Managed Security Operations

Leakage of sensitive information is a huge risk for your organization, whether due to intentional misuse, leakage, carelessness, inadequate security or theft. In order to prevent the loss, the data must first be classified, which also facilitates categorizing the data. Based on the data classification, DLP technology can then protect data at rest, in use and in motion over the network.

Scope of Services:

• Data classification workshop
• Definition of data classification and sensitivity policies
• Automated and manual data classification
• Development of data prevention controls
• Implementation of DLP component

SOC forms an essential part of your protection plan and your data protection system by reducing the exposure of information systems to both external and internal risks. This service provides the design and implementation of SIEM tools and solutions (on-prem and cloud with multi-tenancy).

Scope of Services:

• Define the strategy – purpose of SOC and business goals.
• Implement infrastructure.
• Deploy internal and external Intelligence tools (news feeds and vulnerability alerts).
• Employ monitoring and analytical tools to detect threats.
• Configure information models.
• Set up Security Incident and Event Management tools (SIEM), Log Management; configure related features to improve infrastructure threat landscape.
• Log collection: Aggregate data from multiple data sources, including applications, with infrastructure combining beats and Logstash.
• Log processing: Normalize logs regularly to search and analyze the data.
• Storage and retention: Index for fast search, retain for forensic and compliance purposes to allow processing of large data volumes.
• Querying: Enable custom queries for the data collected, parsed, and indexed.
• Dashboards: Allow slice and dice of the data as per requirements, with wide array of different visualization types.
• CIM data models: Implement Configuration Information Models based on data and business/security logic.
• Correlation: Integrate specific SIEM correlation rules with AI/ML into threat intelligence event sequences to determine if anomalies are security weaknesses or cyber-attacks.
• Incident Management: Handling of the problem detection and analyst alert function for incident identification and incident response.
• User behavior analytics: Determine anomalies in user access behaviors.

EDR solutions are used to continuously monitor suspicious activity and respond to advanced threats. Some response tools use analytics to identify patterns and detect anomalies, such as rare processes, strange or unrecognized connections, or other flagged activities. This process can be automated so that anomalies trigger alerts for immediate action or further investigation.

Scope of Services:

• Implementation of on-prem threat intelligence and active response server
• Setup of pre-configured collectors and templates
• Integration of security module for intercommunication with all security products using OpenDXL (Data Exchange Layer) and centralized management
• Setup of automated response and remediation with EDR components
• Detailed threat workspace provided to identify and respond effectively to potential threats on managed endpoints

The goal of SOC is to make your organization resilient to future attacks; provide effective reporting mechanisms; and ensure timely threat detection. A successful SOC relies heavily on security professionals like those in our Computer Security Incident Response Team (CSIRT). This service provides 24X7 support for monitoring network traffic, logs, and security events to identify vulnerabilities and prevent breaches.

Scope of Services:

• Onboarding customer devices
• Monitoring and detection
• Identification, correlation, aggregation, retention, scanning, monitoring
• Incident response
• Alerting, incident management, communication
• Threat intelligence
• Threat hunting, intelligence collection, vulnerability management
• Quality assurance
• Optimization, tuning and maintenance, metrics
• Management of vulnerabilities reported by an automated analysis tool
• Threat modeling based on behavioral analysis of the data and threat model engine