{"id":3053,"date":"2023-12-11T17:44:00","date_gmt":"2023-12-11T16:44:00","guid":{"rendered":"https:\/\/vision-business.consulting\/v1\/portfolio\/?p=3053"},"modified":"2023-12-26T17:45:57","modified_gmt":"2023-12-26T16:45:57","slug":"implementation-of-a-sap-security-action-plan-including-a-pca-and-a-pra-moa-and-moe-phases-for-carrefour","status":"publish","type":"post","link":"https:\/\/vision-business.consulting\/v1\/portfolio\/implementation-of-a-sap-security-action-plan-including-a-pca-and-a-pra-moa-and-moe-phases-for-carrefour\/","title":{"rendered":"Implementation of a SAP (Security Action Plan) including a PCA and a PRA \u2013 MOA and MOE phases for \u2018\u2019Carrefour\u2019\u2019"},"content":{"rendered":"

[vc_row css=\u00a0\u00bb.vc_custom_1636976312556{padding-top: 40px !important;}\u00a0\u00bb][vc_column]

ABOUT THE CLIENT<\/h3><\/div>
<\/span><\/div><\/div>[vc_empty_space height=\u00a0\u00bb20px\u00a0\u00bb][vc_column_text]Carrefour
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row css=\u00a0\u00bb.vc_custom_1636976312556{padding-top: 40px !important;}\u00a0\u00bb][vc_column]

PROJECT OVERVIEW<\/h3><\/div>
<\/span><\/div><\/div>[vc_column_text]In partnership with Safescore, we helped Carrefour define its Security Action Plan (PAS), inspired by ISO 27001 IT compliance.
\n[\/vc_column_text][vc_empty_space height=\u00a0\u00bb20px\u00a0\u00bb][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row css=\u00a0\u00bb.vc_custom_1636987569453{padding-top: 10px !important;}\u00a0\u00bb][vc_column]

TECHNICAL DIFFICULTIES<\/h3><\/div>
<\/span><\/div><\/div>[vc_empty_space height=\u00a0\u00bb20px\u00a0\u00bb][vc_column_text]Coming across an existing non-compliant situation and working to bring it into conformity without impacting operations is a path strewn with pitfalls:
\nHeterogeneity of systems: As the organization uses a variety of technologies, platforms and systems, it was difficult to put in place a coherent security policy covering the entire IT environment.<\/p>\n

Impact on productivity: If we hadn’t worked systematically on the switchover from pre-production mode, with adjustments and iterations until success was achieved, before applying the same to production mode, compliance could have led to temporary interruptions to operations, planned downtime and adjustments to work processes, which could have had an impact on productivity.
\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row css=\u00a0\u00bb.vc_custom_1636987615323{padding-top: 10px !important;}\u00a0\u00bb][vc_column]

THE SOLUTION<\/h3><\/div>
<\/span><\/div><\/div>[vc_empty_space height=\u00a0\u00bb20px\u00a0\u00bb][vc_column_text]We covered three main areas: applications, infrastructure and data. Here is an overview of the projects covered in each of these areas:<\/p>\n

1. Application security :<\/p>\n

Secure development: Adoption of secure development practices such as the use of secure frameworks, user input validation, SQL injection prevention, session management, etc.
\nIdentity and access management: Implement a robust authentication system and ensure that users are given only the necessary privileges.
\nUpdates and patches: Keep applications up-to-date with the latest security patches to avoid known vulnerabilities.
\nSecurity testing: Perform regular security tests such as penetration tests and vulnerability scans to identify and resolve security issues.
\nError handling: Customize error messages to avoid disclosing sensitive information, and ensure that errors are properly handled.
\n2. Infrastructure security :<\/p>\n

Firewalls and packet filtering: Configure firewalls to control incoming and outgoing network traffic, and apply packet filtering rules.
\nPhysical security: Protect physical access to your servers and network equipment to prevent physical intrusion.
\nPatch management: Regularly apply security patches to servers, operating systems and third-party software.
\nNetwork monitoring: Set up a network monitoring system to detect suspicious activity.
\nPassword management: Apply a strong password management policy, encourage complex passwords and use two-factor authentication (where possible).<\/p>\n

3. Data security :<\/p>\n

Encryption: Use encryption to protect sensitive data in transit and at rest.
\nData classification: Classify data according to its sensitivity and apply security policies accordingly.
\nAccess management: Restrict access to sensitive data to authorized users only.
\nBackup and disaster recovery: Implement regular backup processes and disaster recovery plans to ensure data availability.
\nSecure deletion: Ensure that sensitive data is securely deleted when it is no longer required.
\nData auditing: Perform data audits to track access to and modifications of sensitive data. [\/vc_column_text][\/vc_column][\/vc_row][vc_row][vc_column][\/vc_column][\/vc_row][vc_row][vc_column width=\u00a0\u00bb1\/2″]

KEY BENEFITS<\/h3><\/div>
<\/span><\/div><\/div>[vc_empty_space height=\u00a0\u00bb20px\u00a0\u00bb][\/vc_column][vc_column width=\u00a0\u00bb1\/2″]

TECHNOLOGY<\/h3><\/div>
<\/span><\/div><\/div>[vc_empty_space][\/vc_column][\/vc_row][vc_row disable_element=\u00a0\u00bbyes\u00a0\u00bb][vc_column][vc_empty_space][vc_text_separator title=\u00a0\u00bbRequest More Info\u00a0\u00bb color=\u00a0\u00bbsky\u00a0\u00bb border_width=\u00a0\u00bb2″][\/vc_column][\/vc_row][vc_row disable_element=\u00a0\u00bbyes\u00a0\u00bb el_class=\u00a0\u00bbsml\u00a0\u00bb][vc_column][vc_column_text]