{"id":4940,"date":"2024-02-13T11:02:15","date_gmt":"2024-02-13T09:02:15","guid":{"rendered":"https:\/\/it-integrator.ua\/platforms\/tier-2-risk-informed\/"},"modified":"2024-03-12T11:15:39","modified_gmt":"2024-03-12T09:15:39","slug":"tier-2-risk-informed","status":"publish","type":"platforms","link":"https:\/\/it-integrator.ua\/en\/platforms\/tier-2-risk-informed\/","title":{"rendered":"Tier 2: Risk Informed"},"content":{"rendered":"
1. Secure Web Gateway, SWG<\/strong><\/span><\/h6>\n

Purpose:<\/strong><\/span> Filtering user access to the Internet and protection against threats in the WEB:<\/p>\n

    \n
  • built-in categorizer of websites with the possibility of fully automatic configuration of access policies to web resources in the graphical interface<\/li>\n
  • filtering access to websites (blocking malicious and phishing sites, restricting user access in accordance with configured Internet policies)<\/li>\n
  • granular setting of policies and permissions (for example: “Facebook is blocked for everyone, but HR employees are read-only”)<\/li>\n
  • disclosure and analysis of encrypted TLS\/SSL connections<\/li>\n
  • antivirus check “on the fly”<\/li>\n
  • prevention of data leakage (when integrated with DLP) by blocking the uploading of critical data to public file repositories, their transfer via messengers, etc.<\/li>\n
  • monitoring the activity of users accessing the Internet, collecting statistics and analyzing visited websites, monitoring the effectiveness of the use of working time<\/li>\n<\/ul>\n
    2. Secure Mail Gateway, SMG<\/strong><\/span><\/h6>\n

    Purpose:<\/span> <\/strong>The basic mandatory component of most cyber security systems that protects the most vulnerable component of the IT infrastructure to attacks – the mail server:<\/p>\n

      \n
    • blocking 99% of SPAM and phishing (intended to “lure” user credentials, “deliver” malicious attachments)<\/li>\n
    • “disarmament” of potentially harmful emails (removal of active and dangerous content, web links, etc.) with delivery of only safe content to the user<\/li>\n
    • antivirus check “on the fly” by the built-in signature antivirus of all incoming messages<\/li>\n
    • integration with third-party “sandboxes” (sundbox) to analyze all suspicious attachments<\/li>\n
    • data leakage prevention (when integrated with DLP)<\/li>\n<\/ul>\n
      3. Cyber Deception System, CDS<\/strong><\/span><\/h6>\n

      Purpose:<\/span><\/strong> “War is the way of deception” (Sun Tzu):<\/p>\n

        \n
      • creating false “targets” in the IT infrastructure to mask real assets (servers, PCs, network equipment, ATMs, video cameras, printers, logic controllers, etc.)<\/li>\n
      • actively misleading attackers and diverting the vector of their attacks from real assets of the IT infrastructure<\/li>\n
      • accurate detection of threats without any signatures, including malicious “zero-day” code that is not detected by conventional antiviruses<\/li>\n
      • quick detection and investigation of insider activity<\/li>\n
      • early warning of the beginning of a targeted cyber attack (both on the perimeter and in the middle of the network)<\/li>\n<\/ul>\n
        4. <\/strong><\/span>Privilege Access Management, PAM<\/strong><\/span><\/h6>\n

        Purpose:<\/span><\/strong> Construction of secure administration processes, one of the components of the Zero Trust architecture:<\/p>\n

          \n
        • full observation and control over the actions of privileged users (system administrators, contractors, auditors and other users with increased access rights), “video recording” of all administration sessions – SSH, RDP, HTTPS, etc., with the possibility of viewing them and recognizing text and commands<\/li>\n
        • the ability to prevent the execution of commands from the “black list”<\/li>\n
        • detection, tracking and management of service accounts
          \nfully functional implementation of the mechanism for temporarily granting elevated privileges<\/li>\n
        • implementation of the “two hands” rule (access to the system administrator to the server is explicitly confirmed by the security administrator)<\/li>\n
        • exclusion of the possibility to connect to servers “bypassing” the solution by storing and automatically changing administrative passwords to target systems exclusively RAM<\/li>\n
        • a built-in ticketing system for the implementation of a holistic process of managing the administration of target systems<\/li>\n
        • analysis of administrators’ work statistics<\/li>\n<\/ul>\n
          \u00a05. <\/strong>Network Access Control, NAC<\/strong><\/span><\/h6>\n

          Purpose:<\/span><\/strong> Control of access to the corporate network:<\/p>\n

            \n
          • monitoring network connections and blocking unwanted ones based on configurable policies (availability of patches and corrections for the OS, updates for antivirus software, etc.)<\/li>\n
          • automatic change of access rights to corporate resources according to user role, device type, network connection method, etc.<\/li>\n
          • automation of the application of policies for devices in the network, including for personal devices (according to the BYOD concept)<\/li>\n
          • implementation of a self-registration portal for connecting to guest Wi-Fi<\/li>\n<\/ul>\n
            6. Risk based Vulnerability Management, RbVM<\/strong><\/span><\/h6>\n

            Purpose:<\/span><\/strong> The main complex component of building the Vulnerablity Management process:<\/p>\n

              \n
            • identification and inventory of all assets in the corporation. networks and the Internet<\/li>\n
            • accurate identification of known OS and application vulnerabilities<\/li>\n
            • profile monitoring of specific vulnerabilities of WEB applications<\/li>\n
            • visualization of cyber security risks, their level of criticality and growth\/decrease trends over time<\/li>\n
            • comparison of the organization’s risk model with similar companies in the industry (in an impersonal form)<\/li>\n
            • generalization and prioritization of risks, issuance of recommendations on their processing<\/li>\n
            • integration with Help Desk class systems to build a holistic process of eliminating vulnerabilities<\/li>\n
            • ensuring compliance with regulatory requirements and Compliance (for example, PCI DSS)<\/li>\n<\/ul>\n","protected":false},"featured_media":0,"template":"","class_list":["post-4940","platforms","type-platforms","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/platforms\/4940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/platforms"}],"about":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/types\/platforms"}],"wp:attachment":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/media?parent=4940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}