IAM and PAM
Identity and access management (IAM) and PAM form the identity layer every other control depends on: the access lifecycle, MFA, privileged sessions and access reviews. Full detail sits on our IAM and PAM implementation page.
Security engineering
Implement security controls across enterprise systems.
Design, deploy, and integrate the identity, development, data, and monitoring controls your teams need to operate securely.
Implementation domains
- IAM and PAM
- Identity lifecycle, privileged access, approvals, reviews, and revocation.
- DevSecOps
- Security gates, secrets, dependencies, scanning, and evidence embedded in delivery pipelines.
- Security product integration
- Connect enterprise platforms to identity, data, workflow, and monitoring sources.
- Encryption and key management
- Protect data in systems and exchanges with operable key processes.
- DLP and classification tooling
- Handling rules connected to technical enforcement.
- Logging, monitoring, and alerting
- Configured logs, alerts, review procedures, retention, and evidence of response.
- Backup, recovery, retention, and deletion
- Availability and lifecycle controls that match policy.
- Third-party and secure data exchange
- Access and sharing that can be explained and reviewed.
Clear ownership from design to operation
Every implementation defines what Limaz designs, deploys, integrates, and validates. It also records the responsibilities assigned to the client and any disclosed technology partner.
From control requirement to working control
Regulations state what must be true. They leave the engineering to you. The National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC-2:2024), control 2-12-3, require event logs for privileged accounts and remote access, kept for at least 12 months. The control stops there. Which log sources, which parser, which alert rule and who reads the alert at 2 a.m. are your decisions, and this is where programmes stall.
We take every control through four questions. What does the requirement demand, written as a testable condition? Which systems must satisfy it? Which product configuration or integration makes it true? What evidence proves it operates, day after day?
Each control ends with a design decision, a configuration, a test and a named owner. It is finished when the test passes in production and your team runs it without us.
This page covers the enterprise security stack. Identity and privileged access, and security inside software delivery, each have a dedicated page. A short summary of how they connect sits further down.
Security products we integrate
- Security information and event management (SIEM)
- Log source onboarding, parsing, time synchronisation, detection use cases, alert triage workflow and retention. Supports ECC subdomain 2-12 and section 3.3.14 of the Saudi Central Bank (SAMA) Cyber Security Framework (CSF), Cyber Security Event Management.
- Endpoint detection and response (EDR)
- Deployment to every workstation and server, policy tiers, tamper protection, isolation rules and SIEM integration. Meets ECC control 2-3-3 on protection from malware and suspicious activity using modern protection technologies.
- Email security
- Phishing and spam filtering, protection against advanced persistent threats, multi-factor authentication (MFA) for webmail, and Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) on every sending domain, as ECC control 2-4-3 requires.
- Data loss prevention (DLP)
- Policies built from your data classification scheme across email, web, endpoints and cloud applications. Rules start in monitor mode and move to blocking once false positives are tuned. Supports ECC subdomain 2-7 Data and Information Protection.
- Web application firewall (WAF)
- Placed in front of every internet-facing application, with tuned rule sets and logging to the SIEM. ECC control 2-15-3 requires a WAF for external web applications, and Payment Card Industry Data Security Standard (PCI DSS) requirement 6.4.2 requires an automated attack-prevention solution in front of public-facing web applications.
- Vulnerability management
- Authenticated scanning of all assets at a risk-based frequency, severity classification, patch workflow and remediation deadlines, in line with ECC subdomain 2-10 and SAMA CSF section 3.3.17.
- Encryption and key management
- Key management systems and hardware security modules (HSMs) integrated with databases, applications and backups, with key ownership and rotation defined. Supports ECC subdomain 2-8 Cryptography.
Configuration baselines and hardening
A security product on default settings leaves gaps attackers know well. Hardening closes them, and baselines keep them closed.
We build a baseline for each platform: Windows and Linux servers, databases, network devices, cloud accounts, containers and the security tools themselves. Each baseline starts from the Center for Internet Security (CIS) Benchmarks or the vendor's hardening guide, is adjusted to your architecture, and records every deviation with its reason and approver.
NCA ECC control 1-6-2 requires secure configuration and hardening to be reviewed before projects and changes go live. Control 2-3-3 requires patch management and centralised clock synchronisation with an accurate, trusted source. SAMA CSF addresses the same infrastructure in section 3.3.8 Infrastructure Security.
A baseline holds only while drift is detected. We automate configuration checks against each baseline, send drift to the asset owner, and build the baseline into golden images and infrastructure as code, so new systems start hardened.
Logging and monitoring that supports investigations
- What NCA ECC requires
- Event logs for critical information assets, for critical and privileged accounts and for remote access; defined SIEM techniques; continuous monitoring; and retention of at least 12 months (control 2-12-3).
- Sources that matter
- Identity provider and directory, privileged access management (PAM) sessions, virtual private network (VPN) and remote access, firewalls and proxies, EDR, email security, cloud control planes, databases holding customer data, and core business applications.
- Time and identity
- Every source synchronised to one trusted time source, as ECC control 2-3-3 requires, and every event tied to a named user or service account. An investigation timeline depends on both.
- Use cases over volume
- Detection rules built for your threats: privileged account misuse, new administrator accounts, mass data export, disabled security tools, log deletion and logins from unexpected locations. Each rule has an owner and a response playbook.
- Investigation readiness
- Fast searchable storage for recent months and a retrievable archive for the rest of the retention period, with integrity protection so logs hold up as evidence.
- Proof of monitoring
- Alert handling records, triage times and closure notes. Examiners ask how alerts were handled, beyond whether a SIEM exists.
Where IAM, PAM and DevSecOps fit
Two parts of security engineering have their own detailed pages. Here is how they connect to the rest of the stack.
DevSecOps
Security checks and evidence inside the software pipeline, from threat modeling to container scanning. Full detail sits on our DevSecOps implementation page.
How they connect
Identity events and PAM sessions feed the SIEM. Pipeline findings feed vulnerability management. EDR and DLP enforce policies that IAM and data classification define.
Handover and operation
A control is finished when your team runs it. Every implementation ends with a structured handover.
Validate in production
Test each control against its requirement with real events: trigger the alert, attempt the blocked action, and confirm the log reaches the SIEM with the right user and timestamp.
Document the build
As-built configuration, baseline deviations, integration diagrams and administrative access for each tool, stored where your team maintains them.
Write runbooks
Step-by-step procedures for daily checks, alert triage, rule changes, agent failures, certificate and key renewal, and upgrades.
Assign ownership
A named owner for each product and each control, with a RACI (responsible, accountable, consulted, informed) matrix covering your team, Limaz and any technology partner.
Train and shadow
Hands-on sessions for operators, then a period where your team runs the tools and Limaz reviews the work.
Measure and keep evidence
Agree operating measures such as EDR coverage, log source health, DMARC enforcement and time to triage, and set up the evidence folders for NCA and SAMA assessments.
Common gaps we find
- A SIEM ingesting large volumes while privileged session, cloud and core application logs are missing.
- EDR on workstations while servers and virtual desktops run legacy antivirus or nothing.
- DMARC published at p=none for years, so spoofed email in your name still reaches customers and staff.
- DLP left in monitor mode indefinitely because the rules were never tuned.
- A WAF in detection mode only, with nobody reviewing its alerts.
- Hardening baselines written once and never checked for drift.
- Clocks out of sync across systems, which breaks investigation timelines.
- Tools owned by a vendor contract instead of a named internal owner.
Focused implementation services
IAM and PAM implementation
Identity lifecycle, access reviews, privileged accounts, and integration.
DevSecOps implementation
Security decisions, checks, and evidence inside software delivery.
Cybersecurity risk management
Prioritize treatment and connect it to accountable owners.
NCA ECC & CCC implementation
Connect technical implementation to applicable NCA controls.
Questions
Security control implementation turns regulatory requirements and risk treatment plans into configured, tested and operating technical controls. It covers integrating security products such as SIEM, EDR, DLP, WAF and email security, hardening platforms against baselines, connecting logs to monitoring, and handing each control to a named owner with runbooks and evidence. The result is a control that passes an NCA or SAMA assessment because it works in production.
Several ECC-2:2024 controls describe capabilities that security products deliver. Control 2-3-3 requires modern malware protection on workstations and servers, and patch management. Control 2-4-3 requires email filtering, protection against advanced persistent threats, MFA for webmail, and SPF, DKIM and DMARC. Control 2-12-3 requires SIEM-based log collection, continuous monitoring and 12-month log retention. Control 2-15-3 requires a web application firewall for external web applications.
NCA ECC-2:2024 control 2-12-3 sets a minimum retention period of 12 months for cybersecurity event logs. The same control requires logs for critical information assets, privileged accounts and remote access, defined SIEM techniques and continuous monitoring. Keep logs searchable and integrity-protected so they support investigations, and extend retention wherever a sector regulation or contract sets a longer period.
Traditional antivirus blocks known malicious files by signature. Endpoint detection and response (EDR) records process, file, network and user activity on each device, detects suspicious behaviour, and lets responders investigate and isolate a machine remotely. NCA ECC control 2-3-3 requires protection from malware and suspicious programs and activities using modern and advanced technologies, which is the capability EDR provides.
Domain-based Message Authentication, Reporting and Conformance (DMARC) tells receiving mail servers what to do with email that fails SPF and DKIM checks for your domain, and sends you reports on who sends mail in your name. NCA ECC control 2-4-3 requires SPF, DKIM and DMARC for the entity's email domains. Move the policy from monitoring (p=none) to quarantine or reject so spoofed email is stopped.
Yes. Limaz starts by assessing the coverage and configuration of the tools you already have, then completes deployment, tunes the rules, integrates each product with identity, logging and your workflows, and hands it over with runbooks and evidence. When a new product is needed, we define the requirements and evaluation criteria first, so the selection follows your controls and architecture.
Discuss your requirements with Limaz
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.