Services

Governance | IT Architecture | Development | Analysis

The offered services can be divided into three main roles. The following describes what IT security services each role provides and who the typical clients are.

1. Management Consultant

technical project manager

The management consultant service is normally requested in situations where IT security is in focus from a  business point of view. Typical tasks incl:

  • Setup an Information Security governance incl. Roles & Responsibilities, processes and performance metrics.
  • Conduct a Security Risk Assessment and deliver security control catalogue with a practical roadmap.

The overall security control deliverables are strategically aligned with the long-term business roadmap. Each security controls is prioritized based on a risk assessment and a business case. The in-depth technical knowledge is not needed in this service because the main focus in on governance.

2. IT Security Architect

it security architect

This service is desired when the client lacks time or competence whilst evaluating or designing a new solution.

Typical tasks include:

  • Design, evaluate and/or implement an IT solution that may take business, infrastructure, data and application into consideration (TOGAF) with focus on IT Security.
  • Create company specific IT security strategy or policy. Align the company with an acknowledged framework i.e. ISO 27000 series or NIST framework or author and implement IT Security standards.

Normally the project ends with a hand-over to operations, the moment the solution is up and running. However, it is recommended to keep the project running for some time after hand-over to ensure all use cases have been identified and dealt with.

3. Analyst or Developer

This service is solely in the operational domain where the end-goal is always well-defined and easy to navigate after.

Typical tasks incl:

  • Analyze and implement security controls based on audit findings, security incidents, threat management or strategy.
  • Develop a tool, script or customize an IT system.

Food for thought

Each service requires a different skill-set and therefore it is often sold separately because typically one individual has only one skill-set. The challenge is to consult the right individual at the right time and therefore not waste these resources time or company’s money. In practice this means knowing upfront which competence has relevant views that should be consulted at a certain stage in a project, at a specific workshop or at a specific meeting, which basically is impossible without non-value adding activities.

The big advantage with IT-Security.dk is that we have resources that have ALL THREE skill-sets in one individual, which is quite rare. This means in practice fewer surprises, faster and less expensive implementation, more time with value-adding activities (fewer meetings and  re-work) and simply put a better end-result.