Software Company With
Right Technology Great Experience Business Knowledge

Best in class software solutions for automation
AND
To secure critical IT infrastructure!

WhatsApp Us For Saudi Aramco CCC

Saudi Aramco Cyber Security Certificate -
Building Defence System
Hidd - Kingdom of Bahrain

Job Category:Assistance for Saudi Aramco Cyber Security Certificate

Location:Muharraq, Bahrain

Date:Feb 2022

BDS has built a regional reputation as a professional supplier and installer of Specialist Perimeter Protection solutions throughout the GCC and wider MENA region, providing the highest levels of security against terrorist or criminal attack. Entrusted by some of the largest systems integrators and associated EPC contractors to deliver security solutions to their blue chip and governmental clients, BDS has played an integral part in the protection of Critical National Infrastructure in the heartland of the Middle East. With Headquarters in Bahrain and regional offices across Saudi Arabia, Oman and Kuwait, BDS is strategically positioned to support clients within region.

Gap Analysis

Before initiating any project activities, we conducted a thorough gap analysis to evaluate the current state of the organization IT infrastructure. This process allowed us to systematically identify strengths, weaknesses, and areas requiring improvement. By mapping the existing setup against best practices and future requirements, we gained a clear understanding of the challenges ahead. The analysis not only provided a complete picture of the task at hand but also laid the foundation for prioritizing actions and implementing effective solutions.

Update of Infrastructure

Based on the findings of the gap analysis, we initiated a structured program to upgrade the IT infrastructure and align it with the requirements for obtaining the Third-Party Cybersecurity Compliance Certificate. Key activities included compiling a detailed inventory of assets, updating operating systems, migrating databases to secure local servers, implementing static IP configurations, upgrading office productivity tools, and strengthening Wi-Fi protection. These improvements established a more resilient technology environment capable of supporting compliance and long-term security objectives.

Compilation of an Acceptable Use Policy (AUP)

The Acceptable Use Policy (AUP) serves as the blueprint for both technical and practical approaches to internal and external cybersecurity. We developed a comprehensive policy drawing on SANS Institute guidelines and other recognized best practices. The AUP provides clear guidance for IT Administrators while also educating employees on responsible use. It incorporates essential documentation, including Aramco Cybersecurity Incident Response forms, employee exit checklists, information sanitization records, and employee acknowledgments of training and acceptance of the policy.

Group Policies via Domain Controller

A Microsoft Domain Controller was deployed to centralize network management, and all laptops, desktops, and servers were integrated into the domain. Group Policy Objects (GPOs) were configured to enforce key security measures, including password complexity, renewal cycles, reuse restrictions, account lockout policies, and automatic screen lock. Additional controls disabled display settings, restricted file transfers via USB or DVD, blocked command prompt access, and ensured system updates. Browser policies prevented password saving, while Internet Explorer was blocked and redirected to Microsoft Edge.

Firewall implementation

To secure the network perimeter, a Sophos firewall appliance was deployed, complemented by a subscription to Sophos Xstream Protection for enhanced security. This subscription provides advanced features such as deep packet inspection, encrypted traffic scanning, network and web protection, zero-day threat defense, machine learning based detection, and centralized orchestration with premium support. Remote access to local resources was secured through multi-factor authentication using the Sophos Authenticator app, which generates time-based and event-based one-time passwords (OTP) in compliance with RFC 6238 and RFC 4226.

End-Point Security

All devices were protected using Kaspersky Endpoint Security for Business Advanced, ensuring comprehensive defense across the organization. Centralized policies were configured through the Kaspersky Control Center to manage and monitor endpoint devices effectively. These policies included real-time device tracking, daily antivirus database updates, and scheduled weekly deep scans. Additional measures covered patch management, file encryption, and enhanced server protection. Together, these controls created a layered security environment designed to minimize risks, improve resilience, and safeguard critical information assets.

Microsoft 365 Services

To strengthen email security, multi-factor authentication (MFA) was implemented across all Microsoft 365 services, and every user was enrolled. With this control in place, users are required to approve sign-in attempts through the Microsoft Authenticator mobile app, adding a second layer of verification beyond passwords. Any suspicious or unauthorized login request can be denied instantly by the user, effectively blocking potential threat actors. This proactive measure significantly reduces the risk of account compromise and enhances overall business email protection.

Cyber Security Training

All users participated in a comprehensive cybersecurity training program designed to build awareness and strengthen defense against evolving threats. The training covered key topics such as the fundamentals of cybersecurity, acceptable use of company infrastructure, and the risks of social engineering and phishing attacks. Additional modules addressed password security, data protection, ransomware, malware, imposter scams, and email spoofing. Practical guidance on policies like clean desk practices, safe internet use, and everyday security tips equipped employees with knowledge to recognize and prevent threats.

Secure Sanitization

As required by the Third-Party Cybersecurity Compliance Certificate, all data must be sanitized in accordance with NIST 800-88 or equivalent standards at the end of its lifecycle, retention period, or prior to device reassignment or destruction. We recommended four software solutions that comply with NIST and other globally recognized frameworks, including the NCSC, NATO, Common Criteria (EAL+3), ADISA, HIPAA, Sarbanes-Oxley, and German VSITR. The Acceptable Use Policy (AUP) also defines sanitization methods, secure storage of sanitized drives, and destruction of unusable media

Sender Policy Framework (SPF)

Sender Policy Framework (SPF) is a key email authentication protocol designed to prevent email spoofing and phishing. By publishing an SPF record in the domain DNS, organizations specify which mail servers are authorized to send emails on their behalf. When an email is received, internet service providers validate the sending server against the SPF record to confirm its legitimacy. This verification process helps reduce the risk of forged emails, strengthens domain reputation, and improves overall email deliverability and trust.

Email Anti Malware and Spam Protection

The mail server was updated with advanced anti-malware and anti-spam policies to safeguard organizational communications. These policies block malicious content, manage bulk messages, and provide proactive protection through Microsoft Safe Links and Safe Attachments, ensuring harmful URLs and files are neutralized before reaching users. The anti-spam framework filters suspicious or unsolicited content, strengthening defenses against phishing and spoofing. Together, these measures protect both inbound and outbound mail traffic, reduce exposure to cyber threats, and enhance overall email system security.

DomainKeys Identified Mail (DKIM) Implementation

DomainKeys Identified Mail (DKIM) is an email authentication protocol that enables organizations to take responsibility for messages they send by applying a digital signature. This signature is validated by mailbox providers through cryptographic authentication, confirming that the message has not been altered in transit and originates from an authorized source. DKIM was implemented on the organization email system to enhance trust, reduce the risk of spoofing, and strengthen protection against phishing and other email-based cyber threats.

Compilation of Evidences and Discussion
with 3rd Party IT Auditors

After completing the implementation of all cybersecurity requirements, we compiled evidence from multiple sources to validate compliance. For each control, screenshots were captured with date, time, domain, and user information using administrator-level command interpreter (cmd) commands. Care was taken to ensure that screenshots were clean, clear, and properly referenced within the Third-Party Control (TPC) framework. Each TPC included the correct reference number and concise comments to allow the auditor to easily review the material. Once submitted, the auditor examined the evidence, held discussions with our team, and conducted real-time validation tests. Their review covered the firewall, endpoint security solutions, group policy objects, and a sample of user terminals. After verifying that all Third-Party Controls were correctly implemented and functioning as intended, the IT auditor confirmed compliance and formally issued the Third-Party Cybersecurity Compliance Certificate to our client, signifying successful completion of the certification process.

Software Company With Right Technology Great Experience Business Knowledge

Best in class software solutions for automation ANDTo secure critical IT infrastructure!