When you need to ensure compliance with your CCRI, RMF ATO, or your CUI/CMMC Certification, partnering with a company that has deep roots and experience working with the DoD and in particular Defense Industrial Base can make a world of difference. Our engineering services cover a wide range of technologies focused on helping organizations engineer their systems so that defense-in-depth and industry best-practice security and compliance are integrated into the planning and deployment phase as well as through the entire maintenance lifecycle.
When you proactively look at your compliance goals and requirements, it’s much “easier” to integrate the appropriate controls and STIGs (Security Technical Implementation Guides) during the planning and building stage, vs taking an existing system or plan and retrofitting it to meet the controls and STIGs.
Whether you have existing systems that need to be brought up to NIST 800-53 or 800-171 regulatory compliance, or if you are looking to build a new system from the ground up, our cleared and seasoned engineering team can work with you to help you reach your goals for Hardening, SIPRNet/NIPRNet/eWAN engineering, Vulnerability Assessment, and Insider Threat Management.
Our cleared engineers have a broad range of certifications including:
- CISSP-Information Systems Security Management Professional (CISSP)
- Qualified Navy Validator (QNV)
- Certified Authorization Professional (CAP)
- Certified Ethical Hacker (CEH)
- ISACA Certified Information Security Manager (CISM)Cisco Certified Network Professional (CCNP)
- CCRI Team Lead
- Traditional/Physical Security
- Global Information Assurance Certification (GIAC)
- Project Management Professional (PMP)
- See all Team Certifications
System & Application Hardening
The United States Defense Information Systems Agency (DISA) creates and maintains a library of security guidelines for the Department of Defense (DoD) Information Systems. These guidelines called Security Technical Implementation Guides or STIGs identify configuration settings and procedures that organizations should apply to improve the security of their networks and systems. Many federal government agencies, as well as Cleared Defense Contractors (CDC), require that systems comply with these guidelines as part of the deployment and operational certification of the system.
SecureStrux has seasoned Cyber Assessors and Engineers that have been securing enclaves, networks, and systems for the DoD and those who are required to meet Defense requirements for over 20 years. Many of our team members were pioneers with DISA when STIGs were just being developed and even helped write a few along the way. As these standards and processes have matured, we continued to work with DISA to help maintain these guides and use them to harden systems by either “baking” security in upfront before deployment or reverse-engineering systems and networks when needed so that they would be compliant and sustainably secure.
Read more about our Hardening Services
NIPRNet and SIPRNet Multi-Factor Authentication
SecureStrux has assisted its clients, who require a DoD Public Key Infrastructure (PKI) environment, set-up their required systems and third-party applications for authentication. We work closely with DISA and the Cyber Exchange to get all the required application certificates Common Access Card (CACs), and tokens. Whether you need PKI for an application, a web service, on-premise, or in the cloud, SecureStrux can help your organization configure your applications, systems and network appliances to meet DoD compliance.
Network Port Security Solution
A challenge facing network administrators is determining how to control who can access the organization’s internal network and who can’t. For example, can a staff member or vendor walk into your building with their personal laptop, plugin and access the network? Can a salesman come into demo products, and they would just pull the Ethernet jack off a PC and connect it to their laptop, and get access? You might think this an unlikely and infrequent scenario, but it happens. Being able to control and having visibility to what is connected to your environment is critical to the cyber hygiene of any network. Implementing and configuring these systems and ports so that you know who connected and being alerted when something is connected that should not be, can be difficult to configure and monitor. But we can help.
SecureStrux has engineered and implemented a variety of 802.1x Port Security solutions to meet the robust requirements for both DoD and commercial clients. We have proven success in working with a variety of vendors and have inexpensive solutions that are easy to manage and can many times be implemented with existing hardware and systems.
Cloud risk assessments identify security gaps in an organization’s Software as a Service (SaaS) and Platform as a Service (PaaS) applications and operating systems to meet RMF and CMMC/CUI Compliance
SecureStrux reviews the organization’s usage of cloud applications, platforms, and infrastructure setup and services, together with their use cases, risk profile and objectives. We then assess current configurations and settings, deployed and planned native and third-party tools, and monitoring and detection capabilities, comparing these settings against security benchmarks, best practices, and compliance standards.
We work closely with our clients to coordinate our analysis with their policies, budgets, and existing implemented technology. Detailed recommendations are provided for improving the company’s protective controls and detection capabilities, clearly articulating the reasoning and compliance reference behind each recommendation, the priority and the estimated remediation effort of each security enhancement.
We have seasoned engineers and cybersecurity analysts that have worked with both large and small cloud implementations. Our engineers have experience with VMware and Citrix/Xen, Amazon’s AWS, Microsoft Azure Cloud Computing Services.
Understand your vulnerabilities and learn how to eliminate them with a penetration test.
- Have you been wondering what exactly would happen if your company was targeted by a determined attacker doing their best to break into your network?
- When is the last time you scanned your organization’s entire online IP space, from the applications to the operating systems to the wireless networks?
- Isn’t it time you found out for certain where the vulnerabilities in your organization lie so you can then create a plan to effectively deal with them?
SecureStrux penetration testing professional services have conveniently packaged a sequence of periodic (and scheduled) pen tests into an annual automated penetration testing subscription.
Learn more about our Penetration Tests
Insider Threat & Data Transfer Auditor.
Our DTAuditor tool monitor users in real-time when they copy data from machines to removable media (flash and CD-ROM drives). Learn more here – Data Transfer Auditor
Endpoint Security contains products designed to meet known intrusion points, discover gaps, and reduce the likelihood of unauthorized device and network access. Leading point products including Host Intrusion Prevention System, Asset Publishing Service, Asset Configuration Compliance Module, Device Control Module/Data Loss Prevention, Policy Auditor, Rogue System Detection, and VirusScan Enterprise.
Learn more here – Endpoint Security
Increase visibility into critical security issues, implement the Tenable Suite to automate network discovery and use associated products to deliver comprehensive network and application vulnerability scanning and configuration assessment.
Learn more here – Vulnerability Scanning with Tenable
For more information on any of our Cyber Engineering Services, complete the form below and a team member will follow up with you.