Information Security Assessment in Dubai

Assume the message will be convincing and remove the single point of failure instead. The controls that stop these attacks are procedural before they are technical.

Procedural controls, in order of effect:

1. Require out-of-band verification for every payment instruction and every supplier bank-detail change, on a number held on file rather than one supplied in the message.
2. Enforce that rule regardless of who is asking or how urgent it sounds, and make overriding it a disciplinary matter rather than a judgement call.
3. Give finance staff an explicit, blame-free escalation path for a request that feels wrong, because the attack depends on nobody asking.
4. Run unannounced simulations aimed at the finance and executive-assistant functions. One exercise tells you more about exposure than any policy document.

Technical controls that back them up:

• Publish SPF, DKIM and DMARC with an enforcing policy, so your own domain cannot be spoofed outright.
• Flag external mail visibly in the client, including on mobile, where most impersonation succeeds.
• Monitor certificate transparency logs and registrar feeds for lookalike domains that impersonate your brand.
• Deploy phishing-resistant multi-factor authentication, ideally hardware-backed, so a captured password is not enough.
• Alert on mailbox rule creation and forwarding changes, the usual first action after an account is taken over.

Why the attack works so well in this region, and what to do in the first hour of a suspected case, is set out in our article on spear-phishing and executive impersonation in the UAE.

Cost tracks scope, not headcount. A single-framework gap assessment for a mid-sized entity typically runs four to six weeks of consultant time. Adding technical control testing, multiple locations, or several frameworks at once extends that. We scope from your architecture and your regulatory obligations, then quote a fixed engagement rather than an open-ended day rate.

Four to six weeks for a focused gap assessment, eight to twelve for a full posture review across several frameworks. Fieldwork is usually two to three weeks of that; the rest is evidence review, validation, and writing findings that hold up when someone challenges them.

We specify the fix, and we separate the two engagements deliberately. Where an independent assessment opinion has to stay independent, for example ahead of a certification or a customer assessment, remediation advice runs as a distinct piece of work with different people. Where independence is not required, the same engineers who found the issue can specify and oversee the fix your team implements, as part of our cyber security consulting in Dubai.

For technical control testing, read-only access is usually enough, and it can be scoped to specific systems and time windows. Documentation review and interviews need no system access at all. All assessment data can stay on infrastructure inside the UAE, including fully air-gapped environments where nothing leaves the site.

Plan for roughly two to four hours per control owner across the fieldwork period, concentrated in interviews and evidence walkthroughs. Technical testing against read-only access is invisible to users. We schedule interviews in advance and send the evidence request list up front, so nobody is asked to produce a document in the room.

Yes. The board-level report is written to be shareable as it stands, and it is the document most customer assurance teams actually want. The engineering report contains system detail and reproduction paths, so it normally stays internal, or is shared under NDA in redacted form. We can produce a separate summary letter for a specific customer or regulator on request.

Annually for a full assessment, with a targeted re-test of the previous findings at three to six months so remediation is verified rather than assumed. Anything that materially changes the architecture, a cloud migration, a new business line, an acquisition, warrants an out-of-cycle review of the affected scope rather than waiting for the annual slot.