Intrusion Monitoring

According to CERT, Computer Emergency Response Team, cyber security incidents increased by an average of 85% per year from 2000 to 2003. In 2004, CERT stopped tracking incident reports altogether when they became too commonplace to be meaningful. Today, not only are the new types of vulnerabilities growing by leaps and bounds; the pace at which they strike has accelerated at an alarming rate.

If you have just one computer on the Internet, then network security is an issue for your institution. It is quite common for businesses to put locks on the doors and windows, subscribe to a security service and even install cameras that are used to record all the traffic entering and exiting the building. Unfortunately, this attention to detail is not always paid to the institutions network. Usually a firewall is put into place on the perimeter, much like installing locks on the doors. Sometimes an intrusion detection sensor is put into place in sequence, either before or after the firewall, to monitor traffic into and out of the network, like the security service. The main oversight when implementing an Intrusion Detection or Prevention Sensor is that they are usually neglected after initial installation. Unlike a firewall, intrusion detection and prevention sensors need to be updated and monitored by a trained professional dedicated to that function 24 hours a day, 7 days a week. For most companies, this option is simply not financially feasible.

DataComm pairs a best-of-breed device with best-in-class service. Our proprietary device, securSHIELD, has the ability to monitor activity on multiple network segments with real-time blocking of suspicious activity. DataComm’s Intrusion monitoring service, secuRNOC, uses certified security technicians that interpret the suspicious activity and respond to threats in a customer-specified manner. For as little as $395 a month, our customers can sleep easy knowing that their networks are secured.

DataComm implemented their network operation center in Tampa, Florida in 2000. The network operations center has two distinct parts, the network operations center and the security operations center, each catering to specific client needs. Since security is the service that is being provided to our customers, DataComm’s physical and data security is well structured and tested. The physical building is a cement block structure with two authorized entry points. The security operations center is located in the center of the main building. The room is protected by steel doors and only authorized personnel may enter. Biometric access is required for both entry to the secured facility and to logon to the workstations.

The security operations center is staffed 24x7x365, by trained security technicians. The Security Operations Center has redundant high speed Internet Access, isolated electrical circuits, On-site UPS battery back-up system, On-site gas generator, plus a Fire Detection and suppression system. To further ensure uninterrupted service to our customers, DataComm also supports an Off-Site Disaster Recovery Center at Brunswick Electric Membership Utility in North Carolina. This facility has been built to withstand category five hurricane winds of up to 180 mph. The site also has redundant telephone carriers providing Internet Access. Electricity to the location is backed up with independent generators supplying UPS power to the facility in the event of power failure and all data connections to the building use Optical technology providing total isolation.

Alert, Block then Call. DataComm takes these three simple steps seriously, and uses them to guide our everyday practices. When an attack is detected, our security technicians are alerted. At that point in time, a technician would analyze the attack and the potential severity and act accordingly, either by blocking or monitoring for further malicious activity. When an actual attack is discovered, DataComm would then call the customer and inform them of the attempted breach.

DataComm provides electronic monthly reports that satisfy federal regulatory requirements (GLB, SOX, HIPAA). The reports include an extensive look at your network activity in the raw data logs and a more thorough report of high level alarms and actions taken by DataComm’s security technicians in the incident response logs. The executive overview, also included in the report, minimizes the amount of time required to review the report.