Agile Systematic Integrated Resilience (ASIR)
For enterprises and users of technology products and services, BCG Platinion offers the following services for Operational Technology (OT), Classic Information Technology (IT), Internet of Things (IOT), Industrial Internet of Things (IIOT), Mobile, and special applications (e.g.: medical devices, vehicles, etc.):
Systematic Cyber Resilience Assessment
Determine the organizations assets: data, intellectual property, physical, human, operations, and reputation, including the systematic development of an agile asset Inventory that is continuously maintained, and meets the regulatory and/or best practice requirements best suited to the organization. Building of the asset inventory will be based on BCG Platinion models, such as STAMP and System Dynamics, and consistent with regulatory, and risk management frameworks, including: NIST Cybersecurity Framework, NERC-CIP, FISMA, FFIEC, COBIT, COSO, SCO, and others as appropriate. This asset inventory will contain the key elements required to make prioritized decisions on how to invest in protecting the assets. E.g.:
- Asset value (data, IP, physical, operations, financial, reputational
- Business criticality
- Potential cyber-threats (present and future)
- Cross functional dependencies between IT, OT, IOT, IIOT, Mobile, and specialized applications.
Risk Mitigation Strategy
Agile implementation of prioritized cyber-hardening recommendations to achieve the desired increase in cyber-resilience and reduce the organization’s attack surface thereby achieving the desired level of cyber-risk, including:
- Based on the results of the Systematic Cyber Resilience Assessment, BCG Platinion modeling technologies such as STAMP and Systems Dynamics enable BCG Platinion to determine the most cost effective methods for achieving the desired level of cyber-risk and ROI.
- BCG Platinion risk mitigation looks at all facets of the organization: strategic, organizational, operational, as well as technology on hand vs. available in the market. BCG Platinion will develop a Total Cybersecurity Strategy that integrates into the overall organizational strategy in the same way that Total Quality Management, or Safety are integrated into the organization’s strategy. In this way, the BCG Platinion Total Cybersecurity Strategy will be shown to enhance the organizations profitability, customer loyalty, and reputation.
Implementation of the Risk Mitigation Strategy
Once the organization has developed a comprehensive and prioritized Risk Mitigation Strategy, BCG Platinion can assist the organization with implementing that strategy. The BCG Platinion team can provide the manpower to evaluate technologies, implement those technologies, and train the client organization’s personnel and Integrate cybersecurity across all functional areas of the organization, including: IT, OT, IOT, mobile, IIOT, and Special Applications. BCG Platinion areas of expertise include:
- Application Whitelisting
- Patch Management and Configuration Management
- Reducing Attack Surface – close ports & services
- Defendable/Resilient – network segmentation – logical enclaving
- Management of Authentication and Access Privileges
- Implementation of Secure Remote Access methods
- Develop and implement cybersecurity procedures and monitoring of your supply chain
- Penetration testing to validate cyber-resilience
Setting up internal SOCs, SIEM and anomaly detection tools, including training users to:
- Monitor IP traffic on boundaries for abnormal or suspicious communications.
- Monitor IP traffic within the OT, IT, IOT, and mobile devices and networks for malicious connections or content.
- Use of host-based products to detect malicious software and attack attempts.
- Use of login analysis (time and place for example) to detect stolen credential usage or improper access, verifying all anomalies with quick phone calls.
- Monitor account/user administration actions to detect access control manipulation
- Develop Business Continuity (BCP) and Disaster Recovery (DRP) plans
- Assisting with the implementation of the BCP and DRP during a Business Continuity and/or Disaster Recovery event.
- Set up and assist in war gaming and other practice drills and training