>>Security Policy and Program Services

Most security problems arent just technical, theyre organizational. Good policies and practices aligned to corporate goals and a thoroughly trained staff can help reduce risk as effectively as the most up-to-date technology.

The Purpose

We help you make sure that your security policies and standards - and the people theyre intended to guide - are as sound as your technology.

Policies and Standards 
As part of any project, we carefully assess the gaps in your policies and standards - not just in your systems. Weve discovered that almost all the problems we uncover arent just technical problems, theyre organizational problems. If you lack a security policy or a standard where you need one, well help you develop it. If your policies and standards arent serving you well, well identify why and help you improve them.

Strategic Planning 
Policies and standards that serve you well today might not be adequate in the future. The marketplace changes. New regulations come into effect. Threats evolve. We help you develop a strategic planning process so that you can evolve as circumstances change.

Business Process 
Security isnt just about security, its about your business. We look at your organization as a whole to determine the impact a security or compliance failure might have on your operations, your reputation, and your business objectives. We help you assess and develop policies and standards - and a strategy - that both strengthen your security and advance your business goals.

Training and Awareness 
Policies and practices are effective only if your staff understands them and knows how their expected to comply. We make sure your companys personnel - from the security experts to the management and rank-and-file employees - get the training needed to maximize the effectiveness of your policies and procedures.

Back to top

The Opportunity for Complete, Outsourced Program Management

If you want to concentrate solely on business, but still have the confidence that your business is secure, Alawy can help. We are experts at implementing security programs. Between complementing your staff with our consultants and our cost-effective Managed Security Services, Alawy believes it can address your strategic outsourcing needs.

Back to top

Interim and Deputy Chief Information Security Officers and Chief Privacy Officers

Chief information security officers (CISO) and chief privacy officers (CPO) are hard to find. Theyre in short supply, and privacy and security are becoming increasingly visible. Alawys Interim CISO and CPO program provides you with fully qualified officers who will learn your organization thoroughly. They can help you maintain compliance today and plan for the future as well. By providing senior security and privacy staff, we can help:

• Define the CISO or CPO functions
• Jump-start stalled security or privacy efforts
• Maintain momentum in existing programs during your search for a permanent CISO or CPO

We can also provide Deputy CISO and CPO services to augment your capabilities if you already have a CISO or CPO in place.

Back to top

Value to You

Higher Efficiency, Lower Cost 
We design a security program with your company in mind - with your business objectives at the forefront - so that you can improve your security posture while remaining focused on your core revenue-generating pursuits. Both your IT professionals and their customers - the rest of the company - can work more smoothly, which helps the company save precious time to market.

The Fit Thats Right for You 
We take what youre doing right and make it better. We dont have to impose an entirely new system on your organization. We make sure you help protect your company from threats and adhere to regulatory requirements - but we also make sure the program we recommend doesnt burden your organization.

A Complete Solution 
Most security problems arent just technical, theyre organizational. Good policies and practices and a thoroughly trained staff can help reduce risk as effectively as the most up-to-date technology. Computer crime is an ever-growing risk, and its consequences can range from the minor to the catastrophic. Many companies that suffer catastrophic security breakdowns never recover. Inadequate policies and practices and untrained staff are a serious security gap.

Back to top

How We Work

1. We learn your goals and constraints.

We meet with key personnel to understand:

• Your business goals
• The money and staff you can devote to improving your security

We want to tailor our recommendations to your goals without overtaxing your resources.

2. We evaluate your current policies and practices.

We compare your current policies and practices against your business goals and industry standards.

3. We assess your need for a security program.

We want to help you develop a strategic planning process - so your company can evolve as market demands, regulations, and threats change. We also want to help you reduce the total cost of security.

4. We analyze your business processes.

We want to make sure that the security technology that youre using - or considering - serves to strengthen your security and to advance your business goals. We also want to make sure that your IT processes are providing security where it matters - to everyone in your company.

5. We train your personnel.

We identify what everyone in your company needs to know to make your policies and practices effective and provide workshops to educate them. We focus on the specialized needs of your IT staff, the rigorous requirements for management, and the general awareness all employees need.

Back to top

The Results

An Effective and Efficient Security Program 
We develop security policies and practices that are effective because they meet the established standards of your industry. We also tailor them to your corporate goals - so they make your business run more smoothly.

Practical Responses to Security and Privacy Problems 
We base your policies and practices on industry standards to make sure theyre sound. We align them with your business goals to make sure they make sense for you. We help you develop a strategic planning process to make sure policies and practices continue to make sense in the future.

Tailored Communications 
We tailor our recommendations to speak clearly and effectively to the people they affect. We provide executive summaries for decision makers - and the specialized details that give your technical staff the information they need to implement the policies and practices we recommend.

Thorough Training and Awareness Building 
Our workshops cover general-interest topics such as password security and acceptable Internet use. We also provide specialized training in:

• Regulatory compliance issues, such as Sarbanes-Oxley, HIPAA, and the Gramm-Leach Bliley Act
• Technical areas such as VPN, intrusion detection systems, and incident management and forensics

Back to top

Why Alawy

Alawy has worked to secure the networks of Fortune 500 companies in the financial, energy, insurance, media and consumer goods sector in the United States. A significant amount of this experience has been within the financial services and banking sectors—assessing infrastructure security and architecting and deploying secure solutions. We participate in the FBI's InfraGard as advisers in threat and security matters.

Our Security Consultants are Software Engineers trained in Information Security. They understand systems architecture. They see the whole picture. We’re not a software company limited to our own line of products. We provide our clients with the solution that best fits their business and budget needs. We do not cater to a "one size fits all" approach. Our focus is on protecting the sensitive information you are trusted to safeguard -- information belonging to your business and your clients -- from malicious theft or careless mishandling.

Security isn't just about security; it's about your business. We focus on providing solutions tailored to your corporate goals and the real threats you face. Read about Our Approach - the foundation for all our work.

Focus on your business:

• We help you stay competitive. We use our knowledge and experience to benchmark your risk against your industry.
• We value actions by their consequences. Our focus is consequences, not just risk.
• We focus on our relationship with our customers. Our goal is to be your trusted security advisor.
• We provide recommendations that are vendor independent to give you the freedom to implement the solution that suits you best.
• We help you stay competitive. Our business is security, not just consulting.

• We have a wide variety of clients in a broad range of industries. That exposes us to the need for many different architectures, designs, and solutions.
Our team of consultants is made up of Certified Information System Security Professionals (CISSPs).

Back to top