All Articles

10/13/2016 Newsletters

Log Management Retention Requirements

Automated Event Log Management Solutions are used to facilitate the most difficult job in any compliance process. Regular review and correlation of event data through merging and archiving of events from multiple systems and separation of the most critical 1% of activities from useless 99% of noise. From the compliance perspective, event log management is: Collection (Consolidation), Archiving (Retention), Audit Reporting, and Monitoring (Alerting).

On September 20th, 2016, Digital Edge released an article on Log Management Laws and Regulations. Click here to view a little “Cheat Sheet" on the Event Log Retention Requirements that are mandated by major compliance regulations.

9/20/2016 White Papers

Log Management: Related Laws and Regulations

Log management is an often overlooked function of any IT organization. On one hand it is a very simple thing, however when implemented, you may find yourself overwhelmed in a plethora of details and related problems and can inevitably lead many to just drop the implementation – with the thought – we may not need it, everything is working on its own.

In addition to a great stash of valuable information, visibility, capabilities for additional alerting, predictions, forensic and behavior analysis, log management is one of the areas of control for multiple compliance and regulatory frameworks.

Relevance to Laws and Regulations: There are multiple compliance regulations related to log management. It is the law to log and review.

HIPAA
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) outlines relevant technical and non-technical security standards to ensure individuals’ ePHI, “electronic protected health information”.

 
PCI DSS
The PCI DSS was created to encourage and enhance cardholder data security and facilitate the extensive adoption of consistent data security measures worldwide. This applies to all organizations that store, process, and/or transmit cardholder data.
 
SOX
SOX requires that all publicly traded companies establish and follow a framework of internal controls that support accountability and integrity of the financial reporting process. A vital part of SOX requirements includes the collection, management, and analysis of log data.  
ISO 27001
The ISO 27001 standard is a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving management systems information security (ISMS) within the context of the overall commercial risks of the organization.
FISMA
FISMA requires all federal agencies to document and implement controls for information technology systems that support their operations and assets.


 
GPG 13
HMG organizations are required to follow Protective Monitoring for HMG ICT Systems, based on Communications-Electronic Security Group’s GPG 13 to gain access to UK GCSX, Government Connect Secure Extranet.
 
NERC CIP
NERC has its own framework to protect bulk power systems against cyber security compromises that could result in operational failures or instability.





 
GLBA
GLBA, also known as the Financial Modernization Act of 1999, was enacted to secure protection over customer records and information.






 
201 CMR 17.00
The Massachusetts General Law Chapter 93H regulation 201 CMR 17.00 was established to protect personal information of residents of the Commonwealth of Massachusetts. This regulation applies to all organizations, companies, or persons that own or license personal information about Massachusetts residents.
 
DoDI 8500.2
Since IT environments can generate millions of logs daily, DoDI 8500.2 has recommendations of analyzing and reporting on log data can reduce manual or homegrown remedies that are inadequate and cost prohibitive.  
NIST-CSF
NIST-CSF sets information security standards and guidelines for serious infrastructure as defined within the Executive Order 13636 from the President of the United States of America.
 
NIST 800-53
NIST 800-53 produces information security standards and guidelines for federal information systems.



 
NRC RG 5.71
In the Code of Federal Regulations, Section 73.54, Title 10 it is required that the NRC licensees provide high assurance that digital computer and communication systems and networks are sufficiently protected against cyber-attacks.
NEI 08-09 Rev 6
The NEI developed and published the NEW 08-09 Rev 6 to address many areas surrounding access control, audit and accountability, incident response, and system and information integrity. This is an extension of CFR 73.54.
 

Digital Edge is proud to introduce our new and latest product LogIT. Log Management will allow us to assist our clients uncover the value of something that already exists, but is not visible in their information technology environment's plethora of valuable information. Digital Edge ensures that our clients will get the most out of their application, system, and security logs. Besides collecting and storing logs, LogIT will help expose the full use of logs and machine data for network protection and compliance.

Digital Edge provides enterprise ELK Log Management Solution, cloud based or on premises. We stand out from our competitors for multiple reasons – including that we do not limit retention period and we don't have restrictions for value or speed for log streams. Additionally, we customize dashboards for our clients individual needs and expose our services to clients over VPNs of private cross-connects in data centers that we support. On top of all that, Digital Edge's LogIT can provide an unparalleled solution in today's IT Landscape.

Through sensors, Digital Edge captures all possible information generated in any device, application, and security event. We ensure security by staying alert on any security alert generated by any infrastructure device or application, along with collecting valuable forensic information. LogIT also provides a combination of structured and unstructured search built on our Elasticsearch backend. Unstructured search provides a Google-like experience while our MDI fabric enables contextual search when greater precision is required. Our search builder allows you to easily realize the best of both worlds instantly.

Click the link https://www.digitaledge.net/log-management-assessment-tool/ to assess your log management needs and budget. For further information please feel free to contact us.

 

 

9/6/2016 White Papers

Elastic Infrastructure

Digital Edge’s Log Managed Solutions are delivered as a fully managed cloud service. You only need to point your logs to us and we will:

  • Aggregate and safely store your logs;
  • Give you full visibility into your logs including advanced search and filtering;
  • Alert you on required patterns;
  • Help you to customize this solution and integrate it with your other systems such as Security Information and Event Management system (SEIM), compliance reporting and others.

To see the architecture click here.

8/19/2016 Newsletters

Policies

Digital Edge publishes this policies to make sure everybody get meaningful choices about how and why data is collected and used, and ensuring that you have the information you need to make the choices that are right for you across our products and services.

Digital Edge committed to ISO standards and publishes bridging polciy as well as some other global policies. 

ISO 27001-2013 High Level Information Security Policy

Digital Edge GDPR Policy

 

 

Contact Us

If you have any questions or complaints about our policies, write or call our Compliance Team:

Digital Edge Ventures Inc – Compliance Team
7 Teleport Drive Staten Island New York 10311
Call us: 1-718-370-3352
Email us: compliance@digitaledge.net

8/10/2016 Newsletters

Security Update Cyber Incident Reporting

Digital Edge’s Security Team assists clients with cyber security forensics and often hears the question – “what is the proper way to report to law enforcements?” As a company, we aim to aid our clients in informing them on the right steps to take when dealing with a cyber-incident. There is a growing number of cyber networks that were seriously attacked and this is not a matter to be taken lightly. This is why Digital Edge feels it is important to know the right procedure. These incidents can result in serious consequences with the capability of causing lasting harm. By reporting these incidents, the government can assist them with agencies that can investigate the incident, lessen the consequences, and help avoid these cyber incidents in the future.

Please click here for more information.

If you feel that you need assistance from the Digital Edge Security team, please contact us at support@DIGITALEDGE.NET or open a ticket through Digital Edge web site at https://www.digitaledge.net.

6/20/2016 Newsletters

IMN’s Cloud Service Provider CEO Panel

At The Provider Forum on Data Centers & Cloud Services Infrastructure (East), in Washington DC, on June 9, 2016, Digital Edge’s own, Michael Petrov participated as a panelist for the IMN’s Cloud Service Provider CEO Panel. Michael was proud to be joined by three other top CEO’s in the field, Peter Feldman, CEO of Datagryd, Yan Ness, CEO of Online Tech, and Steven Vincinaza, CEO of Cirrity. This high quality panel was moderated by Kemal Hawa, a Shareholder from Greenberg Traurig, LLP. 

The audience was engaged and excited to hears this panels answers to questions like: 

  • “What are you doing to remain competitive in a market dominated by a few 800 pound gorillas? Are you specializing? Will there continue to be opportunities for mid-market providers? How do you see your business model evolving?”
  • “Is a national scale needed today? How are you building out your ecosystem? What are your growth strategies? Where do you see untapped opportunities? What do you look for in a partner?” 
  • “How are end-user needs/expectations evolving? How are you meeting these? What does it take to stand out from the crowd in Cloud services marketing, sales and delivery today?”
  • “Cyber security and risk management: How are you protecting your clients’ data? How are you managing these costs? What is the future of security in the Cloud?”

This panel was a big success! Great Job Mike!

IMN’s Cloud Service Provider CEO Panel

6/7/2016 Newsletters

Security Update: Was TeamViewer Hacked? Digital Edge Believes it was a Backdoor Dropped by Trojan.MulDrop6.39120

Digital Edge’s Security Team is monitoring the situation with TeamViewer hacking allegations. The news broke last week – some TeamViewer users complained that intruders gained access to their computers through TeamViewer program. 
TeamViewer denied any hacking allegations but shortly following, its service was knocked off by a DDoS attack aiming DNS services, leaving more questions to TeamViewer’s Security Team. 

1. Even though the situation is still not clear, the Digital Edge Security Team sides with security expects blaming a BackDoor Trojan discovered in May of 2016. The signature for the Trojan was added on 05/26/2016. The version of Trojan -  BackDoor.TeamViewer.49 utilizes TeamViewer as its backdoor implementation and is delivered by Trojan.MulDrop6.39120 through Adobe vulnerability. Even though the Trojan is supposed to hide the TeamViewer interface and use its functions in the background, we believe that mutation of the virus (the virus uses advanced hiding techniques) can create an unpredicted effect on the systems with legitimately installed TeamViewer causing effect described by users that reported the compromise. 

Please click here for more details

As a result, we do believe that it is safe to use TeamViewer, unless your system does not have updated antivirus and does not have all latest patches installed. By saying that, the Digital Edge team urges to cautiously use this product, as there is no confirmation from TeamViewer’s Security Team or reputable security companies that our analysis is correct

2. Digital Edge security team has contacted all clients using TeamViewer and discussed preventive measures. 

3. If you are using TeamViewer please click here to see our advice how to verify that your TeamViewer was not hacked. 

If you feel that you need assistance from the Digital Edge Security team please contact Danielle Saladis at dsaladis@DIGITALEDGE.NET

Digital Edge is committed to providing the highest levels of security within all the IT infrastructure environments under its care. In order to achieve this utmost goal for all of our clients, we continuously maintain vigilance both on the productive side of IT as well as on its destructive side. We thus send out news and security bulletins such as this one from time to time to ensure that our clients are informed and educated on any important developments in IT security and are fully aware of what we are doing to ensure that we and our clients are always at the Cutting and at the Digital Edge of technology.

5/26/2016 Newsletters

DE Reviews: Verizon Security Breach Report

Digital Edge reviews Verizon’s 2016 Security Breach Report, this report partners with companies in order to provide the public with critical security information. This Security Breach Report includes the number of security breaches, the types of attaches, as well as successful attacks.

5/19/2016 Case Studies

Digital Edge Case Study: Exchange Infrastructure as a Service

Digital Edge builds Infrastructure as a Service (IaaS) solutions based on our close relationships with our hardware and software manufacturing partners. The IaaS based Exchange infrastructure utilizing Fortinet product stack is outlined in this document.

5/16/2016 White Papers

The Cloud Revolution: What is the Next Step?

Are we done with the cloud revolution? Is the crusade against hardware over? Was getting rid of the hardware from our closets the final goal? Right, the cloud movement started with the goal to free up IT departments from the subject that is universally hated –  hardware related headaches, from renewals, end of lives, end of supports, those sticky VARs, capital investment, to the constant feeling that when you invest capital into your new hardware that you are losing 10-20% of your money’s value right away. This feeling is comparable to the notion of buying a new car and driving out of the dealership – the car is now not worth that same as when you signed the contract, minutes before.