We have all seen how a cyber security breach can cripple IT systems, and destroy organisational and individual management reputations. So, when you suffer an incident, an immediate, calm, incident response, and expert management guidance is essential. When an incident hits, time is of the essence to limit the damage.

As you will understand, each incident is unique and requires a different response. However, with almost two decades of experience, ECSC has encountered the full range of attack scenarios, and has up-to-date knowledge of the latest attack trends. Read our brochure on Incident Response for insights into how to tackle an incident, understanding your risks and how we could help.

Cyber security incidents can emerge and escalate rapidly. Therefore, it is sensible to prepare and test a plan for how you deal with incidents, both from a technical and management perspective.

Want to test your business? ECSC Group plc and Broadcast Media Services Ltd (BMS) support clients during major incidents and, together, we have designed a range of exercises. Download for more information.

Understand how outsourcing your cyber security management to a specialist Security Operations Centre could benefit your organisation.

Your external Internet-facing systems, and perimeter network devices, are the first point of attack for many security breaches. They are subject to constant automated probing by hackers, looking for weaknesses either from misconfigurations or vulnerabilities.

So, how do you know what the hackers are seeing, and whether you look vulnerable and are therefore at immediate risk? Read our brochure to learn more.

Before you can even think about effectively managing a potentially damaging cyber security breach, it is worth simply understanding what your detection capabilities really are.

Our brochure explores:

• How to deal with a security breach
• Knowing how you secure you are
• Finding technologies that deliver
• Recruiting and retaining the right expertise
• Detecting cyber security breaches
• Achieving cyber security standards

Protective monitoring or Security Information and Event Management (SIEM), is now considered an essential element of IT security provision. Results from security breach investigations show that ascertaining the nature of the breach is difficult without sufficient event data. In addition, if security event collection is accompanied by appropriate monitoring and alerting, the breach could have been detected and contained, or even prevented. Protective monitoring is an important element of your IT security protection and the prevention of a damaging incident. Download our brochure to find out more.

This 10 minute guide has been designed to help you understand SIEM, irrespective of your software choice.

Each ECSC Management Guide is carefully authored for a management audience, and designed for both the technically knowledgeable and also senior managers with an interest, but not necessarily a deep technical background.

The world of cyber security breach detection and response is fast-moving and filled with new marketing terminology - often used to describe old, or unproven, technology. So, it is worth understanding a little of what options are available and the latest trends.

By downloading this brochure you will learn how Nebula could enhance the cyber security of all organisations, regardless of size, existing technologies or budget.

To learn more about Nebula in detail, and discover the best fit for your organisation, please download the service specification guide here.

In this Blue Paper, you will learn:

• What is Self Assessment?
• Detail on each questionnaire
• The different types of questionnaire available

The standard applies to anyone storing, processing, or transmitting debit and credit card data. This brings not only merchants, but a wide range of service providers, within the scope of the standard. The standard is primarily being enforced by the acquiring banks - whom merchants ultimately send their transactions to, and receive payment from.

This Blue Paper is intended as an introductory document to help you understand the Payment Card Industry (PCI) Data Security Standard (DSS). The comments and advice are based on extensive consulting experience, and are designed to guide you in meeting the requirements, or making use, of the standard.

The Payment Card Industry Data Security Standard (PCI DSS) was published over 5 years ago, and in that time has undergone a series of revisions as technology, and information security best practises have developed.

In this Blue Paper we highlight how the latest version of the standard (PCI DSS version 3.0) has changed from previous versions, and look at the implications the changes may have on your organisation. You will learn:

• How to define your scope
• The implications of your usual business practices
• How to transition to the new version of the standard

Today there are solutions that enable you to remove the actual payment process from your call centre agents, either with automated payment systems or systems that intercept telephone keypad tones for entering card details. These solutions do remove your desktop environment from your PCI DSS scope, however it is still your responsibility to ensure that the actual system deployed to do this is PCI DSS compliant itself. Read this paper to fully understand your risk and service options.

PCI DSS is an Information Security standard which you MUST adhere to if you handle credit or debit cards as part of your business operations.

In this Blue Paper, you will learn:

• Who does and doesn't need to be PCI compliant
• Determining your level of compliance
• How to implement the standard with minimum complexity

Processing payment cards (credit or debit), is an essential function for many organisations. With card details being a particular target for criminals, your IT security must be high. PCI DSS was established in response to feedback from forensic investigations that follow breaches of card data.

The contents of the standard are a set of preventive measures that, if followed correctly, should prevent you from suffering a costly breach. This paper explores the difficulties when establishing a PCI DSS compliant environment and why outsourcing may be the best solution.

For organisations that handle payment card data, meeting all the requirements of PCI DSS is a significant challenge. Numerous technologies are available to outsource payment processing, which removes the need to meet many of these requirements. But, where this is not an option, it is extremely important to determine the areas of technology, policy and process to which the standard applies. This is known as the SCOPE. This paper explores the SCOPE and meeting PCI DSS twelve Requirement sections.

Recommended read to all organisations with concerns about phishing attacks. This document supports the NCSCs recommended multi-layered approach to defending your organisation against phishing.

In this Blue Paper, you will learn:

• How large organisations can develop a global ISMS
• What are the key decisions required as part of implementing an ISMS
• Guidance on creating documentation

Presenting it services to the internet, whether hosted locally or within dedicated data centres, brings with it significant it security risks. many organisations are now realising that to comply to the required level of security, the architecture, configuration and ongoing management of hosted systems, also requires a level of skill and experience that you may not have in-house.

This paper explores how using an experienced, and trusted, Managed Security Service Provider (MSSP) can give you a level of security design, configuration, and monitoring that only the largest organisations can afford to recruit and retain.

Assessing your current level of security, and deciding whether this is appropriate is technically challenging - and that is why most people accept the need to involve a specialist third-party organisation to do this via 'penetration' testing. Many organisations are now realising that to comply to the required level of security, the architecture; configuration and ongoing management of hosted systems, requires a level of skill and experience that you may not have in-house.

Managed gateway solutions can take many forms, depending upon your requirements. In some cases, ECSC will design and commission the full gateway security architecture, helping you build an environment to meet your exact specification. This may involve firewalls, remote access, web and email filtering, intrusion detection systems, together with log analysis and alerting. Read our paper to find out more.

A fully managed security service from ECSC Group plc (ECSC) comes with the most comprehensive Service Level Agreement (SLA) in the industry. With ECSC you get much more than a single time limit on a 'response' that can be delivered by unqualified off-shore personnel. This document acts as a guide to your Standard SLA, and helps you understand how it relates to the day-to-day service your receive from the Security Operations Centre (SOC).

An Intrusion Detection System (IDS) is, as the name implies, an efficient and effective mechanism to detect attacks and malicious activity on your internal network. This ECSC Management Guide is designed to help you understand the critical elements in developing and maintaining an effective IDS.

Web Application Firewall (WAF) is, in our experience, the most important layer of defence against a wide range of attacks for your Internet-facing websites. Our quick 10 minute guide to protecting your web services explains what you need to consider to keep your servers secure.