:2013, Alarm Systems - CCTV Surveillance Systems for Use in
Security Applications, Part 7: Application Guidelines.
20. BSI BS 7958:2009, Closed circuit television (CCTV) - Management and operation -
Code of practice.
21. BSI BS 8495:2014, Code of practice for digital CCTV recording systems for the
purpose of image export to be used as evidence.
22. BSI BS 8418:2010, Installation and remote monitoring of detector activated CCTV
systems - Code of practice.
23. BSI BS EN 50130-4 + A1:2011, Alarm systems - Part 4: Electromagnetic
compatibility - Product family standard: Immunity requirements for components of fire,
intruder, hold up, CCTV, access control and social alarm systems - AMD: November,
2014.
HSE Consultancy
We assist with your effective management of health, safety, and environmental risk. This
will provide business benefits to protect your workers, minimize sickness and absence
rates, reduce your insurance premiums and enhance your organizations reputations.
We offer a wide range of support which can include solving complex issues involving
various countries and their differing legislation. Time sensitive actions and volume based
tasks. Providing just the right level of commercial and economic benefits to your
business.
Our knowledge is built on providing trusted health, safety, and environmental solutions
by interpreting legislation in line with your business priorities and objectives. Bringing
insight, best practice and cost saving initiatives, our service continually evolves to meet
your business needs using a collaborative approach
HSE and Quality Management system development and implementation
we conduct a gap analysis to focus on areas of improvement which are then measured
against OHSAS 18001:2007, ISO 14001, ISO 9001 or other best practice standards
such as local legislation.
We can then develop your health, safety, environmental and/or quality management
system and proactive management tools to help you achieve compliance and
accreditation (where appropriate) in line with your chosen management model.
The management system would encompass the following headlines amongst others;
Introduction, policy & leadership, roles and responsibilities, targets and objectives, legal
compliance, risk management, contractor management, emergency management,
regional safe operating procedures, the management of change, training and
competency, hazard near miss accident and incident reporting, audits, communication
and consultation, performance monitoring, document control and management review.
Our consultant would also develop any associated forms, checklists, registers etc. which
link with and support the manual.
Knowledge transfer would also be arranged and company staff coached and mentored
on the new procedures.
Health and safety management
We offer the broadest range of health and safety risk management services to assist
businesses to comply with every aspect of health and safety legislation including:
Audits and assurance activities
Risk assessments and effective control strategies
Specialist health and safety consultancy
Health and safety outsourcing
Design and implementation of health and safety management systems
Occupational hygiene measurements and solutions
HSE system review and audit
our consultants have specialist experience in many health, safety, and environmental
subjects and will provide an independent assessment and evaluation of your particular
risks. The consultant will examine existing arrangements to include organizational
policies and procedures, existing risk control measures and their effectiveness and
observe working conditions and practices.
A baseline organizational position can be established to understand the health and
safety culture within the business, evidence the working environment and understand
how health and safety are currently demonstrated.
Review any existing health and safety systems, manuals, policies, processes, and
procedures. Review and assess the property portfolio to establish areas of high priority
and review and assess the current employee job roles to establish areas of high priority.
Topics covered for audit can include; manual handling, working at height, display screen
equipment, workplace transport, COSHH, machinery arrangements, environmental
assessments, precautions against slips, trips and falls, electrical equipment safety, first
aid arrangements, welfare facilities and general cleanliness and tidiness.
Staff competence can also be assessed based on interview and qualifications.
The benefits of using our services include:
Working with our proven methodologies you will benefit from an investment in quality
procedures and system ensuring that you minimize your exposure to liability and adverse
publicity by having appropriate due diligence measures in place.
Peace of mind from using class-leading skilled consultants, many of whom are ex-
enforcement officers with extensive knowledge of their field.
Crisis, Emergency and Disaster Management, EA in Action
We at Consilium Consulting believe that building a successful CEDMC Practices must be
based on comprehensive understanding on how the involved organizations interact and
work together to run CEDMC business processes. Components mean all what a process
needs for its execution: people, information, IT services, locations and events. Our
experience shows that studying all the components needs to be in the context of a
scientific framework that maps the business architecture thus documenting the different
components and their relationships. We use the well-established Enterprise Architecture
concepts to achieve this goal.
Our Approach focuses on building and designing artefacts, that is, descriptive
representations of the complex business Processes and Functions running in each of
entities involved in the Crisis, Disaster or Emergency Management. This will enable
Incident, Emergency, Business Continuity and Crisis Teams to have a deep focused
concentration on selected aspects of a process, event or equipment without losing a
sense of the contextual, or holistic, perspective.
During any incident, emergency or crisis there are simply too many details and
relationships to consider simultaneously. However, at the same time, isolating single
variables and making decisions out of context results in more damage, costs and
dissipation of energy.
CONTACT US
Bucklands Beach Rd, Auckland 2012, New Zealand
Info@consilium-consulting.net
FOLLOW US
Google +
PROFILE
We are working to be the partner of choice in management consultancy and solutions
Tel: 006421999605
© Copyright 2017. All Rights Reserved.