Technology implementation

Firewall typically replaces routers and separates external networks from internal ones, which are divided into smaller areas as necessary. It supports security features such as VPN, intrusion prevention system (IPS), anti-DDoS, antispam, antimalware, sandboxing and URL filtering.  

Router serves as the connection point between the enterprise network and the public Internet, but it does not have, in and of itself, sufficient security features.  

Switch allows the devices within the network to be connected by wire and provides security features in combination with third-party systems. Access point provides wireless connectivity within the corporate network. 

Supported vendors – Palo Alto Networks, Fortinet, CISCO, SURICATA, UBIQUITI, FLOWMON 

Devices are secured outside the enterprise network perimeter, while blocking suspicious websites, connections and malicious files, as well as protecting devices when disconnected from the secure enterprise network. 

Supported vendors – CORTEX, ESET, HEIMDAL, SentinelOne 

Restricting the exfiltration of confidential files from an endpoint device, thus preventing accidental or intentional deletion of data. It does not allow selected files to be moved from directories in endpoint devices, while at the same time monitoring network traffic and prohibiting unauthorised sessions. 

Supported vendors – FORCEPOINT, safetica, ENDPOINT PROTECTOR 

Providing security for public corporate websites and services such as enterprise web portals or file sharing servers. The transfer of services from internal to external networks is secured while internal servers and running services are protected against misuse. 

Supported vendors – Modsecurity, f5, umperva 

Network devices such as firewalls, switches and other equipment, e.g. servers, are monitored in terms of availability and performance. Hardware and running services are monitored for the purposes of tracking/comparing historical data and real-time reporting, as well as for sending alerts in the event of failures. 

Supported vendors – ZABBIX 

Collecting information from all end devices, e.g. which network interfaces are running and which users are logged in. This information is then fed into log management, where further analysis can be performed. 

Supported vendors – Wazuh, Beats, Sysmon 

The central node for logs and events from devices. It analyses and correlates events from different networks and sources into a single event. Subsequently, rule-based alerts are generated for further analysis. 

Supported vendors – Splunk, IBM, QRadar, Elastic 

Not all users should have access to all systems. IAM is a single point for user access management and also provides additional features such as multi-factor authentication or SSO. 

Supported vendors – Okta, DUO, JumpCloud 

Identifying the vulnerabilities or misconfigurations that could be exploited by malware or attackers for stealing, encrypting, or destroying enterprise assets. Keeping records of vulnerabilities that have been identified, how attackers can exploit them, and what steps should be taken to remediate them. 

Supported vendors – vScan 

Cyber attack threats, natural disasters, fraud and human errors can put your company’s assets and reputation at risk. Enhance your company’s operational resilience with Governance, Risk Management and Compliance, which is a service that provides support in analysing the risks and gaps, as well as management of compliance with legislation, including implementation management services, by proactively identifying threats and implementing procedures aimed at achieving greater security for your company. 

Supported vendors – SECUREA 

The brain of security operations, which automates the tasks and responses to security incidents. These “decisions” are based on relevant and trusted data collected through the Threat Intelligence service, such as site reputation and hash files. 

Supported vendors – Recorded Future, Palo Alto Networks 

Honeypots are systems with ready-made exploits and fake confidential data that attackers are likely to target. As a result, honeypots can generate internal Threat Intelligence reports on potential attackers and attack vectors, and can also help detect potential security breaches. 

Supported vendors – Cowrie, DIONEA