Managed cybersecurity for Canadian businesses: defence in depth, identity-aware firewall rules and centralized SIEM log auditing from CreateITivity.
Discipline: Cybersecurity & Business Continuity
Working term: Identity-aware firewall rules based on role as well as address
Formats: ongoing monthly work or a single audit
Who you talk to: the senior lead, on every weekly call
The service
Our approach to Cybersecurity & Threat Mitigation
Protect your digital assets with comprehensive defence-in-depth security. CreateITivity deploys perimeter defences, identity-aware firewall rules, and centralized Security Information and Event Management (SIEM) log auditing to detect and neutralize potential vulnerabilities. We follow stringent security frameworks to safeguard sensitive customer data, proprietary systems, and business continuity.
Problems that show up again and again when we first look at an account. Our plan is built to deal with each one.
Firewall rules nobody remembers writing
Over the years, temporary exceptions become permanent and old vendor access stays open. The rule base grows until no one can say which rules are still needed, so no one dares remove any.
Access tied to the network instead of the person
If anything inside the office network can reach the finance server, a compromised laptop gets the same access as the controller. Rules should follow who the user is and what their role needs.
Alerts scattered across five consoles
The firewall, email filter, endpoint tool and cloud tenant each raise their own warnings. Without one place to correlate them, the pattern that signals an intrusion is easy to miss.
Phishing that lands every week
Staff receive convincing fake invoices, delivery notices and sign-in prompts. One approval is enough to hand over a session, which is why email and identity controls have to work together.
Inside a Cybersecurity & Threat Mitigation engagement
The core work
Defence in depth
Identity-aware firewall rules
Centralized SIEM log auditing
Also covered
Threat detection and response
Framework-aligned controls
How we keep the work accountable
Before work starts, we agree on the number that matters most to you. Each sprint is planned against it. You get a short recorded update every week and a dashboard you can open any time, and the senior lead joins every call.
A senior lead runs your account from day one
A recorded walkthrough each week and a shared reporting dashboard
We work inside the tools and CMS your team already uses
Target ranges written into the agreement before we begin
Our Process
Four stages of Cybersecurity & Threat Mitigation
The same order every time: find the constraint, plan, deliver, then review. Here is what each stage involves.
01
Security assessment
We review firewall rules, admin accounts, sign-in settings, endpoint coverage and what is being logged today, and map the findings against the Canadian Centre for Cyber Security baseline controls.
02
Harden identity and the perimeter
Multi-factor sign-in, least-privilege roles and identity-aware firewall rules go in first, because stolen credentials are the most common way in.
03
Connect the SIEM
Log sources are connected, detection rules are tuned to your normal activity and an escalation path is agreed with you, including who we call and when.
04
Detect, respond and improve
Alerts are triaged and acted on. After each meaningful event we write up what happened and adjust controls so the same route is harder next time.
01
Defence in depth
Several layers, so one failure does not decide the outcome
Defence in depth means no single control carries the whole load. At the perimeter, firewalls filter what reaches you. Inside, segmentation separates staff devices from servers, guest Wi-Fi and building systems. At the identity layer, multi-factor sign-in and least-privilege roles limit what any one account can do. On each device, endpoint protection watches for malicious behaviour.
When an attacker gets past one layer, the next one slows them down and creates a signal we can see. That extra time is often what separates a contained incident from a company-wide one.
Perimeter filtering and network segmentation
Multi-factor sign-in and least-privilege admin roles
Endpoint protection on servers and staff devices
Email filtering tuned against impersonation and fake invoices
02
Rules reviewed
Every rule documented with a reason and an owner
Firewall administration
Firewall rules that follow the user, and a rule base you can explain
Traditional firewall rules allow traffic by address and port. Identity-aware rules add who is connecting, so a rule can say that the accounting group may reach the finance system while everyone else is refused, wherever they sign in from.
We start by reviewing the rules you have, documenting what each one does and removing the ones that no longer serve a purpose. New rules go through a simple change process with a written reason and an owner. Firmware is kept current, and configuration is backed up so a failed device can be replaced without rebuilding its rules from memory.
Full review and clean-up of the existing rule base
Rules tied to user groups and roles
Documented changes with a reason and an owner for each
Firmware updates and configuration backups
03
Alert review
Correlated across sources, then escalated or closed
SIEM log auditing
One place where the warning signs line up
A Security Information and Event Management (SIEM) platform collects logs from firewalls, servers, Microsoft 365 or Google Workspace, endpoints and key applications, then correlates them. A failed sign-in from abroad means little on its own. Followed by a successful sign-in, a new mail-forwarding rule and a burst of file downloads, it is a pattern worth acting on.
We connect your sources, tune detection rules to cut noise, and review the alerts that matter. Logs are retained so that, after an incident, you can establish what was accessed. That evidence is what you need to decide whether a breach meets the PIPEDA "real risk of significant harm" threshold.
Logs from network, identity, cloud and endpoint sources
Correlation rules tuned to your environment
Alert review with a documented escalation path
Retention that supports breach investigation and record-keeping
What you can hold us to
The commitments behind this service
These describe how the work is done and what you receive. They are not predictions about attacks or outages, which nobody can promise.
A named senior specialist leads each account
Progress shown in live Looker Studio dashboards
Measured on leads and revenue
Identity-aware
Firewall rules based on role as well as address
One view
Network, cloud and endpoint logs correlated together
Documented
Every rule and every escalation has a written record
Baseline-mapped
Controls tracked against Canadian Centre for Cyber Security guidance
FAQs
Before you sign: common questions
Straight answers on scope, timing and how we report.
What is identity-aware firewalling?
It means firewall rules can refer to users and groups, as well as IP addresses and ports. Access to a sensitive system is granted to the people whose role needs it, so a compromised device elsewhere on the network does not automatically inherit that access.
Do we need a SIEM if we already have antivirus?
Antivirus watches individual devices. A SIEM looks across all your systems at once, which is how you spot an intrusion that touches email, identity and file storage without tripping any single tool. For a business holding customer personal information, that wider view also gives you the evidence you need after an incident.
Which systems can you collect logs from?
Typically firewalls, Windows and Linux servers, Microsoft 365 or Google Workspace, endpoint protection tools and important line-of-business applications. We confirm the exact list during the assessment, since it depends on what your systems can export.
Can you work with our existing firewall and security tools?
Usually, yes. We review what you have first. Where a device is out of support or cannot do what your risk requires, we explain why and give you options, and we will not push a replacement you do not need.
Is this enough for a business that handles health information in Ontario?
It covers the technical safeguards side. Health information custodians under PHIPA also have administrative duties, such as policies, staff training and notification procedures, which we can support but which your organization owns. We align controls to your obligations once we understand them.
Find the weak spots in your systems before they fail
Tell us what you run, where it is hosted and what has gone wrong lately. One of our engineers looks it over by hand and sends back the first fixes we would make, whether or not you hire us. Marketing and development questions are welcome too.
Planning security and continuity work? Let's talk.
Tell us about the business and a senior specialist will get back to you within one business day. If starting with security and continuity looks like the wrong first step, we will say so and suggest what to fix first.
