White Papers
To Do: Check List to Comply with DFS Cybersecurity Law
It is critical for all regulated institutions that have not yet done so to move swiftly and urgently to adopt a cybersecurity program and for all regulated entities to be subject to minimum standards with respect to their programs.
The law will produce large penalties if your company is found not in compliance and Digital Edge’s Solution is here to help avoid those hefty fines.
To Do List:
- Determine if you are regulated; to see how please click here.
- Determine if you are eligible for any of the 5 possible exemptions; to review the exceptions click here.
- If you are eligible for exemption, you must file the Cyber Security Notice of Exception by September 27, 2017.
- Depending on your exemption category, you may still need to build a cyber security system. Click here to see how Digital Edge can help you.
- By August 28, 2017, covered entities must be in compliance.
- February 15, 2018, covered entities must submit first Certification of Compliance.
DFS Compliance – Mandatory Cybersecurity Requirements
On March 1, 2017, the New York State Department of Financial Services’ (DFS) mandatory cybersecurity requirements for financial services entities became effective, with implementation to occur within 180 days (August 28, 2017). Let the Digital Edge Cybersecurity Team keep your business in compliance!
At a high level, the regulation requires that all covered entities:
- Conduct a documented risk assessment
- Establish a risk-based cybersecurity program
- Adopt a written cybersecurity policy
- Designate a qualified CISO
- Implement written third-party cyber risk policies
- Establish a written incident response plan
- Notify the superintendent of DFS of any cybersecurity events
- Submit an annual certification of compliance
It is critical for all regulated institutions that have not yet done so to move swiftly and urgently to adopt a cybersecurity program and for all regulated entities to be subject to minimum standards with respect to their programs. To learn more about this mandatory compliance regulations, please read our most recent whitepaper entitled “DFS Compliance – Mandatory Cybersecurity Regulations”
Digital Edge DFS Cybersecurity Solution
The Digital Edge Cybersecurity Team is well-versed in the DFS regulation. We are ready to help companies mitigate risk and ensure compliance with all aspects of the DFS regulation! Contact us today to further explore how our team can provide your business with an unparalleled cybersecurity solution, with our continued focus on Stability, Security, Efficiency and Compliance.
IT Skills Assessment Platform
In an effort to help organizations to better assess candidates, their level of expertise and knowledge of relevant subjects, Digital Edge and Appcore Solutions (https://appcoresolutions.com/) have designed and built an IT Skills Assessment Platform.
This platform gives organizations the ability to create custom tailored online tests for each job opening. Additionally, this system also allows your organization to invite your candidates to take relevant tests and preview the results.
Currently, Digital Edge utilizes this system to pre-screen candidates before an initial face-to-face meeting. We invite you to take a test drive and share your opinion about the system, its concepts and features.
We invite you to take a test drive and share your opinion about the system, its concepts and features.
Please try the system:
Please click the link below to get more details and access to the system!
Read more about the platform here.
The Benefits of Pen Testing
A huge threat to today’s businesses is hackers. They can manipulate their way into any businesses system and take advantage of any data that is important to the company. This can generally leave long lasting, harmful effects on the business which might even lead to eventual failure of the organization.
Don’t let this happen to you! Digital Edge offers a Penetration test in which our trained and specialized team gets authorized access to “attack” your system. This is done in the form of a real attack using strategies hackers usually use. Digital Edge uses standard licensed security assessments and penetration tools, as well as their own proprietary techniques, black hat reconnaissance and exploitation methods. The purpose of this test is to expose any and all vulnerabilities in your system that can potentially hurt your business, so they can be fixed. Pen tests provide the precautionary measures needed to be taken to ensure there be no breach in your system. They ensure the safety of your data by allowing you to be ready to prevent future attacks.
Due to rapid technological advances, Pen tests should be done regularly to catch any vulnerabilities that pop up before it’s too late. Read more about how Digital Edge’s Penetration test can be beneficial to your company!
Log Management: Related Laws and Regulations
Log management is an often overlooked function of any IT organization. On one hand it is a very simple thing, however when implemented, you may find yourself overwhelmed in a plethora of details and related problems and can inevitably lead many to just drop the implementation – with the thought – we may not need it, everything is working on its own.
In addition to a great stash of valuable information, visibility, capabilities for additional alerting, predictions, forensic and behavior analysis, log management is one of the areas of control for multiple compliance and regulatory frameworks.
Relevance to Laws and Regulations: There are multiple compliance regulations related to log management. It is the law to log and review.
Digital Edge is proud to introduce our new and latest product LogIT. Log Management will allow us to assist our clients uncover the value of something that already exists, but is not visible in their information technology environment's plethora of valuable information. Digital Edge ensures that our clients will get the most out of their application, system, and security logs. Besides collecting and storing logs, LogIT will help expose the full use of logs and machine data for network protection and compliance.
Digital Edge provides enterprise ELK Log Management Solution, cloud based or on premises. We stand out from our competitors for multiple reasons – including that we do not limit retention period and we don't have restrictions for value or speed for log streams. Additionally, we customize dashboards for our clients individual needs and expose our services to clients over VPNs of private cross-connects in data centers that we support. On top of all that, Digital Edge's LogIT can provide an unparalleled solution in today's IT Landscape.
Through sensors, Digital Edge captures all possible information generated in any device, application, and security event. We ensure security by staying alert on any security alert generated by any infrastructure device or application, along with collecting valuable forensic information. LogIT also provides a combination of structured and unstructured search built on our Elasticsearch backend. Unstructured search provides a Google-like experience while our MDI fabric enables contextual search when greater precision is required. Our search builder allows you to easily realize the best of both worlds instantly.
Click the link https://www.digitaledge.net/log-management-assessment-tool/ to assess your log management needs and budget. For further information please feel free to contact us.
Elastic Infrastructure
Digital Edge’s Log Managed Solutions are delivered as a fully managed cloud service. You only need to point your logs to us and we will:
- Aggregate and safely store your logs;
- Give you full visibility into your logs including advanced search and filtering;
- Alert you on required patterns;
- Help you to customize this solution and integrate it with your other systems such as Security Information and Event Management system (SEIM), compliance reporting and others.
To see the architecture click here.
The Cloud Revolution: What is the Next Step?
Are we done with the cloud revolution? Is the crusade against hardware over? Was getting rid of the hardware from our closets the final goal? Right, the cloud movement started with the goal to free up IT departments from the subject that is universally hated – hardware related headaches, from renewals, end of lives, end of supports, those sticky VARs, capital investment, to the constant feeling that when you invest capital into your new hardware that you are losing 10-20% of your money’s value right away. This feeling is comparable to the notion of buying a new car and driving out of the dealership – the car is now not worth that same as when you signed the contract, minutes before.
Cyber Security Attack Vectors and Classification
Digital Edge has decided to simply classified types of attacks, so that when we discuss tools and vectors we will refer this document.
1. Frontal Assault
1.a - Code Tampering: This type of attacks are conducted from outside of a client's, by probing open ports and trying to force the code behind those ports to do unwanted actions, allowing hackers either remote execution, illegal upload with further execution, or system crash.
1.b - Brute Force: An attacker uses techniques that are trying multiple combinations of passwords and keys trying to pick correct combination.
1.c - Denial Attack: When an attacker creates either a large number of requests or specifically crafted requests or both at the same time to cause a client's system to stop responding.
1.d - Floods: An attacker creates large amount of traffic, produced by hacker's controlled infected machines - "bots or zombies" to simply overflow capacities of the client networks or their ISPs.
2. Internal Assaults
2.a - Browser Scripting Attacks: During this attack, a hacker is convincing a user to go to a malicious website. Such website has a java or other scripting code that cause client's browser to perform unwanted actions, infect the computer, download unwanted software, etc.
2.b - Email Attacks: During this attack, a hacker tricks a user to open an attachment that has a code that causes the opening program such as MS Office, Adobe PDF viewer, etc. to perform unwanted actions, such as infect the computer, download unwanted software etc.
2.c - Removable Media Attacks: This attack is conducted through an infected removable media. A USB memory card may have a malicious software that is executed when the storage is attached to the client's computer.
2.d - BOYD Device Attack: A hacker would be able to infect client's personal desktop or personal phone and wait for when the user will bring it to the office. The infected "own" device can spread infection inside the local network.
In the future, the Digital Edge Security Team will publish Security Solutions Reviews which will always refer to this classification, specifying which security challenge the solution is supposed to solve.
When Does Colocation Become Competitive With The Public Cloud?
Digital Edge received this White Paper from Plexxi, written by Plexxi in a partnership with Colovore, King Star Computer, and Piston. We feel that this white paper has great importance to the IT community as there is a current misconception of the cost savings of the cloud is “as high as ever”.
Digital Edge has reached out to Plexxi to permit us to re-publish this White Paper, however have not yet received any feedback. If we are requested to do so, we will remove it from our White Paper section.
This white paper is completely aligned with Digital Edge’s view on TCO and ROI. Additionally, this paper explains latest news from Apple, that the company is planning to build their own datacenters, thus leaving AWS with a few billion dollar gap in AWS’s yearly gross sales.