IT Security Concepts

An IT security concept is the foundation for protecting your IT infrastructure.

Services

• Status quo analysis: Systematic assessment of your existing IT infrastructure, processes, and security measures. This includes documentation of network architecture, access controls, backup strategies, and existing policies. All subsequent steps build on this analysis.
• Threat modeling: Structured analysis of potential threats and attack vectors, focused on your specific IT landscape and industry. I use established methods such as STRIDE and attack trees to systematically identify your critical attack surfaces.
• BSI IT-Grundschutz & ISO 27001: Alignment of your security concept with established standards. Support in preparing for ISO 27001 or BSI IT-Grundschutz certification, including the required documentation and evidence.
• Risk assessment & prioritization: Evaluation of identified risks by likelihood and impact. Prioritization of measures by cost-benefit ratio, so you invest your budget where it achieves the greatest protective effect.
• Concrete recommendations: Detailed action plan with clear responsibilities, timelines, and implementation steps that your team can act on directly.

What does a finished security concept contain?

The completed security concept is a document that typically includes:

• Management summary: Summary of key findings and recommendations for decision-makers, understandable without a technical background.
• Status quo documentation: Detailed description of your current IT infrastructure, processes, and existing protective measures with maturity assessment.
• Threat and risk analysis: Catalog of identified threats with risk assessment, visualized in a risk matrix.
• Action catalog: Prioritized list of concrete measures with responsibilities, estimated effort, timelines, and expected risk reduction.
• Implementation roadmap: Phased plan: which measures should be implemented immediately, short-term, and medium-term.

Background

At CISPA Helmholtz Center, my research includes how development teams handle confidential credentials (API keys, passwords, certificates) and where vulnerabilities arise. The results have appeared at venues including USENIX Security. Where that is relevant to your concept, I draw on it.

Process

1. Free initial consultation: Needs analysis and clarification of project scope.
2. Status quo analysis: On-site or remote, one to several days depending on organization size.
3. Threat modeling and risk assessment: Structured analysis and documentation.
4. Security concept creation: Including action catalog and implementation roadmap.
5. Results presentation: Presentation and joint discussion, on request for both the technical team and executive management.
6. Optional implementation support: Assistance during implementation and regular reviews.

Who is it for?

My security concepts are mainly for small and mid-sized companies (SMEs) in Hannover, Braunschweig, Bremen, Hamburg, and across Germany. Particularly suited for organizations that need to meet regulatory requirements such as NIS2 or GDPR, are pursuing ISO 27001 certification, or want to systematically review their existing security architecture.