Consulting

As experts in the field of IT security with over 30 years of professional experience, we identify the points that benefit your company's information security the fastest and ensure sustainable, more secure IT. Regardless of industry-specific regulations, most IT environments are subject to statutory minimum requirements for information security, such as BDSG / GDPR, KonTraG, NIS2 Directive/BSIG (BSI-Gesetz) plus industry-specific regulations.

Information security should always be part of the whole (=IT management, software development, infrastructure, etc.) and not left to chance or a piece of technology. Governance or GRC as part of an ISMS rather leaves control and steering to management, instead of leaving (in-)security to chance.

Exposed components are of particular importance, especially in the age of AI. Here it is important to invest in security early and to defend with the appropriate measures. Fundamental, security-relevant deficiencies – e.g., in web applications or networks – are difficult and costly to change in operation. A "Secure Software Development Lifecycle" therefore consists not only of development and a pentest, but of many key points to ensure sustainable and appropriate security.

You can expect the following from us:

• IT security concepts from planning and documentation through to operation
• Classic ISO activities: tracking, maintaining, escalating tickets in the field of IT security
• Establishment of security policies
• Review of architectures and concepts as an outsider
• Project support for IT security, specifications, ensuring best-practice standards, support with compliance requirements
• SDLC, Secure Software Development Lifecycle, DevOps, CI/CD

Training / Workshops

Training and workshops are important tools to create awareness, convey concepts, and to pass on knowledge in terms of IT security.

We offer such training at your premises after discussing the desired content: it should be tailored to the respective environment. These can be simple awareness seminars or more in-depth technical trainings. The target audience is, on the one hand, technical staff, to whom we pass on knowledge, e.g., for system or web application security; on the other hand, in the context of workshops we present, develop, or discuss concepts and security strategies for project/IT managers and management.

Awareness workshops on handling computers securely and raising awareness of threats are in demand. These can be supplemented by phishing and other social engineering campaigns.