enquiries@dthomas.co.uk • +44 (0) 23 9282 2254
23 May 2024
Leading pensions fintech Dunstan Thomas has secured a SecurityScorecard ‘A’ rating following a two year period in which it has focused intensively on increasing its in-house cyber security skills and tightening cyber security systems to protect its IT infrastructure and the data it holds for its major name clients across the pensions and platform market.
During this period, Dunstan Thomas focused investment on six core cyber security toolsets to assist in securing its A rating during April 2024. These included investment in Security Information & Event Management (SIEM), Data Loss or leakage Prevention (DLP), Endpoint Detection & Response (EDR), as well as Intrusion Prevention Systems (IPS).
Dunstan Thomas’ workload also included securing Cyber Essentials certification covering core the cybersecurity elements: firewalls, secure configuration, access control, malware protection and patch management.
Matt Roblin, IT Director at Dunstan Thomas, explained the process of securing an A rating:
We found the SecurityScorecard system very useful because it can be set up to review all your cyber security protections and assess your threat landscape. It then helps you work out the most significant threats which need mitigating. Once those higher category threats have been tackled, you see an immediate, positive impact on your scorecard which is now up to 93 out of 100 and rising. It’s very reassuring for our clients because it is such an independent and well-recognised security threat management scoring system.
Ihab El-Saie, CEO at Dunstan Thomas added:
Matt and his team’s work in enabling us to reach SecurityScorecard A rating has provided our clients with terrific reassurance. We now constantly and proactively monitor our threat landscape for anomalies which may provide early warning signals of a new attack or vulnerability. We also have systems which can neutralise threats if they exceed our pre-configured risk thresholds.
We can isolate devices from the network and block incoming traffic in a millisecond if network behaviour patterns look anomalous, and much of this is done in a fully automated manner now.
