Prioritise
Identify what genuinely exposes the organisation: identities, access, backups, internet exposure, dependencies, workstations, servers and sensitive data.
Cybersecurity
Security at the right level, in the right order.
Cybersecurity support turns a context that is often broad and unclear into concrete decisions: priority risks, realistic measures, clear responsibilities, incident response support and a remediation roadmap.
YSAX is listed on the national platform Cybermalveillance.gouv.fr, the French national platform supporting victims of cybercrime, operated by the State, for incident response and remediation, and Yann Sanchez is a member of CLUSIR Auvergne-Rhône-Alpes, a regional network of information security professionals.
Cybersecurity listings & networks
Being listed on Cybermalveillance.gouv.fr and belonging to CLUSIR amount to neither a certification nor an official label.
Approach
Security that is useful, understandable and manageable.
Structure
Put readable governance in place: roles, rules, policies, indicators, reviews, supplier requirements and risk trade-offs.
Support
Turn decisions into actions that are followed up: schedule, owners, committees, documentation, change management and reporting.
Security incident
Support and remedial intervention, including on site.
Responding to an incident
YSAX provides support and remedial intervention on IT security incidents, travelling on site where the situation requires it and where the scope of the engagement allows.
- Qualifying the incident, the level of urgency and the systems affected
- Containment measures and reduction of exposure
- Collection of useful traces: logs, workstations, servers, accounts and traffic
- Technical investigation and identification of probable causes
Remediating and regaining control
The aim is to restore controlled operations, reduce the risk of recurrence and deliver findings that decision-makers and technical teams alike can understand.
- Remediation of the vulnerabilities or misconfigurations identified
- Review of access, privileged accounts, backups and logs
- Coordination with internal teams, hosting providers or suppliers
- Post-incident action plan and hardening recommendations
Possible engagements
Formats matched to the level of maturity.
Remedial incident response support
Remote or on-site work to help understand, contain, correct and document an IT security incident.
- On-site visit possible depending on context, urgency and the value of being there
- Analysis of traces and search for technical causes
- Remediation actions and priority hardening
- Post-incident findings and treatment priorities
Security posture review
A short or in-depth assessment giving a clear view of strengths, weaknesses and treatment priorities.
- Interviews with executive management, the IT department and business units
- Documentation and architecture review
- Analysis of existing measures
- Prioritised action plan
Governance & compliance
Aligning security requirements with the way the organisation actually works.
- Information security policy, charters, processes and committee structure
- ISO/IEC 27001, audits, remediation plans
- EBIOS Risk Manager, GDPR, NIS, DORA depending on context
- Security reporting and indicators
Technical hardening
Support on the technical topics that reduce exposure and strengthen resilience.
- IAM, MFA, PKI, privileged accounts
- Network segmentation, VPN, firewalls, proxy, WAF
- SIEM, logs, vulnerabilities and remediation
- Disaster recovery and business continuity, backups, hardening and architecture
Cyber programme management
Coordination of workstreams involving several teams, with trade-offs, dependency tracking and reporting to decision-makers.
- Scoping, schedule, budget and project risks
- Cross-functional facilitation across IT, business units and management
- Follow-up of suppliers and integrators
- Change management and skills development
Deliverables
Material made for deciding and tracking.
Executive summary
A short read on risks, impacts, priorities and trade-offs.
Action plan
Ordered actions, owners, dependencies, estimated effort and milestones.
Detailed analysis
Findings, evidence, gaps, recommendations and level of criticality.
Steering pack
Tracking table, committee structure, indicators and points to watch.
Frequently asked questions
Cybersecurity, audit and incident response.
What cybersecurity engagements are available?
Engagements may cover cybersecurity audits, security posture reviews, governance, risk assessment, remediation, the management of action plans, incident response support and security awareness for teams.
Can an incident response start remotely?
Yes, an initial qualification can often start remotely: context, urgency, systems affected, access available, first containment measures and a decision on whether an on-site visit is worthwhile.
When is an on-site presence preferable?
Being on site is useful when access to the equipment, the teams, the logs or the real environment speeds up diagnosis, the collection of traces or remediation.
Does cybersecurity work also cover training and awareness?
Yes, a cyber engagement can include security awareness for teams, elected officials, public-sector staff or users, so that technical measures are understood and genuinely applied day to day.
Experience base
A practice shaped by demanding environments.
Certifications & training
ISO/IEC 27001 Lead Auditor, EBIOS RM, DPO AFNOR, Fortinet NSE4, CCSA, ITILv3, VCP5-DCV.
Technical background
GNU/Linux, networks, authentication, encryption, certificates, logs, vulnerabilities and architecture.
Reporting culture
Plain-language explanation, writing, synthesis, teaching and facilitation of cross-functional initiatives.