Cyber security

SMEs today face an “accelerated” digital transformation:

Hyperconnectivity: 100% digital and mobile users.
Ubiquity: democratized access to disruptive technologies (cloud).
Uberization: New business models born from technology.

In this environment, digital is inaccessible for many SMEs and also exposes them to increasingly mature and complex cyber threats.

The MNEMO group’s response to this challenge is CCI-Ex, the Center of Excellence in Cybersecurity and Innovation for SMEs. Its objective is to eliminate the digital divide for SMEs through agile, understandable and affordable solutions for a SAFE digital transformation.

The company MNEMO EVOLUTION & INTEGRATION SERVICES, S.A.- CENTRO DE CIBERSEGURIDAD E INNOVACIÓN, S.L., UNION TEMPORAL DE EMPRESAS, (hereinafter CCIEX) has been awarded as a Specialized Entity in advising the “ACTIVA CIBERSEGURIDAD Program” by the EOI F.S.P Foundation. (hereinafter EOI) and a Framework Agreement has been signed for this purpose between both parties on September 26, 2023.

ACTIVA CYBERSECURITY, belonging to the “Activa” family of programs, is an initiative promoted by the General Secretariat of Industry and SMEs (SGIPYME) of the Ministry of Industry, Commerce and Tourism in the development of its National Strategy for Connected Industry 4.0 that Its objectives include increasing the industrial added value and qualified employment in the sector, promoting its own model for the industry of the future by developing the local offer of digital solutions, and also promoting differential competitive levers to support the Spanish industry and boost its exports.

ACTIVA CIBERSEGURIDAD offers the analysis of the current situation of the company in terms of Cybersecurity to know its current level of security and the development of a specific Cybersecurity Plan for it, with a personalized design of actions in terms of cybersecurity, to be developed and implemented by the beneficiary company.

The Program is aimed at all types of SMEs, especially those that wish to improve or enhance their cybersecurity processes.

GOALS

In a manner consistent with the objectives and indications of the ACTIVA CIBERSEGURIDAD Program, CCI-Ex collaboration pursues the following high-level objectives:

UNDERSTAND: Perform a comprehensive cybersecurity diagnosis to understand your current security level.
IDENTIFY and document real vulnerabilities and security gaps in the company’s website and public services.
GUIDE: Provide a Cybersecurity Plan that includes prioritized and specific measures to improve your security posture.
RAISE AWARENESS: Raise awareness about the importance of integrating cybersecurity into your business strategy and how to act against cyber attacks.

SCOPE

UNDERSTANDING MEETING. 1-hour interview with the client’s business and technological areas to understand the client’s organizational, procedural and technological context that predetermines their level of exposure to cybersecurity risks. The areas to be treated are the following:
- Review of results of the light self-diagnosis of the client’s cybersecurity status using the INCIBE tool.
- Review of results of the HADA maturity test (cybersecurity indicator) carried out by the client.
- Compilation of improvement recommendations at an organizational, procedural and technological level for subsequent integration into a personalized Diagnostic Report for the client.
CYBERSECURITY PLAN: The information obtained in the previous phase will be used to develop a personalized Cybersecurity Plan with the proposal of specific measures to be implemented along with their priority, costs and dependencies on each other.The Cybersecurity Plan will contain, for each measure to be implemented:
- Descriptive information
- Evaluation and monitoring information
- Economic impact information
- The resulting Plan will be presented through a virtual meeting.CCI-Ex will not be responsible for the implementation of the Plan, although it may give advice.
STARTING AND PLANNING OF THE SERVICE: First call or meeting in online mode to make contact with the company in which the following activities will be contemplated:
- Presentation of the Activa Cybersecurity initiative.
- Presentation of the CCI-Ex project team to the client team.
- Knowledge of the expectations and objectives pursued by the company.
- Request for information about the company. In particular, it will be requested to carry out the self-diagnosis with the INCIBE tool, as well as the evaluation of the HADA digital maturity index, with special focus on the “cybersecurity” enabler.
- Planning the understanding meeting and the following phases.
VULNERABILITY AUDIT: Remote technical diagnosis of pentesting type on one (1) client’s web application (to be agreed upon in the face-to-face understanding meeting). The website to be audited will have a maximum of 15 endpoints (elements of interaction with end users such as forms, APIs or web services) and will be carried out in gray box mode (with certain prior information from already registered users or context of the technology. employee) using manual ethical hacking techniques by a qualified auditor.This will allow an understanding of the main security vulnerabilities at runtime of said website, along with their impact and recommended measures for their effective and permanent mitigation. All of this will be included in a personalized Diagnostic Report for the client.
CLOSURE OF THE SERVICE AND AWARENESS WORKSHOP: After the delivery of the Cybersecurity Plan, a phase of consultative advice and resolution of doubts will be enabled on demand and remotely about the Cybersecurity Plan presented in the previous phase.Additionally, an online sectoral and/or regional awareness-raising workshop of up to 3 hours will be planned and delivered jointly with other companies (25 to 50 SMEs in total), with the aim of raising awareness on how to integrate cybersecurity into your business strategy.Finally, in this last phase, the SME will receive precise instructions on what it should do in the event of suffering a cyber attack and who it should contact in the event of suffering an incident or attack, as well as the obligation to report it.

TERMS OF SERVICE: WORK TEAM

MNEMO will temporarily assign a Project Team in closed project mode, composed of::
- One (1) Commercial Delegate who will act as a point of contact for the purposes of contracting, start-up and closure of the project, as well as in the management of execution risks and management of change, if applicable.
- One (1) Specialist Consultant in governance, risk and compliance tasks in cybersecurity matters with a partial dedication and who will carry out the tasks of planning, understanding the client context, participation in work meetings, and in the delivery and presentation of the results.
- One (1) Technical Auditor who will carry out the specific vulnerability diagnosis tasks on the systems agreed upon within the framework of the project and who will not have direct dialogue with the client, but will work through the intermediation of the specialist Consultant.
For its part, it will appoint a Technical Manager who will serve as a permanent interlocutor during project time, make technical decisions and assume the results of the project.
There will be a continuous and direct dialogue during project time between the Specialist Consultant and the Technical Manager to guarantee alignment between the global objectives of the ACTIVA CIBERSEGURIDAD Program, the internal policies and guidelines of, and the performance of the tasks of the CCI-Ex Project Team.
CCI-Ex will provide the members of its Project Team with the material resources necessary for their activity (e.g. personal computer or laptop).
For its part, it will provide the CCI-Ex Project Team with secure telematic access to the systems necessary for the development of the project. Access will be uninterrupted and planned outages will be notified in good time.
Likewise, the Technical Manager will provide CCI-Ex with the specifications that it reasonably requires and that are necessary for the correct execution of the services, as well as its location and the tools and means to be used.

TERMS OF SERVICE: MODALITY OF SERVICE

The total scope of the service is approximately twenty (20) hours of advice, to be accrued within a period of no more than four (4) months from the first contact with CCI-Ex.
The CCI-Ex Service Team will carry out its functions remotely and according to the time zone of mainland Spain (GMT+1).
The CCI-Ex dedicated team will preferably work during business hours from Monday to Thursday from 8:00 a.m. to 5:30 p.m. (with a 1-hour lunch break) and Friday from 8:00 a.m. to 2:00 p.m., unless a distribution is agreed upon. of different hours between your Technical Manager and the CCI-Ex Project Team, respecting in all cases the dedication of forty (40) hours per week. There will be continuous work in summer in the months of July and August with hours from 8:00 a.m. to 3:00 p.m.
The project planning will avoid the assignment of CCI-Ex personnel in non-working periods (such as weekends, national, regional and local holidays of the city of Madrid and holidays according to company agreement), unless agreed and compensated accordingly. otherwise in writing between the parties.
The execution of the project, once the pre-contractual process has been closed by the Commercial Delegate, will be coordinated by the Specialist Consultant assigned internally by CCI-Ex to this project and who will act as the sole and permanent point of contact with the Technical Manager for the purposes of the tasks indicated in section 3. Objectives and Scope of this document.
Any query or request during project time must be channeled exclusively and in writing by your Technical Manager to the CCI-Ex Specialist Consultant, with CCI-Ex not given for requests received through alternative channels.
Any deviation from the initial needs of the project or request to change the scope of the CCI-Ex service will be treated by the Technical Manager and the Commercial Delegate on behalf of CCI-Ex as an annex to this contract.

CYBERSECURITY SERVICES FOR SMEs

DIAGNOSIS: Be aware of the risks you assume by using technologies in your daily life and propose a strategy to avoid cyber attacks.
PROTECTION: Establish cybersecurity solutions for your workplace and your business data, even when you work from home.
MONITORING: Detect and manage possible data leaks and identity theft of your employees, digital channels and digital brand of your company on the internet.
REMEDIATION: Provide expert advice in your first steps in the event of a cyber attack or security breach.

DIAGNOSIS | WE EVALUATE YOUR CYBERSECURITY POSTURE

The goal is to elevate your cybersecurity posture to a low-risk level in line with your business needs, current cyber risk challenges, market trends, and alignment with your sector.

PHASE 1: ANALYSIS OF THE BUSINESS CONTEXT
- Understanding of technological infrastructure and its risks.
- Understanding your business priorities.
- Security controls maturity checklist
PHASE 2: TECHNICAL INFRASTRUCTURE AUDIT
- Analysis of vulnerabilities in exposed systems.
- Cybersecurity rating and sector comparison.
- Differential analysis regarding good security practices.
PHASE 3: PROJECT PLAN AND PRESENTATION
- Preparation of a personalized Cybersecurity Plan.
- Definition of a results report.
- Conducting a group workshop and closing the service.

METHODOLOGICAL APPROACH

PHASE 1 GUIDED SELF-DIAGNOSIS

In this phase, we seek to know the current state of Security in order to define the Security strategy and roadmap. To do this, a session will be held in the facilities where a self-diagnosis will be carried out using the tool developed by INCIBE where, thanks to our security consultant, an evaluation of the risk in terms of information security of your organization will be carried out.

ACTIVITIES

Define the scope of the technological infrastructure.
Understand the context of the organization: basic security requirements, regulations, regulations and standards, roles and responsibilities, etc.
Compilation of information security postures and policies.
Risk assessment based on three different categories: people, processes and technology.
Review of basic security recommendations based on these categories.

CUSTOMER INVOLVEMENT

Answer clearly the self-diagnosis provided. To do this, you will have the guidance of our security consultant who will be present during the execution of this activity.
Guarantee the involvement of the teams and impacted areas. It would be advisable, if third parties do not intervene, to involve those roles that manage the company’s computer systems.
Provide appropriate interlocutors and a space to conduct interviews.

DELIVERABLES

Results of the self-diagnosis and maturity test.
Compilation of basic security recommendations for:
- People
- Processes
- Technologies

PHASE 2 WEB AUDIT AND PUBLIC SERVICES

In this phase, a website that you use for your business and that you own will be audited. To do this, there will be a highly qualified expert auditor.

DESCRIPTION and PURPOSE

Identification of existing vulnerabilities that may directly or indirectly compromise the organization’s technological infrastructure through web services. Black box or gray box analyzes are included. This subservice also addresses scanning of up to 15 endpoints.

The objective is to identify specific security flaws in web applications, which when corrected allow guaranteeing a high level of security in the applications, by detecting existing vulnerabilities both automatically and manually, and recommending the corresponding corrective actions.