Security Policy, Practices & Personnel Services

The Purpose We help you make sure that your security policies and standards—and the people they're intended to guide—are as sound as your technology. Develop policies and standards to promote security. Most security problems arent just technical, they’re organizational. Good policies and practices aligned to corporate goals and a thoroughly trained staff can help reduce risk as effectively as the most up-to-date technology.

Policies and Standards
As part of any project, we carefully assess the gaps in your policies and standards—not just in your systems. We’ve discovered that almost all the problems we uncover aren’t just technical problems, they’re organizational problems. If you lack a security policy or a standard where you need one, we’ll help you develop it. If your policies and standards aren’t serving you well, we’ll identify why and help you improve them.

Strategic Planning
Policies and standards that serve you well today might not be adequate in the future. The marketplace changes. New regulations come into effect. Threats evolve. We help you develop a strategic planning process so that you can evolve as circumstances change.

Business Process
Security isn’t just about security, it’s about your business. We look at your organization as a whole to determine the impact a security or compliance failure might have on your operations, your reputation, and your business objectives. We help you assess and develop policies and standards—and a strategy—that both strengthen your security and advance your business goals.

Training and Awareness
Policies and practices are effective only if your staff understands them and knows how they’re expected to comply. We make sure your company’s personnel— from the security experts to the management and rank-and-file employees—get the training needed to maximize the effectiveness of your policies and procedures.

The Opportunity for Complete, Outsourced Program Management
If you want to concentrate solely on business, but still want to have the confidence that your business is secure, Alawy can help. Between complementing your staff with our consultants and our cost-effective Managed Security Services, Alawy believes it can address your strategic outsourcing needs.

Interim and Deputy Chief Information Security Officers and Chief Privacy Officers
Chief Information Security Officers (CISO) and Chief Privacy Officers (CPO) are hard to find. They’re in short supply, and privacy and security are becoming increasingly visible. Alawy’s Interim CISO and CPO program provides you with fully qualified officers who will learn your organization thoroughly. They can help you maintain compliance today and plan for the future as well. By providing senior security and privacy staff, we can help:

• Define the CISO or CPO functions;
• Jump-start stalled security or privacy efforts, and;
• Maintain momentum in existing programs during your search for a permanent CISO or CPO.

We can also provide Deputy CISO and CPO services to augment your capabilities if you already have a CISO or CPO in place.

Back to top

Value to YouHigher Efficiency, Lower Cost
We design a security program with your company in mind—with your business objectives at the forefront—so that you can improve your security posture while remaining focused on your core revenue-generating pursuits. Both your IT professionals and their customers—the rest of the company—can work more smoothly, which helps the company save precious time to market.

The Fit Thats Right for You
We take what you're doing right and make it better. We don’t have to impose an entirely new system on your organization. We make sure you help protect your company from threats and adhere to regulatory requirements—but we also make sure the program we recommend doesn’t burden your organization.

A Complete Solution
Good policies and practices and a thoroughly trained staff can help reduce risk as effectively as the most up-to-date technology. Computer crime is an ever-growing risk, and its consequences can range from the minor to the catastrophic. Many companies that suffer catastrophic security breakdowns never recover. Inadequate policies and practices and untrained staff are a serious security gap.

Back to top

How We Work

1. We learn your goals and constraints. We meet with key personnel to understand:
   • Your business goals
   • The money and staff you can devote to improving your security. We want to tailor our recommendations to your goals without overtaxing your resources.
2. We evaluate your current policies and practices. We compare your current policies and practices against your business goals and industry standards.
3. We assess your need for a security program. We want to help you develop a strategic planning process—so your company can evolve as market demands, regulations, and threats change. We also want to help you reduce the total cost of security.
4. We analyze your business processes. We want to make sure that the security technology that you're using—or considering—serves to strengthen your security and to advance your business goals. We also want to make sure that your IT processes are providing security where it matters—to everyone in your company.
5. We train your personnel. We identify what everyone in your company needs to know to make your policies and practices effective and provide workshops to educate them. We focus on the specialized needs of your IT staff, the rigorous requirements for management, and the general awareness all employees need.

Tailored Communications
We tailor our recommendations to speak clearly and effectively to the people they affect. We provide executive summaries for decision makers—and the specialized details that give your technical staff the information they need to implement the policies and practices we recommend.

Thorough Training and Awareness Building
Our workshops cover general-interest topics such as password security and acceptable Internet use. We also provide specialized training in:
• Regulatory compliance issues;
• Technical areas such as VPN, intrusion detection systems, and incident management and forensics.

Back to top

Why Alawy

Alawy has worked to secure the networks of Fortune 500 companies in the financial, energy, insurance, media and consumer goods sector in the United States. A significant amount of this experience has been within the financial services and banking sectors—assessing infrastructure security and architecting and deploying secure solutions. We participate in the FBI's InfraGard as advisers in threat and security matters.

Our Security Consultants are Software Engineers trained in Information Security. They understand systems architecture. They see the whole picture. We’re not a software company limited to our own line of products. We provide our clients with the solution that best fits their business and budget needs. We do not cater to a "one size fits all" approach. Our focus is on protecting the sensitive information you are trusted to safeguard -- information belonging to your business and your clients -- from malicious theft or careless mishandling.

Security isn't just about security; it's about your business. We focus on providing solutions tailored to your corporate goals and the real threats you face. Read about Our Approach - the foundation for all our work.

Focus on your business:

• We help you stay competitive. We use our knowledge and experience to benchmark your risk against your industry.
• We value actions by their consequences. Our focus is consequences, not just risk.
• We focus on our relationship with our customers. Our goal is to be your trusted security advisor.
• We provide recommendations that are vendor independent to give you the freedom to implement the solution that suits you best.
• We help you stay competitive. Our business is security, not just consulting.

• We have a wide variety of clients in a broad range of industries. That exposes us to the need for many different architectures, designs, and solutions.
• Our consultants are IT/clients/index.jspals who’ve worked with Fortune 500 companies or in the financial, energy, insurance, media and consumer goods industries.
• Our team of consultants is made up of Certified Information System Security Professionals (CISSPs).

Back to top