Insights & News

Your risk of a cybersecurity breach is increasing every year and when it happens, it can cost a fortune! But you may be relying on old school technologies to protect your business. Building out a fully staffed security operations centre is impossible for smaller or regionally based businesses because of both costs and lack of skilled resources. Some other managed security service providers are super expensive, and only cover a few edge security devices, which is not enough. And beyond that, compliance requirements are getting tougher for every industry!  

To help our customers address these challenges, we have worked with our key partners to develop a comprehensive cybersecurity solution. Our offering provides cybersecurity monitoring for all your critical devices, not just your Security Firewall. We use advanced analytics and correlation to detect threats and generate automated notifications 24 hours a day, 365 days a year. We also have real life, human security analysts reviewing your security data every day for oversight and compliance.

Our solution is completely integrated with our regular support services, right down to integrating directly into our standard ticketing system. And best of all, because we are leveraging modern machine learning technology and automation, our solution is extremely cost effective. In fact, we can monitor all your entire network for less cost than what you could pay a security specialist to support your environment. In short, our solution bridges what we like to call the “cybersecurity gap” … too many threats and compliance requirements, but not enough time, people, or money.  

So how is this service so effective at detecting cybersecurity threats and meeting compliance requirements, all whilst remaining cost effective? We collect data from your entire network and pass through our AI powered platform. Our platform connects to all your critical devices to gather information like manufacturer, model, and each device’s configuration. Then we start collecting all the security logs in real time from every device including your end point security on your company computers. All this data is compressed and fully encrypted before sending to our cloud-based Security Information and Event Management (SIEM).  

Here is an example of some of the device information we collect and store in our SIEM. We know all about the device, even what applications are installed and what Windows services are running on a server. Knowing about all your critical devices, what each does, and how it is configured is incredibly important for accurate correlation and analysis.  

We also use this information to automatically track configuration changes. The intelligence we collect allows us to monitor and report on every change in your network, which can detect unusual cybersecurity activity. And if you are in a regulated industry such as healthcare, retail, or financial services, this change management feature is critical for compliance!  

As the raw security events come into our SIEM, we enhance them with additional information such as geolocation data. Then we automatically compare all the events against our global threat database that we maintain using multiple threat feeds. The powerful analytics engine of our SIEM starts correlating and analysing the events from all your devices to look for anything suspicious. We track user activity, count certain events over time, watch traffic patterns for things like unusual file downloads, and look for hundreds of other things. This advanced behaviour analysis is extremely effective at detecting known, and unknown, cybersecurity threats as well as suspicious anomalies. When any high severity issue is found, a notification is immediately sent to the support team including remediation guidance that tells the support team what they can do to fix the issue. The support team gets instant notification of a problem and the information they need to quickly respond and fix it.  

What about all the issues and suspicious activity that do not generate an automatic notification? Well, that is where our Security Operations Centre (SOC) comes in! Every day, 7 days a week, 365 days a year, our SOC team reviews reports, dashboards, and trend data for all your events. These daily reviews look for hidden threats and other information that a fully automated system just cannot detect. And if you are in a regulated industry, chances are these daily human reviews are required for regulatory compliance. Our service also includes a wealth of reports that can be delivered to you whenever you like.  

As you can see, our service is very comprehensive and highly effective at detecting cybersecurity threats. But you may be asking, “so what and who cares… what does all this mean for my business?” Well, let us go through some examples of how our service addresses real-world issues you are facing today.  

For the first example, let us say one of your employees logs in remotely from your office in China. Wait, you do not have an office in China! Because we know where all your devices are, where your traffic is going, and which locations are acceptable, we can quickly distinguish expected behaviour from a potential threat. For another user example, we automatically detect when a user logs in from 2 different devices or locations at the same time. This can indicate the use of shared accounts, which is never a promising idea. Or worse, it could mean one of your employee’s passwords have been compromised. Another fitting example is if one of your PCs tries to contact a server that is in our global threat database, someone following a fake link for example. This should of course never happen, so a notification to our support team gets generated immediately. How about if someone on the changes the configuration of your Security Firewall without authorisation? Our configuration management feature automatically detects this as well, and we even tell us what has changed.  

Our behaviour-based analytics understands what is normal for your environment. So, if an unusually large amount of data is transferred, or if a file download happens in the middle of the night, we know about it. Our system also understands what each device on your network should be doing and uses that for context. Let us say a server is sending out a couple hundred emails per hour or per day. Well, if it is an email server, it is supposed to send out emails. But if it is your application server, it has possibly been compromised.  

Our system automatically understands the difference between an email server and another server, which helps determine what is normal behaviour, and what is not. This is important because you want to be notified of real cybersecurity threats, not overwhelmed with alerts when there is nothing actually wrong.  

Our cybersecurity solution provides comprehensive monitoring for all your critical devices, not just your Security Firewall. You get advanced analytics and correlation to detect threats and generate automated notifications 24 hours a day, 365 days a year. You have a full SOC team with security analysts reviewing your security data daily to catch hidden threats and meet compliance requirements. You also get a solution that is completely integrated with your current IT (Information Technology) support. All in a package that is extremely cost effective. To learn more about our solution, or cybersecurity topics in general, please visit our website or contact us today.