Security Assurance

We provide security assurance through the complete Cloud Lifecycle.

NCMME offers 360 degree Security Consulting, Design, Implementation and Management

Design and implementation of Security on the Cloud is fundamentally different from Security for on-premise IT infrastructure and applications. When services are hosted on the Public Cloud, you do not have physical access to the infrastructure on which the services run. As a consequence there is some dependency on the Cloud provider for certain elements of security.

Cloud service providers do take the responsibility of providing physical security for the infrastructure and Client data. Their security extends to protecting Client data from insider threats. The Security posture and Security measures taken by the Cloud Service provider are documented and available to partners and clients. These Security measures provide Security assurance, and the documentation helps in meeting the compliance requirements of various Security standards.

You, however, still need to take measures to protect your applications from a range of Internet threats such as: exploitation of vulnerabilities and attacks targeted at your infrastructure and internet exposed applications. At NCMME, our Security experts offer a range of services to protect your services from a wide range of threats. Our security consultants are certified on a range of Security standards, and they will help ensure compliance to any Security standard relevant to your Cloud services.

Our Security Consulting practice is a comprehensive and covers all aspects of Security for your cloud-based services. We assess, design, implement, monitor and manage your Cloud Security.

Security in the

Cloud lifecycle

Our Security Consulting practice is a comprehensive and covers all aspects of security for your cloud-based services.

Components of NCMME Cloud’s Security Consulting Service

Our Consulting team can help you with the complete security lifecycle, or just advise on a segment. We assess, design, implement, monitor and manage your Cloud security.

Security Compliance Consulting

We can assist you with Security design based on the Security requirements of your application and their Security compliance requirements. We can:

Perform a Gap Analysis

Remediate by plugging Security gaps across Infrastructure, Applications and Processes

Ensure compliance to any required Security standards

For new applications going on to the Cloud, we recommend and implement:

Security configurations to plug Vulnerabilities

Security Processes that adhere to best practices

Security Tools that protect against various threats

These recommendations are necessary to be deployed to achieve Compliance. The scope of the recommendation will include Infrastructure, Applications, Processes and Tools to be deployed on the Cloud. The recommendations are compiled into a Security Design document. We automate Compliance to Security standards and make it easy to stay compliant.

Security Implementation

Vulnerability Assessment (VA) and Penetration Testing (PT)

We recommend regular testing of your Infrastructure, internet facing devices and applications for Vulnerabilities in coding and configurations. You should also look at Penetration Testing every quarter or six months. Proactive testing will harden your Security, and lower the possibility of attacks being successful.

Internet Threat Protection

We partner with world class Internet Security technology companies, and implement protective measures such as: Anti-Malware, Anti-Virus, Network and Web Application Firewalls, Intrusion Detection and protection devices and protection against DDOS attacks.

Security Implementation Design & Plan

A methodical approach to implementing Security in the Cloud
With inputs from the compliance requirements assessment or from a general Security assessment, we develop an implementation design and a corresponding implementation plan. Our implementations will invariably address details such as:

• Choice of a Cloud provider based on subscription costs, Security compliance and practices
• Bill of Material on the Cloud based on the Security design
• Cloud services that need to be procured (including configuration and Security settings)
• Security processes that need to be followed
• Security monitoring parameters
• Incident management procedures and associated process automation
• Systems and processes to prevent configuration drift

We execute several post implementation procedures for Security Assurance
After any first time implementation, we have some standard post implementation processes such as:

• Testing the implementation to ensure that the implementation is according to the design
• Testing the application performance
• Performing another vulnerability assessment
• Running a penetration test to check for vulnerabilities and
• Remediating vulnerabilities, if any, with updated Security configurations

Watching your Cloud for Security threats and breaches round the clock
Once the Security implementation is done, your Cloud is monitored for:

• Application availability
  – Load balancing, infrastructure availability
  – Set up application backup and recovery plans, along with recovery processes
• Application performance
• Web application Security with
  – Malware and Virus protection
  – Application firewall for protection against OWASP and Internet Security threats