Security Operations Center (SOC)

With SIEM (Security Information and Event Management) as a Service, we offer comprehensive, transparent IT security monitoring for your entire IT infrastructure. SIEM captures log and event data generated by applications, security devices and host systems and stores it on a central platform. The software collects data from antivirus solutions, firewall log files and other locations and classifies it into categories, such as malware activity and failed or successful logins. If it detects a threat in the process, it triggers an alert and indicates a threat level according to predefined rules.

With Endpoint Detection & Response as a Service, we detect suspicious or threatening activities on all your endpoints quickly and reliably. All background processes and activities on the devices are monitored: program executions and modifications, registry changes, network connections and the like. As soon as they appear suspicious, we intervene.

The main task of vulnerability management is to check IT systems for known technical vulnerabilities or security gaps. Any vulnerabilities are identified on the basis of a continuously updated list of vulnerabilities. This is based both on the "Common Vulnerabilities & Exposures" database and on notifications published by the manufacturers themselves.

Threat Hunting is the search and detection of IoC in the IT infrastructure of a company. On the one hand, this is triggered by an already existing suspicion of a compromise or signs of an IT security incident, which result in a forensic analysis in the form of threat hunting. On the other hand, threat hunting is dedicated to the active search for ongoing attacks or preparatory threatening activities that have already been able to overcome existing defenses and security controls.

During a penetration test, the tester acts like a potential attacker. He uses the same tools, information sources and tries to bypass the implemented security measures unnoticed. For example, temporary vulnerabilities or structural problems of networks, hardware and software are revealed. In contrast to a real attack, the type as well as the scope of the tests are coordinated with the responsible persons beforehand and during the execution. In addition to documenting the procedure, a comprehensive report evaluates the current security level and makes suggestions for improvement.

The Cybersecurity Assessment is used to determine the maturity level of an organisation's cyber security based on the Center of Internet Security (CIS) Critical Security Controls. The CIS Critical Security Controls represent the most respected standard for effective cyber defense. They provide specific and actionable ways to stop today's most widespread and dangerous cyberattacks. The CIS Critical Security Controls do not attempt to replace comprehensive standards such as ISO 27001/27002, BSI IT-Grundschutz or the NIST Cybersecurity Framework. A key advantage of the CIS Controls is that they are derived from the most common attack patterns and enable rapid identification of the necessary next steps.