Managed Security Operations

Leakage of sensitive information is a huge risk for organizations, whether due to intentional misuse, leakage, carelessness, inadequate security or theft. In order to prevent loss, the data first needs to be classified, which also facilitates categorizing the data. Based on the data classification, DLP technology can then protect data at rest, in use and in motion over the network.

Scope of Services:

• Data classification workshop
• Define data classification and sensitivity policies
• Automated and manual data classification
• Communicate and develop controls for data prevention
• Implementation of DLP component

SOC forms an essential part of your protection plan and your data protection system that reduces the level of exposure of information systems to both external and internal risks. This service provides designing and implementation of SIEM (implementing SIEM tools on-prem and cloud with multi-tenancy).

Scope of Services:

• Define a strategy – purpose of SOC and business goals
• Implement infrastructure
• Internal and external Intelligence tools (news feeds and vulnerability alerts)
• Monitoring and analytical tools to detect threats
• Configure information models
• Set up Security Incident and Event Management tools (SIEM), Log Management, as well as configuring related features to improve the threat landscape of the infrastructure
• Log collection: Aggregate data from multiple data sources, including applications, the infrastructure combining beats and Logstash
• Log processing: Logs must be normalized to search and analyze the data
• Storage and retention: Index for fast search, retain for forensic and compliance purposes to allow you to process larger volumes of data
• Querying: Custom queries for the data collected, parsed, and indexed
• Dashboards: Wide array of different visualization types and allowing to slice and dice the data as per the requirement
• CIM data models: Configuration information models based on data and business/security logic
• Correlation: Various SIEM correlation rule with Artificial Intelligence and Machine Learning integrated with various threat intelligence sequences of events could indicate anomalies that may suggest security weaknesses or cyber-attack. To determine anomalies
• Incident Management: To handle the problem detection and analyst alert function for Incident identification and incident response
• User behavior analytics: To determine anomalies in user access behaviors

EDR solutions are used for continuous monitoring of suspicious activity and response to advanced threats. Some tools provide a response through analytics that identifies patterns and detect anomalies, such as rare processes, strange or unrecognized connections, or other risky activities flagged based on baseline comparisons. This process can be automated so that anomalies trigger alerts for immediate action or further investigation. This service provides the implementation of EDR solution to cater zero attacks by enabling AI features and automated response and remediation of threats.

Scope of Services:

• Implementation of on-prem threat intelligence and active response server
• Setup pre-configured collectors and templates
• Integration of all security module for intercommunication with all security products with OpenDXL (Data Exchange Layer) and centralized management
• Setup automated response and remediation with EDR components
• Detailed threat workspace to identify potential threats on managed endpoints and respond to them

The main objectives of SOC include making an organization resilient to future attacks; providing effective reporting mechanisms and allowing for timely detection of threats. A successful SOC relies heavily on security professionals who make up the team, such as Computer Security Incident Response Team (CSIRT). This service provides 24X7 operations support for monitoring network traffic, logs, and security events to identify vulnerabilities and prevent breaches.

Scope of Services:

• Onboarding customer devices
• Monitoring and detection
• Identification, correlation, aggregation, retention, scanning, monitoring
• Incident response
• Alerting, incident management, communication
• Threat Intelligence
• Threat hunting, intelligence collection, vulnerability management
• Quality assurance
• Optimization, tuning and maintenance, metrics
• Management of vulnerabilities reported by an automated analysis tool
• Threat Modeling based on behavioral analysis of the data and Threat model engine