Consulting Services

Our Customer relationship has as a pillar the training: promoting users behaviors by creating habits, routines and processes to ensure that the information is really protected. Our Consulting Services allow digital security to be the result of implementing Computer Security and Behavioral Training solutions for people.

Our business

Physical Security

Environment that involves the company and all existing infrastructure, to control the flow of information between the outside world and the company.

Social engineering

Implement behaviors and solutions to prevent people from performing operations or tasks they would not normally do to a stranger.

Web Applications

Application security systems in Web applications, deposited in the company or outside.

Operating Systems

Auditing and configuring operating systems to make them safe.

Physical Security

Company Layout.

In tiny companies, physical layout issues may not be a problem. However, risk factors such as building size, employees number, entries number, servers location or confidential information must be taken into account in the absence of information leakage.

Access Control.

Access control to several company sites is critical to ensure that only certain employees with the correct privileges have access to information from their area of responsibility.

Surveillance video.

The visual control of areas belonging to a company is important both on the deterrent level and on the "who" did the "what" and "when", especially in critical and common areas where people who are not members of the company.

Unsafe hardware, laptops, smartphones and tablets.

Network control devices that connect and validate in our network, is very important. There are simple and effective methods and mechanisms so that we do not have unexpected "visits" in our "houses".

Available Information on digital media and its treatment.

It sounds ridiculous, but control over information on paper and digital media is critical to defending a company's information. The existence of safe locations for digital media and the correct destruction of information that no longer interests the company, is imperative for it not to fall into unreliable hands or the company's lack of trust.

Network Segmentation.

Without high added costs we can segment our network, that is, in the same physical network it is possible to create communication areas only for the company's computers, isolated from common areas where computers, smartphones or other network devices are normally connected. customers or suppliers.

Wireless Points.

It is already common ground that no wireless network is unbreakable, not even with the WPA2 protocol. The question is to control the traffic generated by those using our Wireless. This means that, "where" accesses, "what" accesses and "when." We are not talking about simply querying Web pages.

Firewall.

In most small and medium businesses that have Firewall, or only the Router provided by the Internet service provider, these defense mechanisms are set up for attacks coming from outside. However it is known that more than 75% of corporate attacks are done from the inside out. With minimal investment, or only configuration, it is possible to control the traffic and solve most of the possible attacks.

Social engineering

Contact and identification procedures.

Procedures are created and specified so that incoming contacts, external or internal, can be recognized as trustworthy and trustworthy individuals.

Classification of Information and Use Levels.

All existing information in the company should be cataloged and the corresponding access levels created according to the information that each employee should have access to. Prevention is thus created against the possibility of a worker being naive and unduly contributing information that is not within his or her sphere of influence or responsibility.

Web Applications

Configuring applications to increase security.

Web-based applications are very vulnerable to various types of attacks that go beyond validating user accounts. For example, "SQL" injections into form fields, or "XPATH" injections, for sites that use XML file databases.

Replacement of current user / password validation solutions with more robust ones.

The use of passwords can be validated by using attacks with brute-force dictionaries, capturing them by key-logging, or by using "bots" to steal passwords recorded in the computer.

Operating Systems

Vulnerability Detection.

Operating systems are created by programmers, and it is normal that they can not perform all possible vulnerability tests. Knowing this situation, what is normal to happen is that there are small defects that translate into small "holes", where you can inject information via network so that you can take care of the computer, and consequently your information. The goal is to detect and resolve these flaws.

Activation and configuration of security measures, available from the manufacturer.

The correct configuration of operating system security updates is important to address the vulnerabilities that exist during their creation. The control of the application of the security updates is extremely necessary, so as not to have impact in the day-to-day work, as in the verification of the states of application of the same ones.

Implementation of secure communication on the internal network.

The existence of effective security between the company's computers is necessary so that it is not possible to capture the information that travels in our network or between offices. Normally, the operating systems already have the possibility of this type of encryption almost always disabled. This leads to the possibility of the information being captured by a computer that connects to the network without our authorization.

Implementation of periodic safety and control procedures.

Both the operating systems, "Firewall" and other devices connected to the network, record all hits that are successfully and unsuccessfully performed. Periodic monitoring of the two is necessary. The unsuccessful logs are used to determine where the attack was attempted, and to successfully determine if there is a misuse of credentials.

Consulting Services

Our business

Physical Security

Social engineering

Web Applications

Operating Systems

Some of our Clients