Technical findings
Findings your engineers can fix, with severity based on what an attacker could reach.
Cyber security · Australia
Cyber defence for Australian organisations.
We partner with businesses and government to defend against cyber threats, manage cyber risk and build resilience. Our services cover penetration testing, AWS configuration review, incident response readiness, load testing, advisory, compliance and governance.
Standards
Essential EightInformation Security ManualProtective Security Policy FrameworkSecurity of Critical Infrastructure ActPrivacy Act 1988Australian Privacy PrinciplesNotifiable Data Breaches schemeAPRA CPS 234AWS Well-ArchitectedHosting Certification Framework
We align our work to these standards. They are not certifications held by Southern Shield.
After the engagement
Testing is useful when it leads to action.
We test, review and prepare Australian organisations, then stay with what follows the report: what to fix, who owns it, and how it is governed.
| Starting point | After the engagement |
|---|---|
| A scanner export filed with the board pack. | A clear account of the path an attacker could take, written for the people who will fix it. |
| Cloud settings left as the account was created. | An AWS review that names the guardrail and the design change separately. |
| An incident plan that has never been exercised. | An exercised plan, with the time taken, any missing role, and an owner for each action. |
| An assumption that the portal will hold during rates week. | A measured limit, agreed stop conditions, and a note of what fails first. |
| A policy set that is not in use. | Governance with named owners, review dates, and a meeting that already exists. |
Services
Services that protect your organisation and build resilience.
Four services test how your systems perform today. Three help you manage risk, meet your obligations and keep security decisions in place after the report is delivered.
01Penetration testingAuthorised testing of the applications, networks, and identities in operational use: the public portal, staff remote access, the API behind a form, and privileges that should not extend. Findings are ranked by what an attacker can reach, then written so an engineer and an executive can both act.02AWS configuration reviewAccounts, identity, logging, network boundaries, and data guardrails, assessed against the settings around the workloads in production. The review separates a guardrail that can be closed promptly from a design change that requires a project.03Incident response readinessPlans, roles, and a facilitated exercise that shows whether an incident can be contained: ransomware during business hours, a misused mailbox, exposed personal information, or failure of a public portal. The engagement concludes with an after-action record that names owners and dates.04Load testingCapacity under the traffic the organisation is about to receive, with journeys, a ceiling, and abort conditions agreed before the first request is sent. The result identifies the point at which latency, errors, and saturation prevent the service from meeting its commitments.05AdvisorySenior advice on architecture, procurement and the next four quarters, with no product attached. We help founders, general managers and executives reach a decision they can explain to their board.06ComplianceEssential Eight, the Information Security Manual, the Privacy Act, SOCI, and the sector duties that already apply, mapped to evidence you hold. Gaps are ranked by obligation and effort, in language an auditor or a board can read.07GovernanceWe help you keep security decisions visible after the test, with a register that is maintained, policies staff can follow, and reporting suitable for a council, an executive or a board.
Partners
Platforms an engagement usually names.
Most engagements name a cloud account, an identity system, and the place the code or the service is run. We assess the platforms below when they are in scope: who can change them, what they expose, and what an attacker could reach.
Marks are shown in black and white. They identify platforms we assess. They are not vendor partnerships or certifications held by Southern Shield.
01 · Cloud
Amazon Web Services
Accounts, identity, logging, and what the internet can reach.
- 01
Organisation structure, accounts, and service control policies
- 02
Identity, federation, and paths to administrator access
- 03
Logging, retention, and who can disable it
- 04
Network exposure, public storage, keys, and backups
Sectors
A partner for business and government.
01
Security support sized to the team you have.
The organisation holds customer data, and a small number of people cover technology, suppliers, and incident response. The engagement must be specific enough to approve in a single meeting.
- Limited internal capacityOne or two people cover technology. A provider performs the operational work. Security has to fit that arrangement.
- Systems the business depends onCustomer data, payments, identity, and email. If they fail, operations stop.
- An external assurance requestAn insurer, a customer, or a board asks for evidence that currently exists only as a spreadsheet.
How we work
A clear path from scope to retest.
Every engagement is scoped. Findings are written for the people who will fix the system, and for the leaders accountable for the risk.
- 01
Scope
We agree the systems, how sensitive the data is, and the decision the work needs to support.
- 02
Test
We test and review only the environment named in the agreed scope.
- 03
Report
You receive a technical report for the people who will fix the issues, and a short summary for the people who will fund the work.
- 04
Remediate
Your team or your provider carries out the fixes. We stay available to explain what we found.
- 05
Retest
We confirm the fixes in a window agreed at the start, then help you bring the result into your governance.
What you receive
Findings your organisation can use.
We write findings in the language of the Essential Eight, the Information Security Manual, the Privacy Act, and the policies your organisation already uses.
Executive summary
A short document for the founder, general manager or accountable executive, covering the consequence and the cost of leaving a finding open.
Owners and dates
Named owners, review dates and a retest window, so the work continues after we leave.