Filter page

Products

DDoS protection

Enterprise-class DDoS protection and Web Application Firewall.

Zenedge

Zenedge

Features

24X7 SOC

Advanced BOT identification capabilities

More than 30 POPs worldwide

Description

Enterprise-class DDoS protection and Web Application Firewall.

Specification

Cloud based, Network Layers 3,4,7.

Can do website vulnerability assessments, have template for presenting results.

Download as PDF

Web Gateway

McAfee Web Gateway delivers comprehensive security for all aspects of web traffic in one high-performance appliance software architecture.

McAfee

McAfee

Features

  • Common criteria EAL2+ and FIPS 140-2 Level 2 certified
  • Available in multiple hardware models and as a virtual machine supporting VMware and Microsoft Hyper-V
  • Integrated with complementary Intel® Security solutions including McAfee Advanced Threat Defense and McAfee Threat Intelligence Exchange
  • Rated number one anti-malware in a secure web gateway (AV-TEST)

Description

McAfee Web Gateway delivers comprehensive security for all aspects of web traffic in one high-performance appliance software architecture. For user-initiated web requests, McAfee Web Gateway  first enforces an organization’s Internet use policy. For all allowed traffic, it then uses local and global techniques to analyze the nature and intent of all content and active code entering the network via the requested web pages, providing immediate protection against malware and other hidden threats. And, unlike basic packet inspection techniques, McAfee Web Gateway can examine SSL traffic to provide in-depth protection against malicious code or control applications that have been hidden through encryption.

Links

Data Sheet 

Solution Brief 

Product Guide 

Best practices 

Case Study

ExpertCenter 

Review

Download as PDF

Threat Intelligence Exchange (TIE)  

McAfee® Threat Intelligence Exchange enables adaptive threat detection and response by operationalizing intelligence across your endpoint, gateway, network, and data center security solutions in real time.

McAfee

McAfee

Features

Adaptive threat protection closes the gap from encounter to containment for advanced targeted attacks from days, weeks, and months down to milliseconds.

Collaborative threat intelligence is built out of global intelligence data sources combined with local threat intelligence gathering.

You get immediate visibility into the presence of advanced targeted attacks in your organization.

Relevant security intelligence is shared in real time among endpoint, gateway, network, and data center security solutions.

You are empowered to make decisions on never-before-seen files, based on endpoint context (file, process, and environmental attributes) blended with collective threat intelligence.

Integration is simplified through the McAfee Data Exchange Layer. Implementation and operational costs are reduced by connecting together Intel Security and non-Intel Security security solutions to operationalize your threat intelligence in real time.

Description

McAfee® Threat Intelligence Exchange enables adaptive threat detection and response by operationalizing intelligence across your endpoint, gateway, network, and data center security solutions in real time. Combining imported global threat information with locally collected intelligence and sharing it instantly, allows your security solutions to operate as one, exchanging and acting on shared intelligence. McAfee Threat Intelligence Exchange narrows the gap from encounter to containment from days, weeks, and months down to milliseconds.

Specifications

McAfee Threat Intelligence Exchange consists of the following components:

  • McAfee Threat Intelligence Exchange Server 1.2.0
  • McAfee Data Exchange Layer Client 1.1.0
  • McAfee Threat Intelligence Exchange Module 1.0.1 for VirusScan Enterprise

Additional requirements for McAfee Threat Intelligence Exchange include:

McAfee Endpoint Protection

  • McAfee VirusScan Enterprise 8.8, Patch 4 with Hotfix 929019, Patch 5
  • McAfee Endpoint Security 10.1 or later

McAfee Security Management

  • McAfee ePolicy Orchestrator 5.1.1

Virtualization Infrastructure

  • VMWare vSphere 5.1.0 with ESXi 5.1 or later

Links

Data Sheet

Solution Brief 

Product Guide 1.3.0

Bank Case Study  

ExpertCenter  

Product Home Page

POC Guide

Download as PDF

Network Security Platform (NSP)

McAfee® Network Security Platform is a uniquely intelligent security solution that discovers and blocks sophisticated threats in the network.

McAfee

McAfee

Features

Unparalleled Advanced Threat prevention

  • Signature-less, advanced malware analysis
  • Inline Browser and JavaScript emulation
  • Advanced botnet and malware callback detection
  • Behavior-based analysis and DDoS protection
  • Integration with McAfee Advanced Threat Defense

Security Connected

  • Real-time threat sharing with McAfee Threat Intelligence Exchange (TIE)
  • Endpoint context via ePolicy Orchestrator® (McAfee ePO™)
  • Endpoint process correlation via Endpoint Intelligence Agent
  • Data Sharing and Quarantine with McAfee Enterprise Security Manager (SIEM)
  • Host Risk Analysis via McAfee Vulnerability Manager
  • Predictive malware detection via McAfee GTI

Description

McAfee® Network Security Platform is a uniquely intelligent security solution that discovers and blocks sophisticated threats in the network. Using advanced detection and emulation techniques, it moves beyond mere pattern matching to defend against stealthy attacks with extreme accuracy. This next-generation hardware platform scales to speeds of more than 40 GBPS with a single device to meet the needs of demanding networks. The Security Connected approach to security management streamlines security operations by combining real-time McAfee Global Threat Intelligence (McAfee GTI) feeds with rich contextual data about users, devices, and applications for fast, accurate response to network-borne attacks.

Links

Data Sheet

Solution Brief

Product Guide 

Administration Guide 

Case Study

Download as PDF

Active Response

Bolster your defenses beyond foundational endpoint protection with endpoint threat detection and response.

McAfee

McAfee

Description

Designed to monitor, control and alert when endpoints are compromised.

An endpoint detection and response tool for advanced threats.

Bolster your defenses beyond foundational endpoint protection with endpoint threat detection and response. McAfee Active Response is a leading innovation in finding and responding to advanced threats. As a key part of an integrated security architecture, it offers continuous visibility and powerful insights into your endpoints, so you can identify breaches faster and gain more control over the threat defense lifecycle. McAfee Active Response gives you the tools you need to correct security issues faster in the way that makes the most sense for your business. Key features include:

Collectors: Find and visualize data from systems.

Triggers and persistent collectors: Continuously monitor critical events or state change with one set of instructions.

Reactions: Get pre-configured and customizable actions when triggered, so you can target and eliminate threats.

Centralized management with McAfee ePolicy Orchestrator: Use a single console for comprehensive security management and automation.

Specification

Supported client operating systems

  • CentOS 6.5, 32-bit
  • RedHat 6.5, 32-bit
  • Microsoft Windows
    • Windows 8.0, Base, 32-bit, and 64-bit
    • Windows 8.1, Base, U1; 32-bit and 64-bit
    • Windows 2012, Server Base, R2; U1; 64-bit
    • Windows 2008 R2 Enterprise, SP1, 64-bit
    • Windows 2008 R2 Standard, SP1, 64-bit
    • Windows 7 Enterprise, up to SP1; 32-bit and 64-bit
    • Windows 7 Professional, up to SP1; 32-bit and 64-bit

 

Links

Data Sheet
Solution Brief
Product Guide
ExpertCenter

Download as PDF

Next Gen Intrusion Detection & Protection System (IDS / IPS)

Detect and Prevent Advanced Targeted Attacks

eSentire

eSentire

Features

  • Always-On Full-Packet Capture
  • Whitelisted Executables
  • Endpoint Lock-Down/Quarantine
  • Automatic Signature-based Intrusion Detection and Prevention
  • IP Range Blocking (Geo-location blacklisting)
  • Whitelisting, Blacklisting and Custom Rules
  • Zero Network Latency
  • Decrypted SSL Traffic Analysis

Description

Detect and Prevent Advanced Targeted Attacks

Mid-sized organizations now represent 54%(1) of all cybersecurity breaches and what’s troubling is that you might not even be aware that you’re a prime target. These attacks are becoming more sophisticated and much harder to detect. Yet traditional cybersecurity technologies haven’t evolved at the same pace and as a result, fail to effectively protect you from today’s sophisticated attacks.

Now more than ever, your organization needs protection against more than just signature-based attacks. It needs holistic protection that’s also capable of defending against zero-day targeted attacks and advanced persistent threats (APTs). Network Interceptor protects against both known and unknown threats.

At the core of the Managed Detection and Response™ service is Network Interceptor, a next-gen IDS/IPS designed for mid-sized enterprise. It fuses robust threat intel to deliver real-time signature-based threat detection and prevention, while introducing the unique ability to identify unknown cyber threats through behaviour-based anomaly detection and attack pattern analysis.

With always-on full traffic capture, our team of highly skilled threat analysts get the full picture they need to hunt, investigate, identify and escalate unique threats in real-time, always. Completely customizable to your specific business context and policies, Network Interceptor is redefining cyber protection for mid-sized organizations in the face of today’s constantly evolving cyber threat landscape.

Links

Datasheet

Download as PDF

Firewall / Next Generation Firewall

Check Point provides customers of all sizes with the latest data and network security protection in an integrated next generation firewall platform, reducing complexity and lowering the total cost of ownership.

Checkpoint

Checkpoint

Features

  • Comprehensive Threat Prevention
  • Prevent Known and Zero Day Threats
  • GAIA – A Unified Secure Operation System
  • Virtualisation
  • Measurement of Security Appliances

Description

Check Point provides customers of all sizes with the latest data and network security protection in an integrated next generation firewall platform, reducing complexity and lowering the total cost of ownership. Whether you need next-generation security for your data centre, enterprise, small business or home office, Check Point has a solution for you.

Links

Check Point Appliances Brochure  
Emerging Security Challenges in Carrier-Class Firewalls
Appliance Comparison Chart
Real-World Performance Testing

Download as PDF

Unified Security Service

Censornet USS enables you to monitor and control Web, Email and Cloud Application use to provide complete security for your organisation from one dashboard.

CensorNet

CensorNet

Features

  • Cloud Application Visibility
  • Cloud Application Control
  • Safe anywhere on any device
  • Safe Web Access
  • Email Security
  • Safe from Malware
  • Analytics across email, web and applications
  • Fast and Unobtrusive

Description

Censornet USS enables you to monitor and control Web, Email and Cloud Application use to provide complete security for your organisation from one dashboard. You can protect your employees, whether in the office or mobile, against cyber-attacks, and accidental or malicious leaks of sensitive data. Keeping your organisation safe from from the risks associated with the rapid growth in cloud applications, and the emergence of Shadow IT. USS is a comprehensive cyber security service that combines modules for the security, monitoring and control of web, email and cloud application across your network in one dashboard and logging service, meaning that common policies can be easily applied and incidents tracked across different media. USS provides the security and control of an on-premise or end point component with the flexibility and mobility of a cloud service. It is the next generation in Email and Web security with Cloud Application Control giving you the power to extend web access policies to Bring Your Own Device initiatives and to monitor and control Shadow IT.

Specification

  • Software for Networks
  • Available as a downloadable software, CensorNet’s Cloud Gateway software can be deployed on a virtual server or physical server in less than 30 minutes to extend security policies to the entire network
  • Agent Software for Roaming Users or Standalone Devices
  • Microsoft Windows agent that enforces policies on the device. Tamper proof and simple to deploy either with an install wizard or scripted via Active Directory Group Policy. Mac OS X version will be available soon.
  • Secure Browser for iOS
  • A secure browser app for iOS6 and above provides an alternative to Safari which extends the web access controls to the mobile device
  • Scalable
  • Highly optimised for large networks, the solution takes advantage of multiple processors, all available RAM and has a 64-bit architecture
  • Deployment Modes
  • Agent software, Direct proxy (set by group policy, WPAD or manually), or gateway mode for guest, BYOD or non-domain devices
  • WPAD Support
  • Automatic creation of Web Proxy Automatic Discovery (WPAD) file based on network configuration
  • BYOD Captive Portal
  • The Captive Portal allows existing users or guests to adopt BYOD and log in from those devices with valid user credentials e.g. Active Directory
Download as PDF

Advanced Threat Protection

Designed to work with other products, a central system to verify files.

McAfee

McAfee

Features

  • User interactive mode: Enables analysts to interact directly with malware samples.
  • Extensive unpacking capabilities: Reduces investigation time from days to minutes.
  • Full logic path: Enables deeper sample analysis by forcing execution of additional logic paths that remain dormant in typical sandbox environments.
  • Sample submission to multiple virtual environments: Speeds investigation by determining which environment variables are needed for file execution.
  • Detailed reports from disassembly output to graphical function call diagrams and embedded or dropped file information: Provides critical information for analyst investigation.

Description

Designed to work with other products, a central system to verify files. Works with: McAfee Active Response, McAfee Application Control, McAfee Enterprise Security Manager, McAfee ePolicy Orchestrator software, McAfee Network Security Platform, McAfee Threat Intelligence Exchange, McAfee Web Gateway McAfee Advanced Threat Defense protects against advanced malware, including zero-day and advanced persistent threats, providing the strongest advanced threat protection available. Advanced targeted attacks are designed to defeat security systems through approaches that either confuse or evade defenses. McAfee Advanced Threat Defense detects targeted attacks and connects with existing defenses, converting threat intelligence into immediate action and protection. Unlike traditional sandboxes, it provides multiple analysis engines to broaden detection and expose evasive threats. As part of the Security Connected platform, McAfee Advanced Threat Defense is tightly integrated with other Intel Security solutions—from network to endpoint—enabling instant sharing of threat intelligence across the entire infrastructure to enhance zero-day threat protection, reduce time from detection to containment, and aid investigation to remediate post-attack.

Specification

ATD-3000 – 30 VMs, Form factor 1U Rack-Mount ATD-6000 – 60 VMs, Form factor 2U Rack-Mount File/media types supported: PE files, Adobe files, MS Office Suite files, Image files, Archives, Java, Android Application Package Analysis methods: McAfee Anti-Malware, GTI reputation: file/URL/IP, Gateway Anti-Malware (emulation and behavioral analysis), dynamic analysis (sandboxing), static code analysis, custom YARA rules Supported OS: Win 8 (32-bit/64-bit), Win 7 (32-bit/64-bit), Win XP (32-bit/64-bit), Win Server 2003, Win Server 2008 (64-bit); Android All Windows operating system support available in: English, German, Italian, Japanese, and Simplified Chinese.

Links

Data Sheet Solution Brief Product Guide 3.6.2
Best practices to avoid being compromised by file infectors
Best practices to avoid being compromised by Worms
Bank Case Study
ExpertCenter

Download as PDF

Services

Security Monitoring

The transfer, storage, analysis, and elimination of these security logs can, however, become extremely complex and sometimes even unmanageable for organizations. Cognosec’s solutions allow you to easily log data from sources such as operating systems, network devices, applications, and databases.

Cognosec Services

Cognosec Services

Features

Security monitoring is the gathering, analyzing and presenting information from:

  • network and security devices
  • identity and access-management applications
  • vulnerability management and policy-compliance tools
  • operating-system, database and application logs
  • external threat data

Description

The extent of event logging has evolved incredibly over they years and is now used for almost everything from troubleshooting problems to optimizing system and network performance, tracking user actions, and providing vital information for the investigations of malicious activity. Due to the ongoing implementation of new legislation and the vast deployment of networked servers, workstations, and other devices over the last decade, the sheer amount of logging information available has become incredible. The transfer, storage, analysis, and elimination of these security logs can, however, become extremely complex and sometimes even unmanageable for organizations. Cognosec’s solutions allow you to easily log data from sources such as operating systems, network devices, applications, and databases. We ensure that the data is collected, filtered, normalized, and stored centrally in order to facilitate analysis, correlating, reporting, and alerting. Cognosec fully supports the design, implementation, and customization of log management systems to ensure that the desired objectives are still achieved with absolute minimal impact to performance, resulting in the safest and most easily managed systems possible.

Download as PDF

Incident Response, Business Continuity & Forensics

Security Incident and Event Management (SIEM) tools analyze & provide a consolidated view of the overall security posture in the organization.

Cognosec Services

Cognosec Services

Features

We provide a full service offering from consulting, gap analysis, technology choice, architecture & design, implementation and management of:

  • Managed Compliance Services (eg. Monitoring and reporting based on specific PCI-DSS or SOX requirements)
  • On premise SIEM implementations
  • Hybrid SIEM implementations
  • Cloud based SIEM implementations

Description

Security Incident and Event Management (SIEM) tools are used to collect, correlate, aggregate and store security logs from servers, network devices, DLP Systems, security devices, databases and Access Control Systems (any device that can provide a log file with a security context) on a network. They analyze & provide a consolidated view of the overall security posture in the organization. These systems allow security professionals to quickly identify suspected breaches & malware incidents in near real time and to conduct forensic investigations using historical data. SIEM systems can be enormously expensive and require a high level of skill to run. They require constant tuning and maintenance so it makes sense for many businesses to outsource to experts.

Specification

We provide bespoke managed compliance services for customers who are required to monitor and report on the compliancy of their systems, against certain standards and regulations such as PCI, Sarbanes – Oxley, HIPPA, COBIT, ISO, BASEL II, FISMA, GLBA, NERC, but who wish to outsource this function. Examples of these Managed Compliancy Services are:

  • Managed PCI Compliance
  • Managed IPS Reporting Service for Sarbanes – Oxley
  • Penetration Testing for compliance
  • Security Awareness training for compliance
  • Venerability Scanning Services for compliance
  • Gap assessments and configuration analysis of security tool sets
Download as PDF

Gateway Security

In todays connected world, Web & Email Services are critical business tools. Your company has to protect it’s users from multiple internet borne threat vectors at all times on all their devices, from smartphones to laptops and desktop computers.

Cognosec Services

Cognosec Services

Features

We provide a full service offering from consulting, gap analysis, architecture & design, implementation and management of:

  • Hybrid Cloud mail and web gateway services incorporating Cloud application control
  • Integration with Data Loss/Leakage Prevention (DLP) Services
  • Application Aware Content Filtering Capability
  • Advanced Zero Day Threat Detection Capability with Global Threat Intelligence Feeds
  • Enhanced management of Office365 and Gmail (Granular Security Features that appear in our Portal making these platforms safer to use)

Description

In todays connected world, Web & Email Services are critical business tools. Your company has to protect it’s users from multiple internet borne threat vectors at all times on all their devices, from smartphones to laptops and desktop computers. The widespread use of mobile and BYOD platforms has resulted in a vanishing perimeter. Modern web & email gateways have become increasingly complex to configure and manage. They handle huge volumes of digital traffic and need to constantly update their malware, adware, URL reputation services and anti-spam engines. The high adoption of cloud-based email services, like Office365 and Gmail, coupled with an upsurge in mail-borne cyber attacks incorporating ransomware has brought renewed focus to effective web and email security. We provide a thought leadership together with niche services in this domain for any size of business. Hybrid or Cloud-based solutions – seamlessly implemented & managed for you by our Gateway Security Team. This is a subscription service.

Download as PDF

Compliance & SIEM Services

Security Incident and Event Management (SIEM) tools analyze & provide a consolidated view of the overall security posture in the organization.

Cognosec Services

Cognosec Services

Features

We provide a full service offering from consulting, gap analysis, technology choice, architecture & design, implementation and management of:

  • Managed Compliance Services (eg. Monitoring and reporting based on specific PCI-DSS or SOX requirements)
  • On premise SIEM implementations
  • Hybrid SIEM implementations
  • Cloud based SIEM implementations

Description

Security Incident and Event Management (SIEM) tools are used to collect, correlate, aggregate and store security logs from servers, network devices, DLP Systems, security devices, databases and Access Control Systems (any device that can provide a log file with a security context) on a network. They analyze & provide a consolidated view of the overall security posture in the organization. These systems allow security professionals to quickly identify suspected breaches & malware incidents in near real time and to conduct forensic investigations using historical data. SIEM systems can be enormously expensive and require a high level of skill to run. They require constant tuning and maintenance so it makes sense for many businesses to outsource to experts.

Specification

We provide bespoke managed compliance services for customers who are required to monitor and report on the compliancy of their systems, against certain standards and regulations such as PCI, Sarbanes – Oxley, HIPPA, COBIT, ISO, BASEL II, FISMA, GLBA, NERC, but who wish to outsource this function.

Managed Compliancy Services are:

  • Managed PCI Compliance
  • Managed IPS Reporting Service for Sarbanes – Oxley
  • Penetration Testing for compliance
  • Security Awareness training for compliance
  • Venerability Scanning Services for compliance
  • Gap assessments and configuration analysis of security tool sets
Download as PDF

Network Security

Network Security components keep your network safe.

Cognosec Services

Cognosec Services

Features

Network Security refers to the security components which reside at the network layer of the business. The network layer connects the individual computers servers, applications and data storage areas together. Many attacks and interception attempts take place at this level, so it is a critical area to protect. The rapid adoption rate of cloud services and smart apps is becoming increasingly complex to manage, for both businesses and individuals in their own capacity. We provide a full service offering for any size of business from 25 users to 80,000 users, ranging from consulting, gap analysis, architecture & design, implementation and management of:

  • Host-based Intrusion Prevention Services HIPS) – For Servers
  • Perimeter facing and Internal facing Firewalls
  • Web Application Firewall Services
  • Network Access Control (NAC)
  • Network Intrusion Prevention (NIPS) Services

Description

Network Security components keep your network safe and include some or all of the following, depending on your requirements:

Firewalls (FW) – These are network devices that operate like border controls – only allowing the traffic you want to pass in and out of your company.

Web Application Firewalls (WAF) – These are similar to firewalls but designed to protect public websites. They only allow specific web traffic through in either direction to protect sensitive or confidential information often held in databases linked behind the website. WAFs are Essential for eCommerce businesses, who need public facing websites that facilitate payments.

Network Intrusion Prevention Services (NIPS) – protects against malicious hidden processes and hacking using devices on the network. These devices process large volumes of traffic and generate many lines of  log data, which have to be managed properly to deliver proper value.

Network Access Control (NAC) – This technology prevents unauthorized (or “Rogue”) devices from joining your network. When a device does not meet your security policies or standards it should not be able to access your network.

Network Data Loss/Leakage Prevention (NDLP) – is a technology which utilizes policies on a computer that helps prevent sensitive data from being transmitted to the wrong people, both inside and outside the company.

Distributed Denial of Service (DDoS) Services –DDoS attacks have evolved into complex and overwhelming security challenges. The attacks target the transport and network layers of a communication system and flood network interfaces with traffic, causing inability to respond to legitimate traffic. This impacts your ability to conduct business using the network or internet, causing financial loss.

By choosing the correct managed cybersecurity services provider, all technologies can be deployed, configured and managed from a central console, but have to be properly tuned and managed to deliver ROI to the End User.

All reporting, remediation and escalation activities coordinated centrally.

Download as PDF

Data Security

Data Security describes how your business protects it’s Intellectual Property or “Crown Jewels”.

Cognosec Services

Cognosec Services

Features

The service would typically involve full or part-time management of some or all of the following technologies:

  • Antimalware
  • Browser Control
  • Endpoint Encryption
  • Host Based Intrusion Prevention
  • Database Security
  • Host-based Data Loss/Leakage Prevention (DLP)
  • Cloud Application Controls & BYOD

Description

Data Security describes how your business protects it’s Intellectual Property or “Crown Jewels”. Data Security is achieved by combining various technologies at specific points on a network and configuring these to work together according to security best practice. Every company’s network will differ slightly from others, so it is important to architect the solution before implementing it. We provide a full service from consulting, gap analysis, architecture & design, implementation and management.

Specification

Remote Managed Services imply the virtual presence of our people on your premises. Our staff work remotely either as technical consultants or subject matter experts, or may perform specific operational security tasks for your company, depending on your requirements and the type of service you require. Our Remote Managed Cyber Security Service options are:

  • Retainers, where a fixed amount of hours are purchased, bundled with an SLA for a guaranteed response.
  • Full Outsource Where you fully outsource one or more of your security functions to us. We take full responsibility for the function from end to end, (this can include design, implementation, which would take place on site. Once implementation has been completed, we will remotely perform the daily management of the platform and / or the chosen solutions. This would typically include reporting, escalation, troubleshooting and upgrading.
  • Partial Outsource Where you partially outsource one or more of your security functions to us. We take partial responsibility for the function, and this work takes place remotely. This can include aspects of design, implementation,  management of a platform or solution, reporting, escalation, troubleshooting and upgrading.

Our Managed Cyber Security Services can be tailored according to your exact needs and budget. We do not subscribe to a one size fits all approach. We have developed and refined an agile framework which focuses on the successful delivery and implementation of affordable security services to all sectors of the market. Customers who adopt our framework through our managed security services make noticeable progress towards a more mature security posture in very short timeframes. This is borne out in vastly improved coverage, policies, detection rates, correlation, deduplication, escalation processes, analysis, incident response and forensic capability, reporting and visibility.

Download as PDF

Forensics

Cognosec can assist you with your digital forensics investigations. This is the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data.

Cognosec Services

Cognosec Services

Features

The process for performing digital forensics comprises the following basic phases: Collection: identifying, labeling, recording, and acquiring data from the possible sources of relevant data, while following procedures that preserve the integrity of the data. Examination: forensically processing collected data using a combination of automated and manual methods, and assessing and extracting data of particular interest, while preserving the integrity of the data. Analysis: analyzing the results of the examination, using legally justifiable methods and techniques, to derive useful information that addresses the questions that were the impetus for performing the collection and examination. Reporting: reporting the results of the analysis, which may include describing the actions used, explaining how tools and procedures were selected, determining what other actions need to be performed (e.g., forensic examination of additional data sources, securing identified vulnerabilities, improving existing security controls), and providing recommendations for improvement to policies, procedures, tools, and other aspects of the forensic process.

Description

Over the last decade, the number of crimes that involve computers has grown, spurring an increase in companies and products that aim to assist law enforcement in using computer-based evidence to determine the who, what, where, when, and how for crimes. As a result, computer and network forensics has evolved to assure proper presentation of computer crime evidentiary data into court. Forensic tools and techniques are most often thought of in the context of criminal investigations and computer security incident handlingóused to respond to an event by investigating suspect systems, gathering and preserving evidence, reconstructing events, and assessing the current state of an event. Cognosec can assist you with your digital forensics investigations. This is the application of science to the identification, collection, examination, and analysis of data while preserving the integrity of the information and maintaining a strict chain of custody for the data.

Specification

During a forensic investigation Cognosec will identifyi potential data source and acquire the data from the sources. Data acquisition will be performed using a three-step process:

  1. developing a plan to acquire the data
  2. acquiring the data
  3. verifying the integrity of the acquired data

After data has been collected, the next phase is to examine the data, which involves assessing and extracting the relevant pieces of information from the collected data. This phase may also involve bypassing or mitigating OS or application features that obscure data and code, such as data compression, encryption, and access control mechanisms. Once the relevant information has been extracted, Cognosec will study and analyze the data to draw conclusions from it and then prepare and present the information resulting from the analysis phase.

Download as PDF

Incident Response  

Cognosec’s Incident Response solution is an organized approach for responding to the an incident appropriately and managing the aftermath of the security breach.

Cognosec Services

Cognosec Services

Features

Cognosec can assist you with the following steps:

  1. Creating an incident response policy and plan
  2. Developing procedures for performing incident handling and reporting
  3. Setting guidelines for communicating with outside parties regarding incidents
  4. Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
  5. Determining what services the incident response team should provide
  6. Training the incident response team

Description

Combating malicious software and events in your environment isn’t just a matter of implementing the right technological solutions. Effectively combating malicious activities is a solution that combines people, processes, and technology.

Cognosec’s Incident Response solution is an organized approach for responding to the an incident appropriately and managing the aftermath of the security breach. Cognosec’s Incident Response solution will also help establish new defenses, protecting your systems and data from future attacks

Specification

According to the SANS Institute, there are six steps to handling an incident most effectively:

Preparation: The organization educates users and IT staff of the importance of updated security measures and trains them to respond to computer and network security incidents quickly and correctly.

Identification: The response team is activated to decide whether a particular event is, in fact, a security incident. The team may contact the CERT Coordination Center, which tracks Internet security activity and has the most current information on viruses and worms.

Containment: The team determines how far the problem has spread and contains the problem by disconnecting all affected systems and devices to prevent further damage.

Eradication: The team investigates to discover the origin of the incident. The root cause of the problem and all traces of malicious code are removed.

Recovery: Data and software are restored from clean backup files, ensuring that no vulnerabilities remain. Systems are monitored for any sign of weakness or recurrence.

Lessons learned: The team analyzes the incident and how it was handled, making recommendations for better future response and for preventing a recurrence.

Download as PDF

Network Protection

Cognosec’s Network Security service offers tailored defense systems such as Unified Threat Management (UTM) solutions.

Cognosec Services

Cognosec Services

Description

Developing a network with full-fledged security involves the implementation of many elements and need to be performed by experienced teams of specialists. Cognosec’s Network Security service offers tailored defense systems such as Unified Threat Management (UTM) solutions. UTM is the evolution of the traditional firewall and is an all-inclusive security product able to perform multiple security functions within one single appliance such as network firewalling, network intrusion prevention and gateway antivirus (AV), gateway anti-spam, VPN, content filtering, load balancing, and data leakage prevention. The combination of automated scanning and manual search filtering provides you with an extremely efficient and effective way of protecting yourself against even the most pesky attackers.

Specifications

Network protection consists of the policies and practices adopted to prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources.

Download as PDF

Data Protection

We offer complete design, implementation, and customisation support for access-rights management systems and data leakage prevention solutions. This provides valuable information used for detecting unauthorised access events and any possible data leakages

Cognosec Services

Cognosec Services

Features

Cognosec can assist you while implementing the correct architecture to protect your data.

Network DLP

Typically a software or hardware solution that is installed at network egress points near the perimeter. It analyzes network traffic to detect sensitive data that is being sent in violation of information security policies.

Endpoint DLP

Such systems run on end-user workstations or servers in the organization. Like network-based systems, endpoint-based can address internal as well as external communications, and can therefore be used to control information flow between groups or types of users.

Data identification

DLP solutions include a number of techniques for identifying confidential or sensitive information. Sometimes confused with discovery, data identification is a process by which organizations use a DLP technology to determine what to look for (in motion, at rest, or in use).

Data leakage detection

Sometimes a data distributor gives sensitive data to a set of third parties. Some time later, some of the data is found in an unauthorized place (e.g., on the web or on a user’s laptop). The distributor must then investigate if data leaked from one or more of the third parties, or if it was independently gathered by other means.[8]

Data at-rest

“Data at rest”” specifically refers to old archived information that is stored on either a client PC hard drive, on a network storage drive or remote file server, or even data stored on a backup system, such as a tape or CD media. This information is of great concern to businesses and government institutions simply because the longer data is left unused in storage, the more likely it might be retrieved by unauthorized individuals outside the Network.[9] In order to protect this phase of data, systems use methods such as access control and data encryption.[1]

Data in-use

“Data in use” refers to active data stored in databases that the user is currently interacting with. DLP systems that protect data in-use may monitor and flag certain unauthorized activities.

Data in-motion

“Data in motion” is data that is currently traversing through a network to an endpoint destination. These networks can be internal or external. DLP systems that protect data in-motion monitor sensitive data that is being sent over a network through various communication channels such as email or IM

Description

The protection of sensitive data such as passwords, payment information, financial data, or intellectual property needs to a priority for organisations. With the establishment of security regulations such as the PCI DSS, HIPAA, and the EU Data Protection Directive, systems can be brought to a high standard of security, but the sheer number of threats targeting vital systems is dramatically increasing, so efforts towards protecting data should as well. Security breaches resulting in leaked data can become very costly to an organisation and to it’s clients should attackers get ahold of sensitive data. Cognosec can perform an assessment on the IT-infrastructure handling the data and can ensure that your sensitive data is properly managed . We offer complete design, implementation, and customisation support for access-rights management systems and data leakage prevention solutions. This provides valuable information used for detecting unauthorised access events and any possible data leakages

Specifications

The term data protection is used to describe both operational backup of data and disaster recovery/business continuity (BC/DR). A data protection strategy should include data lifecycle management (DLM), a process that automates the movement of critical data to online and offline storage and information lifecycle management (ILM), a comprehensive strategy for valuing, cataloging and protecting information assets from application/user errors, malware/virus attacks, machine failure or facility outages/disruptions.

Download as PDF

Compliance Management     

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance describes the goal that organisations aspire to achieve in their efforts to ensure that they are aware of and take steps to comply with relevant laws and regulations.

Cognosec Services

Cognosec Services

Features

In general, compliance means conforming to a rule, such as a specification, policy, standard or law. Regulatory compliance describes the goal that organisations aspire to achieve in their efforts to ensure that they are aware of and take steps to comply with relevant laws and regulations. Due to the increasing number of regulations and need for operational transparency, organizations are increasingly adopting the use of consolidated and harmonized sets of compliance controls] This approach is used to ensure that all necessary governance requirements can be met without the unnecessary duplication of effort and activity from resources

Description

Cognosec’s extensive experience and expertise in the Governance, Risk, and Compliance (GRC) sector has proven invaluable to countless organizations expecting to meet internal and external requirements in preparation for receiving certification. Cognosec’s independent and objective assessment on the policies and processes fulfills four major roles:

  • Prepares you for the challenging process of certification.
  • Avoids the potentially severe financial loss you may suffer for being incompliant with external regulations
  • Prioritizes the corrective measures in order of maximum efficiency and effectiveness to your business processes.
  • Ensures your regulators, customers, and shareholders that proper due diligence measures have been taken.

Our specialists will work side by side with the compliance, security, and risk officer in the design and improvement of company frameworks, guidelines, and processes.

Download as PDF

Penetration Testing

The overall objective of penetration testing is to provide an independent and reliable view of the security of the internet-facing infrastructure of an IT environment.

Cognosec Services

Cognosec Services

Features

Penetration testing is recommended annually, and in the event of major changes to your infrastructure. It is essential for companies holding intellectual property, information linked to personal identities, or financial information such as credit card data – and is often mandated by regulators. Penetration testing will help:

  • Prevent severe financial losses that could arise due to unreliable infrastructure or fraud
  • Provide the necessary proof of due diligence for regulators, customers, and shareholders
  • Protect the brand from the dreadful loss of reputation

Description

Penetration testing is a crucial element in securing your IT systems. Our team of experts can simulate an attack on multiple levels to determine whether sensitive data is at risk. The overall objective of penetration testing is to provide an independent and reliable view of the security of the internet-facing infrastructure of an IT environment. The assessment identifies weaknesses and vulnerabilities and quantifies the severity thereof – providing the information needed to address and control the threats.

Specifications

Penetration testing is a ‘mock’ or staged attack to identify vulnerabilities in information systems. Our testers, ‘white hat hackers’, put themselves in the position of someone determined to gain access to resources without knowledge of usernames, passwords and other normal means. Like a hacker or cyber criminal, they try every trick in the book, every possible plan of attack. They find the ways applications could be modified, and confidential information such as price lists or customer databases stolen or subverted. They then provide a report – explaining how they ‘broke in’ and how an organisation can avoid it happening ‘for real’.

Download as PDF