Security Consulting Services

Creating a secure environment requires both an understanding of the business’ larger objectives and clear and open communication between security professionals, operational leaders, and the boardroom.

Our experience sitting on your side of the desk means that we understand your challenges and know what it takes to design and implement security solutions that will work—and one that all stakeholders will embrace.

Our many subject matter experts are cross-trained in multiple areas and can be made available to provide IT/security consulting on an as-needed basis. LBMC Cybersecurity would work under the direction of an individual you designate and provide either remote or on-site assistance.

Creating a secure environment requires both an understanding of our clients larger objectives and clear and open communication between security professionals, operational leaders, and the boardroom. The LBMC Cybersecurity team includes award-winning security professionals who have built and run successful information security program plans for companies of all sizes. Our experience sitting on your side of the desk means that we understand your challenges and know what it takes to design practical and actionable information security program plans that will work—and ones that all stakeholders will embrace.

Targeted Subject Matter Expertise—Support Where You Need It

Sometimes, you don’t need to overhaul your information security program plan from the ground up. Instead, you may simply need to supplement your existing capabilities with specific security expertise. Our professionals are a diverse group of highly-credentialed and experienced information security professionals. That means we have the right IT security talent to complement your existing team. Here are just a few of our areas of expertise:

• Forensic analysis of security log information
• Penetration testing
• Centers for Medicare & Medicaid Services (CMS) Minimum Security Requirements
• National Institute of Standards and Technology (NIST) security control framework
• Health Insurance Portability and Accountability Act (HIPAA) Security Rule
• Specific certifications, such as HITRUST Common Security Framework (CSF) Assessors, PCI Qualified Security Assessors, and Certified Public Accountants

Business-Focused Security Programs

We draw on our extensive experience in healthcare and a variety of other industries to assist your organization in security program development that meets your overall business objectives and help you appropriately manage cybersecurity threats. First, we conduct a thorough risk assessment, so that we can identify weaknesses in your organization’s security framework. Taking into account factors such as the size of the company, business objectives, risk tolerance, and budget, we create an information security program development roadmap. This roadmap may include policies and standards, intrusion detection and monitoring programs, enhanced documentation, and/or an awareness program to enhance the skills of existing IT staff through training and recruitment. Great design only manifests itself through great implementation. LBMC Cybersecurity can help your team execute each step of your program in an effective yet manageable way, whether you are phasing in changes over time or undergoing a full-scale implementation.

1. Ensure that you either have or can quickly provision protections against DDoS attacks. Most organizations do not keep these protections on premise and choose to rely on external parties for this protection (ISPs, upstream providers, Cloudflare, Akamai, etc.). If you are unaware of whether these protections are available to you, now is the time to consider your capabilities and plan accordingly.
2. From a propaganda perspective, the United States will be targeted for website defacements. There have already been reports of this activity. Ensure that your web applications, and associated platforms, are properly patched from a security perspective. In addition, web application assessments are strongly suggested to determine any other security issues.
3. Ensure that security patching is consistent for internal workstations and servers.
4. Ensure proper segmentation between your production and business networks exists to segregate any networks that contain industrial control systems (ICS).
5. Perform external penetration tests to understand your security risks from attackers on the internet.
6. Conduct social engineering tests with a focus on phishing emails that are designed to capture user credentials. Also, ensure the multi-factor authentication (MFA) is deployed on all external entry points (cloud, Office365, VPN, etc.).

In the current technological environment, vendors are not only helpful but are sometimes required to run certain aspects of many businesses. At the same time, each of your vendors presents a unique risk to your organization, whether it’s information security or the availability of your company’s product or service. Understanding and managing this vendor risk is a key component of any truly effective security program. LBMC Cybersecurity uses a business-centric and tailored methodology that includes:

• Reviewing and analyzing your existing VRM program and making recommendations for improvements
• Collaboratively develop vendor survey questionnaires and an improved risk assessment approach
• Conducting assessments on the agreed upon vendor population

With these best practices in place, you can maintain and scale your third-party vendor risk management program.

Our virtual CISO (vCISO) services will play an integral part in the development of strategic policy, technology planning and investments in information security at your organization. Collectively, LBMC Cybersecurity has 50 years of CISO experience. As a proven leader in the field, our vCISO services provide an executive level leader with strong technical skills, strategic capabilities, and a talent for integrating people and processes into a comprehensive approach to security.

We believe a vCISO should:

• Identify, evaluate, and measure risks
• Ensure compliance
• Prioritize remediation
• Recommend adjustments to controls
• Advise & educate management
• Provide guidance on the disposition of risks
• Implement security control processes
• Evaluate the effectiveness of security controls

The vCISO will partner with business units to manage the security environment, design secure products, and enable your organization to execute on its business strategy while protecting its data and brand in the marketplace.