Cyber Risk Management

Cyber Risk management Framework Development

When it comes to cyber security, organizations face a future in which it’s best to prepare for worst-case scenarios. As the number of cyber breaches and impact increase year-on-year, organizations need to be have better visibility into the cyber risk profile of the organization to prepare and plan for the unforeseen circumstances.

That means breach prevention can’t be the sole cornerstone of an effective cyber strategy. As outlined, the question is not if a company is going to be attacked. It’s now a question of when the attack will come.

DTS Solution can help your organization build a comprehensive cyber risk management framework based on years of experience in the cyber security field and protecting some of the most critical entities in the UAE and GCC region. Developing the cyber risk management framework is an end-to-end lifecycle from building the cyber risk management framework, cyber risk assessment methodology, cyber risk quantification criteria, cyber risk remediation and treatment plans to reporting the cyber risks using GRC platforms.

DTS Solution can deliver the cyber risk management framework that is also compliant and benchmarked to standards such as ISO27005:2011, NESA SIA – NCRMF, Dubai ISR v2, SAMA, PCI-DSS v3.2 and NIST 800-37. DTS Solution recommends including the following attributes in cyber security risk management frameworks to make it effective;

Effective framework that includes the entire organizational eco-system
End-to-end scope coverage
Risk assessment based on threat modeling
Proactive incident response planning
Dedicated cyber security and risk resources

We help organizations by enhancing their already existing risk management framework that may not be updated to meet the current threat landscape.
DTS Solution
- Design Transform Secure -

DTS Solution takes into account your business landscape, threat profile, inherent risk level and your risk tolerance level that would be acceptable to the business in case of the risk materializing. The risk management framework will be customized to meet your business landscape and we adopt different strategies depending on your level of maturity and ability to perform, maintain and monitor risks on an ongoing basis.

We often find implementing a detailed risk management framework for an organization that has not established sounds controls and not reach the maturity curve expected has the counter effect.

Cyber Risk Assessment

DTS can develop risk assessment approach for your organization based on two principles. We also help building metrics to identify asset value in the first scenario based on the criticality of the business services. We also build threat modeling methodologies to perform scenario-based risk assessment which take into account scenarios of a highly interconnected enterprise environment where people, process and technology all play a major role.

Asset Based Risk Assessment
Scenario Based Risk Assessment

DTS Solution can deliver the cyber risk assessment that is benchmarked to standards such as ISO27005:2011, NESA SIA – NCRMF, Dubai ISR v2, SAMA, PCI-DSS v3.2 and NIST 800-37. DTS Solution can deliver risk assessment based on a wide variety of domains;

Information Security Standards Risk and Gap Assessment
Technical Security Controls Risk Assessment
Cyber Security Process Risk Assessment

Our risk assessment approach is based upon the following core phases and DTS can help at different phases of the life-cycle, depending on the type of risk assessment required we will advise on the best approach to follow;

CATEGORIZATION AND CHARACTERIZATION OF SYSTEM / SERVICE / SCENARIO
Categorize the system and the information processed, stored, and transmitted by that system or service based on an impact analysis. Critical services should be assessment first from a risk perspective and threat types should be identified in this phase.
SELECTION OF SECURITY CONTROLS
Select an initial set of baseline security controls for the system or service based on the security categorization; tailoring and supplementing the security control baseline as needed based on organization assessment of risk and local business landscape based on the different threat types
IMPLEMENTATION OF SECURITY CONTROLS
Implement the security controls and document how the controls are deployed within the system or service. The implementation of security controls to protect against risk factors is typically a different party that performs the risk assessment
ASSESS THE SECURITY CONTROLS
Assess the security controls using appropriate procedures to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for the system or service. The inherent risks are identified and quantified during this phase
AUTHORIZATION AND ACCEPTANCE
Authorize, accept and agree on the risks mitigation plan based upon a determination of the risk to organizational operations and assets, individuals and other the respective eco-system of suppliers, consumers etc. The outcome of this phase is a concrete risk treatment and mitigation plan with clear decision on the risk acceptance, mitigation or transference.
MONITORING OF THE RISK
Monitor and assess selected security controls in the system and service on an ongoing basis including assessing security control effectiveness, documenting changes to the system or environment of operation, conducting security impact analyses of the associated changes, and reporting the security state of the system that may adversely impact the identified risk status and severity.