Security architecture review
A security architecture review examines how your systems, networks, identities and data connect, and where an attacker could move between them. Our engineers map trust boundaries, privileged access paths and segmentation, then trace attack paths across them against MITRE ATT&CK or a framework of your choice.
Scope
- A diagram of how your environment is actually connected
- Trust boundaries and the paths between them
- Identity, access and administration
- Logging, backup and recovery
How it runs
We combine interviews and configuration review with targeted technical checks.
Secure architecture design
Secure architecture design covers a new system, product, office or cloud environment, with security designed in from the start. nandsec designs network segmentation, identity and administration, data flows, encryption and key management, and centralised logging and recovery with you.
Scope
- Network layout and segmentation
- Identity, access and administration
- Data flows, encryption and key management
- Logging, monitoring and recovery
How it runs
We run design workshops with your team and document the rationale for each design decision.
Threat modelling
The objective of threat modelling is to determine who would target your organisation or one of its systems, how they would do it, and what to change first. nandsec decomposes each system into data flow diagrams of its processes, data stores, external entities and trust boundaries, then enumerates threats per component with STRIDE, MITRE ATT&CK or the method your team already uses.
Scope
- Data flow diagrams for the system and its dependencies
- Threats by component, using STRIDE, ATT&CK or your own framework
- Controls and design changes ranked by risk and cost
- A model your team can update as things change
How it runs
We model each system in workshops with your engineers and system owners.
Network security review
Network security review assesses how your network is designed and controlled, from the internet edge to internal segments and remote access. Our engineers review firewall rule bases, egress filtering, the management plane, VPN configuration, 802.1X network access control and guest isolation.
Scope
- Network design and segmentation
- Firewall rules and exposed services
- Remote access and VPN configuration
- Wireless networks and guest access
How it runs
We review configuration and diagrams before testing the controls that matter most.
Endpoint security review
Endpoint security review assesses laptops, desktops and servers against the CIS Benchmarks or the compliance standard your organisation uses. nandsec tests a sample of devices, from patching and multi-factor authentication to application control, macro settings and backups.
Scope
- Application control and patching of applications and operating systems
- Macro settings and user application hardening
- Administrative privileges and multi-factor authentication
- Disk encryption, backups and local security settings
How it runs
We review a sample of devices and the policies that manage them.
Operational security review
nandsec specialises in understanding and analysing the secondary and tertiary factors that sit outside primary security objectives and tools. This includes the operational security of your organisation and your employees: how your team conducts its activities, your business processes, your communication patterns and more. This is a key aspect of any organisation, and it is often overlooked and not managed effectively. The technical rigour and vigilance of your organisation are pivotal to its intellectual property, privacy and security. Operational security is the process of systematically analysing and managing risk, so that sensitive information does not fall into the wrong hands, by identifying, controlling and protecting evidence of planning and execution. It extends to the human element: the behaviours, habits and decisions of the people within your organisation.
Scope
- Daily routines and habits: predictable patterns in how and when people work, travel and communicate that adversaries can exploit
- Verbal and social conduct: offhand disclosures in public spaces, oversharing on social media, or casual discussion of projects and timelines
- Digital behaviour: credential reuse, mixing personal and professional channels, and unverified links or attachments
- Physical awareness: unsecured documents, unlocked screens, and a lack of situational awareness in shared or public environments
- Identity hygiene: the degree to which personal and professional identities are separated across platforms and contexts
How it runs
Interviews and observation across your teams, then a written report of what an adversary could learn and the habits to change.
Secure development lifecycle
A secure development lifecycle makes security part of how your team plans, writes, reviews, tests and ships code. nandsec measures current practice, then adds review rules, security scanning in CI and release checks, scaled to the size of your team.
Scope
- Current practice measured on a simple maturity scale
- Review rules and pull request checklists
- Security scanning in CI
- Release checks and incident response basics
How it runs
We assess current practice first and review progress against an agreed plan each quarter.
Vulnerability disclosure program
A vulnerability disclosure program gives researchers and customers a way to report vulnerabilities to you, and gives your team a process for each report. nandsec writes the disclosure policy and security.txt file, sets up intake and triage, and publishes advisories with CVE identifiers.
Scope
- Disclosure policy and security.txt
- Intake address, encryption key and triage rota
- Response times you can meet
- Advisory and CVE publication
How it runs
We write the policy and process with you and test them before launch.
Regulatory readiness and SBOM
Regulatory readiness and SBOM prepares your products for the Australian smart device standard under the Cyber Security Act 2024 and the EU Cyber Resilience Act. nandsec runs a gap assessment, generates CycloneDX or SPDX SBOMs in your build and publishes VEX statements for each matched vulnerability.
Scope
- Gap assessment against the requirements that apply to you
- SBOM generation in your build
- Vulnerability matching with VEX statements
- Support periods and update commitments
How it runs
We assess one product line first and turn the result into a checklist for the rest.
Technical due diligence
Technical due diligence gives an independent view of a company's security before you invest in it or buy it. nandsec reviews the target's code and infrastructure for issues that bear on the deal, such as exposed secrets, weak access control and missing incident readiness.
Scope
- Application and infrastructure security
- Identity, access and secrets
- Development practices and incident readiness
- Issues that should change the deal
How it runs
We work under NDA within the deal timetable using read-only access.
Fractional security lead
A fractional security lead provides part-time senior security leadership for an organisation that needs the role but not yet a full-time hire. nandsec owns the security roadmap, design reviews, customer questionnaires and board reporting, then hands over to a permanent hire.
Scope
- A security plan tied to your business and product plans
- Design reviews and decisions on new systems
- Answers to customer security questionnaires and auditors
- Reporting to the board and investors
How it runs
We usually work one day a week and plan the handover to a permanent hire.
Security training
Security training is built around your own systems, with exercises on the stack your engineers already work with. nandsec runs sessions on secure code review, threat modelling with STRIDE, safe use of AI coding tools, and Linux and container hardening.
Scope
- Secure code review for developers
- Threat modelling for engineers and architects
- Safe use of AI coding tools and assistants
- Linux and container hardening
How it runs
We run sessions in person or remotely with exercises on your own systems.