Category Archives: Aanval

Tactical FLEX, Inc. to Host First Webinar in Bi-Monthly Aanval SAS (Situational Awareness System) Webinar Series

Posted on by
Reply

Tactical FLEX, Inc., a global provider of information security, vulnerability, and risk management software solutions, today announced that it will host the first bi-monthly Aanval SAS (Situational Awareness System) webinar series. The webinar series will cover live product demonstrations, product tours, and also feature security industry experts that will discuss topics of great interest to security professionals. Details of upcoming webinars and live demonstrations will be announced shortly.

This month’s webinar scheduled for May 22, 2013 at 12pm EDT is a 15-minute preview that will showcase five powerful Aanval SAS features designed to help organizations and their IT departments expand their security intelligence and network visibility. The five IDS features and offensive tools highlighted are:

» Situational Awareness™
» Offensive Reconnaissance™
» Rogue Host Detection
» False Positive Protection
» Real-time Geolocation Displays

For information and registration, please visit http://www.aanval.com/webinar and http://www.aanval.com/demo.

About Tactical FLEX, Inc.
For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business, and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval® is the industry’s most comprehensive Suricata, Snort, and Syslog Intrusion Detection, Correlation, and Threat Management console on the market. Aanval is designed specifically to scale from small single-sensor installations to global enterprise deployments and can correlate event data and logs from hundreds of vendor products and solutions. Learn more about Aanval SAS (Situational Awareness System) by visiting http://www.aanval.com.

Aanval is also available for download as a free Community edition for testing and evaluation at http://www.aanval.com/download.

Enhancements to Aanval’s Tagging System

Posted on by
Reply

With the release of Aanval v7, Tagging was introduced to allow users to detail and personalize event data. Now, with Aanval SAS (Situational Awareness System), Tagging has taken another large step. 

Tag Multiple Events
While users can still add multiple tags to an event while viewing its details, they can now quickly search and filter events and add multiple tags to multiple events on the new Tag Events display. 

Multiple Views
As an admin, want to know who’s tagging what and how often? Not a problem. You can visit Tag Management and click each available tag to find how often the tag has been used and in which datastores. You can also visit Frequent Tags under the Charts & Graphs option to view what tags have been used most frequently or infrequently. Additional charts help you visually understand tag usage, like pie and bars graphs.

Download Aanval and Use the Tagging System
If you haven’t downloaded Aanval yet, go to our download page to create a free account and download the package. Then head to our wiki for installation guides and our Getting Started guide for the all-new Tagging system!

About Tactical FLEX, Inc.
For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business, and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval® is the industry’s most comprehensive Snort and Syslog Intrusion Detection, Correlation, and Threat Management console on the market. Learn more about Aanval SAS (Situational Awareness System) by visiting http://www.aanval.com.

Intrusion Detection FAQ: What are the Different Types of Front-end GUIs for Snort Intrusion Detection Systems? An Overview of Some Alternative Front-Ends.

Posted on by

There is a myriad of security technology, both open-source and commercial, available for monitoring an organization’s network for intrusions. An important part of an organization’s defense strategy is the ability to detect suspicious activities in order to prevent both internal and external threats as well as identify malicious attacks. Snort is a popular, successful, and the most widely deployed monitoring tool. Snort is a Network Intrusion Prevention System (NIPS) and Network Intrusion Detection System (NIDS) capable of performing packet logging and real-time traffic analyses on IP networks. Snort is also valuable because it can detect attackers and malware as they move through the network. When coupled with a database and a web front-end, users can obtain insights into their network and apply the information to detect attacks and fortify their networks. Snort can be combined with other software to provide a visual representation of intrusion data.

Are you currently researching the different types of front-end GUIs for Snort IDS or looking for an alternative GUI for Snort? In this blog, we will introduce several popular Snort front-end GUIs. 

An Overview of GUIs for Snort IDS

Introduction to ACID
According to Dr. Nikolai Bezroukov, a well-known Senior Internet Security Analyst at BASF Corporation, “The Analysis Console for Intrusion Databases (ACID) is a rather slow PHP-based analysis engine to search and process the database of security events generated by Snort. It is mostly useful as a generic event viewing tool. ACID was written by Roman Danyliw in early 2000 as part of an abandoned in 2003 AIRCERT project at the CERT Coordination Center.” The features of ACID includes alert management, chart and statistics generation, packet viewer and query-builder, and search interface. ACID’s biggest limitation, however, is that it is not scalable beyond several thousand alerts and often produces numerous amounts of false positives. ACID is also very helpful in the analysis of traffic if only used on small- to medium-streams of alerts. As reported by Dr. Bezroukov, these important shortcomings does diminish ACID’s technology value.

Introduction to BASE
BASE is the Basic Analysis and Security Engine that is supported by a group of volunteers. It is an extremely simple web-based Snort console derived from the code from the Analysis Console for Intrusion Databases (ACID) project. This application provides a web front-end to query and analyze the alerts coming from a Snort IDS. BASE searches and processes databases containing security events logged by assorted network monitoring tools such as firewalls and IDS programs. It is written in the PHP programming language and displays information from a database as user-friendly web front-end. According to Snort.org, there were plans for a redesign of BASE, including the database format from which it reads, but Kevin Johnson, the original BASE project manager, has since left the project and turned the project over to new management.

Introduction to Snorby
Snorby is an open source network security monitoring interface scripted in Ruby on Rails. It is a front-end web application for any application that logs events in the Unified2 binary output format. Snorby now supports OpenFPC and integrates with intrusion detection systems like Snort, Suricata, and Sagan. The basic fundamental concept behind Snorby is simplicity. The project goal is to create a free, open source.

Introduction to SGUIL
The Analyst Console for Network Security Monitoring – Sguil is built by network security analysts for network security analysts. Sguil’s main component is an intuitive GUI that provides access to real-time events, session data, and raw packet captures. Sguil facilitates the practice of Network Security Monitoring and event driven analysis. The Sguil client is written in tcl/tk and can be run on any operating system that supports tcl/tk (including Linux, *BSD, Solaris, MacOS, and Win32).

Introduction to Aanval
OpenAanval was originally a very simple web front-end to monitor and browse Snort event data. It was the stand-alone free limited-version of the commercial Aanval console before it was finally integrated in 2005 and is the alternative to ACID as the front-end. Aanval was then publicly released in 2004 and is considered the longest running Snort interface under continuous development on the market today and the industry’s leading web-based GUI for Snort, Suricata, and Syslog intrusion detection, prevention, and correlation. The Aanval console system is specifically designed to scale from small single-sensor installations to global enterprise deployments. Since Aanval’s release in 2004, Aanval has evolved to address the world’s growing network security intrusion detection needs and demands. Over time, there has been an increasing need to keep up with the complexity of security issues, introduction of new security technologies, evolving cyber threats, and the requirements to comply with mandatory regulatory mandates. Equally increasing is the drive for security managers to find a capable Snort front-end GUI that can deliver effective threat management, event correlation, and advanced data analysis reporting. Aanval SAS (Situational Awareness System), the latest version released by Tactical FLEX, Inc. is designed with a unique Situational Awareness engine that provides an in-depth event and architecture analysis of the host network, thus providing crucial network visibility and security intelligence. Aanval SAS is also equipped with a False Positive Protection event validation engine, real-time Live GeoLocation-based displays and powerful offensive tools utilizing Nmap that help shore up defenses and strengthen overall security posture. In addition to commercial Aanval, Aanval also continues to support the Snort community by providing users with a free community version of Aanval that allows full functionality of a single Snort and syslog sensor. Aanval SAS is available for download as a free Community edition for testing and evaluation at http://www.aanval.com/download.

About Tactical FLEX, Inc.
For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business, and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval® is the industry’s most comprehensive Snort and Syslog Intrusion Detection, Correlation, and Threat Management console on the market. Learn more about Aanval SAS (Situational Awareness System) by visiting http://www.aanval.com.

What Can Defenders Do to Strengthen Defenses? Why Situational Awareness is The Great IT Advantage You Can’t Afford to Lack.

Posted on by

Over 6,000 organizations around the globe use Aanval because it provides unparalleled oversights over the networks it protects. In today’s dangerous and evolving cyber battlefield, advanced threats are overpowering traditional security solutions. Additional network visibility and security intelligence are now required to efficiently detect network vulnerabilities and combat the full realm of sophisticated threats facing today’s enterprises. The alarming Verizon Study report that nearly 60% of data breach cases came to light after months or even years after their occurrences. The report also revealed that in 54% of cases, only 2% of those cyber attacks discovered the breach within a matter of hours. Within larger organizations, 39% discovered in months, 27% in days and 24% in weeks. In terms of data exfiltration, 38% of respondents were aware of this in minutes, while 25% were aware within days. More over, the study concluded that the number of breached records increased from 4 million to 174 million in a year, with 97% of them described as “avoidable.” It is pretty clear that cyber criminals are gaining an upper hand when their victims are “situationally unaware” that they have been compromised and further lack the crucial technology to proactively detect and combat cyber attacks. 

A second alarming new study also revealed that many hacked businesses remain unprepared for the next breach. The new Ponemon survey report finds three-fourths of hacked organizations either have had or expect to have a breach that loses them customers and business partners. 66% have, or expect to, suffer “serious” financial consequences in the wake of a breach. Why? Did they not shore up their defenses to hinder attackers or to prepare for the next attack? Not so. More than one-third of organizations hit by data breaches still have no formal plan or process in place to handle the next breach. Moreover, just one-fourth of respondents say that they have the ability to correct the cause of the breach and only 19% have advanced forensics in place to analyze the root cause of an attack. 

How Do You Know If Your Networks Haven’t Already Been Compromised? And, What Can You Do About It? 

Attackers unfortunately have full visibility of your IT environment, so too must you. To  successfully protect your organization, it is vital that you have visibility into all assets, operating systems, services, network behavior, applications, databases, websites, and protocols, as well as potential security threats and vulnerabilities. Organizations must dramatically deepen their knowledge of what is happening right now on their network. Most organizations are not aware when the systems in their networks are connecting to unknown servers and to malicious Websites, and without network visibility, they don’t know what they are up against. Without situational awareness, the overall big picture is missing and the security vulnerability posture cannot be monitored and measured accurately. Overall, it is vital that IT security departments be equipped with the right security solutions so that they can produce actionable information for making accurate decisions on the business operation and defense of the organization. For example, the unique Situational Awareness engine within Aanval provides an in-depth event and architecture analysis of the host network. Our unique Situational Awareness engine allows Security Analysts to quickly identify which specific devices, services, and approximate areas of the network are most at risk and which are more likely to be a problem in the future. Define devices, services, ports, and protocols supported within your network environment and let Aanval SAS help build detailed summaries of your network’s security posture and current risks. 

About Tactical FLEX, Inc.

For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business, and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval® is the industry’s most comprehensive Snort and Syslog Intrusion Detection, Correlation, and Threat Management console on the market. Learn more about Aanval SAS™ by visiting http://www.aanval.com

We invite you to visit our Industry Focus page at http://www.aanval.com/industry to find out how our products and services can aid securing your valuable assets and information.

Aanval® is also available for download as a free Community edition for testing and evaluation at http://www.aanval.com/download. Let Aanval SAS™ turn your security event data into actionable and comprehensive insights.

Cybercrime and Data Breach Weekly News Roundup: April 5-11, 2013

Posted on by

In this week’s breach roundup, read about the latest security incidents reported by organizations in the higher education, healthcare, and government industries.

Hackers Access College Application Records

According to DataBreach Today, “Hackers using an international IP address recently unlawfully accessed an online database containing student admissions records for Kirkwood Community College in Cedar Rapids, Iowa.

The hackers accessed archived admissions records for individuals who applied to take Kirkwood college-credit classes, the college reports. The information spanned from February 2005 to March 13, 2013.

Although the college hasn’t disclosed the number of individuals affected by the March incident, local ABC television affiliate KCRG is reporting 125,000 personal records were compromised in the hacker attack.

Information stored in the records may have included applicant names, birthdates, race, contact information, and Social Security numbers, according to an FAQ on the college’s website. No financial data or academic records, including grades and financial aid information, were stored in the system.

The college is offering affected applicants free identity protection services.”

Source: http://www.databreachtoday.com/college-breach-leads-roundup-a-5671

Hospice Breach Affects More Than 5,000 Patients

Healthcare Informatics reported that “Hospice of Alamance Caswell and LifePath Home Health have notified approximately 5,370 current and past patients, or their next of kin, about a breach of unsecured personal patient protected health information after an incident occurred at their office.”

On Feb. 24th there was a break-in at their main office building in Burlington, N.C., officials said. During the break-in, three laptops were stolen that are used in connection with the provision of care to patients in their own homes. Although the patient database stored on the laptops was fully encrypted to conform to industry standards, the laptops also contained unencrypted e-mails that contained limited patient health information about a small percentage of patients. The laptops have not been recovered at this time.

According to officials, the perpetrators also had access to rooms that contain paper medical and billing records. The police investigation did not reveal any evidence that any record was touched or viewed, and no records were taken. These paper medical records contained personal information, including name, address, phone number, date of birth, Medicare or other health insurance number, prescribed medications, and full or partial Social Security numbers.

Although it does not appear that the files were viewed, Hospice has said there is no way of knowing whether the files were actually viewed. As of this date Hospice has not received any indication that the information has been accessed or used by an unauthorized individual.

“Hospice of Alamance Caswell understands the importance of safeguarding our patients’ personal information and takes that responsibility very seriously,” Peter Barcus, executive director, said in a statement. “We will do all we can to work with our patients or their loved ones whose personal information may have been compromised and help them work through the process. We sincerely regret that this incident has occurred, and we are committed to prevent future such occurrences. We appreciate our patients’ and families’ support during this time.”

Source: http://www.healthcare-informatics.com/news-item/hospice-breach-affects-more-5000-patients

Medical Records of 2k Patients Left Unprotected on Contractor’s Server

SC Magazine disclosed that “thousands of patients of a New York state hospital had their medical records exposed when they were left unprotected on a third-party server for several months.”

How many victims? More than 2,300.

What type of personal information? Medical records, including handwritten doctors’ notes that typically include diagnoses, test results, and emergency department records.

What happened? On Thursday, Glens Falls Hospital announced that an outside contractor, which stores medical records for the hospital, left the data of patients on an unprotected server between November and mid-March. A forensic audit led hospital officials to learn of the breach.

What was the response? Notifications were sent to victims. In addition, the hospital set up a call center for patients with inquiries.

Details: Auditors concluded that some patient records may have been accessed or downloaded by intruders. A hospital spokeswoman said Social Security numbers, addresses, and financial information were not on the unsecured server.

On March 14th the server was taken offline and, since discovering the incident, the hospital fired the contractor, Portal Healthcare Solutions.

Quote: “There’s no way to tell how the records were accessed, or even if any actually were,” Darlene Raynsford, a Glens Falls Hospital spokeswoman, said.

Source: www.poststar.com, The Post-Star, “Glens Falls Hospital alerts patients of possible information breach,”

Laptop Stolen From S.C. Medical Center Contains Data on 7k Veterans

According to SC Magazine “A Department of Veterans Affairs (VA) laptop containing the sensitive data of several thousand patients was stolen in South Carolina.”

How many victims? 7,405.

What type of personal information? Names, birth dates, and partial Social Security numbers.

What happened? The VA sent notification letters to affected patients last week, after discovering the laptop was stolen in February. The theft occurred at the respiratory therapy department of the William Jennings Bryan Dorn VA Medical Center in Columbia, S.C.

What was the response? The VA is offering one year of free credit monitoring to affected patients and has directed individuals with questions to call Lisa Boxton, the Dorn VA privacy officer.

Details: Law enforcement has begun a criminal investigation, though VA officials believe no patient information has been misused. Since the incident, the hospital has secured all laptops that are connected to medical devices.

Quote: “Any time a veteran’s personal information may be compromised, we take the matter very seriously,” said Rebecca Wiley, the medical center director. “We are reaching out to each veteran who may have been impacted.”

Source: www.wistv.com, WIS News 10, “Dorn VA warns patients of possible security breach,”

About Tactical FLEX, Inc.

For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval® is the industry’s most comprehensive Snort and Syslog Intrusion Detection, Correlation, and Threat Management console on the market. Aanval supports both Snort and Suricata, as well as virtually any Syslog data source, and is designed specifically to scale from small single-sensor installations to global enterprise deployments.

We invite you to visit our Industry Focus page at http://www.aanval.com/industry to find out how our products and services can aid securing your valuable assets and information.

Learn more about Aanval SAS™ by visiting http://www.aanval.com. Aanval® is also available for download as a free Community edition for testing and evaluation at http://www.aanval.com/download.

Ten Things You May Not Know About Aanval IDS Console

Posted on by

#1 Aanval was publicly released in 2004 and is considered the longest running Snort interface under continuous development on the market today and the industry’s leading Snort, Suricata, and Syslog Intrusion Detection, Correlation, and Threat Management console. There are three key contributing factors to Aanval’s popularity and global success: situational awareness, false-positive reducing event validation, and multiple source event collection, correlation, and archiving. Learn more about Aanval at http://www.aanval.com.

#2 Aanval currently protects more than 6,000 customers within every industry worldwide including government security, defense organizations, technology corporations, financial services organizations, educational institutions, healthcare providers, biotechnology manufacturers, energy companies, law firms, and many others. View who’s using Aanval at http://www.aanval.com/customers.

#3 Aanval is an enterprise grade IDS solution created for all business sizes and has the unique technological capability to automatically scale to meet the needs of its environment. Aanval is built to scale from small single-sensor installations to global enterprise deployments.

#4 A major focus of Aanval is performance and scalability. Aanval is built with an accelerated real-time event processing system that handles as many as 1,500 events per second and scales beautifully with hardware to process as many as 5,000 events per second. Supporting millions and billions of Snort, Suricata, and Syslog events is fully automated and continues as long as storage space is available. Aanval is further designed to correlate event data and logs from hundreds of vendor products and solutions including Snort, Suricata, Cisco, Barracuda Networks, Sourcefire, and Apple.

#5 Aanval is uniquely and completely written in standard HTML and Javascript, and more importantly void of Adobe Flash. The completely re-written codebase enables Aanval to work in every browser and across every mobile platform.

#6 While many organizations continue to struggle to achieve network visibility, Aanval SAS (Situational Awareness System), the latest version of Aanval, is armed with a one-of-a-kind situational awareness engine that provides an in-depth event and architecture analysis of the host network. Aanval can quickly build detailed summaries of the network’s security posture and current risks as well as provide Security Analysts with the resources they need to identify actual risks and make critical decisions. Delivering actionable security intelligence from an organization’s circumstances and conditions is the pure essence of Aanval’s true situational awareness.

#7 Aanval SAS is also the combination of the most advanced IDS features coupled with powerful offensive tools to shore up defenses such as Network Host Scanner, Rogue Host Detection, and Offensive Reconnaissance that take full advantage of Nmap, the industry’s most well-known and accomplished port scanning utility to perform both automated and on-request network reconnaissance. View product screenshots and details at http://www.aanval.com/aanval.

#8 Aanval continues to support both the information security and open source Snort and Suricata communities by providing users with a free non-commercial version of Aanval that allows full functionality of a single-sensor device. Aanval is designed to work with all versions of Snort and Suricata. Aanval may be downloaded for testing and evaluation at http://www.aanval.com/download.

#9 Commercial Aanval is unlimited for the number of sensors (Snort, Suricata, or Syslog sensors) and also includes telephone and remote support for the product, and console maintenance. With annual unlimited sensor capacity, organizations of all network sizes are no longer limited by sensor cost and can now monitor every aspect of their environment. Explore Aanval SAS Product Comparison Matrix by visiting http://www.aanval.com/aanval.

#10 Aanval Appliances are pre-configured, turn-key deployments of Aanval designed for organizations that need a drop-in solution or possibly have little or no IDS/IPS experience. Aanval Appliances can be configured in an array of configuration options that include Aanval, Snort, Suricata, Nessus, Nmap, Metasploit, and just about any other popular security tool and system. Learn more about Aanval Appliances at http://www.aanval.com/appliances.

Cybercrime and Data Breach Weekly News Roundup

Posted on by

In this week’s breach roundup, read about the latest incidents affecting organizations in the higher education, financial, and healthcare sectors. 

University of Connecticut Health Center Reports Incident

According to DataBreach Today, “The University of Connecticut Health Center reports that a former employee inappropriately accessed about 1,400 patient records. Exposed information on those patients included names, addresses, dates of birth and, in some cases, Social Security numbers and health information, according to a notice posted to the hospital’s website. The health center said there’s no evidence that the patient information inappropriately accessed was used for any purpose.

University of Connecticut Health Center requires all employees to undergo training about patient privacy upon hiring and offers continuous training to reinforce the education, according to the notice. As a result of the incident, the health center is evaluating all its education and monitoring efforts. Affected individuals are being offered free credit monitoring services, along with insurance coverage, for two years.”

Source: http://www.databreachtoday.com/celebrity-breach-leads-roundup-a-5608

DDoS: 6 Banks Hit on Same Day

BankInfo Security reported that “six leading U.S. banking institutions were hit by distributed-denial-of-service attacks on March 12, the largest number of institutions to be targeted in a single day, says security expert Carl Herberger of Radware. 

The attacks are evolving, and the bot behind them, known as Brobot, is growing, he adds. This recent wave of DDoS attacks has proven to be the most disruptive among the campaigns that date back to September, says Herberger, vice president of security for the anti-DDoS solutions provider.” 

“The Brobot has grown, the infection rate has increased, and the encrypted attacks have become more refined,” Herberger says. “As a result, it all is more effective. They’ve clearly gotten better at attacking more institutions at once.”

Radware offers DDoS-mitigation tools to several high-profile clients, including U.S. banking institutions targeted in the recent attacks, Herberger says. As a result, the company has insights about numerous industrial sector attacks as well as online traffic patterns.

Herberger declined to name the institutions affected, citing Radware’s non-disclosure agreements. But according to online traffic patterns collected by Internet and mobile-cloud testing and monitoring firm Keynote Systems Inc., JPMorgan Chase & Co., BB&T and PNC Financial Services Group suffered online outages on March 12. The three banks declined to comment about the attacks or confirm whether they had been targeted this week.

Chase, however, acknowledged an online disruption in a March 12 post to the Chase Twitter feed. The post states: “*ALERT* We continue to work on getting Chase Online back to full speed. In the meantime, pls. use the Chase Mobile app or stop by a branch.” On March 13, the bank came back with this tweet: “We’re sorry it was such a rough day and we really appreciate your patience.”

To view entire news article, visit http://www.bankinfosecurity.com/ddos-6-banks-hit-on-same-day-a-5607

Lost, unencrypted USB thumb drive impacts more than 50k Medicaid providers

SC Magazine disclosed that “a government contractor in charge of building North Carolina’s Medicaid billing system lost a USB thumb drive containing the personal information of thousands of Medicaid providers nationwide.” 

How many victims? 1,182 North Carolina providers were affected, but the personal information of more than 50,000 providers nationwide was compromised.

What type of personal information? Provider data included full names, Social Security numbers, addresses, and dates of birth. No patient information was included.

What happened? A USB thumb drive containing the sensitive data belonging to the North Carolina Department of Health and Human Services was lost by an employee of Falls Church, Va.-based CSC (Computer Sciences Corporation) while it was being delivered between facilities.

What was the response? CSC was told by the state department to perform an outside review of its security. The company said that affected providers would be notified this week.

Details: According to a CSC spokesperson, the employee who misplaced the thumb drive worked on the new Medicaid billing system and is currently on administrative leave. An investigation is currently taking place into the matter. CSC has set up a dedicated hotline where providers can reach out with any inquiries.

Quote: “I have instructed CSC that North Carolina expects an independent third-party assessment to assure CSC’s adherence to required security standards,” Aldona Wos, DHHS secretary, said in a statement.

Source: www.wral.com, WRAL TV, “Medicaid contractor loses provider’s personal information,” March 8, 2013.

Source: http://www.scmagazine.com/lost-unencrypted-usb-thumb-drive-impacts-more-than-50k-medicaid-providers/article/284000/

About Tactical FLEX, Inc.

For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business, and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval® is the industry’s most comprehensive Snort and Syslog Intrusion Detection, Correlation, and Threat Management console on the market. Aanval supports both Snort and Suricata, as well as virtually any Syslog data source, and is designed specifically to scale from small single-sensor installations to global enterprise deployments. 

We invite you to visit our Industry Focus page at http://www.aanval.com/industry to find out how our products and services can aid securing your valuable assets and information. 

Learn more about Aanval SAS™ by visiting http://www.aanval.com. Aanval® is also available for download as a free Community edition for testing and evaluation at http://www.aanval.com/download.

Could a Managed Service Provider be Right for Your Organization? How to Choose a Managed Services Provider for Your Network Operations Center (NOC).

Posted on by

For most organizations and businesses, 80% of IT resources are dedicated to managing the tedious time consuming tasks of operations. Maintenance, troubleshooting networks, fixing outages, reacting to downtime, upgrading software, patching and dealing with bugs, and hardware and technological issues are consuming IT departments. How often does your IT dept. have to put aside critical projects to put out fires? Are you able to track the amount of time your IT dept. has spent on managing your network operations center (NOC)? What is your organization doing to curb costly infrastructure investments? How are you managing your IT resource deficiency?

Best Practices Criteria for Evaluating an MSP


Managed Service is becoming an area that IT departments worldwide are quickly exploring. Although outsourcing IT services can save money, time, and contribute to your overall bottom line, IT departments can’t take this decision lightly. It’s important to note that an MSP’s failures can also present substantial risks for an organization including potential data loss, privacy breach, and lost revenues. MSPs overall relieve IT departments of many significant but costly responsibilities. Managed services typically include advanced monitoring, enhanced security, data storage, and industry-leading technical expertise. That’s why taking the time to thoroughly research and investigate prospective providers is such a worthwhile investment. While evaluating an MSP vendor as a technology partner, you will likely find a wide variety of providers to consider. How do you evaluate these providers and their service offerings to make the best match? Here are four key things to consider.

1. Proven Experience, Track Record, and Security Operations Capabilities

The last thing your organization needs is to have an MSP that’s inexperienced or is trying to be all things to all people. You need an MSP that has a direct and proven experience in the IT services you’ve decided to outsource. If your network is being monitored by the MSP Network Operations Center (NOC), does the MSP have their own (NOC) or do they outsource it? Does their service agreement align with your business requirements? It is important that the services outlined by the prospective MSP are a good fit for the IT service you are looking to outsource and the provider is equipped to deliver on their commitments. Are their remote support in-house employees of the vendor you are engaging or are they outsourced contractors? Would there be enough oversight of the support centers to guarantee that your network is being monitored and maintained responsibly? Unavailable or hap hazard service can negatively affect your organization’s profitability and impact on the operation of your network.

To work with an MSP and enjoy value in a favorable, long-term relationship, long-term viability is critical. A key to a long-term viability is a track record. How long has the MSP been in business and what does their customer base look like? If the MSP has made it through the past 5-10 years, they must be doing something right.

2. Service Offerings

It is also important to gauge the MSP’s sophistication in technology, security infrastructure, and performance in the industry. MSPs should be looking ahead to find new technological developments to ensure that the potential impact of those new technologies are being considered for their organization as well as clients. Is the vendor’s NOC facility utilizing state-of-the-art technology? Without a properly deployed, current-technology NOC, it is likely that businesses and organizations are spending more than necessary and are getting less security than they should.

All MSPs should be leveraging a suite of applications to deliver services to their clients. In order to effectively manage and monitor an NOC, managed service providers need to select a capable network management software, reporting software, and notification software. Security experts believe that SIEM technology, with its ability to automate log monitoring, correlation, pattern recognition, alerting, and forensic investigations has emerged as a central nervous system for gathering, generating, and optimizing IT intelligence. Utilizing a SIEM can help an NOC control, respond to, and prevent threats impacting their environment around the clock. A SIEM can also provide valuable operational efficiency in any organization, especially with large enterprises. Global Security Magazine stated that “SIEM can provide the security leap-frog in a world of point solution–to ensure there are no blind spots in your network security architecture. The SIEM system also was designed to be the single ‘console’ in which the administrator would get both total situational and context-awareness.” How do you know if your MSP is really earning your business? This comes through automated and customized reporting. A good offering includes detailed monthly reports about service provided, maintenance completed, and the total security posture and health of your network.

3. Certified Professions, Support Assistance, and Guaranteed Response Time


Success truly is about the people managing, monitoring, and maintaining your network. How much assistance does the MSP offer? It is essential to identify the staff members or people who will be your account manager and technical support. Who will be your day-to-day contacts? What is their experience and approach to communication? Will the NOC be monitored by experienced and certified network security analysts to ensure your data and infrastructures are secure and protected? Make sure that you are not left with junior team members still learning.

Guaranteed response time and unlimited support around-the-clock is also a must to any MSP service offerings. How quickly will the MSP respond during regular hours, after-hours, on weekends, and on holidays? Most managed services packages include support provided by email, web, phone, and remote access, but it’s crucial to note that most MSPs do not run a night and weekend shift. 


4. Honesty and Clarity in Services Provided. With Whom do They Partner?

Obtaining honesty and clarity in terms of services provided can give valuable and crucial insights on the MSP before moving forward with any service level agreements or contracts. These agreements should guarantee overall network uptime and response resolution times for network issues. Do the provider’s claims sound too good to be true? Are they well-defined? Is the MSP upfront on the services that are included in the overall service cost and what are one-time expenses? What will the MSP handle and what are their obligations regarding service level agreements? Does the MSP outsource part of their operations to a third party or external provider? Will they outsource any parts of your network infrastructure to other third-party providers? It is critical that the MSP is clear about accountability and commitments regarding potential issues that may surface involving multiple parties. It is also recommended that organizations ask probing questions regarding the MSP external partners, where they are located, and how long they have been working together.

Conclusion

Selecting the best MSP technology partner for your organization can be a substantial task. There are many providers from which to select and different capabilities, services, and support models to evaluate. Asking the right questions can give you the best odds of selecting an MSP that will help your organization and more importantly save you time, money, and aggravation. The strength of an MSP overall is determined by the skill, industry expertise, and information security knowledge of its staff members, especially those who have designed the NOC and manage the network services. This has led many leading organizations to turn to Tactical FLEX, Inc. to help bridge the gap between IT resource deficiency and to build a successful defense against today’s evolving cyber threats. Tactical FLEX, Inc. has been building information security, vulnerability, and risk management solutions since 2003 and can effectively manage, maintain, and monitor your Network Operations Center (NOC) around the clock while keeping up with the latest security threats and meeting privacy and security regulations. Protecting, monitoring, and assisting over 6,000 customers worldwide, Tactical FLEX, Inc. believes that security is not a one-time purchased product but a process that is continually changing as technology evolves. For nearly a decade, Tactical FLEX, Inc. has been developing products and services that evolve in parallel with industry and general technology advancements.

Through our state-of-the-art Network Security Operations Center (NSOC) managed service offering, we do the following for our customers:

1. Reduce operating expenses and infrastructure costs.

2. Accelerate detection of security threats, risks, and vulnerabilities around the clock, thereby improving security posture.

3. Focus on the core business.

4. Produce a robust SIEM infrastructure and eliminate investment to grow operational skills to manage SIEM technology.

Our NSOC managed services provide customers with the following:

1. Proactive support, with real time 24/7 monitoring and management.

2. Keeping network systems up to date with the latest revisions, patches, upgrades, and information security technology, thereby minimizing downtime.

3. The capability to reduce staff, operational costs, and complexity in your IT infrastructure.

4. Ensuring more stable, reliable, and secure business processes.

5. Delivering enhanced actionable intelligence on how your available IT resources can be most efficiently implemented and deployed.

6. Delivering greater options for advancing strategic IT initiatives, by eliminating tedious operational tasks that often consume available technology resources.

For more information on Tactical FLEX, Inc. NSOC Management and Monitoring Services and NSOC Development Lab, please visit http://www.aanval.com/nsoc.

About Tactical FLEX, Inc.

For nearly a decade, Tactical FLEX, Inc. has taken great pride in providing best-of-breed security solutions to every type of organization around the world. Our wide spectrum of customers demonstrates our sincere commitment to an industry that remains at the forefront of the digital evolution of the world. Information security is our business, and our customers are our greatest asset. Tactical FLEX, Inc. is a trusted security vendor protecting more than 6,000 organizations within every industry in more than 100 countries. Our product Aanval ® is the industry’s most comprehensive end-to-end SIEM-based Snort and Suricata IDS solution, built with a unique Situational Awareness engine, distinct false-positive protection technology, and a fully-integrated event management and attack data correlation engine. Learn more about Aanval SAS™ by visiting http://www.aanval.com.

We invite you to visit our Industry Focus page at http://www.aanval.com/industry to find out how our products and services can aid securing your valuable assets and information. The Industry Focus website section was created to provide information security professionals a more expansive perspective on the security needs and challenges facing their industries. Every organization, regardless of specific industry, is facing similar and ever-increasing network and inter-network related security threats. Our products and services are designed not only for the important facets of the industries shown below, but for every organization with a network or internet connection.

Aanval® is also available for download as a free Community edition for testing and evaluation at http://www.aanval.com/download. Let Aanval SAS™ turn your security event data into actionable and comprehensive insights.

Aanval SAS Training from Tactical FLEX, Inc.

Posted on by

Tactical FLEX, Inc. has been shaping the information security world since 2003 and understands how complex not only the threat management tools available but using them can be. Aanval SAS is a solid, robust, and fully-featured SIEM, and not only does understanding its capabilities enhance the user experience, but the user’s security posture and situational awareness also enhances.

Tactical FLEX, Inc. offers on-site and remote training courses for Aanval SAS. Instructor-lead and user-driven sessions optimally occur on the user’s newly installed Aanval SAS console, so that as features and tools are discussed, installed, and configured in detail, users have the opportunity to build and implement their custom IDS system.

Detailed training materials are additionally provided for future reference.

To ensure you’re getting the most out of your Aanval SAS console, those completely new and those long-time users now upgrading to Aanval SAS, contact your sales advisor or the sales or support department directly to schedule your team’s training sessions. We want you to feel not only comfortable but confident in your purchase and ability to tackle network threats with Aanval SAS’ quiver of defensive and offensive tools.

Contact Tactical FLEX, Inc.

The Challenge of Building and Improving on a Network Operations Center (NOC).

Posted on by

“Why Outsourcing to a Capable Managed Service Provider is the Only Cost Efficient Short-Cut”

Organizations spend significantly to set up information security controls for their business infrastructure. Aside from the the evolving threat environment calling for 24/7 monitoring capabilities, organizations are also going to great distances to stay competitive by keeping their systems running 24-hours a day, 365 days a year. As a result, the day-to-day maintenance of computer networks and systems grow ever more complex as well as unmanageable, and organizations have recognized the importance of building an NOC as a central control facility for network management. According to Infosectoday.com, by offering a real-time survey of an organization’s current security status an NOC gives businesses a powerful tool not only for controlling, responding to, and preventing threats impacting their environment, but also for reducing risk, avoiding costly downtime while protecting brand and reputation. In this blog, we will explore the challenges of building an NOC and improving on an existing NOC when organizations are cutting infrastructure costs to save funding. The biggest drawback in building a 24/7 NOC are cost factors, as it requires a substantial financial investment to build, manage, and maintain. Not all organizations have the resources, time, expertise, or financial backing to build and staff a dedicated NOC. Depending on the size of your infrastructure, this could cost organizations anywhere from tens of thousands to hundreds of thousands of dollars to set up and maintain an around-the-clock managed solution.

Here are some important cost factors to consider:

1. Before implementing an NOC, organizations need time to create a comprehensive plan dealing with NOC design: processes, workflows, written policies, threat management procedures, as well as determining a building a location site that is safe and secure. Planning disaster recovery operations is also a requirement involving security executives, IT departments, and upper management. There are many difficult planning and projects involved to make a successful NOC.
2. Purchase of data center technology with expensive hardware, computer servers, and various network equipment.
3. Organizations needs to select network management software, reporting software, and notification software for managing your network. This is where an investment in a SIEM tool to collect, store, and analyze an enormous amount of log data makes an impact.
4. Organizations would need to staff highly skilled IT analysts that understand the latest development of threats, technological developments, and be able to monitor and manage a 24/7 NOC. Since NOC is operational around-the-clock, staffing is frequently one of the most challenging aspects of building an NOC.
5. Experts such System/Network Administrators would be staffed to keep the network running and modify intrusion detection activities, rules, and managing a development lab. Forensic Experts would also be needed to provide more in-depth analyses.

How can Organizations Build or Upgrade a Successful NOC with Little or No Budget? The Only Short Cut is to Outsource and Work with a Qualified Managed Service Provider.

According to Security Magazine, the business of running an NOC is a difficult one. Who has the time to retain the right people, build comprehensive processes and procedures, and implement a robust Security Event and Information Management (SIEM) infrastructure? Those tasks require time, expertise, and experience. Is there a shortcut? Yes, there is. The only shortcut in establishing a capable NOC is to outsource the monitoring and management to a qualified managed service provider such as Tactical FLEX, Inc. Outsourcing will allow organizations to lower its IT management and infrastructure costs as well as focus on its core business.

Are planning to have an NOC up and running in two months but don’t necessarily care about it running five years from now? It’s important to note that the increasing pace of technology development and the increasing value of new security technology means that NOC design must consider both current and future technology; otherwise, it would cost a lot of time and resources to improve an existing NOC facility.

According to Securityinfowatch.com, if organizations are considering upgrading their NOCs, there are many factors involved including:

1. Primary and Alternate Location
2. Range of Functions
3. Scope of Local, Regional, or Global Monitoring
4. Personnel Size and Equipment
5. Current and Future Technology

In addition, security experts believe that without a properly deployed, current-technology NOC, it is likely that organizations are spending more money than necessary and is getting less security than it should.

Learn how our NSOC can effectively manage your security needs. View our Sept. 2012 Newsletter.

Visit the NSOC at Tactical FLEX, Inc. http://www.aanval.com/nsoc.