RHEA Security services brochure

RHEA Security Services Your partner for cybersecurity.

Keeping your assets and employees safe.

RHEA Security Services

Identify io n

• O pe n so

ur c

a

er vi

C

Se ity ass cu •

t ur ma

T) s

po

nt

re

nd

(S O

C)

• In cide nt r e s p o n s

eme

n

nag

ma

tio de

ci

s Cy b e

t in o r r P Po s t

nt

ec

ou

e

•

c e t e

t

R

es

ce

Cyber-range based training

nt

ce s

• SO C

S IN

(O s ce ce vince

t i io C o n o p e r at

it y cur • Se

ns

nu

Security Training

D

tect Pro

e in tel s i o v li g r d y m en s A S s e e y sessment • C s t a om r riyber risk pl ia

t en

Reco ver

ua t eval nd

Introduction While cybersecurity had already become a prime sustainability concern for industries and organizations for several years, events in Ukraine have brought cybersecurity into sharp focus around the world. The much anticipated proliferation of cyber activity because of the conflict is happening now, with an expectation of more to come. This is a real and present threat to governments, businesses and institutions who now find themselves on the frontline of this cyber conflict.

solutions and services that address the threats each organization faces. We also support our clients with cyber training and a suite of cybersecurity services designed to keep pace with this rapidly changing world. To this end, the RHEA Security Services team brings three core capabilities:

The cybersecurity of critical infrastructures and, importantly, their supply chains is a rapidly growing concern around the world. No sector is immune from the threat, with hostile state-based entities and terror-motivated actors seeking to exploit vulnerabilities to cause economic, societal and/or geopolitical impact. Ultimately, cyber vulnerabilities in sectors such as nuclear energy and air traffic management could result in physical harm.

•

RHEA has spent the last 12 years developing advanced methodologies, technologies and solutions to protect our society against these threats. Founded in the work done for space companies and institutions, most notably the European Space Agency (ESA), these solutions are, by their nature, aimed at protecting high profile, critical infrastructures.

However, cybersecurity is equally important for organizations of every size, and we have solutions for all.

Our end-to-end approach provides solutions for every part of the cybersecurity lifecycle.

We analyze the threats faced by organizations, implement techniques and approaches to minimize and alleviate those threats, and provide ongoing cybersecurity protection including monitoring, detection, response and investigation.

This approach ensures that the security measures we implement address the constantly evolving cyber threats and are bespoke to the organization being secured.

• Lifecycle offering: services to assist our clients at any and every stage of the security lifecycle.

Integrated security: combining our in-house expertise to provide holistic security solutions that optimize use of all security specialist areas: cyber, physical and personnel security, systems engineering, security-by-design and operational systems delivery.

• Bespoke solutions: tailored and ‘bestof-breed’ approach to delivery and client relationships, working with clients to provide customized solutions.

Critical infrastructures, such as energy, telecommunications and transport, are key targets for cyber terrorists looking to exploit vulnerabilities to cause economic and geopolitical impact and, ultimately, danger to life when considering nuclear energy and air traffic management, for example.

Our package of services is tailored to bring you maximum protection in the fastest way while controlling costs. Our services can be procured independently or packaged into a complete Security-as-a-Service offering.

RHEA works with our customers as trusted partners to ensure we can rapidly deploy tailored www.rheagroup.com

3

Identify

Se ity ass cu •

C

t ur

r ce

ia

yb

INT

r v ice

po

nt

re

nd

(S O

C)

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

ce

tio

Cyber-range based training

ci

nu

eme

Security Training

nt

s

• SO C

) se

ma

s ou

tect Pro

Reco ver

• O pe n

s ce vince

4

ns

es

R

RHEA’s senior advisors help security teams and company executives bridge the gap between the cyber challenge on the shop floor and priorities

nd

r

We can help make this real by assisting C-level executives and Boards to understand the strategic importance of cybersecurity. Our outstanding technical expertise is supplemented by several senior staff members who have deep experience of driving cyber at national policy and strategy levels, in both the public and private sectors. This gives us the capability to advise, in plain language, the most senior levels on how cybersecurity is connected to and enables the strategic goals of your organization. In other words, we help you consider cybersecurity in the context of your organization and operations, before committing investment to the tactical solutions we offer; this ensures that the solution is driven by strategy and goals, and not simply a sticking plaster.

t i io C o nity operat

Experience tells us that the awareness and/ or governance of cybersecurity can be a challenge for some organizations. The C-suite may not be convinced of the threat or the cybersecurity need, or it may be viewed as just an IT matter. It is not uncommon, for example, to see IT and security (often related to physical security) residing in separate budgets with different accountable individuals, and there can be a tension about who pays or who is ultimately responsible.

RHEA advocates that, because cybersecurity is a pan-organization issue, its ownership is most appropriately at Board level, and that senior executives should take an active role in cyber risk management and data breach preparedness.

ta

cu • Se

Cyber Risk Evaluation

io n

i dvisory ntellig y A sessment • CoSer en mp rit er risk as l

en

S (O

Security Advisory Services

m

ce

s es

ua t eval

in the boardroom. Using this approach, we help executives to extract value from a well-thoughtout cybersecurity strategy, which dramatically decreases your risk exposure and thereby delivers greater value to your customers and shareholders.

How at risk is your organization?

Every organization has vulnerabilities – things that can be exploited to do harm to the organization and/or its operations. The key to security excellence is knowing what and where your vulnerabilities and risks are, so you can appropriately manage and mitigate them. Just one cyber vulnerability could make an organization susceptible to a malicious cyberattack, leading to the loss or degradation of business-critical assets (such as IP, data, processes or reputation) or opening the door to cyber fraud (e.g. phishing) or extortion (e.g. ransomware), putting your business continuity and sustainability at serious risk.

Our experience has taught us that vulnerability management is no longer discretionary; indeed, it is becoming increasingly prevalent as a requirement for compliance, audit and risk management frameworks, making it a must-do first step.

Knowing to what level your organization is at risk is a function of understanding the vulnerability, relevant threats and how they may impact your organization and or its operation. It is paramount to undertake this risk assessment process

thoroughly; this ensures the implemented mitigation measures are bespoke to, and optimized for, the risk. A risk-based approach to vulnerability management enables effective mitigation choices and the communication of risk across the organization, the security and operations teams, and up to top levels of management.

What we do We help businesses to reduce their cybersecurity risks by identifying vulnerabilities in the context of existing and emerging threats, and quantifying and prioritizing the associated risks to shape mitigation choices. Our process also identifies the attack surface: that is, what a cyber adversary sees when looking at your business. This process results in clear outcomes, which enables your business to remediate issues and reduce exposure to cybersecurity threats. Based on this detailed analysis, we can also support you in obtaining the optimum cyber insurance coverage, tailored and suited to your organization, thereby creating direct and long-term return on investment.

the internal network (e.g. an insider threat or a compromised end-user system) that will actively exploit vulnerabilities and leverage configuration deficiencies to provide a tangible demonstration of the associated business impacts in clear, repeatable steps.

External Penetration Testing: This is a • combination of manual and automated testing of a client’s public-facing systems by simulating a malicious attacker on the internet. These systems include servers that have public IP addresses that can be accessed by users on the internet, for example websites and email servers. Our testing will uncover: •

Firewall misconfigurations

• Vulnerability identification and exploitation paths • Compromised administrative services and interfaces • Vulnerability to other attack techniques • Potential attack vectors by which a system could be compromised remotely.

How we do it In simple terms, we ethically (and transparently to you) forensically examine your systems for vulnerabilities. This is known as penetration testing. As the name implies, we access the systems to investigate whether the extant security measures are a suitable defence against contemporary threats. Importantly, you know exactly what we are doing, you authorize it and our results are reported to you.

• Customized Penetration Testing (scenario based): Some organizations will already have specific attack vectors or threat models of particular concern. In this service, RHEA experts will define a plan to simulate those scenarios. This approach places an emphasis on providing assurance that the defence mechanism is ready to adequately respond to a given incident.

Penetration testing We provide different versions of penetration testing services: • Internal Penetration Testing: This simulates the presence of an attacker on www.rheagroup.com

5

Identify

Se ity ass cu •

C

t ur

s ou

r ce

e

l ia

r v ice

re

(S O

nd

C)

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

R

po

nt

ci

nu

ce

tio

Cyber-range based training

eme

Security Training

nt

s

• SO C

) se

ns

es

i

INT

ma

• O pe n

tect Pro

Reco ver

io n

s ce vince

yb

r

Certified

t i io C o nity operat

Certified

ISMS ISO 27001

nd

cu • Se

QMS ISO 9001

ta

S (O

ISO 9001

It is becoming progressively more important Certified that organizations can demonstrate to their Board members and shareholders that they operate within their stated governance policy and processes while also complying with their various standards and practices.

ua t eval

dvisory ntellig y A sessment • CoSer en mp rit r risk as

en

ce

Compliance ServicesQMS

e

m ss

• NIST and CIS baselines for infrastructure and configuration assessments • Relevant NIST guidelines and security controls • The OWASP Testing Guide versions 3 and 4 with the OWASP Web Service Security Cheat Sheet, where relevant

RHEA can help you achieve this. Being certified (ISO 9001 and ISO 27001), you can be confident that we bring the best practice for your sector.

ISMS ISOof27001 Some the numerous standards we comply Certified

with are:

• Application Security Validation Standard (ASVS) for (web) applications • Relevant OWASP publications such as the Top 10 and the ASVS, supported by the OWASP Application Security Testing Guide • SANS Top 25: the most common and most dangerous errors when creating software

6

• Mobile ASVS (MASVS) for mobile applications • MITRE ATT&CK • MITRE Secure Code Review Practice • STRIDE methodology in threat modelling (spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege) • OWASP Mobile Top 10 • Up-to-date information from (software) suppliers such as Google, Apple, Amazon and Microsoft.

RHEA Security Services – Your partner for cybersecurity, keeping your assets and employees safe

Identify

Although a SOC serves as the defence mechanism to prevent a wide range of cybersecurity incidents and to respond to cyber threats, its benefit is maximized if the organization adopts a model that best suits the business and its specific operations. www.rheagroup.com

ma

C

t ur

Se ity ass cu •

l ia

• SO C

po

nt

re

(S O

C)

nd

nt

n

nag

ma

t s Cy b er Pro• Post in

nt

ec

ou

• In cide nt r e s p o n s

e

De

c te

t

ce

tio

Cyber-range based training

de

nu

eme

Security Training

ci

Reco ver

Using this analysis as a basis, we structure an approach to move clients to the required level (generally considered to be 4 or 5). This allows our advisors to determine the correct approach to securing your operations, tailored to your business needs.

e

ce s

5. Optimizing.

yb

er vi

4. Quantitatively managed

ce

T) s

3. Defined

ou r

S IN

2. Managed

• O pe n s

tect Pro

Initial

io n

(O s ce vince

1.

ns

es

R

0. Incomplete

nd

ur

For those with a SOC already, our approach is to first evaluate the maturity of their existing security operations. Our SOC Maturity Assessment uses the Capability Maturity Model Integration (CMMI) approach, which identifies the specific maturity level:

t i io C o nity operat

It is critical that organizations have the right solutions in order to deal with cybersecurity threats, tailored to their specific needs.

ta

c • Se

Security Operations Centre (SOC) Maturity Assessment and Evaluation

ua t eval

in t Advisory S elligen ir tyr risk assessment • Comper

en

ce

es

sm

SOC Model Evaluation RHEA’s SOC Model Evaluation is based on our extensive experience of designing and implementing SOC infrastructures and operating our own SOCs. It identifies the best SOC model for organizations and can be customized to fit certain requirements, based on our methodology: • Understand the current SOC operating model, service delivery and scope • Evaluate team structures and operational model • Identify missing processes from the service functions • Understand the technology • Understand the people–processes–business triad • Understand the services to be delivered.

Once the 360° evaluation is complete, our expert team will issue an executive report and improvement proposal with actionable recommendations for more tailored services delivered by the SOC, supporting the SOC return on investment (ROI) and other cyber resilience investments.

7

Identify

l ia

• SO C

ma

C

t ur

Se ity ass cu •

e

re

nd

(S O

C)

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

po

nt

ci

nu

ce

tio

Cyber-range based training

eme

Security Training

nt

s

Reco ver

yb

r v ice

es

i

) se

8

r ce

INT

Corporate human resources offices and recruitment businesses are trusted to place the right individuals. Background checks are standard procedures when individuals are considered for hire. Those checks, however, do not paint a complete picture. Investigators can help businesses get a better view of potential hires or existing employees and contractors.

Our service can include standalone reviews

s ou

tect Pro

Human Resources OSINT Services

• O pe n

s ce vince

Entering a contract, partnership or any other business relationship is a complicated venture with potentially serious consequences. Our OSINT services can help your business learn whether another party represents reputational or legal risk. Our OSINT investigators can answer every question to make sure that you enter business deals with a clear understanding of your counterparties.

io n

S (O

OSINT for Business Owners and Corporate Executives

ns

R

OSINT has multiple applications for businesses and individuals. Whether you need to clarify some personal matters or study your competition, or need more data to support your business decisions, our investigators can provide complete evidence based on all information available in the cyberspace.

nd

r

The value of this service is in the proactive nature of examining multiple services to obtain real-time, deep-dive information on which business leaders can make clear decisions about the threats that face their organizations.

t i io C o nity operat

In a fast, continuously changing and evolving open-source world, we work in partnership with our clients to help them adapt and stay ahead of the game. We provide our services through highly experienced experts and leading-edge processes and technology.

ta

cu • Se

RHEA’s Managed OSINT services gather intelligence on an organization, a person or a business online to help you avoid risk and make better decisions.

ua t eval

dvisory ntellig y A sessment • CoSer en mp rit r risk as

en

ce

Open Source Intelligence (OSINT) Services

e

m ss

or ongoing monitoring services to ensure the safety and security of business operations and reputation.

OSINT Investigations for Insurance Companies Insurance fraud is very costly, with insurers paying off millions of euros in fraudulent claims.

Modern technology offers multiple outlets and opportunities to conceal wrongdoings; techsavvy fraudsters get better and better at using them. We can support insurance investigations, potentially saving a great amount of time and money. Our cyberspace investigators can help discover data that can be difficult to uncover through conventional means.

OSINT for Legal Services The availability of accurate and complete data is critical for any type of litigation – civil or criminal.

Law firms and other legal services, whether representing the plaintiff or defence, need to have all data at their disposal, whether it is ‘good’ or ‘bad’. The availability or lack of this information can make or break the case.

Our investigators can provide support to find the additional data that may make an important difference.

RHEA Security Services – Your partner for cybersecurity, keeping your assets and employees safe

Identify ta

C

t ur

Se ity ass cu •

l ia

• SO C

re

nd

(S O

C)

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

po

nt

ci

nu

ce

tio

Cyber-range based training

eme

Security Training

nt

ce s

es

i

er vi

This is more than just continuous learning; we also develop roadmaps that detail how to manage each challenge, including disaster recovery measures, where relevant. If the system is infiltrated and an attack is successful, this preparation can make the difference between hours and days of downtime.

r ce

T) s

The core of our SOC capability is a peerless and constantly updated knowledge of contemporary cybersecurity. Specifically, we continuously ensure we remain up to date with current and emerging threats, and the latest threat detection techniques and response technologies.

ns

R

Preparation

sou

e

ur

t i io C o nity operat

No matter how well prepared an IT team is, it is virtually impossible to prevent all problems. In addition, an IT team does not operate in a cybersecurity-centric capacity.

Threats may emerge in systems in many ways and from various angles. However, a SOC can do a lot to mitigate the efforts of attackers, often vanquishing them completely. This is done using preparation and preventative maintenance, as well as applying scrutinized, continuous monitoring services benefiting from up-to-date intelligence of the cyber threats recorded around the world.

• O pe n

S IN

yb

c • Se

Security Operations Centre (SOC) Services

io n

tect Pro

ma

nd

(O s ce vince

Reco ver

ua t eval

dvisory ntellig y A sessment • CoSer en mp rit r risk as

en

ce

Continuous Cyber Protection Services

e

m ss

white-list and black-list, then regularly adding and subtracting sites from both categories.

Preventative maintenance also involves making sure the applications that interact with your network are secure. Applications have become an increasingly popular attack surface, but by securing each application or its environment, you can limit the effectiveness of the attacks.

Continuous Proactive Monitoring Constant monitoring is key to maximizing visibility. To ensure your monitoring system is effective, the SOC team implements tools that scan your network, looking for anything that is highlighted as suspicious. This includes obvious threats and abnormal activity that may or may not pose a danger. Some activity will be easy to identify as malicious because the data fits a preidentified threat profile. Other activities may be suspicious but not overtly dangerous.

Preventative Maintenance Preventative maintenance is not about preventing attacks, because attacks are going to happen. It focuses more on making sure attacks fail, or limiting the damage they inflict.

Integral to preventative maintenance is regularity. Your security system must be constantly updated so it can keep up with ever-evolving attack methodologies: for example ensuring your network firewall policies are up to date and choosing which sites you want to www.rheagroup.com

9

0

Crisis Amount: 0 Ratio: 0:0

1

Investigations Amount: 1 Ratio: 1:1

2

18

45,700,000

Incidents Amount: 2 Ratio: 2:1 Issues / Offences Amount: 18 Ratio: 9:1 Events Previous amount: 49.8 million Ratio: 22988956:1

Alert Ranking and Management The monitoring process will automatically and immediately alert the SOC team of emerging threats. Because it is not uncommon to get hundreds or thousands of alerts every day, the alerts themselves must be managed, and the RHEA SOC team shoulders this responsibility.

Using the expertise of our SOC teams along with the tools at their disposal, the core alerts (events) are assessed to determine the real or root cause of any cybersecurity issue. The diagram above shows how the volume of cybersecurity events experienced by a single customer managed by our SOC was reduced to a manageable amount of incidents, and ultimately investigations, utilizing our SOC team’s expertise, tools and skills.

When an incident is identified, the RHEA SOC team will establish the type of threat, how

10

aggressive it is and what areas of the network the threat is targeting. In the case of multiple threats, they are prioritized in terms of urgency, allowing resources to be optimally apportioned to respond to and manage them, minimizing the impact and risk to your business.

Threat Hunting The RHEA threat hunting service uses a combination of cyber threat intelligence sources and active threat hunting within the information collected by the SOC; this information is used to further protect your systems and business.

Early Warning System (EWS) and Cyber Threat Intelligence RHEA SOC services make full use of cyber threat intelligence. This is information used to understand the threats that have, will or are currently targeting your organization.

Identify

C

t ur

e

l ia

er vi

Se ity ass cu •

yb

po

nt

re

(S O

C)

nd

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

ce

tio

Cyber-range based training

ci

nu

eme

Security Training

nt

ce s

• SO C

ma

ce

T) s

Reco ver

ou r

S IN

www.rheagroup.com

• O pe n s

tect Pro

In the case of a ransomware attack, the SOC may have to identify backups made before the attack occurred. These can then be used to restore the devices after a wipe has been performed, which effectively sends the device ‘back in time’ to how it was before the incident.

io n

(O s ce vince

After the dust settles following an incident, the SOC team will get things back up and running again. This may involve recovering lost data or examining data that may have been compromised.

ns

es

R

Recovery and Remediation

nd

ur

Addressing an emerging threat is one of the most critical activities of an SOC. When a threat has been identified, it is the RHEA SOC team that serves as the boots on the ground; they are the responders who are first on scene, taking appropriate action to protect the network and its users. Simultaneously, while the SOC team responds to the emerging threat, they will develop and deliver a comprehensive solution to enhance your organization’s protection while minimizing disruption to user activity. In this way, business continuity can be maintained while keeping the organization safe.

t i io C o nity operat

Threat Response

ta

c • Se

Incident Response Services

ua t eval

in t Advisory S elligen ir tyr risk assessment • Comper

en

ce

es

sm

Log Management Logs are often automatically generated and overlooked; however, they contain a plethora of useful information about the system, including anything that may have infiltrated it. The SOC team will therefore carefully collect, maintain and review log activity.

Root Cause Analysis After an incident, it is the RHEA SOC that answers the questions central to the incident, such as: What happened? How was it accomplished? Why did it happen?

Log data plays an important role in this process. It can be used to help figure out how the threat penetrated the system, as well as where it entered and from where it came. When this information is collected and correlated, it can be used to prevent similar threats from getting through in future.

11

Identify

C

a tu

r

Se ity ass cu •

• SO Cm

po

nt

re

nd

(S O

C)

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

ce

tio

Cyber-range based training

ci

nu

eme

Security Training

nt

s

Reco ver

r v ice

12

ia

yb

) se

Our teams rapidly prevent, detect and respond to threats with comprehensive, intelligencedriven endpoint visibility.

i

INT

Endpoint Forensics

r ce

tect Pro

We develop attack context in near-real time and facilitate rapid investigations, using lossless data capture, search and retrieval on massive data sets.

s ou

s ce vince

Network Forensics

• O pe n

S (O

Many of the modern malware components leave few or no artifacts on storage devices; instead, they manipulate processes directly in a system’s memory. By analyzing the memory from a system, it may be possible to recover encryption keys or samples of the malware that would otherwise not be recoverable.

ns

es

R

Memory Forensics

n

ur

We safely analyze malware in a secure environment to strengthen threat intelligence.

Learn about entire attack lifecycles, from initial exploit to call-back destinations and more.

ta

t i io C o nity operat

Malware Analysis

io n

nt Adsevssimsenot ry Se elligen y • C s t a r k om ri er ris pl

en

c • Se

Should a cyber incident occur, we can provide services to conduct analysis on what has happened. There are good reasons to do this. Completely understanding what happened will give clear insights into the attack method and potential damage beyond what can be seen, highlight areas of vulnerability that require mitigation action and, ultimately, capture the forensic data to provide evidence to support legal action against the perpetrator.

m

ce

Post Incident Management Services

s es

at valu de

eDiscovery Support This is the technical process for identifying, collecting and producing electronically stored information in response to a request made in relation to a lawsuit or court order/subpoena.

Given the volume of data and the diverse nature of its formats, this can be a complex and timeconsuming task. Ensuring that the appropriate level of data is collected and stored securely is essential. In some case a ‘legal hold’ has to be applied to systems and data so that it cannot be modified, deleted or otherwise corrupted.

We can provide the technical expertise to reduce the impact of eDiscovery on the business and ensure that legal requirements for evidentiary collection and assurance are met.

RHEA Security Services – Your partner for cybersecurity, keeping your assets and employees safe

Identify • O pe n

s ou

r ce

C

l ia

re

nd

(S O

C)

n

nag

ma

nt

ec

t s Cy b er Pro• Post in

de

ou

• In cide nt r e s p o n s

e

De

c te

t

R

po

nt

ci

nu

ce

tio

Cyber-range based training

eme

Security Training

nt

ce s

• SO C

er vi

Se ity ass cu •

e

T) s

yb

ur

t i io C o nity operat ns

es

i

S IN

t ur

io n

tect Pro

ma

nd

(O s ce vince

Reco ver

ta

c • Se

RHEA offers a range of cybersecurity courses for teams from any organization that needs to improve its cybersecurity awareness and capabilities. Every course can be tailored to your needs and taught using our Next Generation Cyber-Range, based on our advanced CITEF™ emulation platform.

ua t eval

dvisory ntellig y A sessment • CoSer en mp rit r risk as

en

ce

Security Training Services

e

m ss

Blue / Red Team Cyber Exercise Learn to defend your organization from real-time attacks in the safety of a virtual environment.

Hands-On Cyber Awareness A cyber risk awareness course customized to match your operational environment. Give your team handson experience of how to handle cyber risk by learning in an emulation of your real-life environment.

Applied Incident Response Forensic Investigation Training Learn how to analyze incidents in depth and propose measures to prevent similar events occurring in future.

Cyber First Responder Learn how to identify potential cyber incidents and contribute to incident response.

www.rheagroup.com

Cybersecurity for Programmes and Projects Master the risk management practices and security controls to be applied from the early stages of project delivery.

13

How to Engage with RHEA Our services are available as a complete suite or as individual services.

Our approach is to establish an ongoing security partnership with our customers. The start of this journey is an initial free consultation in the form of a half-day, free-of-charge workshop, where we explore your security needs, agree with you the scope of services that you require and then deliver a short, fully costed, confidential proposal. We suggest that this workshop is performed under a non-disclosure agreement (NDA) to ensure confidentiality on both sides.

Our approach is to be clear on costs and the benefits that our services will deliver to you, so you can easily understand your financial undertaking and the outcomes that you can expect from working with us.

Advisory Services In our proposal, our prices are put together using a bottom-up, effort-based estimate. We can offer a fixed price for a package of work to deliver a service or set of services, or take a ‘time and materials’ approach where you purchase a number of days to be used as you see fit, based on our recommendations.

Discounts can be provided for bulk purchases of combinations of services over a period of time on a fixed price basis.

14

Security Operations Centre (SOC) pricing Our SOC pricing is based on the number of endpoints that need to be managed in your business. RHEA personnel will integrate your infrastructure into our SOC environment as part of our service, then provide ongoing monitoring of your environment.

We generally provide this service along with a package of consultancy at reduced rates, which can be utilized for any of the SOC services described in this document. This ensures a strong relationship is built between your business and the RHEA security team and we can help you continually evolve your security posture to minimize business risk.

Training Services pricing Training can be provided on an individual student basis on standard training course, or tailored for a group of students from your organization, either at your site or at RHEA’s premises.

A full pricelist will be provided as part of our engagement.

RHEA Security Services – Your partner for cybersecurity, keeping your assets and employees safe

ARS OF SUCC YE ES

G

IN

EE

D

W

IT H

YO U

1992-2022

30

S

EN

RHEA was founded 30 years ago to support space customers in all aspects of space missions, from definition to operations. Twelve years ago, RHEA identified the growing security risks of cyberattacks within spacecraft operations, which led to a joint investment between RHEA and the European Space Agency (ESA) to establish a Cyber Security Centre of Excellence in Belgium to support space missions.

CELEBRATI NG

About RHEA

RIN

O G THE W

RL

Since then, we have continued this development and our partnership with ESA, which has included multimillion-euro projects to develop tools, techniques and approaches to secure some of Europe’s most critical space infrastructures.

Space is one of the 13 domains identified by national governments as being critical infrastructure. In this context, we have extended our customer base to other space agencies, including large organizations such as the European Union Agency for the Space Programme (EUSPA) for advisory security support to major programmes, and also work with small organizations to help them address the growing cyber threat.

Working closely with large, medium and small organizations, RHEA is a fast-growing company, with over 700 staff supporting customers onsite and at RHEA’s offices located in 11 countries. RHEA has developed a strong reputation for service delivery, leading to widespread recognition of the company as being a trusted partner that develops and nurtures long-term collaborations with our clients.

www.rheagroup.com

15

About Us RHEA Group is a privately-owned professional engineering and solutions company, providing bespoke engineering solutions, system development and security services for space, military, government and other critical infrastructure organisations. Since its creation in 1992, RHEA has built a reputation as a trusted partner, developing tailored solutions that help drive organisational and cultural initiatives, leading to sustainable added value for its customers.

Headquartered in Belgium for its European operations and in Montreal for its North American operations, RHEA Group employs over 700 people and has offices in Belgium, Luxembourg, UK, Czech Republic, Italy, France, Germany, Spain, Switzerland, the Netherlands and Canada and works at clients’ premises throughout Europe and North America. RHEA is ISO 9001 and ISO 27001 certified.

info@rheagroup.com

www.rheagroup.com

©RHEA Group 2022