Cybersecurity and identity management

Scope of work

• Hardening of Linux servers and compliance with CIS benchmarks.
• Centralised identity and access management with FreeIPA.
• Internal certificate authority and certificate lifecycle management.
• Network segmentation, filtering and secure remote access.
• Implementation of a detection chain and support for your SOC.

Deliverables

• An automated hardening baseline and a compliance report.
• A highly available identity directory, with access policies.
• Detection rules, dashboards and response procedures.
• A prioritised remediation plan for the gaps identified.

Technologies

• FreeIPA, Kerberos, LDAP, Dogtag PKI, SSSD, two-factor authentication.
• CIS Benchmarks, AppArmor, auditd, nftables, Ansible for industrialisation.
• Open source detection chain, correlation and the MITRE ATT&CK framework.

Engagement terms

Ten to thirty days depending on scope, fixed price or ongoing support.

We build and equip the detection chain; running it day to day is the responsibility of your teams, or of a support contract whose level is chosen under the monitoring engagement.

How the engagement runs

Phase 1 — Assessment

• Measurement of configuration gaps and of the attack surface.
• Review of access management and of privileged accounts.

Phase 2 — Identity foundation

• Deployment of the directory, its replicas and the internal PKI.
• Server enrolment and centralised access policies.

Phase 3 — Hardening

• Industrialised hardening through Ansible and compliance checking.
• Network segmentation and secure remote access.

Phase 4 — Detection

• Log collection, detection rules and actionable alerts.
• Response procedures and an incident qualification exercise.