Ethical Hacking

Viruses, Trojans, Spyware and other malware is still one of the biggest threats to IT systems so the mandatory part of the security of any system is the solution for endpoint security or antivirus/antispyware solutions.

The system might be implemented in several levels of protection in a form of a network firewall or UTM device that protects computers from threats that enter via the Internet, but even though it is necessary antivirus/antispyware solution that protects computers from local threats (infecting via USB disk or local area network).

In systems with 10 or more computers it is recommended to use a centralized solution that would allow management with the protection of all computers from a single and massive installation without the need to access each computer individually as well as centralized reports for the security situation of the entire system.
All of this eases detection and solving the problems in case of an outbreak of a virus. In addition, centralized endpoint security solution enables distribution of virus definition from a local server with no need of individual computers to take definitions from the internet, thereby reducing the burden of Internet connection.

Benefits:

• Client equipment protection.
• System protection from threats throughout contaminated client equipment (PC, Laptop, Tablet, Smartphone).

Manufacturers:

Panda Security, Symantec.

Companies suffer data loss not only from malware or theft with intent, but often these losses are due to improper storage of data: lost laptop or USB drive, infected media is used in the company, sensitive data is sent and stored without encryption etc.

Often employees are not aware of the consequences and therefore they do not report such incidents.

Despite such losses of data, companies are often exposed to the risk when employees on their own install software that has been forbidden by corporate policy and for whom the company has no license. An additional challenge for the IT sector is the popularization of "bring your own device" (BYOD) phenomenon and the increasing number of devices where employees store documents, including cloud services and modern communication platforms such as Skype.

All this results in the need for modern principle of C.A.F.E. (Control, Audit, Filter, Encrypt) management of all devices and data paths.

Benefits:

• Customer Equipment Protection
• Access control to data, filtering sensitive information, applications control, encryption, audit, mobile devices management.

Ethical hacking from Certified Ethical Hacker according to the methodology of the institution EC Council. Upon completion of testing the client receives a test report of permeability, which includes complete performed work, identified vulnerabilities and proposed solutions for improving security.

There are two basic types of testing:

1. Internal testing permeability - This testing is focused on the threats and risks that come from inside the company or which are aimed at internal network, system or company employees.
2. External test permeability - Coverage of this testing is targeted at systems that are exposed to the Internet. Because anyone with internet access can practically remotely reach out to these external systems, they include regular evaluation linked to their risk.

Tests for permeability can be performed by using one of the three following methods:

• White Box The test team collaborates with the company's IT sector and has unrestricted access to internal resources or data needed for testing. This is the most complete method even though its conditions are far from reality.
• Gray Box Access to internal resources and data is restricted. Certain employees of the company's IT staff does not have to be introduced for testing in order to verify their response to it. This method is a combination of the other two at the same time is probably the most efficient method.
• Black Box There is no access to internal resources. Only key employees or members of management are introduced for the testing in order to verify entirely the reactions and countermeasures undertaken by the IT sector in the case of attack during testing. This is the most complete but also the most realistic method.

The increased number and complexity of threats from the Internet created a need for control of the complete communication from the local network to the Internet and the Internet to the local network users. Furthermore, a growing number of companies require solutions for the control of deliberate misuse of company resources (p2p communication, social networks, games, etc.) and want to protect their networks from possible access to harmful content (phishing , XSS, SPAM, url-categories).

Using a larger number of mechanisms such as antivirus protection, Web filtering, IPS/IDS and control of the applications, Unified Threat Management (UTM) devices enables secure communication with helpful resources and block all types of communications that are hazardous or unwanted. These solutions are united in a single device: firewall functionality, antivirus, antispyware antispam protection, Intrusion Detection System/Intrusion Prevention System (IDS/IPS), Application Control, Data Leakage Prevention (DLP), VPN access and Web filtering functions.

Lately, more valuable becomes innovative Next-Generation Firewall (NGFW) solutions that Palo Alto Networks have, according to their performance and capabilities they exceed not only UTM appliances but also competitive solutions from other manufacturers.

This is primarily due to the ever unreached visibility and control of applications and content-by user, not just IP address - even to 60Gbps, with no degradation in performance thanks to the unique SP3 (Single-Pass Parallel Processing) architecture. Based on patented App-ID technology, Palo Alto Networks NGFW accurately identify the application independently of port, protocol technique of masking or SSL encryption-and scan the content to prevent threats or expiration information.

Benefits:

• Safe release of applications.
• Safe communications regardless the location of employees (in the company or outside of it).
• Increased employee productivity.

Manufacturers:

Palo Alto Networks, Cyberoam

In IT systems, there are many sources of safety measures and information status. Different devices generate a large amount of logs that are very hard to follow and analyze in real time and it is often possible that some incidents may be notice too late or may not be noticed at all.

Security Information and Event Management (SIEM) solution represent collecting, normalization and automated analysis of security events and logs from various devices in real time.

The logs of all network devices, servers, applications for identity management and access to resources, databases and other services in the system are collected in one place due to processing and generating reports i.e. archiving.

SIEM solution collects logs and analyzes events, taking into consideration their correlations hence it generates automatic alerts and reports in real time. Depending on your situation, it can set up and receive notifications of potentially hazardous events.

On a single console are displayed all the warnings of the entire network, presented and connecting information, generate report i.e. prepared long-term security information provided. The focus is on monitoring and managing user rights and servicing, Name and Network Information Services, monitoring of network activities and changes in the system, revision of logs and management responses to threats.

It is not possible to change or be deleted the archived logs in order to cover some activities.

SIEM functionalities:

• Gathering information from various sources.
• Correlation, testing and analysis of linkage and dependence between the events and incidents.
• Warnings, sending an automated alerts for potentially hazardous events immediately after the analysis of the collected data.
• Presentation overview of significant events through charts, easier identifying non-standard events.
• Verification of alignment with defined standards for Management of security and protection of information (supported standards PCI DSS, SOX, NIST 800-53, DISA STIG, HIPAA, NERC CIP and NRC RG, DODI Defense Cyber security Program).
• Long-term preserving security logs.

Benefits:

• Data protection.
• Protection from malicious or undesirable actions of employees or external partners.
• Harmonization with legal regulations.

Manufacturers:

New Net Technologies (NNT)