Let’s take a step back from all the acronyms, products, policies and all the other security word-cloud worthy terms that are part of the security environment. Let’s examine what we are working to accomplish.
Ultimately, security is all about protecting
our customers, employees, partners and our business!
Meaning that security has to come before any other priorities! It has to be baked into everything that we do! Now if this seems a little daunting, well you’re right! There is a ton here. So how do we take a systematic approach that will help us understand your risks, gain control and have confidence to securely run your business?
Vulnerability Management as a Service (Full stack) is a continuous process to detect, prioritize & fix vulnerabilities. From infrastructure to code, VMaaS offers full coverage encompassing an entire IT landscape.
CSW has a risk-based approach to VMaaS – where they identify, investigate, and prioritize vulnerabilities based on weaponization.
CSW uses a near real-time vulnerability platform to display their results. The platform allows you to communicate, collaborate, and manage your vulnerability program in a centralized manner.
The platform maps your vulnerabilities to known threats and based on the threat context; a risk rating is computed for assets that stand exposed.
As results come in from various scans and tests, you can take immediate measures to fix vulnerabilities prioritized for remediation rather than wait for reports to be formalized, interpreted, and delegated.
Everything: our data, systems, processes, interactions and ultimately our reputation!
CSW’s blend of automated and manual testing process uncovers vulnerabilities that could be weaponized and have known threats.
Findings are delivered through a near real-time RSVP platform that allows you to view, collaborate and interact with security analysts as they pentest.
Understand how you could be breached and what you need to fix first. Once the test is completed, remediation activities can begin almost immediately without any undue delay.
Comprehensible remediation reports that makes reproducing the issue easy and effortless. You can use our platform to validate the same.
View historical data and remediation measures undertaken juxtaposed with your risk reduction. Get alerts about vulnerabilities in different segments and stay secure.
There are all sorts of bad actors out there that want to cause harm for multiple reasons that we won’t detail out right now. But the threats can also come from innocent mistakes made by our own employees. They can also come from not proactively addressing known vulnerabilities.
PCI Security Standard Council stipulates that organizations conduct a quarterly PCI ASV scan of your systems using an approved external entity. CSW is a PCI Approved Scanning Vendor (PCI-ASV) that can help make organizations compliant to PCI requirements and compliance. Their team evaluates the security of your systems, card data environment (CDE), identifies vulnerabilities, and manages risks thereof.
Laws & Regulations inform Policies and require Controls. What are these Laws & Regulations? Do we have to get a law degree to understand them? Where do we even get started? Many organizations are required to follow certain compliance frameworks. You may be obligated to comply based on legal or contractual requirements. But in many cases following these programs is really just best practice!
There are so many flavors of compliance. Here are just a few of the many compliance programs that AWS adheres to and supports:
CSA
Cloud Security Alliance Control
ISO
International Organization for Standardization
PCI DSS Level 1
Payment Card Standards
AICPA SOC
SOC for Service Organizations
FIPS
Government Security Standards
Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada’s Federal Private Sector Privacy Legislation
Freedom of Information and Protection of Privacy Act (British Columbia)
Privacy Legislation in British Columbia (BC)
Health Information Act (HIA)
Privacy Legislation in Alberta
Personal Health Information Protection Act (PHIPA)
Privacy Legislation in Ontario
Personal Health Information Privacy and Access Act (New Brunswick)
Privacy Legislation in New Brunswick
Zuggand has a rich history in building and maintaining robust Security and Compliance programs. With our deep public sector background we invested considerably in working with NIST, HIPAA, HITRUST, PCI, FERPA, FIPS, FedRamp, FISMA and other programs. We developed a policy framework from the ground up to support multiple public sector entities and have worked in this space for nearly a decade now. Our strength is leveraging this knowledge and experience to make it simple to what you need to do in the shared responsibility model in AWS Cloud.
It is important to establish core security principles that you can build your security practice on! AWS has developed a set of living best practices called the Well-Architected Framework (WAF). The AWS Well-Architected Framework helps you understand the pros and cons of decisions you make while designing your critical systems. By using the Framework you will learn architectural best practices for designing and operating reliable, secure, efficient, and cost-effective systems in the cloud.
The Security pillar for the Well-Architected Framework has seven key principles for best practices which are: