{"global":{"lastError":{},"locale":"en","locales":{"data":[{"id":"de","name":"Deutsch"},{"id":"en","name":"English"}],"loading":false,"error":false},"currency":{"id":49,"name":"EUR"},"currencies":{"data":[{"id":49,"name":"EUR"},{"id":124,"name":"RUB"},{"id":153,"name":"UAH"},{"id":155,"name":"USD"}],"loading":false,"error":false},"translations":{"product":{"reference-bonus":{"en":"Offer a reference bonus","ru":"Предложить бонус за референс","_type":"localeString"},"configurator":{"en":"Сonfigurator","ru":"Конфигуратор","_type":"localeString"},"i-sell-it":{"ru":"I sell it","_type":"localeString","en":"I sell it"},"i-use-it":{"ru":"I use it","_type":"localeString","en":"I use it"},"roi-calculator":{"ru":"ROI-калькулятор","_type":"localeString","en":"ROI-calculator"},"selling":{"_type":"localeString","en":"Selling","ru":"Продают"},"using":{"ru":"Используют","_type":"localeString","en":"Using"},"show-more-button":{"ru":"Показать еще","_type":"localeString","en":"Show more"},"hide-button":{"ru":"Скрыть","_type":"localeString","en":"Hide"},"supplier-popover":{"ru":"поставщик","_type":"localeString","en":"supplier"},"implementation-popover":{"_type":"localeString","en":"deployment","ru":"внедрение"},"manufacturer-popover":{"en":"manufacturer","ru":"производитель","_type":"localeString"},"short-description":{"_type":"localeString","en":"Pitch","ru":"Краткое описание"},"i-use-it-popover":{"_type":"localeString","en":"Make your introduction and get a bonus from ROI4CIO or the supplier.","ru":"Внесите свое внедрение и получите бонус от ROI4CIO или поставщика."},"details":{"en":"Details","ru":"Детальнее","_type":"localeString"},"description":{"ru":"Описание","_type":"localeString","en":"Description"},"product-features":{"ru":"Особенности продукта","_type":"localeString","en":"Product features"},"categories":{"_type":"localeString","en":"Categories","ru":"Категории"},"solutions":{"en":" Problems that solves","ru":"Проблемы которые решает","_type":"localeString"},"values":{"_type":"localeString","en":"Values","ru":"Ценности"},"сomparison-matrix":{"_type":"localeString","en":"Comparison matrix","ru":"Матрица сравнения"},"testing":{"_type":"localeString","en":"Testing","ru":"Тестирование"},"compare":{"ru":"Сравнить с конкурентами","_type":"localeString","en":"Compare with competitors"},"characteristics":{"en":" Characteristics","ru":"Характеристики","_type":"localeString"},"transaction-features":{"ru":"Особенности сделки","_type":"localeString","en":"Transaction Features"},"average-discount":{"ru":"Средняя скидка партнера","_type":"localeString","en":"Partner average discount"},"deal-protection":{"_type":"localeString","en":"Deal protection","ru":"Защита сделки"},"average-deal":{"ru":"Средний размер сделки","_type":"localeString","en":"Average deal size"},"average-time":{"ru":"Средний срок закрытия сделки","_type":"localeString","en":"Average deal closing time"},"login":{"en":"Login","ru":"Войти","_type":"localeString"},"register":{"en":"Register","ru":"Зарегистрироваться","_type":"localeString"},"to-know-more":{"ru":"Чтобы узнать больше","_type":"localeString","en":"To know more"},"scheme":{"_type":"localeString","en":" Scheme of work","ru":"Схема работы"},"competitive-products":{"en":" Competitive products","ru":"Конкурентные продукты","_type":"localeString"},"implementations-with-product":{"ru":"Внедрения с этим продуктом","_type":"localeString","en":"Deployments with this product"},"user-features":{"en":"User features","ru":"Особенности пользователей","_type":"localeString"},"job-roles":{"en":" Roles of Interested Employees","ru":"Роли заинтересованных сотрудников","_type":"localeString"},"organizational-features":{"ru":"Организационные особенности","_type":"localeString","en":"Organizational Features"},"calculate-price":{"en":" Calculate product price","ru":"Рассчитать цену продукта","_type":"localeString"},"selling-stories":{"_type":"localeString","en":" Selling stories","ru":"Продающие истории"},"materials":{"ru":"Материалы","_type":"localeString","en":"Materials"},"about-product":{"en":"About Product","ru":"О продукте","_type":"localeString"},"or":{"_type":"localeString","en":"or","ru":"или"},"program-sends-data":{"en":"Program Sends Data","_type":"localeString"},"calculate-roi":{"ru":"Рассчитать ROI продукта","_type":"localeString","en":"Calculate Product ROI"},"complementary-categories":{"_type":"localeString","en":"Complementary Categories","ru":"Схожие категории"},"program-receives-data":{"en":"Program Receives Data","_type":"localeString"},"rebate":{"ru":"Бонус","_type":"localeString","en":"Bonus"},"rebate-for-poc":{"ru":"Бонус 4 POC","_type":"localeString","en":"Bonus 4 POC"},"configurator-content":{"ru":"Рассчитайте стоимость продукта","_type":"localeString","en":"Calculate price for this product here"},"configurator-link":{"en":"here","ru":"тут","_type":"localeString"},"vendor-popover":{"_type":"localeString","en":"vendor","ru":"производитель"},"user-popover":{"_type":"localeString","en":"user","ru":"пользователь"},"select-for-presentation":{"ru":"выбрать продукт для презентации","_type":"localeString","en":"select product for presentation"},"auth-message":{"en":"You have to register or login.","ru":"Вам нужно зарегистрироваться или войти.","_type":"localeString"},"add-to-comparison":{"ru":"Добавить в сравнение","_type":"localeString","en":"Add to comparison"},"added-to-comparison":{"en":"Added to comparison","ru":"Добавлено в сравнения","_type":"localeString"},"roi-calculator-content":{"en":"Calculate ROI for this product here","ru":"Рассчитайте ROI для данного продукта","_type":"localeString"},"not-yet-converted":{"ru":"Данные модерируются и вскоре будут опубликованы. Попробуйте повторить переход через некоторое время.","_type":"localeString","en":"Data is moderated and will be published soon. Please, try again later."},"videos":{"_type":"localeString","en":"Videos","ru":"Видео"},"vendor-verified":{"_type":"localeString","en":"Vendor verified","ru":"Подтверждено производителем"},"event-schedule":{"ru":"Расписание событий","_type":"localeString","en":"Events schedule"},"scheduling-tip":{"ru":"Выберите удобную дату и время и зарегистрируйтесь на ивент.","_type":"localeString","en":"Please, сhoose a convenient date and time and register for the event."},"register-to-schedule":{"_type":"localeString","en":"To register for the event please log in or register on the site.","ru":"Для того чтобы зарегистрироваться на ивент пожалуйста авторизируйтесь или зарегистрируйтесь на сайт."},"comparison-matrix":{"ru":"Матрица сравнений","_type":"localeString","en":"Comparison matrix"},"compare-with-competitive":{"ru":"Сравнить с конкурентными","_type":"localeString","en":" Compare with competitive"},"avg-deal-closing-unit":{"ru":"месяцев","_type":"localeString","en":"months"},"under-construction":{"_type":"localeString","en":"Current feature is still developing to become even more useful for you.","ru":"Данная услуга всё ещё находится в разработке."},"product-presentation":{"_type":"localeString","en":"Product presentation","ru":"Презентация продукта"},"go-to-comparison-table":{"en":" Go to comparison table","ru":"Перейти к таблице сравнения","_type":"localeString"},"see-product-details":{"ru":"Детали","_type":"localeString","en":"See Details"}},"header":{"help":{"_type":"localeString","en":"Help","de":"Hilfe","ru":"Помощь"},"how":{"en":"How does it works","de":"Wie funktioniert es","ru":"Как это работает","_type":"localeString"},"login":{"ru":"Вход","_type":"localeString","en":"Log in","de":"Einloggen"},"logout":{"ru":"Выйти","_type":"localeString","en":"Sign out"},"faq":{"_type":"localeString","en":"FAQ","de":"FAQ","ru":"FAQ"},"references":{"en":"Requests","de":"References","ru":"Мои запросы","_type":"localeString"},"solutions":{"ru":"Возможности","_type":"localeString","en":"Solutions"},"find-it-product":{"en":"Selection and comparison of IT product","ru":"Подбор и сравнение ИТ продукта","_type":"localeString"},"autoconfigurator":{"ru":"Калькулятор цены","_type":"localeString","en":" Price calculator"},"comparison-matrix":{"en":"Comparison Matrix","ru":"Матрица сравнения","_type":"localeString"},"roi-calculators":{"ru":"ROI калькуляторы","_type":"localeString","en":"ROI calculators"},"b4r":{"ru":"Бонус за референс","_type":"localeString","en":"Bonus for reference"},"business-booster":{"en":"Business boosting","ru":"Развитие бизнеса","_type":"localeString"},"catalogs":{"en":"Catalogs","ru":"Каталоги","_type":"localeString"},"products":{"ru":"Продукты","_type":"localeString","en":"Products"},"implementations":{"ru":"Внедрения","_type":"localeString","en":"Deployments"},"companies":{"ru":"Компании","_type":"localeString","en":"Companies"},"categories":{"en":"Categories","ru":"Категории","_type":"localeString"},"for-suppliers":{"ru":"Поставщикам","_type":"localeString","en":"For suppliers"},"blog":{"en":"Blog","ru":"Блог","_type":"localeString"},"agreements":{"en":"Deals","ru":"Сделки","_type":"localeString"},"my-account":{"_type":"localeString","en":"My account","ru":"Мой кабинет"},"register":{"ru":"Зарегистрироваться","_type":"localeString","en":"Register"},"comparison-deletion":{"ru":"Удаление","_type":"localeString","en":"Deletion"},"comparison-confirm":{"ru":"Подтвердите удаление","_type":"localeString","en":"Are you sure you want to delete"},"search-placeholder":{"en":"Enter your search term","ru":"Введите поисковый запрос","_type":"localeString"},"my-profile":{"en":"My profile","ru":"Мои данные","_type":"localeString"},"about":{"_type":"localeString","en":"About Us"},"it_catalogs":{"_type":"localeString","en":"IT catalogs"},"roi4presenter":{"_type":"localeString","en":"Roi4Presenter"},"roi4webinar":{"_type":"localeString","en":"Pitch Avatar"},"sub_it_catalogs":{"_type":"localeString","en":"Find IT product"},"sub_b4reference":{"_type":"localeString","en":"Get reference from user"},"sub_roi4presenter":{"_type":"localeString","en":"Make online presentations"},"sub_roi4webinar":{"_type":"localeString","en":"Create an avatar for the event"},"catalogs_new":{"en":"Products","_type":"localeString"},"b4reference":{"_type":"localeString","en":"Bonus4Reference"},"it_our_it_catalogs":{"en":"Our IT Catalogs","_type":"localeString"},"it_products":{"en":"Find and compare IT products","_type":"localeString"},"it_implementations":{"_type":"localeString","en":"Learn implementation reviews"},"it_companies":{"_type":"localeString","en":"Find vendor and company-supplier"},"it_categories":{"en":"Explore IT products by category","_type":"localeString"},"it_our_products":{"en":"Our Products","_type":"localeString"},"it_it_catalogs":{"_type":"localeString","en":"IT catalogs"}},"footer":{"copyright":{"ru":"Все права защищены","_type":"localeString","en":"All rights reserved","de":"Alle rechte vorbehalten"},"company":{"ru":"О компании","_type":"localeString","en":"My Company","de":"Über die Firma"},"about":{"ru":"О нас","_type":"localeString","en":"About us","de":"Über uns"},"infocenter":{"_type":"localeString","en":"Infocenter","de":"Infocenter","ru":"Инфоцентр"},"tariffs":{"_type":"localeString","en":"Subscriptions","de":"Tarife","ru":"Тарифы"},"contact":{"ru":"Связаться с нами","_type":"localeString","en":"Contact us","de":"Kontaktiere uns"},"marketplace":{"de":"Marketplace","ru":"Marketplace","_type":"localeString","en":"Marketplace"},"products":{"de":"Produkte","ru":"Продукты","_type":"localeString","en":"Products"},"compare":{"_type":"localeString","en":"Pick and compare","de":"Wähle und vergleiche","ru":"Подобрать и сравнить"},"calculate":{"ru":"Расчитать стоимость","_type":"localeString","en":"Calculate the cost","de":"Kosten berechnen"},"get_bonus":{"ru":"Бонус за референс","_type":"localeString","en":"Bonus for reference","de":"Holen Sie sich einen Rabatt"},"salestools":{"ru":"Salestools","_type":"localeString","en":"Salestools","de":"Salestools"},"automatization":{"de":"Abwicklungsautomatisierung","ru":"Автоматизация расчетов","_type":"localeString","en":"Settlement Automation"},"roi_calcs":{"_type":"localeString","en":"ROI calculators","de":"ROI-Rechner","ru":"ROI калькуляторы"},"matrix":{"en":"Comparison matrix","de":"Vergleichsmatrix","ru":"Матрица сравнения","_type":"localeString"},"b4r":{"ru":"Rebate 4 Reference","_type":"localeString","en":"Rebate 4 Reference","de":"Rebate 4 Reference"},"our_social":{"de":"Unsere sozialen Netzwerke","ru":"Наши социальные сети","_type":"localeString","en":"Our social networks"},"subscribe":{"de":"Melden Sie sich für den Newsletter an","ru":"Подпишитесь на рассылку","_type":"localeString","en":"Subscribe to newsletter"},"subscribe_info":{"ru":"и узнавайте первыми об акциях, новых возможностях и свежих обзорах софта","_type":"localeString","en":"and be the first to know about promotions, new features and recent software reviews"},"policy":{"ru":"Политика конфиденциальности","_type":"localeString","en":"Privacy Policy"},"user_agreement":{"ru":"Пользовательское соглашение ","_type":"localeString","en":"Agreement"},"solutions":{"_type":"localeString","en":"Solutions","ru":"Возможности"},"find":{"en":"Selection and comparison of IT product","ru":"Подбор и сравнение ИТ продукта","_type":"localeString"},"quote":{"ru":"Калькулятор цены","_type":"localeString","en":"Price calculator"},"boosting":{"_type":"localeString","en":"Business boosting","ru":"Развитие бизнеса"},"4vendors":{"ru":"поставщикам","_type":"localeString","en":"4 vendors"},"blog":{"ru":"блог","_type":"localeString","en":"blog"},"pay4content":{"ru":"платим за контент","_type":"localeString","en":"we pay for content"},"categories":{"en":"categories","ru":"категории","_type":"localeString"},"showForm":{"_type":"localeString","en":"Show form","ru":"Показать форму"},"subscribe__title":{"ru":"Раз в месяц мы отправляем дайджест актуальных новостей ИТ мира!","_type":"localeString","en":"We send a digest of actual news from the IT world once in a month!"},"subscribe__email-label":{"_type":"localeString","en":"Email","ru":"Email"},"subscribe__name-label":{"ru":"Имя","_type":"localeString","en":"Name"},"subscribe__required-message":{"ru":"Это поле обязательное","_type":"localeString","en":"This field is required"},"subscribe__notify-label":{"ru":"Да, пожалуйста уведомляйте меня о новостях, событиях и предложениях","_type":"localeString","en":"Yes, please, notify me about news, events and propositions"},"subscribe__agree-label":{"en":"By subscribing to the newsletter, you agree to the %TERMS% and %POLICY% and agree to the use of cookies and the transfer of your personal data","ru":"Подписываясь на рассылку, вы соглашаетесь с %TERMS% и %POLICY% и даете согласие на использование файлов cookie и передачу своих персональных данных*","_type":"localeString"},"subscribe__submit-label":{"en":"Subscribe","ru":"Подписаться","_type":"localeString"},"subscribe__email-message":{"ru":"Пожалуйста, введите корректный адрес электронной почты","_type":"localeString","en":"Please, enter the valid email"},"subscribe__email-placeholder":{"_type":"localeString","en":"username@gmail.com","ru":"username@gmail.com"},"subscribe__name-placeholder":{"ru":"Имя Фамилия","_type":"localeString","en":"Last, first name"},"subscribe__success":{"ru":"Вы успешно подписаны на рассылку. Проверьте свой почтовый ящик.","_type":"localeString","en":"You are successfully subscribed! Check you mailbox."},"subscribe__error":{"ru":"Не удалось оформить подписку. Пожалуйста, попробуйте позднее.","_type":"localeString","en":"Subscription is unsuccessful. Please, try again later."},"roi4presenter":{"_type":"localeString","en":"Roi4Presenter","de":"roi4presenter","ru":"roi4presenter"},"it_catalogs":{"_type":"localeString","en":"IT catalogs"},"roi4webinar":{"en":"Pitch Avatar","_type":"localeString"},"b4reference":{"en":"Bonus4Reference","_type":"localeString"}},"breadcrumbs":{"home":{"en":"Home","ru":"Главная","_type":"localeString"},"companies":{"ru":"Компании","_type":"localeString","en":"Companies"},"products":{"ru":"Продукты","_type":"localeString","en":"Products"},"implementations":{"en":"Deployments","ru":"Внедрения","_type":"localeString"},"login":{"en":"Login","ru":"Вход","_type":"localeString"},"registration":{"ru":"Регистрация","_type":"localeString","en":"Registration"},"b2b-platform":{"_type":"localeString","en":"B2B platform for IT buyers, vendors and suppliers","ru":"Портал для покупателей, поставщиков и производителей ИТ"}},"comment-form":{"title":{"ru":"Оставить комментарий","_type":"localeString","en":"Leave comment"},"firstname":{"_type":"localeString","en":"First name","ru":"Имя"},"lastname":{"en":"Last name","ru":"Фамилия","_type":"localeString"},"company":{"en":"Company name","ru":"Компания","_type":"localeString"},"position":{"_type":"localeString","en":"Position","ru":"Должность"},"actual-cost":{"ru":"Фактическая стоимость","_type":"localeString","en":"Actual cost"},"received-roi":{"en":"Received ROI","ru":"Полученный ROI","_type":"localeString"},"saving-type":{"_type":"localeString","en":"Saving type","ru":"Тип экономии"},"comment":{"ru":"Комментарий","_type":"localeString","en":"Comment"},"your-rate":{"_type":"localeString","en":"Your rate","ru":"Ваша оценка"},"i-agree":{"en":"I agree","ru":"Я согласен","_type":"localeString"},"terms-of-use":{"_type":"localeString","en":"With user agreement and privacy policy","ru":"С пользовательским соглашением и политикой конфиденциальности"},"send":{"_type":"localeString","en":"Send","ru":"Отправить"},"required-message":{"ru":"{NAME} - это обязательное поле","_type":"localeString","en":"{NAME} is required filed"}},"maintenance":{"title":{"en":"Site under maintenance","ru":"На сайте проводятся технические работы","_type":"localeString"},"message":{"en":"Thank you for your understanding","ru":"Спасибо за ваше понимание","_type":"localeString"}}},"translationsStatus":{"product":"success"},"sections":{},"sectionsStatus":{},"pageMetaData":{"product":{"meta":[{"name":"og:type","content":"website"},{"name":"og:image","content":"https://roi4cio.com/fileadmin/templates/roi4cio/image/roi4cio-logobig.jpg"}],"translatable_meta":[{"name":"og:title","translations":{"_type":"localeString","en":"Example product","ru":"Конкретный продукт"}},{"name":"og:description","translations":{"en":"Description for one product","ru":"Описание для конкретного продукта","_type":"localeString"}},{"name":"title","translations":{"en":"Product","ru":"Продукт","_type":"localeString"}},{"name":"description","translations":{"ru":"Описание продукта","_type":"localeString","en":"Product description"}},{"name":"keywords","translations":{"_type":"localeString","en":"Product keywords","ru":"Ключевые слова продукта"}}],"title":{"ru":"ROI4CIO: Продукт","_type":"localeString","en":"ROI4CIO: Product"}}},"pageMetaDataStatus":{"product":"success"},"subscribeInProgress":false,"subscribeError":false},"auth":{"inProgress":false,"error":false,"checked":true,"initialized":false,"user":{},"role":null,"expires":null},"products":{"productsByAlias":{"microsoft-system-center-configuration-manager-sccm":{"id":582,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/Microsoft_System_Center_Configuration_Manager__SCCM_.png","logo":true,"scheme":false,"title":"Microsoft System Center Configuration Manager (SCCM)","vendorVerified":0,"rating":"2.70","implementationsCount":5,"suppliersCount":0,"supplierPartnersCount":272,"alias":"microsoft-system-center-configuration-manager-sccm","companyTitle":"Microsoft","companyTypes":["vendor"],"companyId":163,"companyAlias":"microsoft","description":"SCCM components include\r\n\r\nPolicy Infrastructure\r\nService Window Manager\r\nCCM Scheduler\r\nState System\r\nCCM CI SDK\r\nDCM Agent\r\nDCM Reporting\r\nCI Agent\r\nMTC\r\nCI Store\r\nCI Downloader\r\nCI Task Manager\r\nCI State Store\r\nContent In[fra]structure\r\nSoftware Distribution\r\nReporting","shortDescription":"System Center Configuration Manager (SCCM, also known as ConfigMgr), formerly Systems Management Server (SMS) is a systems management software product developed by Microsoft for managing large groups of computers running Windows NT, Windows Embedded, OS X, Linux or UNIX, as well as Windows Phone, Symbian, iOS and Android mobile operating systems. Configuration Manager provides remote control, patch management, software distribution, operating system deployment, network access protection and hardware and software inventory.","type":"Software","isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":4,"sellingCount":20,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Microsoft System Center Configuration Manager (SCCM)","keywords":"Manager, Agent, Store, Reporting, State, System, SCCM, Task","description":"SCCM components include\r\n\r\nPolicy Infrastructure\r\nService Window Manager\r\nCCM Scheduler\r\nState System\r\nCCM CI SDK\r\nDCM Agent\r\nDCM Reporting\r\nCI Agent\r\nMTC\r\nCI Store\r\nCI Downloader\r\nCI Task Manager\r\nCI State Store\r\nContent In[fra]structure\r\nSoftware Distributio","og:title":"Microsoft System Center Configuration Manager (SCCM)","og:description":"SCCM components include\r\n\r\nPolicy Infrastructure\r\nService Window Manager\r\nCCM Scheduler\r\nState System\r\nCCM CI SDK\r\nDCM Agent\r\nDCM Reporting\r\nCI Agent\r\nMTC\r\nCI Store\r\nCI Downloader\r\nCI Task Manager\r\nCI State Store\r\nContent In[fra]structure\r\nSoftware Distributio","og:image":"https://old.roi4cio.com/fileadmin/user_upload/Microsoft_System_Center_Configuration_Manager__SCCM_.png"},"eventUrl":"","translationId":583,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":377,"title":"IT Asset Management","alias":"it-asset-management","description":" IT asset management is the set of business practices that join financial, contractual and inventory functions to support life cycle management and strategic decision making for the IT environment. Assets include all elements of software and hardware that are found in the business environment.\r\nIT asset management generally uses automation to manage the discovery of assets so inventory can be compared to license entitlements. Full business management of IT assets requires a repository of multiple types of information about the asset, as well as integration with other systems such as supply chain, help desk, procurement and HR systems and ITSM.\r\nHardware asset management entails the management of the physical components of computers and computer networks, from acquisition through disposal. Common business practices include request and approval process, procurement management, life cycle management, redeployment and disposal management. A key component is capturing the financial information about the hardware life cycle which aids the organization in making business decisions based on meaningful and measurable financial objectives.\r\nSoftware Asset Management is a similar process, focusing on software assets, including licenses. Standards for this aspect of data center management are part of ISO/IEC 19770.","materialsDescription":" <span style=\"font-weight: bold;\">What is Information Technology Asset Management?</span>\r\nIT asset management (information technology asset management, or ITAM) is a set of business practices that combines financial, inventory and contractual functions to optimize spending and support lifecycle management and strategic decision-making within the IT environment.\r\n<span style=\"font-weight: bold;\">What is the purpose of IT asset management?</span>\r\nAsset management allows the organization to keep track of all their assets. It can tell where the assets are located, how they are used, and when changes were made to them. The data from the asset management solution can ensure that asset recovery will lead to better returns.\r\n<span style=\"font-weight: bold;\">What are the benefits of asset management?</span>\r\nWith a structure asset management framework in place, organizations will realize these and other benefits:\r\nGood Business Practice. Asset management results in better decisions;\r\n<ul><li>Improved Regulatory Compliance;</li><li>Improved Reliability;</li><li>Long Term System Integrity;</li><li>Cost Savings;</li><li>Eligibility for Federal Funding.</li></ul>\r\n<span style=\"font-weight: bold;\">What are the types of asset management?</span>\r\nThere are 7 types of asset management:\r\n<ul><li>Financial Asset Management.</li><li>Enterprise Asset Management.</li><li>Infrastructure Asset Management.</li><li>Public Asset Management.</li><li>IT Asset Management.</li><li>Fixed Assets Management.</li><li>Digital Asset Management.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_IT_Asset_Management.png"},{"id":325,"title":"Performance Management Software","alias":"performance-management-software","description":" <span style=\"font-weight: bold; \">Performance management software </span>— also referred to as a <span style=\"font-weight: bold; \">performance management system</span>— helps a company track, analyze, and evaluate its employees’ performance. is designed to improve business performance by spurring employee productivity. It works to ensure individual employees and teams are engaged and in alignment with organizational goals. Employee review software replaces an annual performance review process with real-time performance tracking, goal setting and feedback.\r\nPerformance management software systems are overseen by the HR department. They fit under the umbrella of <span style=\"font-style: italic; \">talent management systems.</span>\r\nAs next-generation HR software, performance management tools help companies address the modern goals of continually monitoring performance while giving employees feedback and support. Performance review software can track individual contributions to a team, as well as that team's ability to meet business objectives, thus tying performance into the company's bottom line.\r\nImproving employee engagement is another goal of performance management software. An employee can see current individual performance goals and their progress toward meeting them. This includes tracking efforts on specific projects. Managers measure individual performance against goals, and employees get a better idea of where they stand.\r\nThese systems use dashboards for quick and collaborative reviews. They can report individual performance, as well as project and team performance. The systems may also include employee ranking.\r\nAn effective performance management program must interact with other tools - in particular, workforce analytics. Data can be analyzed, for instance, against reporting from financial management systems and sales performance management systems.","materialsDescription":"<h1 class=\"align-center\">Why Implement Performance Management Software?</h1>\r\n<ul><li><span style=\"font-weight: bold; \">Easily-Navigable Dashboard </span></li></ul>\r\nThe top advantage to performance management tools are their ability to bring all key data and performance into one, organized location. Award-winning business performance management software do that. They make it easy to navigate the data and information and help leaders make better decisions for their workforce. \r\n<ul><li><span style=\"font-weight: bold; \">Performance Review Cycles </span></li></ul>\r\nTraditional annual review cycle or not, performance management system software can help coordinate, organize, schedule and store review information. The software will send reminders to leaders, manage permissions as leadership changes and provide structure to the overall process, including scripts based on company values and the employee’s role.\r\n<ul><li><span style=\"font-weight: bold; \">360 Degree and Peer Reviews </span></li></ul>\r\nPerformance and talent management tool can help ensure the process goes smoothly by providing structured and anonymous assessments. In some cases, there might be more than a few people involved in the performance review of one employee, so the software can track the progress of feedback to ensure each manager or leader has provided necessary input in a timely manner.\r\n<ul><li><span style=\"font-weight: bold; \">Customizable Review and Assessment Scripts </span></li></ul>\r\nIt is best practice to base performance on the unique values and goals of your organization, which means the annual review script should be different for a manager than it is for an executive, and nothing like the script of another organization. \r\n<ul><li><span style=\"font-weight: bold; \">Goal and Performance Tracking </span></li></ul>\r\nContinuous performance and goal tracking allows leadership to see the progress of projects clearly while keeping in mind which employees are hitting the mark and which need guidance. And because automated performance management system available to the employee as well, everyone will be on the same page and aligned to the work being done, even between departments in real-time.\r\n<ul><li><span style=\"font-weight: bold; \">Development &amp; Succession Planning </span></li></ul>\r\nEmployees need continuous support in order to become effective contributors to the organization, especially in the long run. With performance management tools, you can track development progress, assign long term goals and ensure you understand the direction of talent and the business as a whole.\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Performance_Management_Software.png"},{"id":327,"title":"Change and Configuration Management Software","alias":"change-and-configuration-management-software","description":" Software teams today face significant challenges. Companies require the production of high-quality software at unprecedented speeds. Software application requirements continue to grow more complex often with shorter and more frequent release cycles. Distributed development teams present challenges related to effective teaming, parallel development and diverse platforms - these factors and more intensify the pressures of developing quality software. Developing quality software in a repeatable and predictable fashion requires managing and tracking development artifacts and the activities of the development team. Successful development teams utilize software configuration management and software change management tools to help manage the software development lifecycle.\r\nSoftware configuration management provides version control and parallels development support to manage and control software assets.&nbsp; Software change management provides defect tracking and automation of software processes across the development lifecycle.\r\nSolutions that combine software configuration management and software change management in a single, tightly integrated solution are referred to as software change and configuration management (SCCM) solutions. SCCM solutions utilize activities to easily manage changes made to development artifacts. Unlike standalone SCM tools, SCCM solutions usually include substantial workflow capabilities which automate and effectively govern the software development processes for repeatable and predictable software development.\r\nEssentially, SCCM answers the ‘who’, ‘what’, ‘when’, and ‘why’ of software development. Who made the changes? What changes were made to the software? When were the changes made? Why were the changes made? Development teams and project leaders should be able to obtain answers to these questions to manage a project's activities, determine project status and track the actual product evolution.\r\nA fully comprehensive software change and configuration management (SCCM) solution empowers companies by accelerating software and systems delivery, making global teams more efficient, and governing the end-to-end software development processes. Solutions should be secure, flexible, and robust as well as provide the ability to support any size team, regardless of platform or location. Selecting ‘best in class’ solution, implementing proven best practices and partnering with a company that is a leader in technology reduces the risks associated with quality software development.","materialsDescription":" \r\n<span style=\"font-weight: bold;\">What is software configuration management (SCM)?</span>\r\nSoftware configuration management (SCM) is designed to control change by identifying and tracking changed software artifacts and managing different versions of these artifacts.\r\n<span style=\"font-weight: bold;\">What is software change and configuration management (SCCM)?</span>\r\nSoftware change and configuration management (SCCM) provide the comprehensive integration with best practice guidance of software configuration management and software change management capabilities.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Change_and_Configuration_Management_Software.png"},{"id":381,"title":"Software Distribution","alias":"software-distribution","description":" Software distribution can refer to 2 distinct concepts. When used as a verb, software distribution is the process of delivering software to the end user, while a software distribution, as a noun, (distro) is a collection of software.\r\nA software distribution (noun), or distro, is a collection of software components built, assembled and configured so that it can essentially be used &quot;as is&quot;. It is often the closest thing to turnkey form of free software. A distro may take the form of a binary distribution, with an executable installer which can be downloaded from the Internet. Examples range from whole operating system distributions to server and interpreter distributions (for example WAMP installers). Software distributions (noun) can also refer to careware and donateware.\r\nIn recent years, the term has come to refer to nearly any &quot;finished&quot; software (i.e. something that is more or less ready for its intended use, whether as a complete system or a component of a larger system) that is assembled primarily from open source components.\r\nTechnical support is a key issue for end-users of distributions, since the distribution itself is typically free and may not be &quot;owned&quot; in a commercial sense by a vendor. Depending on the distribution, support may be provided by a commercial support vendor, the developers who created the distribution or by the user community itself.\r\nIn simple terms, software distribution is the process of making a software available to the end user from the developer. It gives the organization a safe and consistent method for packaging, deploying and tracking software changes in the enterprise. The software rollout projects can be done quickly and effectively in a hassle free way through software distribution.","materialsDescription":" <span style=\"font-weight: bold; \">What are the Benefits of Software Distribution?</span>\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Improved Software Security</span></span>\r\nA proper software distribution service monitors software performance on various workstations. It checks the software health and can automatically track necessary updates. Various maintenance job like uninstall, configuration, etc can also be performed securely through effective software distribution.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold; \">Track of User Actions</span></span>\r\nStatistics and analytics can be drawn from comprehensive or customized reports gathered from software distribution systems. It can be used to monitor user activities around the particular software on workstations. This can assist in establishing a controlled work environment where the actions of users can be monitored by the enterprise.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold; \">Saves Time</span></span>\r\nSoftware distribution gives comprehensive deployment options and ways to customize installation. Packages can be distributed to users in less time within hours and not in days. Software installations can be done remotely saving both time and effort. The process can be done unattended so IT team can concentrate on other jobs.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Automated Updates</span></span>\r\nSoftware distribution can track important updates and issue them to specific workstations in the organization. IT team does not need to attend to each computer and perform maintenance job. The software distribution system finds and schedules all important upgrades required by the application.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Software_Distribution.png"},{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"}],"characteristics":[],"concurentProducts":[{"id":4611,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/presidio_logo.png","logo":true,"scheme":false,"title":"Presidio Data Center Solution Sets","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"presidio-data-center-solution-sets","companyTitle":"Presidio Inc.","companyTypes":["supplier","vendor"],"companyId":7004,"companyAlias":"presidio-inc","description":"Presidio data center solution sets provide a highly efficient, cost-effective alternative to the traditional data center infrastructure design and implementation process. Solution sets are available for traditional or hyperconverged environments, and integrate the latest technologies from Presidio’s industry-leading partners in customizable offerings that can be implemented quickly, with minimal risk and predictable costs. \r\nAs a leading North American IT solutions provider, Presidio offers digital infrastructure, cloud, and security solutions that help customers capture the value of digitally transforming their businesses and operations. \r\nPresidio delivers this technology expertise through a full life cycle of professional, managed, and ongoing support services, including strategy, consulting, design, and implementation.Presidio has deep experience in all the technologies included in Presidio Data Center Solution Sets, and can easily customize and configure the solutions on-site or stage them at a Presidio facility. \r\nOnly the latest complementary technologies—including Intel® Xeon® Processor Scalable family and Intel® SSDs—are integrated in each solution set to reduce risk for our customers and accelerate time to value.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Innovative&nbsp;&nbsp; financing options</span></p>\r\nIn addition to installing and con guring the solution sets, Presidio offers utility and consumption models with innovative&nbsp; financing options for both infrastructure refreshes and green eld deployments.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">BUNDLING THE&nbsp; BEST TECHNOLOGIES</span></p>\r\nPresidio Data Center Solution Sets integrate proven technologies from industry-leading partners with which Presidio has attained deep and broad training, certi cation, and expertise.\r\n<ul><li>Cisco Gold Partner</li><li>Intel Platinum Partner</li><li>Nutanix Elite Reseller Partner</li><li>APC Elite Data Center Partner</li><li>Dell EMC Titanium Partner</li><li>VMware Premier Partner</li></ul>\r\nPresidio provides&nbsp; flexible&nbsp; financing for capital and operating expenses, so businesses can have one predictable monthly bill and avoid the complexity of entering into separate&nbsp; financing agreements with each technology provider.&nbsp; The&nbsp; financing options include Capacity on Demand, where additional capacity&nbsp; can be staged and readied for use to support rapid growth.\r\n<p class=\"align-center\">POWERED BY INTEL</p>\r\nPresidio Data Center Solution Sets feature the Intel® Xeon® Processor Scalable family, the new foundation for secure, agile, multi-cloud data centers. The new processors, which represent the biggest data center platform advancement this decade from Intel, are architected for exceptional workload-optimized performance and hardware-enhanced security.To ensure the best data center storage possible, the solution sets integrate the latest Intel® SSDs, such as the Intel® Optane™ SSD DC P4800X series—the world’s most responsive data center SSD, with innovative Intel® Optane™ technology.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Innovative solutions configured to meet business demands</span></p>\r\nPresidio Data Center Solution Sets are available for both traditional and hyperconverged environments. Company leverages experience across our 1,600 engineers to identify complementary product offerings and con gure them to bring additional value to the customer. Each solution set is highly con gurable to meet speci c business requirements and deliver the optimal combination of performance, price, and reliability.<br /><br />","shortDescription":"PRESIDIO DATA CENTER SOLUTION SETS FEATURE PROVEN TECHNOLOGIES AND INNOVATIVE FINANCING OPPORTUNITIES FROM AN EXPERT PROVIDER.\r\n","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":11,"sellingCount":4,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Presidio Data Center Solution Sets","keywords":"","description":"Presidio data center solution sets provide a highly efficient, cost-effective alternative to the traditional data center infrastructure design and implementation process. Solution sets are available for traditional or hyperconverged environments, and integrate","og:title":"Presidio Data Center Solution Sets","og:description":"Presidio data center solution sets provide a highly efficient, cost-effective alternative to the traditional data center infrastructure design and implementation process. Solution sets are available for traditional or hyperconverged environments, and integrate","og:image":"https://old.roi4cio.com/fileadmin/user_upload/presidio_logo.png"},"eventUrl":"","translationId":4612,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":4,"title":"Data center","alias":"data-center","description":" A data center (or datacenter) is a facility composed of networked computers and storage that businesses or other organizations use to organize, process, store and disseminate large amounts of data. A business typically relies heavily upon the applications, services and data contained within a data center, making it a focal point and critical asset for everyday operations.\r\nData centers are not a single thing, but rather, a conglomeration of elements. At a minimum, data centers serve as the principal repositories for all manner of IT equipment, including servers, storage subsystems, networking switches, routers and firewalls, as well as the cabling and physical racks used to organize and interconnect the IT equipment. A data center must also contain an adequate infrastructure, such as power distribution and supplemental power subsystems, including electrical switching; uninterruptable power supplies; backup generators and so on; ventilation and data center cooling systems, such as computer room air conditioners; and adequate provisioning for network carrier (telco) connectivity. All of this demands a physical facility with physical security and sufficient physical space to house the entire collection of infrastructure and equipment.","materialsDescription":" <span style=\"font-weight: bold;\">What are the requirements for modern data centers?</span>\r\nModernization and data center transformation enhances performance and energy efficiency.\r\nInformation security is also a concern, and for this reason a data center has to offer a secure environment which minimizes the chances of a security breach. A data center must therefore keep high standards for assuring the integrity and functionality of its hosted computer environment.\r\nIndustry research company International Data Corporation (IDC) puts the average age of a data center at nine years old. Gartner, another research company, says data centers older than seven years are obsolete. The growth in data (163 zettabytes by 2025) is one factor driving the need for data centers to modernize.\r\nFocus on modernization is not new: Concern about obsolete equipment was decried in 2007, and in 2011 Uptime Institute was concerned about the age of the equipment therein. By 2018 concern had shifted once again, this time to the age of the staff: &quot;data center staff are aging faster than the equipment.&quot;\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Meeting standards for data centers</span></span>\r\nThe Telecommunications Industry Association's Telecommunications Infrastructure Standard for Data Centers specifies the minimum requirements for telecommunications infrastructure of data centers and computer rooms including single tenant enterprise data centers and multi-tenant Internet hosting data centers. The topology proposed in this document is intended to be applicable to any size data center.\r\nTelcordia GR-3160, NEBS Requirements for Telecommunications Data Center Equipment and Spaces, provides guidelines for data center spaces within telecommunications networks, and environmental requirements for the equipment intended for installation in those spaces. These criteria were developed jointly by Telcordia and industry representatives. They may be applied to data center spaces housing data processing or Information Technology (IT) equipment. The equipment may be used to:\r\n<ul><li>Operate and manage a carrier's telecommunication network</li><li>Provide data center based applications directly to the carrier's customers</li><li>Provide hosted applications for a third party to provide services to their customers</li><li>Provide a combination of these and similar data center applications</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Data center transformation</span></span>\r\nData center transformation takes a step-by-step approach through integrated projects carried out over time. This differs from a traditional method of data center upgrades that takes a serial and siloed approach. The typical projects within a data center transformation initiative include standardization/consolidation, virtualization, automation and security.\r\n<ul><li>Standardization/consolidation: Reducing the number of data centers and avoiding server sprawl (both physical and virtual) often includes replacing aging data center equipment, and is aided by standardization.</li><li>Virtualization: Lowers capital and operational expenses, reduce energy consumption. Virtualized desktops can be hosted in data centers and rented out on a subscription basis. Investment bank Lazard Capital Markets estimated in 2008 that 48 percent of enterprise operations will be virtualized by 2012. Gartner views virtualization as a catalyst for modernization.</li><li>Automating: Automating tasks such as provisioning, configuration, patching, release management and compliance is needed, not just when facing fewer skilled IT workers.</li><li>Securing: Protection of virtual systems is integrated with existing security of physical infrastructures.</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Machine room</span></span>\r\nThe term &quot;Machine Room&quot; is at times used to refer to the large room within a Data Center where the actual Central Processing Unit is located; this may be separate from where high-speed printers are located. Air conditioning is most important in the machine room.\r\nAside from air-conditioning, there must be monitoring equipment, one type of which is to detect water prior to flood-level situations. One company, for several decades, has had share-of-mind: Water Alert. The company, as of 2018, has 2 competing manufacturers (Invetex, Hydro-Temp) and 3 competing distributors (Longden,Northeast Flooring, Slayton). ","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Data_center.png"},{"id":24,"title":"DLP - Data Leak Prevention","alias":"dlp-data-leak-prevention","description":"Data leak prevention (DLP) is a suite of technologies aimed at stemming the loss of sensitive information that occurs in enterprises across the globe. By focusing on the location, classification and monitoring of information at rest, in use and in motion, this solution can go far in helping an enterprise get a handle on what information it has, and in stopping the numerous leaks of information that occur each day. DLP is not a plug-and-play solution. The successful implementation of this technology requires significant preparation and diligent ongoing maintenance. Enterprises seeking to integrate and implement DLP should be prepared for a significant effort that, if done correctly, can greatly reduce risk to the organization. Those implementing the solution must take a strategic approach that addresses risks, impacts and mitigation steps, along with appropriate governance and assurance measures.","materialsDescription":" <span style=\"font-weight: bold;\">How to protect the company from internal threats associated with leakage of confidential information?</span>\r\nIn order to protect against any threat, you must first realize its presence. Unfortunately, not always the management of companies is able to do this if it comes to information security threats. The key to successfully protecting against information leaks and other threats lies in the skillful use of both organizational and technical means of monitoring personnel actions.\r\n<span style=\"font-weight: bold;\">How should the personnel management system in the company be organized to minimize the risks of leakage of confidential information?</span>\r\nA company must have a special employee responsible for information security, and a large department must have a department directly reporting to the head of the company.\r\n<span style=\"font-weight: bold;\">Which industry representatives are most likely to encounter confidential information leaks?</span>\r\nMore than others, representatives of such industries as industry, energy, and retail trade suffer from leaks. Other industries traditionally exposed to leakage risks — banking, insurance, IT — are usually better at protecting themselves from information risks, and for this reason they are less likely to fall into similar situations.\r\n<span style=\"font-weight: bold;\">What should be adequate measures to protect against leakage of information for an average company?</span>\r\nFor each organization, the question of protection measures should be worked out depending on the specifics of its work, but developing information security policies, instructing employees, delineating access to confidential data and implementing a DLP system are necessary conditions for successful leak protection for any organization. Among all the technical means to prevent information leaks, the DLP system is the most effective today, although its choice must be taken very carefully to get the desired result. So, it should control all possible channels of data leakage, support automatic detection of confidential information in outgoing traffic, maintain control of work laptops that temporarily find themselves outside the corporate network...\r\n<span style=\"font-weight: bold;\">Is it possible to give protection against information leaks to outsourcing?</span>\r\nFor a small company, this may make sense because it reduces costs. However, it is necessary to carefully select the service provider, preferably before receiving recommendations from its current customers.\r\n<span style=\"font-weight: bold;\">What data channels need to be monitored to prevent leakage of confidential information?</span>\r\nAll channels used by employees of the organization - e-mail, Skype, HTTP World Wide Web protocol ... It is also necessary to monitor the information recorded on external storage media and sent to print, plus periodically check the workstation or laptop of the user for files that are there saying should not.\r\n<span style=\"font-weight: bold;\">What to do when the leak has already happened?</span>\r\nFirst of all, you need to notify those who might suffer - silence will cost your reputation much more. Secondly, you need to find the source and prevent further leakage. Next, you need to assess where the information could go, and try to somehow agree that it does not spread further. In general, of course, it is easier to prevent the leakage of confidential information than to disentangle its consequences.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Data_Leak_Prevention.png"},{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":293,"title":"System Software","alias":"system-software","description":" System software is a type of computer program that is designed to run a computer’s hardware and application programs. If we think of the computer system as a layered model, the system software is the interface between the hardware and user applications. The operating system (OS) is the best-known example of system software. The OS manages all the other programs on a computer.\r\nOther examples of system software include:\r\n<ul><li>The BIOS (basic input/output system) gets the computer system started after you turn it on and manages the data flow between the operating system and attached devices such as the hard disk, video adapter, keyboard, mouse and printer.</li><li>The boot program loads the operating system into the computer's main memory or random access memory (RAM).</li><li>An assembler takes basic computer instructions and converts them into a pattern of bits that the computer's processor can use to perform its basic operations.</li><li>A device driver controls a particular type of device that is attached to your computers, such as a keyboard or a mouse. The driver program converts the more general input/output instructions of the operating system to messages that the device type can understand.</li></ul>\r\nAdditionally, system software can also include system utilities, such as the disk defragmenter and System Restore, and development tools, such as compilers and debuggers.\r\nSystem software and application programs are the two main types of computer software. Unlike system software, an application program (often just called an application or app) performs a particular function for the user. Examples include browsers, email clients, word processors, and spreadsheets.","materialsDescription":" \r\n<span style=\"font-weight: bold; \">What is system software?</span>\r\nSystem software is software designed to provide a platform for other software. Examples of system software include operating systems like macOS, GNU/Linux and Microsoft Windows, computational science software, game engines, industrial automation, and software as a service applications.\r\nIn contrast to system software, software that allows users to do user-oriented tasks such as create text documents, play games, listen to music, or browse the web are collectively referred to as application software.\r\nIn the early days of computing most application software was custom-written by computer users to fit their specific hardware and requirements. In contrast, system software was usually supplied by the manufacturer of the computer hardware and was intended to be used by most or all users of that system.\r\nThe line where the distinction should be drawn is not always clear. Many operating systems bundle[jargon] application software. Such software is not considered system software when it can be uninstalled usually without affecting the functioning of other software. Exceptions could be e.g. web browsers such as Internet Explorer where Microsoft argued in court that it was system software that could not be uninstalled. Later examples are Chrome OS and Firefox OS where the browser functions as the only user interface and the only way to run programs (and other web browsers can not be installed in their place), then they can well be argued to be (part of) the operating system and hence system software.\r\nAnother borderline example is cloud-based software. This software provides services to a software client (usually a web browser or a JavaScript application running in the web browser), not to the user directly, and is therefore systems software. It is also developed using system programming methodologies and systems programming languages. Yet from the perspective of functionality there is little difference between a word processing application and word processing web application.\r\n<span style=\"font-weight: bold; \">Operating systems or system control program</span>\r\nThe operating system (prominent examples being Microsoft Windows, macOS, Linux, and z/OS), allows the parts of a computer to work together by performing tasks like transferring data between memory and disks or rendering output onto a display device. It provides a platform (hardware abstraction layer) to run high-level system software and application software.\r\nA kernel is the core part of the operating system that defines an API for applications programs (including some system software) and an interface to device drivers.\r\nDevice drivers, including also computer BIOS and device firmware, provide basic functionality to operate and control the hardware connected to or built into the computer.\r\nA user interface &quot;allows users to interact with a computer.&quot; Either a command-line interface (CLI) or, since the 1980s a graphical user interface (GUI). Since this is the part of the operating system the user directly interacts with, it may be considered an application and therefore not system software.\r\n<span style=\"font-weight: bold;\">Utility software or system support programs</span>\r\nFor historical reasons, some organizations use the term systems programmer to describe a job function which is more accurately termed systems administrator. Software tools these employees use are then called system software. This so-called Utility software helps to analyze, configure, optimize and maintain the computer, such as virus protection. In some publications, the term system software also includes software development tools (like a compiler, linker or debugger).","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_System_and_Network_Management_Software.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4613,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/Prevalent_Inc..png","logo":true,"scheme":false,"title":"Prevalent Third-Party Risk Management Platform","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"prevalent-third-party-risk-management-platform","companyTitle":"Prevalent","companyTypes":["supplier","vendor"],"companyId":7005,"companyAlias":"prevalent","description":"With cyber attacks originating from third parties on the rise, and privacy concerns driving new regulations, it’s critical to ensure that your suppliers can securely manage sensitive systems and data. However, manually collecting, maintaining and analyzing risk status is inefficient, error-prone and costly. \r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Simplify,Automate,Scale.</span></p>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">The only purpose-built, unified platform for third-party risk management </span></p>\r\nDelivered in the simplicity of the cloud, the Prevalent Third-Party Risk Management platform combines automated, standardized vendor assessments with continuous threat monitoring, assessment workflow, and remediation management across the entire vendor life cycle. \r\nThe solution is backed by expert advisory, consulting and managed services to help you optimize and mature your vendor risk management program.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Assess</span></p>\r\n<ul><li>Measure compliance with data security and privacy requirements via automated assessment, review, analysis, remediation and reporting.</li><li>Leverage 50+ templates or build custom surveys</li><li>Automate the end-to-end assessment process and alleviate tedious manual labor</li><li>Assess vendor compliance with ISO 27001, NIST, GDPR, CoBiT 5, SSAE 18, SIG, SIG Lite, SOX, NYDFS, and other regulations and frameworks</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Monitor</span></p>\r\n<ul><li>Gain an outside-in view of risk with continuous cyber and business monitoring, notification of critical issues, and remediation guidance.</li><li>Combine vulnerability scanning with external threat intelligence to uncover IP threats, phishing events, and data breaches</li><li>Identify operational, financial, legal, and brand risks with OSINT business intelligence</li><li>Integrate outside-in scoring with inside-out assessment for a complete view of risk</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Share</span></p>\r\n<ul><li>Access shared libraries of pre-submitted, standardized assessments to quickly check risk scores and augment 1:1 assessment activities.</li><li>Prevalent Exchange: cross-industry vendor data</li><li>Legal Vendor Network™:the industry standard used by 50%+ of top U.S. law firms</li><li>Healthcare Vendor Network™:exclusive partner to H-ISAC Shared Services</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Key Benefits</span></p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">Visibility<br /></span></span></p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">Gain a 360-degree view </span></span></p>\r\n<p class=\"align-left\">Identify IT and business exposures with inside-out assessment and outside-in monitoring, eliminating coverage gaps and informing risk-based decision making.</p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Efficiency<br /></span></span></p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Streamline TPRM &amp; reduce costs</span></span></p>\r\n<p class=\"align-left\">Speed assessments and remediation with bi-directional workflow, document/evidence and task management. Equip vendors with dashboards for managing and addressing risks.</p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Scale<br /></span></span></p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Expand and mature your program</span></span></p>\r\n<p class=\"align-left\">Prevalent’s Risk Operations Center (ROC) and Professional Services teams will partner with you to rapidly implement, scale and customize your end-to-end TPRM program.</p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Reporting<br /></span></span></p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Tailor risk insights &amp; trends</span></span></p>\r\n<p class=\"align-left\">Generate detailed vendor risk registers, compliance mapping reports, remediation guidance and executive overviews. Review full audit trails and drill down to specific controls and risks</p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Remediation<br /></span></span></p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Utilize actionable guidance</span></span></p>\r\n<p class=\"align-left\">Categorize vendors by risk level and importance to the business. Share remediation recommendations and implement fixes, with full audit trails for all communications</p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Compliance<br /></span></span></p>\r\n<p class=\"align-left\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Address assessment and monitoring requirements</span></span></p>\r\n<p class=\"align-left\">Comply with GDPR, HIPAA, NIST SP 800 &amp; CSF, ISO 27001/ 27002/27018, EBA Guidelines, FCA FG 16/5, FFIEC IT Exam Handbook, NY DFS 23 NYCRR 500, OCC Bulletins and more<br /><br /></p>","shortDescription":"Prevalent simplifies and speeds compliance and risk reduction with a unified, automated Third-Party Risk Management (TPRM) platform\r\n","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":5,"sellingCount":14,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Prevalent Third-Party Risk Management Platform","keywords":"","description":"With cyber attacks originating from third parties on the rise, and privacy concerns driving new regulations, it’s critical to ensure that your suppliers can securely manage sensitive systems and data. However, manually collecting, maintaining and analyzing ris","og:title":"Prevalent Third-Party Risk Management Platform","og:description":"With cyber attacks originating from third parties on the rise, and privacy concerns driving new regulations, it’s critical to ensure that your suppliers can securely manage sensitive systems and data. However, manually collecting, maintaining and analyzing ris","og:image":"https://old.roi4cio.com/fileadmin/user_upload/Prevalent_Inc..png"},"eventUrl":"","translationId":4614,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":24,"title":"DLP - Data Leak Prevention","alias":"dlp-data-leak-prevention","description":"Data leak prevention (DLP) is a suite of technologies aimed at stemming the loss of sensitive information that occurs in enterprises across the globe. By focusing on the location, classification and monitoring of information at rest, in use and in motion, this solution can go far in helping an enterprise get a handle on what information it has, and in stopping the numerous leaks of information that occur each day. DLP is not a plug-and-play solution. The successful implementation of this technology requires significant preparation and diligent ongoing maintenance. Enterprises seeking to integrate and implement DLP should be prepared for a significant effort that, if done correctly, can greatly reduce risk to the organization. Those implementing the solution must take a strategic approach that addresses risks, impacts and mitigation steps, along with appropriate governance and assurance measures.","materialsDescription":" <span style=\"font-weight: bold;\">How to protect the company from internal threats associated with leakage of confidential information?</span>\r\nIn order to protect against any threat, you must first realize its presence. Unfortunately, not always the management of companies is able to do this if it comes to information security threats. The key to successfully protecting against information leaks and other threats lies in the skillful use of both organizational and technical means of monitoring personnel actions.\r\n<span style=\"font-weight: bold;\">How should the personnel management system in the company be organized to minimize the risks of leakage of confidential information?</span>\r\nA company must have a special employee responsible for information security, and a large department must have a department directly reporting to the head of the company.\r\n<span style=\"font-weight: bold;\">Which industry representatives are most likely to encounter confidential information leaks?</span>\r\nMore than others, representatives of such industries as industry, energy, and retail trade suffer from leaks. Other industries traditionally exposed to leakage risks — banking, insurance, IT — are usually better at protecting themselves from information risks, and for this reason they are less likely to fall into similar situations.\r\n<span style=\"font-weight: bold;\">What should be adequate measures to protect against leakage of information for an average company?</span>\r\nFor each organization, the question of protection measures should be worked out depending on the specifics of its work, but developing information security policies, instructing employees, delineating access to confidential data and implementing a DLP system are necessary conditions for successful leak protection for any organization. Among all the technical means to prevent information leaks, the DLP system is the most effective today, although its choice must be taken very carefully to get the desired result. So, it should control all possible channels of data leakage, support automatic detection of confidential information in outgoing traffic, maintain control of work laptops that temporarily find themselves outside the corporate network...\r\n<span style=\"font-weight: bold;\">Is it possible to give protection against information leaks to outsourcing?</span>\r\nFor a small company, this may make sense because it reduces costs. However, it is necessary to carefully select the service provider, preferably before receiving recommendations from its current customers.\r\n<span style=\"font-weight: bold;\">What data channels need to be monitored to prevent leakage of confidential information?</span>\r\nAll channels used by employees of the organization - e-mail, Skype, HTTP World Wide Web protocol ... It is also necessary to monitor the information recorded on external storage media and sent to print, plus periodically check the workstation or laptop of the user for files that are there saying should not.\r\n<span style=\"font-weight: bold;\">What to do when the leak has already happened?</span>\r\nFirst of all, you need to notify those who might suffer - silence will cost your reputation much more. Secondly, you need to find the source and prevent further leakage. Next, you need to assess where the information could go, and try to somehow agree that it does not spread further. In general, of course, it is easier to prevent the leakage of confidential information than to disentangle its consequences.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Data_Leak_Prevention.png"},{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":50,"title":"IPC - Information Protection and Control","alias":"ipc-information-protection-and-control","description":"Information Protection and Control (IPC) is a technology for protecting confidential information from internal threats. IPC solutions are designed to protect information from internal threats, prevent various types of information leaks, corporate espionage, and business intelligence. The term IPC combines two main technologies: encryption of storage media at all points of the network and control of technical channels of information leakage using Data Loss Prevention (DLP) technologies. Network, application and data access control is a possible third technology in IPC class systems. IPC includes solutions of the Data Loss Prevention (DLP) class, a system for encrypting corporate information and controlling access to it. The term IPC was one of the first to use IDC analyst Brian Burke in his report, Information Protection and Control Survey: Data Loss Prevention and Encryption Trends.\r\nIPC technology is a logical continuation of DLP technology and allows you to protect data not only from leaks through technical channels, that is, insiders, but also from unauthorized user access to the network, information, applications, and in cases where the direct storage medium falls into the hands of third parties. This allows you to prevent leaks in those cases when an insider or a person who does not have legal access to data gain access to the direct carrier of information. For example, removing a hard drive from a personal computer, an insider will not be able to read the information on it. This allows you to prevent the compromise of confidential data even in the event of loss, theft or seizure (for example, when organizing operational events by special services specialists, unscrupulous competitors or raiders).\r\nThe main objective of IPC systems is to prevent the transfer of confidential information outside the corporate information system. Such a transfer (leak) may be intentional or unintentional. Practice shows that most of the leaks (more than 75%) do not occur due to malicious intent, but because of errors, carelessness, carelessness, and negligence of employees - it is much easier to detect such cases. The rest is connected with the malicious intent of operators and users of enterprise information systems, in particular, industrial espionage and competitive intelligence. Obviously, malicious insiders, as a rule, try to trick IPC analyzers and other control systems.","materialsDescription":"<span style=\"font-weight: bold; \">What is Information Protection and Control (IPC)?</span>\r\nIPC (English Information Protection and Control) is a generic name for technology to protect confidential information from internal threats.\r\nIPC solutions are designed to prevent various types of information leaks, corporate espionage, and business intelligence. IPC combines two main technologies: media encryption and control of technical channels of information leakage (Data Loss Prevention - DLP). Also, the functionality of IPC systems may include systems of protection against unauthorized access (unauthorized access).\r\n<span style=\"font-weight: bold; \">What are the objectives of IPC class systems?</span>\r\n<ul><li>preventing the transfer of confidential information beyond the corporate information system;</li><li>prevention of outside transmission of not only confidential but also other undesirable information (offensive expressions, spam, eroticism, excessive amounts of data, etc.);</li><li>preventing the transmission of unwanted information not only from inside to outside but also from outside to inside the organization’s information system;</li><li>preventing employees from using the Internet and network resources for personal purposes;</li><li>spam protection;</li><li>virus protection;</li><li>optimization of channel loading, reduction of inappropriate traffic;</li><li>accounting of working hours and presence at the workplace;</li><li>tracking the reliability of employees, their political views, beliefs, collecting dirt;</li><li>archiving information in case of accidental deletion or damage to the original;</li><li>protection against accidental or intentional violation of internal standards;</li><li>ensuring compliance with standards in the field of information security and current legislation.</li></ul>\r\n<span style=\"font-weight: bold; \">Why is DLP technology used in IPC?</span>\r\nIPC DLP technology supports monitoring of the following technical channels for confidential information leakage:\r\n<ul><li>corporate email;</li><li>webmail;</li><li>social networks and blogs;</li><li>file-sharing networks;</li><li>forums and other Internet resources, including those made using AJAX technology;</li><li>instant messaging tools (ICQ, Mail.Ru Agent, Skype, AOL AIM, Google Talk, Yahoo Messenger, MSN Messenger, etc.);</li><li>P2P clients;</li><li>peripheral devices (USB, LPT, COM, WiFi, Bluetooth, etc.);</li><li>local and network printers.</li></ul>\r\nDLP technologies in IPC support control, including the following communication protocols:\r\n<ul><li>FTP;</li><li>FTP over HTTP;</li><li>FTPS;</li><li>HTTP;</li><li>HTTPS (SSL);</li><li>NNTP;</li><li>POP3;</li><li>SMTP.</li></ul>\r\n<span style=\"font-weight: bold; \">What information protection facilities does IPC technology include?</span>\r\nIPC technology includes the ability to encrypt information at all key points in the network. The objects of information security are:\r\n<ul><li>Server hard drives;</li><li>SAN;</li><li>NAS;</li><li>Magnetic tapes;</li><li>CD/DVD/Blue-ray discs;</li><li>Personal computers (including laptops);</li><li>External devices.</li></ul>\r\nIPC technologies use various plug-in cryptographic modules, including the most efficient algorithms DES, Triple DES, RC5, RC6, AES, XTS-AES. The most used algorithms in IPC solutions are RC5 and AES, the effectiveness of which can be tested on the project [distributed.net]. They are most effective for solving the problems of encrypting data of large amounts of data on server storages and backups.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/IPC_-_Information_Protection_and_Control.png"},{"id":79,"title":"VM - Vulnerability management","alias":"vm-vulnerability-management","description":"Vulnerability management is the &quot;cyclical practice of identifying, classifying, prioritizing, remediating and mitigating&quot; software vulnerabilities. Vulnerability management is integral to computer security and network security, and must not be confused with a Vulnerability assessment.\r\nVulnerability management is an ongoing process that includes proactive asset discovery, continuous monitoring, mitigation, remediation and defense tactics to protect your organization's modern IT attack surface from Cyber Exposure.\r\nVulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities, such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, or subscribing to a commercial vulnerability alerting services. Unknown vulnerabilities, such as a zero-day, may be found with fuzz testing, which can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).\r\nCorrecting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.\r\nNetwork vulnerabilities represent security gaps that could be abused by attackers to damage network assets, trigger a denial of service, and/or steal potentially sensitive information. Attackers are constantly looking for new vulnerabilities to exploit — and taking advantage of old vulnerabilities that may have gone unpatched.\r\nHaving a vulnerability management framework in place that regularly checks for new vulnerabilities is crucial for preventing cybersecurity breaches. Without a vulnerability testing and patch management system, old security gaps may be left on the network for extended periods of time. This gives attackers more of an opportunity to exploit vulnerabilities and carry out their attacks.\r\nOne statistic that highlights how crucial vulnerability management was featured in an Infosecurity Magazine article. According to survey data cited in the article, of the organizations that “suffered a breach, almost 60% were due to an unpatched vulnerability.” In other words, nearly 60% of the data breaches suffered by survey respondents could have been easily prevented simply by having a vulnerability management plan that would apply critical patches before attackers leveraged the vulnerability.","materialsDescription":" <span style=\"font-weight: bold;\">What is vulnerability management?</span>\r\nVulnerability management is a pro-active approach to managing network security by reducing the likelihood that flaws in code or design compromise the security of an endpoint or network.\r\n<span style=\"font-weight: bold;\">What processes does vulnerability management include?</span>\r\nVulnerability management processes include:\r\n<ul><li><span style=\"font-style: italic;\">Checking for vulnerabilities:</span> This process should include regular network scanning, firewall logging, penetration testing or use of an automated tool like a vulnerability scanner.</li><li><span style=\"font-style: italic;\">Identifying vulnerabilities:</span> This involves analyzing network scans and pen test results, firewall logs or vulnerability scan results to find anomalies that suggest a malware attack or other malicious event has taken advantage of a security vulnerability, or could possibly do so.</li><li><span style=\"font-style: italic;\">Verifying vulnerabilities:</span> This process includes ascertaining whether the identified vulnerabilities could actually be exploited on servers, applications, networks or other systems. This also includes classifying the severity of a vulnerability and the level of risk it presents to the organization.</li><li><span style=\"font-style: italic;\">Mitigating vulnerabilities:</span> This is the process of figuring out how to prevent vulnerabilities from being exploited before a patch is available, or in the event that there is no patch. It can involve taking the affected part of the system off-line (if it's non-critical), or various other workarounds.</li><li><span style=\"font-style: italic;\">Patching vulnerabilities:</span> This is the process of getting patches -- usually from the vendors of the affected software or hardware -- and applying them to all the affected areas in a timely way. This is sometimes an automated process, done with patch management tools. This step also includes patch testing.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/VM_-_Vulnerability_management1.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":834,"title":"IoT - Internet of Things Security","alias":"iot-internet-of-things-security","description":" IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).\r\nIoT involves adding internet connectivity to a system of interrelated computing devices, mechanical and digital machines, objects, animals and/or people. Each &quot;thing&quot; is provided a unique identifier and the ability to automatically transfer data over a network. Allowing devices to connect to the internet opens them up to a number of serious vulnerabilities if they are not properly protected.\r\nIoT security has become the subject of scrutiny after a number of high-profile incidents where a common IoT device was used to infiltrate and attack the larger network. Implementing security measures is critical to ensuring the safety of networks with IoT devices connected to them.\r\nIoT security hacks can happen in any industry, from smart home to a manufacturing plant to a connected car. The severity of impact depends greatly on the individual system, the data collected and/or the information it contains.\r\nAn attack disabling the brakes of a connected car, for example, or on a connected health device, such as an insulin pump hacked to administer too much medication to a patient, can be life-threatening. Likewise, an attack on a refrigeration system housing medicine that is monitored by an IoT system can ruin the viability of a medicine if temperatures fluctuate. Similarly, an attack on critical infrastructure -- an oil well, energy grid or water supply -- can be disastrous.\r\nSo, a robust IoT security portfolio must allow protecting devices from all types of vulnerabilities while deploying the security level that best matches application needs. Cryptography technologies are used to combat communication attacks. Security services are offered for protecting against lifecycle attacks. Isolation measures can be implemented to fend off software attacks. And, finally, IoT security should include tamper mitigation and side-channel attack mitigation technologies for fighting physical attacks of the chip.","materialsDescription":" <span style=\"font-weight: bold;\">What are the key requirements of IoT Security?</span>\r\nThe key requirements for any IoT security solution are:\r\n<ul><li>Device and data security, including authentication of devices and confidentiality and integrity of data</li><li>Implementing and running security operations at IoT scale</li><li>Meeting compliance requirements and requests</li><li>Meeting performance requirements as per the use case</li></ul>\r\n<span style=\"font-weight: bold;\">What do connected devices require to participate in the IoT Securely?</span>\r\nTo securely participate in the IoT, each connected device needs a unique identification – even before it has an IP address. This digital credential establishes the root of trust for the device’s entire lifecycle, from initial design to deployment to retirement.\r\n<span style=\"font-weight: bold;\">Why is device authentication necessary for the IoT?</span>\r\nStrong IoT device authentication is required to ensure connected devices on the IoT can be trusted to be what they purport to be. Consequently, each IoT device needs a unique identity that can be authenticated when the device attempts to connect to a gateway or central server. With this unique ID in place, IT system administrators can track each device throughout its lifecycle, communicate securely with it, and prevent it from executing harmful processes. If a device exhibits unexpected behavior, administrators can simply revoke its privileges.\r\n<span style=\"font-weight: bold;\">Why is secure manufacturing necessary for IoT devices?</span>\r\nIoT devices produced through unsecured manufacturing processes provide criminals opportunities to change production runs to introduce unauthorized code or produce additional units that are subsequently sold on the black market.\r\nOne way to secure manufacturing processes is to use hardware security modules (HSMs) and supporting security software to inject cryptographic keys and digital certificates and to control the number of units built and the code incorporated into each.\r\n<span style=\"font-weight: bold;\">Why is code signing necessary for IoT devices?</span>\r\nTo protect businesses, brands, partners, and users from software that has been infected by malware, software developers have adopted code signing. In the IoT, code signing in the software release process ensures the integrity of IoT device software and firmware updates and defends against the risks associated with code tampering or code that deviates from organizational policies.\r\nIn public key cryptography, code signing is a specific use of certificate-based digital signatures that enables an organization to verify the identity of the software publisher and certify the software has not been changed since it was published.\r\n<span style=\"font-weight: bold;\">What is IoT PKI?</span>\r\nToday there are more things (devices) online than there are people on the planet! Devices are the number one users of the Internet and need digital identities for secure operation. As enterprises seek to transform their business models to stay competitive, rapid adoption of IoT technologies is creating increasing demand for Public Key Infrastructures (PKIs) to provide digital certificates for the growing number of devices and the software and firmware they run.\r\nSafe IoT deployments require not only trusting the devices to be authentic and to be who they say they are, but also trusting that the data they collect is real and not altered. If one cannot trust the IoT devices and the data, there is no point in collecting, running analytics, and executing decisions based on the information collected.\r\nSecure adoption of IoT requires:\r\n<ul><li>Enabling mutual authentication between connected devices and applications</li><li>Maintaining the integrity and confidentiality of the data collected by devices</li><li>Ensuring the legitimacy and integrity of the software downloaded to devices</li><li>Preserving the privacy of sensitive data in light of stricter security regulations</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/iot.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4621,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/Redhawk_Network_Security__LLC.png","logo":true,"scheme":false,"title":"RedHawk Managed SIEM","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"redhawk-managed-siem","companyTitle":"Redhawk Network Security, LLC","companyTypes":["supplier","vendor"],"companyId":7009,"companyAlias":"redhawk-network-security-llc","description":"A staggering 27 percent of IT professionals receive more than one million threat alerts daily, according to a recent survey by Imperva. \r\nWith malware multiplying, an increase in phishing schemes, and cyber criminals taking organizations hostage, the need to be watchful and vigilant is more important than ever. \r\nA technology such as Security Information and Event Management (SIEM) can help you monitor your intrusion points 24x7x365 and combat cyberthreats.But the problem most organizations face is implementing, managing, and monitoring yet another technology. \r\nThey find the process of managing a SIEM daunting, much like trying to find a needle in a haystack. That’s where Redhawk fits in. A correctly-tuned SIEM can help find the needle and also reduce the number of resources required to manage your security program. \r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">For resource-constrained companies, Redhawk’s Managed SIEM Solution provides maximum security benefits with minimal associated costs.</span></span>\r\nIncreasingly sophisticated threats and changing attack methods now require a different approach. \r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Redhawk Network Security provides a dynamic Managed SIEM Solution, powered by AlienVault®, to meet your needs. Thee can help you implement a SIEM solution and manage it every step of the way, including the “tuning” period, where we tune the SIEM alerting to your specific environment.&nbsp; </span></span>\r\nThink of SIEM as keeping a watchful eye on all of your data points, looking for suspicious activity, with quick visibility and fast response times so that you are flagged right away. \r\nBy monitoring your network traffic and threat points, a SIEM can aggregate all of your logs into one source to detect and flag any type of compromise or suspicious activity, such as malware or multiple failed logins.\r\nRedhawk Network Security have the expertise and capabilities to provide the advanced security services you require to stay secure and minimize risks to your organization and the information you manage.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Fully-managed, end-to-end SIEM solution, including the initial set-up, and tuning to your environment to ensure reliable and accurate security monitoring:</span></span>\r\n<ul><li>Redhawk installs and set ups the SIEM solution and tune it to your specific environment.</li><li>Team continually tune the service, answering every alarm, making adjustments along the way. </li><li>24x7x365 Monitoring and Incident Response.</li><li>Threat mitigation and remediation expertise. </li><li>Periodic reports on your schedule in the format you choose</li><li>You have access to up-to-date threat intelligence with access to the AlienVault® Open Threat Exchange® (OTX)</li><li>This is certified compliant with PCI DSS, HIPAA, and SOC 2</li><li>Threat detection across all environments: AWS, Azure, on-premises, and cloud applications such as Office 365 and G Suite</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">All of the Security Essentials in One Platform</span></p>\r\nRedhawk can help you eliminate the complexity and costs of managing multiple, disparate points with a unified platform that delivers all the security essentials required for effective threat detection, incident response, and compliance management. \r\nThis includes:\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Asset Discovery</span></span>\r\nVisibility into who and what is connected to the network at all times \r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Vulnerability Assessment</span></span>\r\nAutomated asset scanning to identify vulnerabilities and exposure\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Intrusion Detection</span></span>\r\nCentralized threat detection across all environments\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Behavioral Monitoring</span></span>\r\nIdentification of suspicious behavior and network anomalies \r\n<span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">SIEM and Log Management</span></span>\r\nCorrelation and analysis of security event data from across the network \r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Compliance Management</span></span>\r\nContinuous monitoring, compliant log storage, and built-in reporting \r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Intelligence</span></span>\r\nReal-time, validated intelligence on the latest threats and attack methods<br /><br />","shortDescription":"A dynamic Managed SIEM Solution, powered by AlienVault to meet your needs. ","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":10,"sellingCount":11,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"RedHawk Managed SIEM","keywords":"","description":"A staggering 27 percent of IT professionals receive more than one million threat alerts daily, according to a recent survey by Imperva. \r\nWith malware multiplying, an increase in phishing schemes, and cyber criminals taking organizations hostage, the need to b","og:title":"RedHawk Managed SIEM","og:description":"A staggering 27 percent of IT professionals receive more than one million threat alerts daily, according to a recent survey by Imperva. \r\nWith malware multiplying, an increase in phishing schemes, and cyber criminals taking organizations hostage, the need to b","og:image":"https://old.roi4cio.com/fileadmin/user_upload/Redhawk_Network_Security__LLC.png"},"eventUrl":"","translationId":4622,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":45,"title":"SIEM - Security Information and Event Management","alias":"siem-security-information-and-event-management","description":"<span style=\"font-weight: bold; \">Security information and event management (SIEM)</span> is an approach to security management that combines SIM (security information management) and SEM (security event management) functions into one security management system. \r\n The underlying principles of every SIEM system is to aggregate relevant data from multiple sources, identify deviations from the norm and take appropriate action. At the most basic level, a SIEM system can be rules-based or employ a statistical correlation engine to establish relationships between event log entries. Advanced SIEM products have evolved to include user and entity behavior analytics (UEBA) and security orchestration and automated response (SOAR). \r\nThe acronyms SEM, SIM and SIEM have sometimes been used interchangeably, but generally refer to the different primary focus of products:\r\n<ul><li><span style=\"font-weight: bold;\">Log management:</span> Focus on simple collection and storage of log messages and audit trails.</li><li><span style=\"font-weight: bold;\">Security information management (SIM):</span> Long-term storage as well as analysis and reporting of log data.</li><li><span style=\"font-weight: bold;\">Security event manager (SEM):</span> Real-time monitoring, correlation of events, notifications and console views.</li><li><span style=\"font-weight: bold;\">Security information event management (SIEM):</span> Combines SIM and SEM and provides real-time analysis of security alerts generated by network hardware and applications.</li><li><span style=\"font-weight: bold;\">Managed Security Service (MSS) or Managed Security Service Provider (MSSP):</span> The most common managed services appear to evolve around connectivity and bandwidth, network monitoring, security, virtualization, and disaster recovery.</li><li><span style=\"font-weight: bold;\">Security as a service (SECaaS):</span> These security services often include authentication, anti-virus, anti-malware/spyware, intrusion detection, Penetration testing and security event management, among others.</li></ul>\r\nToday, most of SIEM technology works by deploying multiple collection agents in a hierarchical manner to gather security-related events from end-user devices, servers, network equipment, as well as specialized security equipment like firewalls, antivirus or intrusion prevention systems. The collectors forward events to a centralized management console where security analysts sift through the noise, connecting the dots and prioritizing security incidents.\r\nSome of the most important features to review when evaluating Security Information and Event Management software are:\r\n<ol><li><span style=\"font-weight: bold; \">Integration with other controls:</span> Can the system give commands to other enterprise security controls to prevent or stop attacks in progress?</li><li><span style=\"font-weight: bold; \">Artificial intelligence:</span> Can the system improve its own accuracy by through machine and deep learning?</li><li><span style=\"font-weight: bold; \">Threat intelligence feeds:</span>&nbsp; Can the system support threat intelligence feeds of the organization's choosing or is it mandated to use a particular feed?</li><li><span style=\"font-weight: bold; \">Robust compliance reporting:</span>&nbsp; Does the system include built-in reports for common compliance needs and the provide the organization with the ability to customize or create new compliance reports?</li><li><span style=\"font-weight: bold; \">Forensics capabilities:</span>&nbsp; Can the system capture additional information about security events by recording the headers and contents of packets of interest? </li></ol>\r\n\r\n\r\n","materialsDescription":"<h1 class=\"align-center\"> Why is SIEM Important?</h1>\r\nSIEM has become a core security component of modern organizations. The main reason is that every user or tracker leaves behind a virtual trail in a network’s log data. SIEM software is designed to use this log data in order to generate insight into past attacks and events. A SIEM solution not only identifies that an attack has happened, but allows you to see how and why it happened as well.\r\nAs organizations update and upscale to increasingly complex IT infrastructures, SIEM has become even more important in recent years. Contrary to popular belief, firewalls and antivirus packages are not enough to protect a network in its entirety. Zero-day attacks can still penetrate a system’s defenses even with these security measures in place.\r\nSIEM addresses this problem by detecting attack activity and assessing it against past behavior on the network. A security event monitoring has the ability to distinguish between legitimate use and a malicious attack. This helps to increase a system’s incident protection and avoid damage to systems and virtual property.\r\nThe use of SIEM also helps companies to comply with a variety of industry cyber management regulations. Log management is the industry standard method of auditing activity on an IT network. SIEM management provides the best way to meet this regulatory requirement and provide transparency over logs in order to generate clear insights and improvements.\r\n<h1 class=\"align-center\">Evaluation criteria for security information and event management software:</h1>\r\n<ul><li>Threat identification: Raw log form vs. descriptive.</li><li>Threat tracking: Ability to track through the various events, from source to destination.</li><li>Policy enforcement: Ability to enforce defined polices.</li><li>Application analysis: Ability to analyze application at Layer 7 if necessary.</li><li>Business relevance of events: Ability to assign business risk to events and have weighted threat levels.</li><li>Measuring changes and improvements: Ability to track configuration changes to devices.</li><li>Asset-based information: Ability to gather information on devices on the network.</li><li>Anomalous behavior (server): Ability to trend and see changes in how it communicates to others.</li><li>Anomalous behavior (network): Ability to trend and see how communications pass throughout the network.</li><li>Anomalous behavior (application): Ability to trend and see changes in how it communicates to others.</li><li>User monitoring: User activity, logging in, applications usage, etc.</li></ul>\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SIEM.png"},{"id":59,"title":"SCADA - Supervisory Control And Data Acquisition","alias":"scada-supervisory-control-and-data-acquisition","description":"<span style=\"font-weight: bold; \">SCADA</span> stands for <span style=\"font-weight: bold; \">Supervisory Control and Data Acquisition</span>, a term which describes the basic functions of a SCADA system. Companies use SCADA systems to control equipment across their sites and to collect and record data about their operations. SCADA is not a specific technology, but a type of application. Any application that gets operating data about a system in order to control and optimise that system is a SCADA application. That application may be a petrochemical distillation process, a water filtration system, a pipeline compressor, or just about anything else.\r\nSCADA solutions typically come in a combination of software and hardware elements, such as&nbsp;programmable logic controllers (PLCs) and remote terminal units (RTUs). Data acquisition in SCADA starts with PLCs and RTUs, which communicate with plant floor equipment such as factory machinery and sensors. Data gathered from the equipment is then sent to the next level, such as a control room, where operators can supervise the PLC and RTU controls using human-machine interfaces (HMIs). HMIs are an important element of SCADA systems. They are the screens that&nbsp;operators&nbsp;use to communicate with the SCADA system.\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">The major components of a SCADA technology include:</span></p>\r\n<ul><li><span style=\"font-weight: bold;\">Master Terminal Unit (MTU).</span> It comprises a computer, PLC and a network server that helps MTU to communicate with the RTUs. MTU begins communication, collects and saves data, helps to interface with operators and to communicate data to other systems.</li><li><span style=\"font-weight: bold;\">Remote Terminal Unit (RTU).</span> RTU is used to collect information from these sensors and further sends the data to MTU. RTUs have the storage capacity facility. So, it stores the data and transmits the data when MTU sends the corresponding command.</li><li><span style=\"font-weight: bold;\">Communication Network (defined by its network topology).</span> In general, network means connection. When you tell a SCADA communication network, it is defined as a link between RTU in the field to MTU in the central location. The bidirectional wired or wireless communication channel is used for the networking purpose. Various other communication mediums like fiber optic cables, twisted pair cables, etc. are also used.</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">Objectives of Supervisory Control and Data Acquisition system</span></p>\r\n<ul><li><span style=\"font-weight: bold;\">Monitor:</span> SCADA control system continuously monitors the physical parameters</li><li><span style=\"font-weight: bold;\">Measure:</span> It measures the parameter for processing</li><li><span style=\"font-weight: bold;\">Data Acquisition:</span> It acquires data from RTU, data loggers, etc</li><li><span style=\"font-weight: bold;\">Data Communication:</span> It helps to communicate and transmit a large amount of data between MTU and RTU units</li><li><span style=\"font-weight: bold;\">Controlling:</span> Online real-time monitoring and controlling of the process</li><li><span style=\"font-weight: bold;\">Automation:</span> It helps for automatic transmission and functionality</li></ul>\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Who Uses SCADA?</h1>\r\nSCADA systems are used by industrial organizations and companies in the public and private sectors to control and maintain efficiency, distribute data for smarter decisions, and communicate system issues to help mitigate downtime. Supervisory control systems work well in many different types of enterprises because they can range from simple configurations to large, complex installations. They are the backbone of many modern industries, including:\r\n<ul><li>Energy</li><li>Food and beverage</li><li>Manufacturing</li><li>Oil and gas</li><li>Power</li><li>Recycling</li><li>Transportation</li><li>Water and waste water</li><li>And many more</li></ul>\r\nVirtually anywhere you look in today's world, there is some type of SCADA monitoring system running behind the scenes: maintaining the refrigeration systems at the local supermarket, ensuring production and safety at a refinery, achieving quality standards at a waste water treatment plant, or even tracking your energy use at home, to give a few examples. Effective SCADA systems can result in significant savings of time and money. Numerous case studies have been published highlighting the benefits and savings of using a modern SCADA software.\r\n<h1 class=\"align-center\">Benefits of using SCADA software</h1>\r\nUsing modern SCADA software provides numerous benefits to businesses, and helps companies make the most of those benefits. Some of these advantages include:\r\n<span style=\"font-weight: bold; \">Easier engineering:</span> An advanced supervisory control application such provides easy-to-locate tools, wizards, graphic templates and other pre-configured elements, so engineers can create automation projects and set parameters quickly, even if they don't have programming experience. In addition, you can also easily maintain and expand existing applications as needed. The ability to automate the engineering process allows users, particularly system integrators and original equipment manufacturers (OEM), to set up complex projects much more efficiently and accurately.\r\n<span style=\"font-weight: bold; \">Improved data management:</span> A high-quality SCADA system makes it easier to collect, manage, access and analyze your operational data. It can enable automatic data recording and provide a central location for data storage. Additionally, it can transfer data to other systems such as MES and ERP as needed. \r\n<span style=\"font-weight: bold; \">Greater visibility:</span> One of the main advantages of using SCADA software is the improvement in visibility into your operations. It provides you with real-time information about your operations and enables you to conveniently view that information via an HMI. SCADA monitoring can also help in generating reports and analyzing data.\r\n<span style=\"font-weight: bold; \">Enhanced efficiency:</span> A SCADA system allows you to streamline processes through automated actions and user-friendly tools. The data that SCADA provides allows you to uncover opportunities for improving the efficiency of the operations, which can be used to make long-term changes to processes or even respond to real-time changes in conditions.\r\n<span style=\"font-weight: bold; \">Increased usability:</span> SCADA systems enable workers to control equipment more quickly, easily and safely through an HMI. Rather than having to control each piece of machinery manually, workers can manage them remotely and often control many pieces of equipment from a single location. Managers, even those who are not currently on the floor, also gain this capability.\r\n<span style=\"font-weight: bold; \">Reduced downtime:</span> A SCADA system can detect faults at an early stage and push instant alerts to the responsible personnel. Powered by predictive analytics, a SCADA system can also inform you of a potential issue of the machinery before it fails and causes larger problems. These features can help improve the overall equipment effectiveness (OEE) and reduce the amount of time and cost on troubleshooting and maintenance.\r\n<span style=\"font-weight: bold;\">Easy integration:</span> Connectivity to existing machine environments is key to removing data silos and maximizing productivity. \r\n<span style=\"font-weight: bold;\">Unified platform:</span>All of your data is also available in one platform, which helps you to get a clear overview of your operations and take full advantage of your data. All users also get real-time updates locally or remotely, ensuring everyone on your team is on the same page.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/SCADA__-_Supervisory_Control_And_Data_Acquisition.png"},{"id":399,"title":"Requirements Visualization, Definition, and Management","alias":"requirements-visualization-definition-and-management","description":" Requirements management is the process of documenting, analyzing, tracing, prioritizing and agreeing on requirements and then controlling change and communicating to relevant stakeholders. It is a continuous process throughout a project. A requirement is a capability to which a project outcome (product or service) should conform.\r\nThe purpose of requirements management is to ensure that an organization documents, verifies, and meets the needs and expectations of its customers and internal or external stakeholders. Requirements management begins with the analysis and elicitation of the objectives and constraints of the organization. Requirements management further includes supporting planning for requirements, integrating requirements and the organization for working with them (attributes for requirements), as well as relationships with other information delivering against requirements, and changes for these.\r\nThe traceability thus established is used in managing requirements to report back fulfilment of company and stakeholder interests in terms of compliance, completeness, coverage, and consistency. Traceabilities also support change management as part of requirements management in understanding the impacts of changes through requirements or other related elements (e.g., functional impacts through relations to functional architecture), and facilitating introducing these changes.\r\nRequirements management involves communication between the project team members and stakeholders, and adjustment to requirements changes throughout the course of the project. To prevent one class of requirements from overriding another, constant communication among members of the development team is critical. For example, in software development for internal applications, the business has such strong needs that it may ignore user requirements, or believe that in creating use cases, the user requirements are being taken care of.\r\nRequirements traceability is concerned with documenting the life of a requirement. It should be possible to trace back to the origin of each requirement and every change made to the requirement should therefore be documented in order to achieve traceability. Even the use of the requirement after the implemented features have been deployed and used should be traceable.\r\nRequirements come from different sources, like the business person ordering the product, the marketing manager and the actual user. These people all have different requirements for the product. Using requirements traceability, an implemented feature can be traced back to the person or group that wanted it during the requirements elicitation. This can, for example, be used during the development process to prioritize the requirement, determining how valuable the requirement is to a specific user. It can also be used after the deployment when user studies show that a feature is not used, to see why it was required in the first place.","materialsDescription":"<span style=\"font-weight: bold; \">Requirements activities</span>\r\nAt each stage in a development process, there are key requirements management activities and methods. To illustrate, consider a standard five-phase development process with Investigation, Feasibility, Design, Construction, and Test, and Release stages.\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Investigation</span></span>\r\nIn Investigation, the first three classes of requirements are gathered from the users, from the business, and from the development team. In each area, similar questions are asked; what are the goals, what are the constraints, what are the current tools or processes in place, and so on. Only when these requirements are well understood can functional requirements be developed.\r\nIn the common case, requirements cannot be fully defined at the beginning of the project. Some requirements will change, either because they simply weren’t extracted, or because internal or external forces at work affect the project in mid-cycle.\r\nThe deliverable from the Investigation stage is a requirements document that has been approved by all members of the team. Later, in the thick of development, this document will be critical in preventing scope creep or unnecessary changes. As the system develops, each new feature opens a world of new possibilities, so the requirements specification anchors the team to the original vision and permits a controlled discussion of scope change.\r\nWhile many organizations still use only documents to manage requirements, others manage their requirements baselines using software tools. These tools allow requirements to be managed in a database, and usually have functions to automate traceability (e.g., by allowing electronic links to be created between parent and child requirements, or between test cases and requirements), electronic baseline creation, version control, and change management. Usually, such tools contain an export function that allows a specification document to be created by exporting the requirements data into a standard document application.\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Feasibility</span></span>\r\nIn the Feasibility stage, the costs of the requirements are determined. For user requirements, the current cost of work is compared to the future projected costs once the new system is in place. Questions such as these are asked: “What are data entry errors costing us now?” Or “What is the cost of scrap due to operator error with the current interface?” Actually, the need for the new tool is often recognized as these questions come to the attention of financial people in the organization.\r\nBusiness costs would include, “What department has the budget for this?” “What is the expected rate of return on the new product in the marketplace?” “What’s the internal rate of return in reducing the costs of training and support if we make a new, easier-to-use system?”\r\nTechnical costs are related to software development costs and hardware costs. “Do we have the right people to create the tool?” “Do we need new equipment to support expanded software roles?” This last question is an important type. The team must inquire into whether the newest automated tools will add sufficient processing power to shift some of the burdens from the user to the system in order to save people time.\r\nThe question also points out a fundamental point about requirements management. A human and a tool form a system, and this realization is especially important if the tool is a computer or a new application on a computer. The human mind excels in parallel processing and interpretation of trends with insufficient data. The CPU excels in serial processing and accurate mathematical computation. The overarching goal of the requirements management effort for a software project would thus be to make sure the work being automated gets assigned to the proper processor. For instance, “Don’t make the human remember where she is in the interface. Make the interface report the human’s location in the system at all times.” Or “Don’t make the human enter the same data in two screens. Make the system store the data and fill in the second screen as needed.”\r\nThe deliverable from the Feasibility stage is the budget and schedule for the project.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Design</span></span>\r\nAssuming that costs are accurately determined and benefits to be gained are sufficiently large, the project can proceed to the Design stage. In Design, the main requirements management activity is comparing the results of the design against the requirements document to make sure that work is staying in scope.\r\nAgain, flexibility is paramount to success. Here’s a classic story of scope change in mid-stream that actually worked well. Ford auto designers in the early ‘80s were expecting gasoline prices to hit $3.18 per gallon by the end of the decade. Midway through the design of the Ford Taurus, prices had centered to around $1.50 a gallon. The design team decided they could build a larger, more comfortable, and more powerful car if the gas prices stayed low, so they redesigned the car. The Taurus launch set nationwide sales records when the new car came out, primarily because it was so roomy and comfortable to drive.\r\nIn most cases, however, departing from the original requirements to that degree does not work. So the requirements document becomes a critical tool that helps the team make decisions about design changes.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Construction and test</span></span>\r\nIn the construction and testing stage, the main activity of requirements management is to make sure that work and cost stay within schedule and budget, and that the emerging tool does, in fact, meet requirements. A main tool used in this stage is prototype construction and iterative testing. For a software application, the user interface can be created on paper and tested with potential users while the framework of the software is being built. The results of these tests are recorded in a user interface design guide and handed off to the design team when they are ready to develop the interface. This saves time and makes their jobs much easier.\r\nVerification: This effort verifies that the requirement has been implemented correctly. There are 4 methods of verification: analysis, inspection, testing, and demonstration. Numerical software execution results or through-put on a network test, for example, provides analytical evidence that the requirement has been met. Inspection of vendor documentation or spec sheets also verifies requirements. Actually testing or demonstrating the software in a lab environment also verifies the requirements: a test type of verification will occur when test equipment not normally part of the lab (or system under test) is used. Comprehensive test procedures which outline the steps and their expected results clearly identify what is to be seen as a result of performing the step. After the step or set of steps is completed the last step's expected result will call out what has been seen and then identify what requirements or requirements have been verified (identified by number). The requirement number, title, and verbiage are tied together in another location in the test document.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Requirements change management</span></span>\r\nHardly would any software development project be completed without some changes being asked of the project. The changes can stem from changes in the environment in which the finished product is envisaged to be used, business changes, regulation changes, errors in the original definition of requirements, limitations in technology, changes in the security environment and so on. The activities of requirements change management include receiving the change requests from the stakeholders, recording the received change requests, analyzing and determining the desirability and process of implementation, implementation of the change request, quality assurance for the implementation and closing the change request. Then the data of change requests be compiled, analyzed and appropriate metrics are derived and dovetailed into the organizational knowledge repository.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Release</span></span>\r\nRequirements management does not end with product release. From that point on, the data coming in about the application’s acceptability is gathered and fed into the Investigation phase of the next generation or release. Thus the process begins again.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Requirements_Visualization.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4366,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ServerChoice.png","logo":true,"scheme":false,"title":"CORE Security","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"core-security","companyTitle":"ServerChoice","companyTypes":["supplier","vendor"],"companyId":6756,"companyAlias":"serverchoice","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Introducing CORE Security</span></p>\r\nWhen it comes to securing your cloud, you need to peace of mind that security’s at the core of your hosted infrastructure. That’s why we’ve put together three ServerChoice CORE Security™ packages, with varying levels of protection, so you can get best-fit cyber security for your organisation.\r\n<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">CORE Base</span></span></p>\r\n<ul><li>Two-factor authentication</li><li>TrendMicro anti-virus &amp; malware protection</li><li>Vulnerability scanning: Unmanaged Quarterly</li><li>System hardening</li><li>Next-generation firewall</li><li>Advanced DDoS mitigation: Standard (20 Gbps)</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">CORE Enterprise</span></span></p>\r\n<ul><li>Two-factor authentication</li><li>TrendMicro anti-virus &amp; malware protection</li><li>Vulnerability scanning: Unmanaged Monthly</li><li>System hardening</li><li>Next-generation firewall</li><li>File integrity monitoring</li><li>Advanced DDoS mitigation: Enhanced (250 Gbps)</li><li>24/7 SIEM services</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">CORE Platinum</span></span></p>\r\n<ul><li>Two-factor authentication</li><li>TrendMicro anti-virus &amp; malware protection</li><li>Vulnerability scanning: Managed Monthly</li><li>System hardening</li><li>Next-generation firewall</li><li>File integrity monitoring</li><li>Advanced DDoS mitigation</li><li>Pro (Terabit+)</li><li>24/7 SIEM services</li><li>Intrusion Prevention System (IPS)</li></ul>\r\n<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Bolt-on CORE Security™ Services</span></span></p>\r\nIn addition to the above security packages, we offer a range of additional security enhancements to deliver maximum protection from cyber threats:\r\n<ul><li>Data loss prevention (DLP)</li><li>Web application firewalls (WAF)</li><li>Penetration testing</li><li>URL filtering (Virtual Desktops only)</li><li>Email spam filtering and antivirus (Exchange only)</li><li>Compliance consultancy</li></ul>\r\n\r\n","shortDescription":"Flexible packages for enhanced securityю When it comes to securing your cloud, you need to peace of mind that security’s at the core of your hosted infrastructure. \r\n\r\n","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"CORE Security","keywords":"","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Introducing CORE Security</span></p>\r\nWhen it comes to securing your cloud, you need to peace of mind that security’s at the core of your hosted infrastructure. That’s why we’ve put together three Server","og:title":"CORE Security","og:description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Introducing CORE Security</span></p>\r\nWhen it comes to securing your cloud, you need to peace of mind that security’s at the core of your hosted infrastructure. That’s why we’ve put together three Server","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ServerChoice.png"},"eventUrl":"","translationId":4366,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":24,"title":"DLP - Data Leak Prevention","alias":"dlp-data-leak-prevention","description":"Data leak prevention (DLP) is a suite of technologies aimed at stemming the loss of sensitive information that occurs in enterprises across the globe. By focusing on the location, classification and monitoring of information at rest, in use and in motion, this solution can go far in helping an enterprise get a handle on what information it has, and in stopping the numerous leaks of information that occur each day. DLP is not a plug-and-play solution. The successful implementation of this technology requires significant preparation and diligent ongoing maintenance. Enterprises seeking to integrate and implement DLP should be prepared for a significant effort that, if done correctly, can greatly reduce risk to the organization. Those implementing the solution must take a strategic approach that addresses risks, impacts and mitigation steps, along with appropriate governance and assurance measures.","materialsDescription":" <span style=\"font-weight: bold;\">How to protect the company from internal threats associated with leakage of confidential information?</span>\r\nIn order to protect against any threat, you must first realize its presence. Unfortunately, not always the management of companies is able to do this if it comes to information security threats. The key to successfully protecting against information leaks and other threats lies in the skillful use of both organizational and technical means of monitoring personnel actions.\r\n<span style=\"font-weight: bold;\">How should the personnel management system in the company be organized to minimize the risks of leakage of confidential information?</span>\r\nA company must have a special employee responsible for information security, and a large department must have a department directly reporting to the head of the company.\r\n<span style=\"font-weight: bold;\">Which industry representatives are most likely to encounter confidential information leaks?</span>\r\nMore than others, representatives of such industries as industry, energy, and retail trade suffer from leaks. Other industries traditionally exposed to leakage risks — banking, insurance, IT — are usually better at protecting themselves from information risks, and for this reason they are less likely to fall into similar situations.\r\n<span style=\"font-weight: bold;\">What should be adequate measures to protect against leakage of information for an average company?</span>\r\nFor each organization, the question of protection measures should be worked out depending on the specifics of its work, but developing information security policies, instructing employees, delineating access to confidential data and implementing a DLP system are necessary conditions for successful leak protection for any organization. Among all the technical means to prevent information leaks, the DLP system is the most effective today, although its choice must be taken very carefully to get the desired result. So, it should control all possible channels of data leakage, support automatic detection of confidential information in outgoing traffic, maintain control of work laptops that temporarily find themselves outside the corporate network...\r\n<span style=\"font-weight: bold;\">Is it possible to give protection against information leaks to outsourcing?</span>\r\nFor a small company, this may make sense because it reduces costs. However, it is necessary to carefully select the service provider, preferably before receiving recommendations from its current customers.\r\n<span style=\"font-weight: bold;\">What data channels need to be monitored to prevent leakage of confidential information?</span>\r\nAll channels used by employees of the organization - e-mail, Skype, HTTP World Wide Web protocol ... It is also necessary to monitor the information recorded on external storage media and sent to print, plus periodically check the workstation or laptop of the user for files that are there saying should not.\r\n<span style=\"font-weight: bold;\">What to do when the leak has already happened?</span>\r\nFirst of all, you need to notify those who might suffer - silence will cost your reputation much more. Secondly, you need to find the source and prevent further leakage. Next, you need to assess where the information could go, and try to somehow agree that it does not spread further. In general, of course, it is easier to prevent the leakage of confidential information than to disentangle its consequences.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Data_Leak_Prevention.png"},{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":41,"title":"Antispam","alias":"antispam","description":"In each system, which involves the communication of users, there is always the problem of spam, or the mass mailing of unsolicited emails, which is solved using the antispam system. An antispam system is installed to catch and filter spam at different levels. Spam monitoring and identification are relevant on corporate servers that support corporate email, here the antispam system filters spam on the server before it reaches the mailbox. There are many programs that help to cope with this task, but not all of them are equally useful. The main objective of such programs is to stop sending unsolicited letters, however, the methods of assessing and suppressing such actions can be not only beneficial but also detrimental to your organization. So, depending on the rules and policies of mail servers, your server, or even a domain, may be blacklisted and the transfer of letters will be limited through it, and you may not even be warned about it.\r\nThe main types of installation and use of anti-spam systems:\r\n<ul><li>installation of specialized equipment, a gateway that filters mail before it reaches the server;</li><li>use of external antispam systems for analyzing emails and content;</li><li>setting up an antispam system with the ability to learn on the mail server itself;</li><li>installation of spam filtering software on the client’s computer.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Anti-spam technologies:</span>\r\n<span style=\"font-weight: bold;\">Heuristic analysis</span>\r\nExtremely complex, highly intelligent technology for empirical analysis of all parts of a message: header fields, message bodies, etc. Not only the message itself is analyzed. The heuristic analyzer is constantly being improved, new rules are continuously added to it. It works “ahead of the curve” and makes it possible to recognize still unknown varieties of spam of a new generation before the release of available updates.\r\n<span style=\"font-weight: bold;\">Filtering counteraction</span>\r\nThis is one of the most advanced and effective anti-spam technologies. It is to recognize the tricks resorted to by spammers to bypass anti-spam filters.\r\n<span style=\"font-weight: bold;\">HTML based analysis</span>\r\nHTML code comparable to samples of HTML signatures in antispam. Such a comparison, using the available data on the size of typical spam images, protects users from spam messages using HTML-code, which are often included in the online image.\r\n<span style=\"font-weight: bold;\">Spam detection technology for message envelopes</span>\r\nDetection of fakes in the &quot;stamps&quot; of SMTP-servers and in other elements of the e-mail header is the newest direction in the development of anti-spam methods. Email addresses can not be trusted. Fake emails contain more than just spam. For example, anonymous and even threats. Technologies of various anti-spam systems allow you to send such messages. Thus, it provides not only the economic movement, but also the protection of employees.\r\n<span style=\"font-weight: bold;\">Semantic analysis</span>\r\nMeaning in words and phrases is compared with typical spam vocabulary. Comparison of provisions for a special dictionary, for expression and symbols.\r\n<span style=\"font-weight: bold;\">Anti-camming technology</span>\r\nScamming is probably the most dangerous type of spam. All of them have the so-called &quot;Nigerian letters&quot;, reports of winnings in the lottery, casino, fake letters and credit services.\r\n<span style=\"font-weight: bold;\">Technical spam filtering</span>\r\nAutomatic notification of e-mail - bounce-messages - to inform users about the malfunction of the postal system (for example, non-delivery of address letters). Attackers can use similar messages. Under the guise of a technical notification, computer service or ordinary spam can penetrate the computer.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Antispam.png"},{"id":45,"title":"SIEM - Security Information and Event Management","alias":"siem-security-information-and-event-management","description":"<span style=\"font-weight: bold; \">Security information and event management (SIEM)</span> is an approach to security management that combines SIM (security information management) and SEM (security event management) functions into one security management system. \r\n The underlying principles of every SIEM system is to aggregate relevant data from multiple sources, identify deviations from the norm and take appropriate action. At the most basic level, a SIEM system can be rules-based or employ a statistical correlation engine to establish relationships between event log entries. Advanced SIEM products have evolved to include user and entity behavior analytics (UEBA) and security orchestration and automated response (SOAR). \r\nThe acronyms SEM, SIM and SIEM have sometimes been used interchangeably, but generally refer to the different primary focus of products:\r\n<ul><li><span style=\"font-weight: bold;\">Log management:</span> Focus on simple collection and storage of log messages and audit trails.</li><li><span style=\"font-weight: bold;\">Security information management (SIM):</span> Long-term storage as well as analysis and reporting of log data.</li><li><span style=\"font-weight: bold;\">Security event manager (SEM):</span> Real-time monitoring, correlation of events, notifications and console views.</li><li><span style=\"font-weight: bold;\">Security information event management (SIEM):</span> Combines SIM and SEM and provides real-time analysis of security alerts generated by network hardware and applications.</li><li><span style=\"font-weight: bold;\">Managed Security Service (MSS) or Managed Security Service Provider (MSSP):</span> The most common managed services appear to evolve around connectivity and bandwidth, network monitoring, security, virtualization, and disaster recovery.</li><li><span style=\"font-weight: bold;\">Security as a service (SECaaS):</span> These security services often include authentication, anti-virus, anti-malware/spyware, intrusion detection, Penetration testing and security event management, among others.</li></ul>\r\nToday, most of SIEM technology works by deploying multiple collection agents in a hierarchical manner to gather security-related events from end-user devices, servers, network equipment, as well as specialized security equipment like firewalls, antivirus or intrusion prevention systems. The collectors forward events to a centralized management console where security analysts sift through the noise, connecting the dots and prioritizing security incidents.\r\nSome of the most important features to review when evaluating Security Information and Event Management software are:\r\n<ol><li><span style=\"font-weight: bold; \">Integration with other controls:</span> Can the system give commands to other enterprise security controls to prevent or stop attacks in progress?</li><li><span style=\"font-weight: bold; \">Artificial intelligence:</span> Can the system improve its own accuracy by through machine and deep learning?</li><li><span style=\"font-weight: bold; \">Threat intelligence feeds:</span>&nbsp; Can the system support threat intelligence feeds of the organization's choosing or is it mandated to use a particular feed?</li><li><span style=\"font-weight: bold; \">Robust compliance reporting:</span>&nbsp; Does the system include built-in reports for common compliance needs and the provide the organization with the ability to customize or create new compliance reports?</li><li><span style=\"font-weight: bold; \">Forensics capabilities:</span>&nbsp; Can the system capture additional information about security events by recording the headers and contents of packets of interest? </li></ol>\r\n\r\n\r\n","materialsDescription":"<h1 class=\"align-center\"> Why is SIEM Important?</h1>\r\nSIEM has become a core security component of modern organizations. The main reason is that every user or tracker leaves behind a virtual trail in a network’s log data. SIEM software is designed to use this log data in order to generate insight into past attacks and events. A SIEM solution not only identifies that an attack has happened, but allows you to see how and why it happened as well.\r\nAs organizations update and upscale to increasingly complex IT infrastructures, SIEM has become even more important in recent years. Contrary to popular belief, firewalls and antivirus packages are not enough to protect a network in its entirety. Zero-day attacks can still penetrate a system’s defenses even with these security measures in place.\r\nSIEM addresses this problem by detecting attack activity and assessing it against past behavior on the network. A security event monitoring has the ability to distinguish between legitimate use and a malicious attack. This helps to increase a system’s incident protection and avoid damage to systems and virtual property.\r\nThe use of SIEM also helps companies to comply with a variety of industry cyber management regulations. Log management is the industry standard method of auditing activity on an IT network. SIEM management provides the best way to meet this regulatory requirement and provide transparency over logs in order to generate clear insights and improvements.\r\n<h1 class=\"align-center\">Evaluation criteria for security information and event management software:</h1>\r\n<ul><li>Threat identification: Raw log form vs. descriptive.</li><li>Threat tracking: Ability to track through the various events, from source to destination.</li><li>Policy enforcement: Ability to enforce defined polices.</li><li>Application analysis: Ability to analyze application at Layer 7 if necessary.</li><li>Business relevance of events: Ability to assign business risk to events and have weighted threat levels.</li><li>Measuring changes and improvements: Ability to track configuration changes to devices.</li><li>Asset-based information: Ability to gather information on devices on the network.</li><li>Anomalous behavior (server): Ability to trend and see changes in how it communicates to others.</li><li>Anomalous behavior (network): Ability to trend and see how communications pass throughout the network.</li><li>Anomalous behavior (application): Ability to trend and see changes in how it communicates to others.</li><li>User monitoring: User activity, logging in, applications usage, etc.</li></ul>\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SIEM.png"},{"id":52,"title":"SaaS - software as a service","alias":"saas-software-as-a-service","description":"<span style=\"font-weight: bold;\">Software as a service (SaaS)</span> is a software licensing and delivery model in which software is licensed on a subscription basis and is centrally hosted. It is sometimes referred to as &quot;on-demand software&quot;, and was formerly referred to as &quot;software plus services&quot; by Microsoft.\r\n SaaS services is typically accessed by users using a thin client, e.g. via a web browser. SaaS software solutions has become a common delivery model for many business applications, including office software, messaging software, payroll processing software, DBMS software, management software, CAD software, development software, gamification, virtualization, accounting, collaboration, customer relationship management (CRM), Management Information Systems (MIS), enterprise resource planning (ERP), invoicing, human resource management (HRM), talent acquisition, learning management systems, content management (CM), Geographic Information Systems (GIS), and service desk management. SaaS has been incorporated into the strategy of nearly all leading enterprise software companies.\r\nSaaS applications are also known as <span style=\"font-weight: bold;\">Web-based software</span>, <span style=\"font-weight: bold;\">on-demand software</span> and<span style=\"font-weight: bold;\"> hosted software</span>.\r\nThe term &quot;Software as a Service&quot; (SaaS) is considered to be part of the nomenclature of cloud computing, along with Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Desktop as a Service (DaaS),managed software as a service (MSaaS), mobile backend as a service (MBaaS), and information technology management as a service (ITMaaS).\r\nBecause SaaS is based on cloud computing it saves organizations from installing and running applications on their own systems. That eliminates or at least reduces the associated costs of hardware purchases and maintenance and of software and support. The initial setup cost for a SaaS application is also generally lower than it for equivalent enterprise software purchased via a site license.\r\nSometimes, the use of SaaS cloud software can also reduce the long-term costs of software licensing, though that depends on the pricing model for the individual SaaS offering and the enterprise’s usage patterns. In fact, it’s possible for SaaS to cost more than traditional software licenses. This is an area IT organizations should explore carefully.<br />SaaS also provides enterprises the flexibility inherent with cloud services: they can subscribe to a SaaS offering as needed rather than having to buy software licenses and install the software on a variety of computers. The savings can be substantial in the case of applications that require new hardware purchases to support the software.<br /><br /><br /><br />","materialsDescription":"<h1 class=\"align-center\"><span style=\"font-weight: normal;\">Who uses SaaS?</span></h1>\r\nIndustry analyst Forrester Research notes that SaaS adoption has so far been concentrated mostly in human resource management (HRM), customer relationship management (CRM), collaboration software (e.g., email), and procurement solutions, but is poised to widen. Today it’s possible to have a data warehouse in the cloud that you can access with business intelligence software running as a service and connect to your cloud-based ERP like NetSuite or Microsoft Dynamics.The dollar savings can run into the millions. And SaaS installations are often installed and working in a fraction of the time of on-premises deployments—some can be ready in hours. \r\nSales and marketing people are likely familiar with Salesforce.com, the leading SaaS CRM software, with millions of users across more than 100,000 customers. Sales is going SaaS too, with apps available to support sales in order management, compensation, quote production and configure, price, quoting, electronic signatures, contract management and more.\r\n<h1 class=\"align-center\"><span style=\"font-weight: normal;\">Why SaaS? Benefits of software as a service</span></h1>\r\n<ul><li><span style=\"font-weight: bold;\">Lower cost of entry</span>. With SaaS solution, you pay for what you need, without having to buy hardware to host your new applications. Instead of provisioning internal resources to install the software, the vendor provides APIs and performs much of the work to get their software working for you. The time to a working solution can drop from months in the traditional model to weeks, days or hours with the SaaS model. In some businesses, IT wants nothing to do with installing and running a sales app. In the case of funding software and its implementation, this can be a make-or-break issue for the sales and marketing budget, so the lower cost really makes the difference.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold;\">Reduced time to benefit/rapid prototyping</span>. In the SaaS model, the software application is already installed and configured. Users can provision the server for the cloud and quickly have the application ready for use. This cuts the time to benefit and allows for rapid demonstrations and prototyping. With many SaaS companies offering free trials, this means a painless proof of concept and discovery phase to prove the benefit to the organization. </li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold;\">Pay as you go</span>. SaaS business software gives you the benefit of predictable costs both for the subscription and to some extent, the administration. Even as you scale, you can have a clear idea of what your costs will be. This allows for much more accurate budgeting, especially as compared to the costs of internal IT to manage upgrades and address issues for an owned instance.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold;\">The SaaS vendor is responsible for upgrades, uptime and security</span>. Under the SaaS model, since the software is hosted by the vendor, they take on the responsibility for maintaining the software and upgrading it, ensuring that it is reliable and meeting agreed-upon service level agreements, and keeping the application and its data secure.&nbsp; While some IT people worry about Software as a Service security outside of the enterprise walls, the likely truth is that the vendor has a much higher level of security than the enterprise itself would provide. Many will have redundant instances in very secure data centers in multiple geographies.&nbsp; Also, the data is being automatically backed up by the vendor, providing additional security and peace of mind. Because of the data center hosting, you’re getting the added benefit of at least some disaster recovery. Lastly, the vendor manages these issues as part of their core competencies—let them.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold;\">Integration and scalability.</span> Most SaaS apps are designed to support some amount of customization for the way you do business. SaaS vendors create APIs to allow connections not only to internal applications like ERPs or CRMs but also to other SaaS providers. One of the terrific aspects of integration is that orders written in the field can be automatically sent to the ERP. Now a salesperson in the field can check inventory through the catalog, write the order in front of the customer for approval, send it and receive confirmation, all in minutes. And as you scale with a SaaS vendor, there’s no need to invest in server capacity and software licenses. </li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold;\">Work anywhere</span>. Since the software is hosted in the cloud and accessible over the internet, users can access it via mobile devices wherever they are connected. This includes checking customer order histories prior to a sales call, as well as having access to real time data and real time order taking with the customer.</li></ul>\r\n<p class=\"align-left\">&nbsp;</p>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/SaaS__1_.png"},{"id":79,"title":"VM - Vulnerability management","alias":"vm-vulnerability-management","description":"Vulnerability management is the &quot;cyclical practice of identifying, classifying, prioritizing, remediating and mitigating&quot; software vulnerabilities. Vulnerability management is integral to computer security and network security, and must not be confused with a Vulnerability assessment.\r\nVulnerability management is an ongoing process that includes proactive asset discovery, continuous monitoring, mitigation, remediation and defense tactics to protect your organization's modern IT attack surface from Cyber Exposure.\r\nVulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities, such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, or subscribing to a commercial vulnerability alerting services. Unknown vulnerabilities, such as a zero-day, may be found with fuzz testing, which can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).\r\nCorrecting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.\r\nNetwork vulnerabilities represent security gaps that could be abused by attackers to damage network assets, trigger a denial of service, and/or steal potentially sensitive information. Attackers are constantly looking for new vulnerabilities to exploit — and taking advantage of old vulnerabilities that may have gone unpatched.\r\nHaving a vulnerability management framework in place that regularly checks for new vulnerabilities is crucial for preventing cybersecurity breaches. Without a vulnerability testing and patch management system, old security gaps may be left on the network for extended periods of time. This gives attackers more of an opportunity to exploit vulnerabilities and carry out their attacks.\r\nOne statistic that highlights how crucial vulnerability management was featured in an Infosecurity Magazine article. According to survey data cited in the article, of the organizations that “suffered a breach, almost 60% were due to an unpatched vulnerability.” In other words, nearly 60% of the data breaches suffered by survey respondents could have been easily prevented simply by having a vulnerability management plan that would apply critical patches before attackers leveraged the vulnerability.","materialsDescription":" <span style=\"font-weight: bold;\">What is vulnerability management?</span>\r\nVulnerability management is a pro-active approach to managing network security by reducing the likelihood that flaws in code or design compromise the security of an endpoint or network.\r\n<span style=\"font-weight: bold;\">What processes does vulnerability management include?</span>\r\nVulnerability management processes include:\r\n<ul><li><span style=\"font-style: italic;\">Checking for vulnerabilities:</span> This process should include regular network scanning, firewall logging, penetration testing or use of an automated tool like a vulnerability scanner.</li><li><span style=\"font-style: italic;\">Identifying vulnerabilities:</span> This involves analyzing network scans and pen test results, firewall logs or vulnerability scan results to find anomalies that suggest a malware attack or other malicious event has taken advantage of a security vulnerability, or could possibly do so.</li><li><span style=\"font-style: italic;\">Verifying vulnerabilities:</span> This process includes ascertaining whether the identified vulnerabilities could actually be exploited on servers, applications, networks or other systems. This also includes classifying the severity of a vulnerability and the level of risk it presents to the organization.</li><li><span style=\"font-style: italic;\">Mitigating vulnerabilities:</span> This is the process of figuring out how to prevent vulnerabilities from being exploited before a patch is available, or in the event that there is no patch. It can involve taking the affected part of the system off-line (if it's non-critical), or various other workarounds.</li><li><span style=\"font-style: italic;\">Patching vulnerabilities:</span> This is the process of getting patches -- usually from the vendors of the affected software or hardware -- and applying them to all the affected areas in a timely way. This is sometimes an automated process, done with patch management tools. This step also includes patch testing.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/VM_-_Vulnerability_management1.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":481,"title":"WAF-web application firewall","alias":"waf-web-application-firewall","description":"A <span style=\"font-weight: bold; \">WAF (Web Application Firewall)</span> helps protect web applications by filtering and monitoring HTTP traffic between a web application and the Internet. It typically protects web applications from attacks such as cross-site forgery, cross-site-scripting (XSS), file inclusion, and SQL injection, among others. A WAF is a protocol layer 7 defense (in the OSI model), and is not designed to defend against all types of attacks. This method of attack mitigation is usually part of a suite of tools which together create a holistic defense against a range of attack vectors.\r\nIn recent years, web application security has become increasingly important, especially after web application attacks ranked as the most common reason for breaches, as reported in the Verizon Data Breach Investigations Report. WAFs have become a critical component of web application security, and guard against web application vulnerabilities while providing the ability to customize the security rules for each application. As WAF is inline with traffic, some functions are conveniently implemented by a load balancer.\r\nAccording to the PCI Security Standards Council, WAFs function as “a security policy enforcement point positioned between a web application and the client endpoint. This functionality can be implemented in software or hardware, running in an appliance device, or in a typical server running a common operating system. It may be a stand-alone device or integrated into other network components.”\r\nBy deploying a WAF firewall in front of a web application, a shield is placed between the web application and the Internet. While a proxy server protects a client machine’s identity by using an intermediary, a web firewall is a type of reverse-proxy, protecting the server from exposure by having clients pass through the WAF before reaching the server.\r\nA WAF operates through a set of rules often called <span style=\"font-weight: bold; \">policies.</span> These policies aim to protect against vulnerabilities in the application by filtering out malicious traffic. The value of a WAF management comes in part from the speed and ease with which policy modification can be implemented, allowing for faster response to varying attack vectors; during a DDoS attack, rate limiting can be quickly implemented by modifying WAF policies.\r\nWAF solutions can be deployed in several ways—it all depends on where your applications are deployed, the services needed, how you want to manage it, and the level of architectural flexibility and performance you require. Do you want to manage it yourself, or do you want to outsource that management? Is it a better model to have a cloud WAF service, option or do you want your WAF to sit on-premises?\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">A WAF products can be implemented one of three different ways:</span></p>\r\n<ul><li><span style=\"font-weight: bold; \">A network-based WAF</span> is generally hardware-based. Since they are installed locally they minimize latency, but network-based WAFs are the most expensive option and also require the storage and maintenance of physical equipment.</li><li><span style=\"font-weight: bold; \">A host-based WAF</span> may be fully integrated into an application’s software. This solution is less expensive than a network-based WAF and offers more customizability. The downside of a host-based WAF is the consumption of local server resources, implementation complexity, and maintenance costs. These components typically require engineering time, and may be costly.</li><li><span style=\"font-weight: bold; \">Cloud-based WAFs</span> offer an affordable option that is very easy to implement; they usually offer a turnkey installation that is as simple as a change in DNS to redirect traffic. Cloud-based WAFs also have a minimal upfront cost, as users pay monthly or annually for security as a service. Cloud-based WAFs can also offer a solution that is consistently updated to protect against the newest threats without any additional work or cost on the user’s end. The drawback of a cloud-based WAF is that users hand over the responsibility to a third-party, therefore some features of the WAF may be a black box to them. </li></ul>\r\n<p class=\"align-left\">&nbsp;</p>\r\n\r\n","materialsDescription":"<p class=\"align-center\"><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">What types of attack WAF prevents?</span></span></p>\r\n<p class=\"align-left\"><span style=\"color: rgb(97, 97, 97); \">WAFs can prevent many attacks, including:</span></p>\r\n<ul><li><span style=\"color: rgb(97, 97, 97); \">Cross-site Scripting (XSS) — Attackers inject client-side scripts into web pages viewed by other users.</span></li><li><span style=\"color: rgb(97, 97, 97); \">SQL injection — Malicious code is inserted or injected into an web entry field that allows attackers to compromise the application and underlying systems.</span></li><li><span style=\"color: rgb(97, 97, 97); \">Cookie poisoning — Modification of a cookie to gain unauthorized information about the user for purposes such as identity theft.</span></li><li><span style=\"color: rgb(97, 97, 97); \">Unvalidated input — Attackers tamper with HTTP request (including the url, headers and form fields) to bypass the site’s security mechanisms.</span></li><li><span style=\"color: rgb(97, 97, 97); \">Layer 7 DoS — An HTTP flood attack that utilizes valid requests in typical URL data retrievals.</span></li><li><span style=\"color: rgb(97, 97, 97); \">Web scraping — Data scraping used for extracting data from websites.</span><span style=\"font-weight: bold; \"></span></li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">What are some WAFs Benefits?</span></p>\r\nWeb app firewall prevents attacks that try to take advantage of the vulnerabilities in web-based applications. The vulnerabilities are common in legacy applications or applications with poor coding or designs. WAFs handle the code deficiencies with custom rules or policies.\r\nIntelligent WAFs provide real-time insights into application traffic, performance, security and threat landscape. This visibility gives administrators the flexibility to respond to the most sophisticated attacks on protected applications.\r\nWhen the Open Web Application Security Project identifies the OWASP top vulnerabilities, WAFs allow administrators to create custom security rules to combat the list of potential attack methods. An intelligent WAF analyzes the security rules matching a particular transaction and provides a real-time view as attack patterns evolve. Based on this intelligence, the WAF can reduce false positives.\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">What is the difference between a firewall and a Web Application Firewall?</span></p>\r\nA traditional firewall protects the flow of information between servers while a web application firewall is able to filter traffic for a specific web application. Network firewalls and web application firewalls are complementary and can work together.\r\nTraditional security methods include network firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS). They are effective at blocking bad L3-L4 traffic at the perimeter on the lower end (L3-L4) of the Open Systems Interconnection (OSI) model. Traditional firewalls cannot detect attacks in web applications because they do not understand Hypertext Transfer Protocol (HTTP) which occurs at layer 7 of the OSI model. They also only allow the port that sends and receives requested web pages from an HTTP server to be open or closed. This is why web application firewalls are effective for preventing attacks like SQL injections, session hijacking and Cross-Site Scripting (XSS).","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_WAF_web_application_firewall.png"},{"id":483,"title":"Messaging Security","alias":"messaging-security","description":"<span style=\"font-weight: bold; \">Messaging security</span> is a subcategory of <span style=\"font-style: italic; \">unified threat management (UTM) </span>focused on securing and protecting an organization’s communication infrastructure. Communication channels can include email software, messaging apps, and social network IM platforms. This extra layer of security can help secure devices and block a wider range of viruses or malware attacks.\r\nMessaging security helps to ensure the confidentiality and authenticity of an organization’s communication methods. Confidentiality refers to making sure only the intended recipients are able to read the messages and authenticity refers to making sure the identity of each sender or recipient is verified.\r\nOftentimes, attackers aim to gain access to an entire network or system by infiltrating the messaging infrastructure. Implementing proper data and message security can minimize the chance of data leaks and identity theft.\r\n<span style=\"color: rgb(97, 97, 97); \">Encrypted messaging (also known as secure messaging) provides end-to-end encryption for user-to-user text messaging. Encrypted messaging prevents anyone from monitoring text conversations. Many encrypted messenger&nbsp; apps also offer end-to-end encryption for phone calls made using the apps, as well as for files that are sent using the apps.</span>\r\nTwo modern methods of encryption are the <span style=\"font-style: italic; \">Public Key (Asymmetric)</span> and the <span style=\"font-style: italic; \">Private Key (Symmetric</span>) methods. While these two methods of encryption are similar in that they both allow users to encrypt data to hide it from the prying eyes of outsiders and then decrypt it for viewing by an authorized party, they differ in how they perform the steps involved in the process.\r\n<span style=\"font-weight: bold; \">Email</span> security message can rely on public-key cryptography, in which users can each publish a public key that others can use to encrypt messages to them, while keeping secret a private key they can use to decrypt such messages or to digitally encrypt and sign messages they send. \r\n<span style=\"font-weight: bold;\">Encrypted messaging systems </span>must be encrypted end-to-end, so that even the service provider and its staff are unable to decipher what’s in your communications. Ideal solutions is “server-less” encrypted chat where companies won’t store user information anywhere.\r\nIn a more general sense, users of unsecured public Wi-Fi should also consider using a <span style=\"font-weight: bold;\">Virtual Private Network </span>(VPN) application, to conceal their identity and location from Internet Service Providers (ISPs), higher level surveillance, and the attentions of hackers.","materialsDescription":"<h1 class=\"align-center\"> What is messaging security?</h1>\r\nMessaging Security is a program that provides protection for companies' messaging infrastructure. The programs include IP reputation-based anti-spam, pattern-based anti-spam, administrator-defined block/allow lists, mail antivirus, zero-hour malware detection, and email intrusion prevention.\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">Six Dimensions of Comprehensive Messaging Security</span></p>\r\n<ul><li><span style=\"font-weight: bold; \">IP-Reputation Anti-spam.</span> It checks each email connection request with a database of IP addresses to establish whether a sender is a legitimate or known spam sender and malware. If a sender is recognized it undesirable the messaging Security program drops the connection before the message is accepted.</li><li><span style=\"font-weight: bold; \">Pattern-based anti-spam</span> utilizes a proprietary algorithm to establish a fingerprint-like signature of email messages. When a message comes in, its pattern is calculated and checked against a database to determine if the message matches a known email pattern. </li><li><span style=\"font-weight: bold; \">Block/Allow List Anti-spam.</span> Administrators can create a list of IP addresses or domains that they would like to either block or allow. This method ensures that trusted sources are explicitly allowed and unwanted sources are explicitly denied access.</li><li><span style=\"font-weight: bold; \">Mail Antivirus.</span> This layer of protection blocks a wide range of known viruses and malware attacks.</li><li><span style=\"font-weight: bold; \">Zero-Hour Malware Protection.</span> By analyzing large numbers of messages, outbreaks are detected along with their corresponding messages. These message patterns are then flagged as malicious, giving information about a given attack.</li><li><span style=\"font-weight: bold; \">SmartDefense Email IPS.</span> The messaging security program utilizes SmartDefense Email IPS to stop attacks targeting the messaging infrastructure. </li></ul>\r\n<h1 class=\"align-center\">What are Signal, Wire and LINE messenger security apps like ?</h1>\r\n<p class=\"align-left\">Secure private messenger is a messaging application that emphasizes the privacy and of users using encryption and service transparency. While every modern messenger system is using different security practices (most prominently SSL/HTTPS) - the difference between secure and classic messengers is what we don’t know in the scope of implementation and&nbsp; approach to user data. </p>\r\n<p class=\"align-left\">Message access control and secure messengers evolved into a distinct category due to the growing awareness that communication over the internet is accessible by third parties, and reasonable concerns that the messages can be used against the users.</p>\r\n<h1 class=\"align-center\">Why secure communication is essential for business?</h1>\r\n<p class=\"align-left\">In the context of business operation, communication is a vital element of maintaining an efficient and dynamic working process. It lets you keep everything up to date and on the same page. And since many things are going on at the same time - tools like messengers are one of the many helpers that make the working day a little more manageable.</p>\r\n<p class=\"align-left\">Some of the information, like employee and customer data, proprietary information, data directly linked to business performance or future projections, may be strictly under a non-disclosure agreement. Without proper text message authentication in information security or encryption, it remains vulnerable to exposure. The chances are slim, but the possibility remains. </p>\r\n<p class=\"align-left\">And there are people interested in acquiring that sensitive information, people who like to play dirty because getting a competitive advantage is a decent motivation to go beyond the law. And when private conversations leak, especially the business-related ones - the impact is comparable with the Titanic hitting an iceberg. </p>\r\n<p class=\"align-left\">Encrypted massages in messenger prevents this from happening.</p>\r\n<p class=\"align-left\">&nbsp;</p>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Messaging_Security.png"},{"id":485,"title":"Web security","alias":"web-security","description":" Web security basically means protecting a website or web application by detecting, preventing and responding to cyber threats.\r\nWebsites and web applications are just as prone to security breaches as physical homes, stores, and government locations. Unfortunately, cybercrime happens every day, and great web security measures are needed to protect websites and web applications from becoming compromised.\r\nThat’s exactly what web security does – it is a system of protection measures and protocols that can protect your website or web application from being hacked or entered by unauthorized personnel. This integral division of Information Security is vital to the protection of websites, web applications, and web services. Anything that is applied over the Internet should have some form of web security to protect it.\r\nThere are a lot of factors that go into web security and web protection. Any website or application that is secure is surely backed by different types of checkpoints and techniques for keeping it safe.\r\nThere are a variety of security standards that must be followed at all times, and these standards are implemented and highlighted by the OWASP. Most experienced web developers from top cybersecurity companies will follow the standards of the OWASP as well as keep a close eye on the Web Hacking Incident Database to see when, how, and why different people are hacking different websites and services.\r\nEssential steps in protecting web apps from attacks include applying up-to-date encryption, setting proper authentication, continuously patching discovered vulnerabilities, avoiding data theft by having secure software development practices. The reality is that clever attackers may be competent enough to find flaws even in a fairly robust secured environment, and so a holistic security strategy is advised.\r\nThere are different types of technologies available for maintaining the best security standards. Some popular technical solutions for testing, building, and preventing threats include black and white box testing tools, fuzzing tools, WAF, security or vulnerability scanners, password cracking tools, and so on.","materialsDescription":" <span style=\"font-weight: bold; \">What is Malware?</span>\r\nThe name malware is short for ‘malicioussoftware’. Malware includes any software program that has been created to perform an unauthorised — and often harmful — action on a user’s device. Examples of malware include:\r\n<ul><li>Computer viruses</li><li>Word and Excel macro viruses</li><li>Boot sector viruses</li><li>Script viruses — including batch, Windows shell, Java and others</li><li>Keyloggers</li><li>Password stealers</li><li>Backdoor Trojan viruses</li><li>Other Trojan viruses</li><li>Crimeware</li><li>Spyware</li><li>Adware... and many other types of malicious software programs</li></ul>\r\n<span style=\"font-weight: bold; \">What is the difference between a computer virus and a worm?</span>\r\n<span style=\"font-weight: bold; \">Computer virus.</span> This is a type of malicious program that can replicate itself — so that it can spread from file to file on a computer, and can also spread from one computer to another. Computer viruses are often programmed to perform damaging actions — such as corrupting or deleting data. The longer a virus remains undetected on your machine, the greater the number of infected files that may be on your computer.\r\n<span style=\"font-weight: bold; \">Worms.</span> Worms are generally considered to be a subset of computer viruses — but with some specific differences:\r\n<ul><li>A worm is a computer program that replicates, but does not infect other files.</li><li>The worm will install itself once on a computer — and then look for a way to spread to other computers.</li><li>Whereas a virus is a set of code that adds itself to existing files, a worm exists as a separate, standalone file.</li></ul>\r\n<span style=\"font-weight: bold; \">What is a Trojan virus?</span>\r\nA Trojan is effectively a program that pretends to be legitimate software — but, when launched, it will perform a harmful action. Unlike computer viruses and worms, Trojans cannot spread by themselves. Typically, Trojans are installed secretly and they deliver their malicious payload without the user’s knowledge.\r\nCybercriminals use many different types of Trojans — and each has been designed to perform a specific malicious function. The most common are:\r\n<ul><li>Backdoor Trojans (these often include a keylogger)</li><li>Trojan Spies</li><li>Password stealing Trojans</li><li>Trojan Proxies — that convert your computer into a spam distribution machine</li></ul>\r\n<span style=\"font-weight: bold; \">Why are Trojan viruses called Trojans?</span>\r\nIn Greek mythology — during the Trojan war — the Greeks used subterfuge to enter the city of Troy. The Greeks constructed a massive wooden horse — and, unaware that the horse contained Greek soldiers, the Trojans pulled the horse into the city. At night, the Greek soldiers escaped from the horse and opened the city gates — for the Greek army to enter Troy.\r\nToday, Trojan viruses use subterfuge to enter unsuspecting users’ computers and devices.\r\n<span style=\"font-weight: bold; \">What is a Keylogger?</span>\r\nA keylogger is a program that can record what you type on your computer keyboard. Criminals use keyloggers to obtain confidential data — such as login details, passwords, credit card numbers, PINs and other items. Backdoor Trojans typically include an integrated keylogger.\r\n<span style=\"font-weight: bold; \">What is Phishing?</span>\r\nPhishing is a very specific type of cybercrime that is designed to trick you into disclosing valuable information — such as details about your bank account or credit cards. Often, cybercriminals will create a fake website that looks just like a legitimate site — such as a bank’s official website. The cybercriminal will try to trick you into visiting their fake site — typically by sending you an email that contains a hyperlink to the fake site. When you visit the fake website, it will generally ask you to type in confidential data — such as your login, password or PIN.\r\n<span style=\"font-weight: bold; \">What is Spyware?</span>\r\nSpyware is software that is designed to collect your data and send it to a third party — without your knowledge or consent. Spyware programs will often:\r\n<ul><li>Monitor the keys you press on your keyboard — using a keylogger</li><li>Collect confidential information — such as your passwords, credit card numbers, PIN numbers and more</li><li>Gather — or ‘harvest’ — email addresses from your computer</li><li>Track your Internet browsing habits</li></ul>\r\n<span style=\"font-weight: bold; \">What is a Rootkit?</span>\r\nRootkits are programs that hackers use in order to evade detection while trying to gain unauthorised access to a computer. Rootkits have been used increasingly as a form of stealth to hide Trojan virus activity. When installed on a computer, rootkits are invisible to the user and also take steps to avoid being detected by security software.\r\nThe fact that many people log into their computers with administrator rights — rather than creating a separate account with restricted access — makes it easier for cybercriminals to install a rootkit.\r\n<span style=\"font-weight: bold; \">What is a Botnet?</span>\r\nA botnet is a network of computers controlled by cybercriminals using a Trojan virus or other malicious program.\r\n<span style=\"font-weight: bold;\">What is a DDoS attack?</span>\r\nA Distributed-Denial-of-Service (DDoS) attack is similar to a DoS. However, a DDoS attack is conducted using multiple machines. Usually, for a DDoS attack, the hacker will use one security compromised computer as the ‘master’ machine that co-ordinates the attack by other ‘zombie machines’. Typically, the cybercriminal will compromise the security on the master and all of the zombie machines, by exploiting a vulnerability in an application on each computer — to install a Trojan or other piece of malicious code.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/security-web-application-security.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":838,"title":"Endpoint Detection and Response","alias":"endpoint-detection-and-response","description":"Endpoint Detection and Response (EDR) is a cybersecurity technology that addresses the need for continuous monitoring and response to advanced threats. It is a subset of endpoint security technology and a critical piece of an optimal security posture. EDR differs from other endpoint protection platforms (EPP) such as antivirus (AV) and anti-malware in that its primary focus isn't to automatically stop threats in the pre-execution phase on an endpoint. Rather, EDR is focused on providing the right endpoint visibility with the right insights to help security analysts discover, investigate and respond to very advanced threats and broader attack campaigns stretching across multiple endpoints. Many EDR tools, however, combine EDR and EPP.\r\nWhile small and mid-market organizations are increasingly turning to EDR technology for more advanced endpoint protection, many lack the resources to maximize the benefits of the technology. Utilizing advanced EDR features such as forensic analysis, behavioral monitoring and artificial intelligence (AI) is labor and resource intensive, requiring the attention of dedicated security professionals.\r\nA managed endpoint security service combines the latest technology, an around-the-clock team of certified CSOC experts and up-to-the-minute industry intelligence for a cost-effective monthly subscription. Managed services can help reduce the day-to-day burden of monitoring and responding to alerts, enhance security orchestration and automation (SOAR) and improve threat hunting and incident response.","materialsDescription":"<span style=\"font-weight: bold; \">What is Endpoint detection and response (EDR)?</span>\r\nEndpoint detection and response is an emerging technology that addresses the need for continuous monitoring and response to advanced threats. One could even make the argument that endpoint detection and response is a form of advanced threat protection.\r\n<span style=\"font-weight: bold;\">What are the Key Aspects of EDR Security?</span>\r\nAccording to Gartner, effective EDR must include the following capabilities:\r\n<ul><li>Incident data search and investigation</li><li>Alert triage or suspicious activity validation</li><li>Suspicious activity detection</li><li>Threat hunting or data exploration</li><li>Stopping malicious activity</li></ul>\r\n<span style=\"font-weight: bold;\">What to look for in an EDR Solution?</span>\r\nUnderstanding the key aspects of EDR and why they are important will help you better discern what to look for in a solution. It’s important to find EDR software that can provide the highest level of protection while requiring the least amount of effort and investment — adding value to your security team without draining resources. Here are the six key aspects of EDR you should look for:\r\n<span style=\"font-weight: bold;\">1. Visibility:</span> Real-time visibility across all your endpoints allows you to view adversary activities, even as they attempt to breach your environment and stop them immediately.\r\n<span style=\"font-weight: bold;\">2. Threat Database:</span> Effective EDR requires massive amounts of telemetry collected from endpoints and enriched with context so it can be mined for signs of attack with a variety of analytic techniques.\r\n<span style=\"font-weight: bold;\">3. Behavioral Protection:</span> Relying solely on signature-based methods or indicators of compromise (IOCs) lead to the “silent failure” that allows data breaches to occur. Effective endpoint detection and response requires behavioral approaches that search for indicators of attack (IOAs), so you are alerted of suspicious activities before a compromise can occur.\r\n<span style=\"font-weight: bold;\">4. Insight and Intelligence:</span> An endpoint detection and response solution that integrates threat intelligence can provide context, including details on the attributed adversary that is attacking you or other information about the attack.\r\n<span style=\"font-weight: bold;\">5. Fast Response:</span> EDR that enables a fast and accurate response to incidents can stop an attack before it becomes a breach and allow your organization to get back to business quickly.\r\n<span style=\"font-weight: bold;\">6. Cloud-based Solution:</span> Having a cloud-based endpoint detection and response solution is the only way to ensure zero impact on endpoints while making sure capabilities such as search, analysis and investigation can be done accurately and in real time.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/hgghghg.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4625,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/SAIC.png","logo":true,"scheme":false,"title":"SAIC Cybersecurity","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"saic-cybersecurity","companyTitle":"SAIC","companyTypes":["supplier","vendor"],"companyId":7011,"companyAlias":"saic","description":"<p class=\"align-center\"><span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Advanced Capabilities That Meet Critical Mission-Assurance Needs.</span></span></p>\r\nToday’s IT users demand reliable digital service delivery at work, at home, or via mobile devices. They also expect their data to be safe and well protected. IT technology advances mean you can shift security to an integrated model where it is built into infrastructure and applications. \r\nSAIC’s advanced cybersecurity solutions combine our cyberspace operations experience with our deep mission understanding to deliver security, assurance, and resilience for your enterprise and workforce against an increasingly complex threat environment.<br />\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \"><span style=\"font-style: italic; \">Benefits</span></span><br /></p>\r\n<p class=\"align-center\">360 ̊ PROTECTION<br /></p>\r\n<p class=\"align-left\">SAIC’strained experts look at your mission, threats, and protective steps you’ve taken to assess the effectiveness of your security program. Team investigate all angles: technology, processes, and people. They identify the gaps that must be filled to protect your sensitive and critical data<br /></p>\r\n<p class=\"align-center\">PEACE OF MIND<br /></p>\r\nSAIC provides the team and tools to fill those gaps in cost-efficient and low-risk ways and perform continuous monitoring for you. Experts ensure compliance with regulatory requirements specific to your organization\r\nSAIC’s experience in supporting national security cyberspace operations gives insights into attack methods and how IT vulnerabilities are exploited. This knowledge gives an “offensive” mindset and underpins approach and proactive capabilities, resulting in continuous service delivery amid a highly contested cyberspace. <br />\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Solution gives:</span><br /></p>\r\n<ul><li>Complete Situational Understanding—Mission-first views of compliance, dependencies, potential avenues of attack, and most effective defensive approaches <br /></li><li>Continuous Assurance—Enterprise security operations are focused on data visibility and protection while it is at rest and in transit<br /></li><li>Security Ops as a Managed Service—Covers all security elements: compliance, infrastructure, operations, and incident response <br /></li><li>“Baked-In” Modernization—Advanced security is integrated into all of our IT modernization projects in application engineering, hosting environments, end user solutions, and infrastructure engineering</li></ul>\r\n\r\n","shortDescription":"Security Ops as a Managed Service—Covers all security elements: compliance, infrastructure, operations, and incident response.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":19,"sellingCount":19,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"SAIC Cybersecurity","keywords":"","description":"<p class=\"align-center\"><span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Advanced Capabilities That Meet Critical Mission-Assurance Needs.</span></span></p>\r\nToday’s IT users demand reliable digital service delivery at work, at home, or via","og:title":"SAIC Cybersecurity","og:description":"<p class=\"align-center\"><span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Advanced Capabilities That Meet Critical Mission-Assurance Needs.</span></span></p>\r\nToday’s IT users demand reliable digital service delivery at work, at home, or via","og:image":"https://old.roi4cio.com/fileadmin/user_upload/SAIC.png"},"eventUrl":"","translationId":4626,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":79,"title":"VM - Vulnerability management","alias":"vm-vulnerability-management","description":"Vulnerability management is the &quot;cyclical practice of identifying, classifying, prioritizing, remediating and mitigating&quot; software vulnerabilities. Vulnerability management is integral to computer security and network security, and must not be confused with a Vulnerability assessment.\r\nVulnerability management is an ongoing process that includes proactive asset discovery, continuous monitoring, mitigation, remediation and defense tactics to protect your organization's modern IT attack surface from Cyber Exposure.\r\nVulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities, such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, or subscribing to a commercial vulnerability alerting services. Unknown vulnerabilities, such as a zero-day, may be found with fuzz testing, which can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).\r\nCorrecting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.\r\nNetwork vulnerabilities represent security gaps that could be abused by attackers to damage network assets, trigger a denial of service, and/or steal potentially sensitive information. Attackers are constantly looking for new vulnerabilities to exploit — and taking advantage of old vulnerabilities that may have gone unpatched.\r\nHaving a vulnerability management framework in place that regularly checks for new vulnerabilities is crucial for preventing cybersecurity breaches. Without a vulnerability testing and patch management system, old security gaps may be left on the network for extended periods of time. This gives attackers more of an opportunity to exploit vulnerabilities and carry out their attacks.\r\nOne statistic that highlights how crucial vulnerability management was featured in an Infosecurity Magazine article. According to survey data cited in the article, of the organizations that “suffered a breach, almost 60% were due to an unpatched vulnerability.” In other words, nearly 60% of the data breaches suffered by survey respondents could have been easily prevented simply by having a vulnerability management plan that would apply critical patches before attackers leveraged the vulnerability.","materialsDescription":" <span style=\"font-weight: bold;\">What is vulnerability management?</span>\r\nVulnerability management is a pro-active approach to managing network security by reducing the likelihood that flaws in code or design compromise the security of an endpoint or network.\r\n<span style=\"font-weight: bold;\">What processes does vulnerability management include?</span>\r\nVulnerability management processes include:\r\n<ul><li><span style=\"font-style: italic;\">Checking for vulnerabilities:</span> This process should include regular network scanning, firewall logging, penetration testing or use of an automated tool like a vulnerability scanner.</li><li><span style=\"font-style: italic;\">Identifying vulnerabilities:</span> This involves analyzing network scans and pen test results, firewall logs or vulnerability scan results to find anomalies that suggest a malware attack or other malicious event has taken advantage of a security vulnerability, or could possibly do so.</li><li><span style=\"font-style: italic;\">Verifying vulnerabilities:</span> This process includes ascertaining whether the identified vulnerabilities could actually be exploited on servers, applications, networks or other systems. This also includes classifying the severity of a vulnerability and the level of risk it presents to the organization.</li><li><span style=\"font-style: italic;\">Mitigating vulnerabilities:</span> This is the process of figuring out how to prevent vulnerabilities from being exploited before a patch is available, or in the event that there is no patch. It can involve taking the affected part of the system off-line (if it's non-critical), or various other workarounds.</li><li><span style=\"font-style: italic;\">Patching vulnerabilities:</span> This is the process of getting patches -- usually from the vendors of the affected software or hardware -- and applying them to all the affected areas in a timely way. This is sometimes an automated process, done with patch management tools. This step also includes patch testing.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/VM_-_Vulnerability_management1.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":485,"title":"Web security","alias":"web-security","description":" Web security basically means protecting a website or web application by detecting, preventing and responding to cyber threats.\r\nWebsites and web applications are just as prone to security breaches as physical homes, stores, and government locations. Unfortunately, cybercrime happens every day, and great web security measures are needed to protect websites and web applications from becoming compromised.\r\nThat’s exactly what web security does – it is a system of protection measures and protocols that can protect your website or web application from being hacked or entered by unauthorized personnel. This integral division of Information Security is vital to the protection of websites, web applications, and web services. Anything that is applied over the Internet should have some form of web security to protect it.\r\nThere are a lot of factors that go into web security and web protection. Any website or application that is secure is surely backed by different types of checkpoints and techniques for keeping it safe.\r\nThere are a variety of security standards that must be followed at all times, and these standards are implemented and highlighted by the OWASP. Most experienced web developers from top cybersecurity companies will follow the standards of the OWASP as well as keep a close eye on the Web Hacking Incident Database to see when, how, and why different people are hacking different websites and services.\r\nEssential steps in protecting web apps from attacks include applying up-to-date encryption, setting proper authentication, continuously patching discovered vulnerabilities, avoiding data theft by having secure software development practices. The reality is that clever attackers may be competent enough to find flaws even in a fairly robust secured environment, and so a holistic security strategy is advised.\r\nThere are different types of technologies available for maintaining the best security standards. Some popular technical solutions for testing, building, and preventing threats include black and white box testing tools, fuzzing tools, WAF, security or vulnerability scanners, password cracking tools, and so on.","materialsDescription":" <span style=\"font-weight: bold; \">What is Malware?</span>\r\nThe name malware is short for ‘malicioussoftware’. Malware includes any software program that has been created to perform an unauthorised — and often harmful — action on a user’s device. Examples of malware include:\r\n<ul><li>Computer viruses</li><li>Word and Excel macro viruses</li><li>Boot sector viruses</li><li>Script viruses — including batch, Windows shell, Java and others</li><li>Keyloggers</li><li>Password stealers</li><li>Backdoor Trojan viruses</li><li>Other Trojan viruses</li><li>Crimeware</li><li>Spyware</li><li>Adware... and many other types of malicious software programs</li></ul>\r\n<span style=\"font-weight: bold; \">What is the difference between a computer virus and a worm?</span>\r\n<span style=\"font-weight: bold; \">Computer virus.</span> This is a type of malicious program that can replicate itself — so that it can spread from file to file on a computer, and can also spread from one computer to another. Computer viruses are often programmed to perform damaging actions — such as corrupting or deleting data. The longer a virus remains undetected on your machine, the greater the number of infected files that may be on your computer.\r\n<span style=\"font-weight: bold; \">Worms.</span> Worms are generally considered to be a subset of computer viruses — but with some specific differences:\r\n<ul><li>A worm is a computer program that replicates, but does not infect other files.</li><li>The worm will install itself once on a computer — and then look for a way to spread to other computers.</li><li>Whereas a virus is a set of code that adds itself to existing files, a worm exists as a separate, standalone file.</li></ul>\r\n<span style=\"font-weight: bold; \">What is a Trojan virus?</span>\r\nA Trojan is effectively a program that pretends to be legitimate software — but, when launched, it will perform a harmful action. Unlike computer viruses and worms, Trojans cannot spread by themselves. Typically, Trojans are installed secretly and they deliver their malicious payload without the user’s knowledge.\r\nCybercriminals use many different types of Trojans — and each has been designed to perform a specific malicious function. The most common are:\r\n<ul><li>Backdoor Trojans (these often include a keylogger)</li><li>Trojan Spies</li><li>Password stealing Trojans</li><li>Trojan Proxies — that convert your computer into a spam distribution machine</li></ul>\r\n<span style=\"font-weight: bold; \">Why are Trojan viruses called Trojans?</span>\r\nIn Greek mythology — during the Trojan war — the Greeks used subterfuge to enter the city of Troy. The Greeks constructed a massive wooden horse — and, unaware that the horse contained Greek soldiers, the Trojans pulled the horse into the city. At night, the Greek soldiers escaped from the horse and opened the city gates — for the Greek army to enter Troy.\r\nToday, Trojan viruses use subterfuge to enter unsuspecting users’ computers and devices.\r\n<span style=\"font-weight: bold; \">What is a Keylogger?</span>\r\nA keylogger is a program that can record what you type on your computer keyboard. Criminals use keyloggers to obtain confidential data — such as login details, passwords, credit card numbers, PINs and other items. Backdoor Trojans typically include an integrated keylogger.\r\n<span style=\"font-weight: bold; \">What is Phishing?</span>\r\nPhishing is a very specific type of cybercrime that is designed to trick you into disclosing valuable information — such as details about your bank account or credit cards. Often, cybercriminals will create a fake website that looks just like a legitimate site — such as a bank’s official website. The cybercriminal will try to trick you into visiting their fake site — typically by sending you an email that contains a hyperlink to the fake site. When you visit the fake website, it will generally ask you to type in confidential data — such as your login, password or PIN.\r\n<span style=\"font-weight: bold; \">What is Spyware?</span>\r\nSpyware is software that is designed to collect your data and send it to a third party — without your knowledge or consent. Spyware programs will often:\r\n<ul><li>Monitor the keys you press on your keyboard — using a keylogger</li><li>Collect confidential information — such as your passwords, credit card numbers, PIN numbers and more</li><li>Gather — or ‘harvest’ — email addresses from your computer</li><li>Track your Internet browsing habits</li></ul>\r\n<span style=\"font-weight: bold; \">What is a Rootkit?</span>\r\nRootkits are programs that hackers use in order to evade detection while trying to gain unauthorised access to a computer. Rootkits have been used increasingly as a form of stealth to hide Trojan virus activity. When installed on a computer, rootkits are invisible to the user and also take steps to avoid being detected by security software.\r\nThe fact that many people log into their computers with administrator rights — rather than creating a separate account with restricted access — makes it easier for cybercriminals to install a rootkit.\r\n<span style=\"font-weight: bold; \">What is a Botnet?</span>\r\nA botnet is a network of computers controlled by cybercriminals using a Trojan virus or other malicious program.\r\n<span style=\"font-weight: bold;\">What is a DDoS attack?</span>\r\nA Distributed-Denial-of-Service (DDoS) attack is similar to a DoS. However, a DDoS attack is conducted using multiple machines. Usually, for a DDoS attack, the hacker will use one security compromised computer as the ‘master’ machine that co-ordinates the attack by other ‘zombie machines’. Typically, the cybercriminal will compromise the security on the master and all of the zombie machines, by exploiting a vulnerability in an application on each computer — to install a Trojan or other piece of malicious code.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/security-web-application-security.png"},{"id":834,"title":"IoT - Internet of Things Security","alias":"iot-internet-of-things-security","description":" IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).\r\nIoT involves adding internet connectivity to a system of interrelated computing devices, mechanical and digital machines, objects, animals and/or people. Each &quot;thing&quot; is provided a unique identifier and the ability to automatically transfer data over a network. Allowing devices to connect to the internet opens them up to a number of serious vulnerabilities if they are not properly protected.\r\nIoT security has become the subject of scrutiny after a number of high-profile incidents where a common IoT device was used to infiltrate and attack the larger network. Implementing security measures is critical to ensuring the safety of networks with IoT devices connected to them.\r\nIoT security hacks can happen in any industry, from smart home to a manufacturing plant to a connected car. The severity of impact depends greatly on the individual system, the data collected and/or the information it contains.\r\nAn attack disabling the brakes of a connected car, for example, or on a connected health device, such as an insulin pump hacked to administer too much medication to a patient, can be life-threatening. Likewise, an attack on a refrigeration system housing medicine that is monitored by an IoT system can ruin the viability of a medicine if temperatures fluctuate. Similarly, an attack on critical infrastructure -- an oil well, energy grid or water supply -- can be disastrous.\r\nSo, a robust IoT security portfolio must allow protecting devices from all types of vulnerabilities while deploying the security level that best matches application needs. Cryptography technologies are used to combat communication attacks. Security services are offered for protecting against lifecycle attacks. Isolation measures can be implemented to fend off software attacks. And, finally, IoT security should include tamper mitigation and side-channel attack mitigation technologies for fighting physical attacks of the chip.","materialsDescription":" <span style=\"font-weight: bold;\">What are the key requirements of IoT Security?</span>\r\nThe key requirements for any IoT security solution are:\r\n<ul><li>Device and data security, including authentication of devices and confidentiality and integrity of data</li><li>Implementing and running security operations at IoT scale</li><li>Meeting compliance requirements and requests</li><li>Meeting performance requirements as per the use case</li></ul>\r\n<span style=\"font-weight: bold;\">What do connected devices require to participate in the IoT Securely?</span>\r\nTo securely participate in the IoT, each connected device needs a unique identification – even before it has an IP address. This digital credential establishes the root of trust for the device’s entire lifecycle, from initial design to deployment to retirement.\r\n<span style=\"font-weight: bold;\">Why is device authentication necessary for the IoT?</span>\r\nStrong IoT device authentication is required to ensure connected devices on the IoT can be trusted to be what they purport to be. Consequently, each IoT device needs a unique identity that can be authenticated when the device attempts to connect to a gateway or central server. With this unique ID in place, IT system administrators can track each device throughout its lifecycle, communicate securely with it, and prevent it from executing harmful processes. If a device exhibits unexpected behavior, administrators can simply revoke its privileges.\r\n<span style=\"font-weight: bold;\">Why is secure manufacturing necessary for IoT devices?</span>\r\nIoT devices produced through unsecured manufacturing processes provide criminals opportunities to change production runs to introduce unauthorized code or produce additional units that are subsequently sold on the black market.\r\nOne way to secure manufacturing processes is to use hardware security modules (HSMs) and supporting security software to inject cryptographic keys and digital certificates and to control the number of units built and the code incorporated into each.\r\n<span style=\"font-weight: bold;\">Why is code signing necessary for IoT devices?</span>\r\nTo protect businesses, brands, partners, and users from software that has been infected by malware, software developers have adopted code signing. In the IoT, code signing in the software release process ensures the integrity of IoT device software and firmware updates and defends against the risks associated with code tampering or code that deviates from organizational policies.\r\nIn public key cryptography, code signing is a specific use of certificate-based digital signatures that enables an organization to verify the identity of the software publisher and certify the software has not been changed since it was published.\r\n<span style=\"font-weight: bold;\">What is IoT PKI?</span>\r\nToday there are more things (devices) online than there are people on the planet! Devices are the number one users of the Internet and need digital identities for secure operation. As enterprises seek to transform their business models to stay competitive, rapid adoption of IoT technologies is creating increasing demand for Public Key Infrastructures (PKIs) to provide digital certificates for the growing number of devices and the software and firmware they run.\r\nSafe IoT deployments require not only trusting the devices to be authentic and to be who they say they are, but also trusting that the data they collect is real and not altered. If one cannot trust the IoT devices and the data, there is no point in collecting, running analytics, and executing decisions based on the information collected.\r\nSecure adoption of IoT requires:\r\n<ul><li>Enabling mutual authentication between connected devices and applications</li><li>Maintaining the integrity and confidentiality of the data collected by devices</li><li>Ensuring the legitimacy and integrity of the software downloaded to devices</li><li>Preserving the privacy of sensitive data in light of stricter security regulations</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/iot.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":5918,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/AssetWise_CONNECTEdition_Logo.jpg","logo":true,"scheme":false,"title":"AssetWise","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":1,"alias":"assetwise","companyTitle":"Bentley Systems","companyTypes":["vendor"],"companyId":2776,"companyAlias":"bentley-systems","description":"Intelligently plan and implement asset performance and reliability strategies. AssetWise provides informed decision support from capital planning through proactive asset maintenance, enabling you to mitigate risk, increase operational efficiency, and ensure regulatory compliance. With improved information flow and interoperability you can collect, analyze, and control relevant asset information. AssetWise delivers actionable information that supports your business processes and drives the performance of your infrastructure assets.\r\nAligned with BIM, PAS, and ISO asset management standards, AssetWise leverages a connected data environment to facilitate the interoperation of multiple data sources, providing a common view of data that delivers accurate and reliable information when it is needed to operations, maintenance, and engineering. With AssetWise CONNECT Edition, your organization can maximize collaboration by communicating critical requirements more effectively across IT, OT, and ET disciplines, and across the entire lifecycle of your assets. Multi-phase deployment allows you to spread investment over time, minimizing operational disruptions.<br /><br />With AssetWise Asset Reliability you can:\r\n<ul><li>Identify assets posing the greatest risk to your business and rank assets by failure consequence and relative risk</li></ul>\r\n<ul><li>View asset condition data and trends in an asset health dashboard to analyze and strategically plan inspections and maintenance</li></ul>\r\n<ul><li>Perform asset condition analytics for linear assets to enhance predictive maintenance and planning</li></ul>\r\n<ul><li>Provide proof of regulatory compliance with historical and real-time condition reports</li></ul>\r\n<ul><li>Manage assets spread across a wide geographic area with a solution that supports your mobile workforce</li></ul>\r\n<ul><li>Optimize worker safety by minimizing unplanned outages, preventing catastrophic failure, and maximizing worker engagement in the field</li></ul>","shortDescription":"AssetWise: Ensuring safe, reliable, compliant, and cost-effective operations","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"AssetWise","keywords":"","description":"Intelligently plan and implement asset performance and reliability strategies. AssetWise provides informed decision support from capital planning through proactive asset maintenance, enabling you to mitigate risk, increase operational efficiency, and ensure re","og:title":"AssetWise","og:description":"Intelligently plan and implement asset performance and reliability strategies. AssetWise provides informed decision support from capital planning through proactive asset maintenance, enabling you to mitigate risk, increase operational efficiency, and ensure re","og:image":"https://old.roi4cio.com/fileadmin/user_upload/AssetWise_CONNECTEdition_Logo.jpg"},"eventUrl":"","translationId":5918,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":64,"title":"PLM - Product Lifecycle Management","alias":"plm-product-lifecycle-management","description":"<span style=\"font-weight: bold; \">Product lifecycle management,</span> sometimes &quot;product life cycle management&quot;, PLM, represents an all-encompassing vision for managing all data relating to the design, production, support and ultimate disposal of manufactured goods. Product life management concepts were first introduced where safety and control have been extremely important, notably the aerospace, medical device, military and nuclear industries. These industries originated the discipline of configuration management (CM), which evolved into electronic data management systems (EDMS), which then further evolved to product data management (PDM).\r\nOver the last ten years, manufacturers of instrumentation, industrial machinery, consumer electronics, packaged goods and other complex engineered products have discovered the benefits of PLM management and are adopting efficient PLM software in increasing numbers.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">The PLM Stages</span></p>\r\n<span style=\"font-weight: bold; \">Beginning of Life (BOL):</span> The beginning of life phase includes all of the design and manufacturing, which consists of the initial conceptualization and development, and any prototypes built. Initial development has multiple sub-actions that identify all the requirements, concepts, and necessary testing. \r\n<span style=\"font-weight: bold; \">Middle of Life (MOL):</span> The middle of life phase is post-manufacturing, when your product is distributed, used, and serviced. At this point, your product is in the hands of the end user. You can collect data on any failures, maintenance rates, and user experience to get information for immediate fixes and future development.\r\n<span style=\"font-weight: bold; \">End of Life (EOL):</span> The end of life phase is the retiring, recycling, or disposing of your product. At this point, the reverse logistics happen for the company. EOL starts when users no longer have a need for the product. At this stage, companies collect information about what parts and materials are still valuable.\r\n<span style=\"font-weight: bold;\">Product lifecycle management software</span> is used to deliver all kinds of products to market, which means there are a lot of different providers out there. Its purpose today is to help organizations: \r\n<ol><li>Develop new products using CAD software</li><li>Produce and manufacture new products</li><li>Bring those products to market</li></ol>\r\nAnd increasingly, product life management software has to process the feedback from the market back to the design and production processes. To achieve these goals, product lifecycle management solutions have to do four things:\r\n<ul><li>Link together CAD metadata with a bill of materials</li><li>Manage workflows for organizations needed to bring products to market</li><li>Manage product data as they move through the product development lifecycle stages</li><li> Hook in auxiliary suppliers and business stakeholders to a shared version of truth or single source of truth.</li></ul>\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Top PLM System Software Requirements</h1>\r\n<span style=\"font-weight: bold; \">Bill of Materials.</span> Having a common source of information across your company is incredibly important during product development. That’s why a bill of materials (BOM) is key to include in your list of product lifecycle management requirements. At the very least, your system should provide a single definition of a particular product and its components. More advanced options include features specifically designed for different team members such as designers, engineers and other professionals who frequently&nbsp; collaborate.\r\n<span style=\"font-weight: bold; \">Computer-Aided Design Management.</span> Managing your CAD activities and documents is more than useful when it comes to PLM. Your solution should be able to manage changes to product configurations while maintaining the functional and physical attributes of a product throughout its lifecycle. Production engineering changes should proliferate throughout your processes, with the changes evident in the subsequent BOMs and plans.\r\n<span style=\"font-weight: bold; \">Manufacturing Product Management.</span> During a product’s lifecycle, you want to keep an eye on your portfolio. With portfolio management, users can determine the proper investment balance to maximize their research and development investment returns. Some systems provide strategy tools to spotlight priorities and support planning. Top PLM software can even determine the best possible investment scenario. Users can also track project progress to completion, which is automatically documented in the product record. This allows greater insight into your processes, facilitating better resource management and allocation.\r\n<span style=\"font-weight: bold; \">Product Regulation and Governance.</span> Failing to follow regulation and compliance standards is one of the quickest ways to earn your business a bad reputation. But having the right tools built into your product life management system can make staying compliant much easier than it would be otherwise. Your solution should be able to centralize relevant information and documentation, making it easier for enterprise organizations to achieve and maintain compliance.&nbsp; You also may choose a system that can comply with medical, environmental, safety, FSA and ISO standards depending on your industry.\r\n<span style=\"font-weight: bold; \">Project and Component Maintenance.</span> Project management tools are vital for providing users visibility into daily processes and progress. These features include tracking and scheduling capabilities, which enable you to manage product development along with resource allocation in real time. Users can also see upcoming milestones and constraints for further planning.\r\n<span style=\"font-weight: bold; \">Quote Process Management.</span> Data from many different sources is often needed during the quote process. PLM’s inherent coordination capabilities gather and organize data pertaining to product design to support your engineering teams. This includes teams developing engineer-to-order and configure-to-order products. The system only shares the necessary data, meaning your team members can spend more time focusing on their work and less on hunting down information. \r\n<span style=\"font-weight: bold; \">Risk Management. </span>This feature brings risks to users’ attention, allowing them to manage, report and mitigate those instabilities. Reducing risks early on prevents issues from growing as they move through product development unseen, reducing the overall cost of development. Some systems do this by “detecting” or “highlighting” risks, whereas some systems simply offer full visibility through PM tools.\r\n<span style=\"font-weight: bold;\">Workflow and Change Management.</span> Plainly said, this suite of PLM software tools gives users insight into product activities. Users can determine phases for a project, as well as assign milestones to keep projects on track. Some systems allow users to see all pending and implemented changes, as well as all items that endure the subsequent effects. This visibility extends to portfolio and resource management, also.\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/PLM_-_Product_Lifecycle_Management.png"},{"id":166,"title":"MES - Manufacturing Execution System","alias":"mes-manufacturing-execution-system","description":"<span style=\"font-weight: bold; \">Manufacturing execution systems (MES)&nbsp;</span> are computerized systems used in manufacturing, to track and document the transformation of raw materials to finished goods. MES software provides information that helps manufacturing decision makers understand how current conditions on the plant floor can be optimized to improve production output. Manufacturing execution solutions work in real time to enable the control of multiple elements of the production process (e.g. inputs, personnel, machines and support services).\r\nThe idea of&nbsp; Execution System might be seen as an intermediate step between, on the one hand, an enterprise resource planning (ERP) system, and a supervisory control and data acquisition (SCADA) or process control system on the other; although historically, exact boundaries have fluctuated. Industry groups such as MESA International— Manufacturing Enterprise Solutions Association were created in the early 1990s in order to address the complexity, and advise on execution, of MES Systems.\r\n<span style=\"color: rgb(97, 97, 97); \">Manufacturing execution software comes with a whole bunch of concepts and terms that help provide a better understanding of what they actually are. Here are some of the more common terms and concepts associated with MES:</span>\r\n<ul><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Enterprise resource planning (ERP) system</span>— strategic business process management tools that integrate all facets of an enterprise into one comprehensive information system that can be accessed by individuals across an entire organization.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">MESA-11</span>— published in 1997, this model — created by the Manufacturing Enterprise Solutions Association (MESA)— indicated the 11 core functions of a standard MES.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">ANSI/ISA-95 standard </span>— created for global manufacturers by the International Society of Automation, this is a standard set of guidelines for developers to follow when creating software that automatically links enterprise systems—like ERP—and control systems.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Overall equipment effectiveness (OEE)</span> — a general unit of measure that evaluates how well a machine works compared to its full potential.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Supervisory Control and Data Acquisition (SCADA) </span>— a system of software and hardware elements that allows manufacturers to maintain efficiency, process data for smarter decisions, and communicate system issues to help reduce downtime.</span></li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold; \"><span style=\"color: rgb(97, 97, 97); \">Core MES Functionality</span></span></p>\r\n<ul><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Operations management.</span> Offer employees a global view of planned production orders and their production routing. <br /></span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Dispatching production units.</span> Manage the bidirectional flow of production data in real time between the ERP and the workshop. This ensures production data is always accurate, consistent, and up to date.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Product tracking and genealogy.</span> Group final parts or batches with all their corresponding manufacturing data—from the raw material to the component assembly. This data is especially useful for manufa</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Labor management.</span> Manages people, products, and/or operations and track any skills or authorizations they require.<br /></span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Quality management.</span> Manages the quality of manufacturing process and units. This function can be integrated directly into the Manufacturing execution system software or can use external software.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Maintenance management.</span> More easily and accurately plans preventative machine maintenance to reduce downtime and production interruptions.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Data collection and acquisition.</span> Tracks and gathers essential data and easily recall that data when needed.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Process management.</span> Provides process routing and operational sequencing—including full production traceability.</span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Performance analysis.</span> Consolidates data to calculate key performance indicators (KPIs) like rework, scrap, process capability, OEE, and more. <br /></span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Document control.</span> Provides a simple way for operators to access important documents—including instructions, drawings, notes, and more—when they need them. <br /></span></li><li><span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Resource allocation and status.</span> Defines and tracks the status of resources and how they are used in the production process.</span></li></ul>\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Is an MES right for my business?</h1>\r\n<p class=\"align-left\">There are plenty of benefits—including increased productivity, improved data capture, real-time visibility into your operations, an optimized workforce, and more. MES manufacturing software provides materials traceability, which is invaluable for manufacturers that must adhere to strict regulations. Manufacturers in the food and beverage, medical device, aeronautics and aerospace, and defense industries require this traceability to ensure they are compliant with regulations.</p>\r\n<p class=\"align-left\">However, manufacturing enterprise system isn’t for everyone. Smaller manufacturers may find that their production operations aren’t large enough to justify an additional software system like an MES. Additionally, they may feel that their profit margins don’t allow for this type of investment. Like any piece of technology, you have to weigh your options and decide if an MES is worth it for your manufacturing enterprise.</p>\r\n<h1 class=\"align-center\">How do MES and ERP systems work together?</h1>\r\n&nbsp;ERP and MES systems play separate but complementary roles in manufacturing operations. ERP systems integrate all facets of an enterprise into one comprehensive information system. For example, employees in planning and scheduling have access to the same data as the staff in financial management. All the data is also available in real time, which enables production managers to make faster, more informed business decisions.Meanwhile, MES is the layer between your manufacturing shop floor systems—like machines and supervisory systems—and your business, planning, and logistics systems—basically, your ERP solution. \r\nMES and ERP integrate with each other to provide a single source of truth throughout your organization. ERP systems can show you that you might need to improve your production output—MES management shows you how.\r\n<h1 class=\"align-center\">What should I be careful about as I pursue my MES strategy? </h1>\r\nKnow what you need. Know your own best-practices requirements. Know your production hardware and equipment inside out so you can be sure that it can be monitored and controlled by a prospective MES vendor's products. Don't believe every claim you hear from an MES software vendor. Ask them to prove their claims by checking with clients who've installed their applications and are seeing them work every day.\r\nKnow the vendor's responsibilities to uptime, production needs, tech support, training, and every other conceivable detail before you sign a contract. Know the answer to your question before you even ask the vendor, because you already did the research and know it from every angle. Be sure your prospective vendors value your critical business processes as much as their own before you put your factories and production into their hands.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/MES_-_Manufacturing_Execution_System1.png"},{"id":285,"title":"Operations and Manufacturing Applications","alias":"operations-and-manufacturing-applications","description":" Manufacturing operations management (MOM) is a collection of systems for managing end-to-end manufacturing processes with a view to optimizing efficiency.\r\nThere are many types of MOM software, including production management, performance analysis, quality and compliance, and human-machine interface (HMI). Production management software provides real-time information about jobs and orders, labor and materials, machine status, and product shipments. Performance analysis software displays metrics at the machine, line, plant, and enterprise-level for situational or historical analysis. Quality and compliance software are used to promote compliance with standards and specifications for operational processes and procedures. HMI software is a form of manufacturing operations management (MOM) software that enables operators to manage industrial and process control machinery using a computer-based interface.\r\nAdvancements in technology and market demands are enabling new capabilities in MOM software platforms, gradually closing gaps in end-user needs.\r\n<ul><li>Collaboration Capabilities: Collaboration and workflow services support people-to-people, people-to-systems, and systems-to-systems interactions, enforcing procedures and rules while flexibly adapting to real-time situations with alternate workflows and processes.</li><li>Security Services: Future manufacturing platforms will leverage common security services that determine roles, responsibilities, authorities, and access across all systems and application functions while fitting into corporate IT security schemes.</li><li>Asset &amp; Production Model: Future manufacturing platforms will have a unified asset and production model that supports all of the interrelationships between physical production equipment, facilities, inventory/materials, and people, as well as production definitions such as the manufacturing bill of materials, productions orders, etc. This contrasts with older systems that either had subsets of these interrelationships across multiple databases or could not effectively deal with federating across multiple systems of record.</li><li>Operations Database &amp; Historians: Evolving from older systems that had separate historians and production databases that were difficult to correlate across, service-based platforms will have a unified operations database and historian. This will capture and aggregate all time-series and production event information surrounding everything involved in each product and production run with a full genealogy of components and materials, related performance information, and federation across other systems and devices of record.</li><li>Visualization and Mobility: Today, different MOM applications support different graphical user interfaces, Web interfaces, specific mobile applications, etc. The future manufacturing platform will provide common visualization and mobility for a consistent user interface experience across different form factors, supporting dedicated and mobile workers that are orchestrated by consistent workflows and procedures.</li><li>Smaller and Focused 'Apps': Today’s monolithic systems and applications have too many interdependencies of databases, operate inconsistently, and are not inherently integrated. Being able to take advantage of many of the common software platform services described above, modular apps will be significantly smaller, simpler, and focused. These apps will be much lighter weight in functionality, and, as a result, significantly easier and faster to develop.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">What is a manufacturing operating system?</span>\r\nA Manufacturing Execution System manages manufacturing operations such as product production rules, bill of materials, recipe data (product definition), resource management, scheduling, work batching (JiT Just in Time manufacturing), production data/logs, production performance, and some analysis.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/Operations_and_Manufacturing_Applications_1_.png"},{"id":377,"title":"IT Asset Management","alias":"it-asset-management","description":" IT asset management is the set of business practices that join financial, contractual and inventory functions to support life cycle management and strategic decision making for the IT environment. Assets include all elements of software and hardware that are found in the business environment.\r\nIT asset management generally uses automation to manage the discovery of assets so inventory can be compared to license entitlements. Full business management of IT assets requires a repository of multiple types of information about the asset, as well as integration with other systems such as supply chain, help desk, procurement and HR systems and ITSM.\r\nHardware asset management entails the management of the physical components of computers and computer networks, from acquisition through disposal. Common business practices include request and approval process, procurement management, life cycle management, redeployment and disposal management. A key component is capturing the financial information about the hardware life cycle which aids the organization in making business decisions based on meaningful and measurable financial objectives.\r\nSoftware Asset Management is a similar process, focusing on software assets, including licenses. Standards for this aspect of data center management are part of ISO/IEC 19770.","materialsDescription":" <span style=\"font-weight: bold;\">What is Information Technology Asset Management?</span>\r\nIT asset management (information technology asset management, or ITAM) is a set of business practices that combines financial, inventory and contractual functions to optimize spending and support lifecycle management and strategic decision-making within the IT environment.\r\n<span style=\"font-weight: bold;\">What is the purpose of IT asset management?</span>\r\nAsset management allows the organization to keep track of all their assets. It can tell where the assets are located, how they are used, and when changes were made to them. The data from the asset management solution can ensure that asset recovery will lead to better returns.\r\n<span style=\"font-weight: bold;\">What are the benefits of asset management?</span>\r\nWith a structure asset management framework in place, organizations will realize these and other benefits:\r\nGood Business Practice. Asset management results in better decisions;\r\n<ul><li>Improved Regulatory Compliance;</li><li>Improved Reliability;</li><li>Long Term System Integrity;</li><li>Cost Savings;</li><li>Eligibility for Federal Funding.</li></ul>\r\n<span style=\"font-weight: bold;\">What are the types of asset management?</span>\r\nThere are 7 types of asset management:\r\n<ul><li>Financial Asset Management.</li><li>Enterprise Asset Management.</li><li>Infrastructure Asset Management.</li><li>Public Asset Management.</li><li>IT Asset Management.</li><li>Fixed Assets Management.</li><li>Digital Asset Management.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_IT_Asset_Management.png"},{"id":417,"title":"Product Life-Cycle Management Applications","alias":"product-life-cycle-management-applications","description":"","materialsDescription":"","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Product_Life_Cycle_Management_Applications.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6181,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti Asset Manager","vendorVerified":1,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-asset-manager","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"Keeping tabs on hardware is challenging for asset managers: IT assets are assigned, reassigned, and moved from one location to another depending on business dynamics. Of IT hardware fixed assets, 30% are missing and can’t be found, and 53% of all data loss and systems downtime is caused by hardware failure.\r\nKnowing what assets you have and where they reside, tracking contracts and regulatory compliance, and gaining visibility into cost of ownership are just the tip of your management iceberg.<br />\r\nWith Ivanti® Asset Manager, you gain all the management support you need. Get a comprehensive view of your managed assets across your entire environment at any lifecycle status. This enterprise-grade hardware asset management solution keeps tabs on your contracts while tracking lease, warranty, and financial information to ensure your IT assets are optimized and secured.<br />\r\n<span style=\"font-weight: bold;\">Manage Your IT Assets from Purchase to Disposal for Complete Asset Optimization</span><br />\r\nDue to the complexity of discovering, tracking, and managing hardware, many organizations today still aren’t tracking their IT assets effectively. In fact, 56% of enterprises verify the location of their fixed assets only once a year, while 10% to 15% haven’t verified their assets in more than five years.3 It’s crucial that you monitor your hardware assets from procurement to disposal to know where they are and how they’re performing so you can make the most of your IT investments.<br />\r\nWhen you better understand the changes that occur throughout the lifecycle, you can make informed purchasing decisions, replace hardware at the right time, and empower management with accurate, thorough information about total cost of ownership. Ivanti Asset Manager monitors and reports what hardware needs to be purchased, updated, and maintained so that IT management can plan ahead, avoid hasty purchasing decisions, and optimize asset use operationally and fiscally.<br />\r\n<span style=\"font-weight: bold;\">Track Asset Availability and Performance</span><br />\r\nManhours spent grappling with multiple systems and inaccurate spreadsheet data to search for and track assets— or produce a single report—is time you can’t afford. Asset Manager simplifies the process with an Asset Repository.<br />\r\nThis enables consistent management—from procurement to purchase order, receipt, deployment, and disposal. It allows the assignment of asset information, including identifying data, lifecycle status, stock, location, and warranty information.<br />\r\nWhile it’s easy to assign data, the task of tracking assets and their performance becomes difficult as the organization evolves, or users change jobs. To maintain repository accuracy, Asset Manager includes powerful data-importing capabilities that allow imported data from several discovery sources, including Ivanti Endpoint Manager, Ivanti Data Center Discovery, and barcode scans. Compare actual against discovered data and report on exceptions. With these insights you can validate assumptions about assignments and update the asset information so that your data is always accurate and relevant.<br />\r\n<span style=\"font-weight: bold;\">Retrieve Data with Barcode Scanning</span><br />\r\nSpeed up data retrieval with Ivanti’s barcode scanning capability. Download the app onto your Android scanning device. Scan assets to look up or modify information or scan multiple assets to update information in Asset Manager as part of your asset-tracking discipline.<br />\r\n<span style=\"font-weight: bold;\">Gain Cost and Contract Visibility</span><br />\r\nProviding accurate, timely financial and contractual information helps you optimize your asset purchases in the way the business needs. With Ivanti, it’s simple to store and view procurement data. Open and maintain purchase orders easily and access individual transactions associated with each asset. Roll up to the total cost of ownership to better manage budgets and forecast needs. Now you can assign financial ownership to report on IT spend by department to defend budget spend and achieve accountability.<br />\r\nTake the guesswork out of asset refresh requirements by calculating and tracking asset age and value. View and manage the complete list of contracts in your environment tied to individual assets. Ensure you’re in contract compliance.<br />\r\nAnticipate contract-renewal dates with configurable notification time periods; be ready to negotiate new contracts on your terms.<br />\r\n<span style=\"font-weight: bold;\">Deliver Enhanced User Experiences with a Product Catalog</span><br />\r\nMaintain a product catalog of authorized items. See assets purchased or assigned, current stock levels, or active orders. Use the catalog to increase speed to provision while reducing service desk calls. Eliminate frustrations that lead to shadow IT and subsequent asset management complexity. This at-aglance information ensures you can organize asset availability proactively to meet business and user requests.<br />\r\n<span style=\"font-weight: bold;\">Drive Vendor Management</span><br />\r\nManaging the vendors that provide your assets is an ongoing process that should include performance monitoring and feedback. Asset Manager stores vendor information to ensure you are managing strategic vendors effectively.<br />You can also keep tabs on vendor interactions by logging comments about their service and the assets they provide.<br />\r\nView these comments in aggregated Vendor Scorecards on your dashboards. Determine whether you’re getting the most out of your investments or if it’s time to terminate relationships.<br />\r\n<span style=\"font-weight: bold;\">Highly Configurable to Meet Your Needs</span><br />\r\nIvanti Asset Manager provides you out-of-the-box reports and dashboards configured to meet the specific needs of your asset management team roles. Rest assured that many years of Ivanti asset management experience and the best practices of industry organizations such as IAITAM are at the heart of the Asset Manager solution. It also features full customdesign options, including full Development, Test, and Live instance configuration. Asset Manager is available in a turnkey Essentials version, prebuilt for fast time to value, or as an Enterprise-grade fully configurable solution both in the cloud and on-premises.<br />\r\n<span style=\"font-weight: bold;\">Integrate with Service Management for improved Service Delivery</span><br />\r\nIvanti Asset Manager is built on the proven Ivanti Service Manager platform, leveraging a mature user interface and offering a strong foundation for growth. Asset Manager integrates with Ivanti Service Manager for easy request management. Users benefit from a rich self-service experience as they navigate easily through an approved service catalog, alleviating pressure on IT staff. In addition, Asset Manager enhances change management processes and policies by providing status updates to IT assets to help maximize productivity. The solution delivers a single asset repository that integrates with your service management CMDB, ensuring accurate, up-to-date information.","shortDescription":"IVANTI ASSET MANAGER: STOP WASTING MONEY AND START OPTIMIZING. GET THE COMPLETE PICTURE OF YOUR IT ASSETS FROM PURCHASE TO DISPOSAL.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti Asset Manager","keywords":"","description":"Keeping tabs on hardware is challenging for asset managers: IT assets are assigned, reassigned, and moved from one location to another depending on business dynamics. Of IT hardware fixed assets, 30% are missing and can’t be found, and 53% of all data loss and","og:title":"Ivanti Asset Manager","og:description":"Keeping tabs on hardware is challenging for asset managers: IT assets are assigned, reassigned, and moved from one location to another depending on business dynamics. Of IT hardware fixed assets, 30% are missing and can’t be found, and 53% of all data loss and","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6182,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":377,"title":"IT Asset Management","alias":"it-asset-management","description":" IT asset management is the set of business practices that join financial, contractual and inventory functions to support life cycle management and strategic decision making for the IT environment. Assets include all elements of software and hardware that are found in the business environment.\r\nIT asset management generally uses automation to manage the discovery of assets so inventory can be compared to license entitlements. Full business management of IT assets requires a repository of multiple types of information about the asset, as well as integration with other systems such as supply chain, help desk, procurement and HR systems and ITSM.\r\nHardware asset management entails the management of the physical components of computers and computer networks, from acquisition through disposal. Common business practices include request and approval process, procurement management, life cycle management, redeployment and disposal management. A key component is capturing the financial information about the hardware life cycle which aids the organization in making business decisions based on meaningful and measurable financial objectives.\r\nSoftware Asset Management is a similar process, focusing on software assets, including licenses. Standards for this aspect of data center management are part of ISO/IEC 19770.","materialsDescription":" <span style=\"font-weight: bold;\">What is Information Technology Asset Management?</span>\r\nIT asset management (information technology asset management, or ITAM) is a set of business practices that combines financial, inventory and contractual functions to optimize spending and support lifecycle management and strategic decision-making within the IT environment.\r\n<span style=\"font-weight: bold;\">What is the purpose of IT asset management?</span>\r\nAsset management allows the organization to keep track of all their assets. It can tell where the assets are located, how they are used, and when changes were made to them. The data from the asset management solution can ensure that asset recovery will lead to better returns.\r\n<span style=\"font-weight: bold;\">What are the benefits of asset management?</span>\r\nWith a structure asset management framework in place, organizations will realize these and other benefits:\r\nGood Business Practice. Asset management results in better decisions;\r\n<ul><li>Improved Regulatory Compliance;</li><li>Improved Reliability;</li><li>Long Term System Integrity;</li><li>Cost Savings;</li><li>Eligibility for Federal Funding.</li></ul>\r\n<span style=\"font-weight: bold;\">What are the types of asset management?</span>\r\nThere are 7 types of asset management:\r\n<ul><li>Financial Asset Management.</li><li>Enterprise Asset Management.</li><li>Infrastructure Asset Management.</li><li>Public Asset Management.</li><li>IT Asset Management.</li><li>Fixed Assets Management.</li><li>Digital Asset Management.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_IT_Asset_Management.png"},{"id":379,"title":"SAM - Software Asset Management","alias":"sam-software-asset-management","description":"<span style=\"font-weight: bold; \">Software asset management (SAM)</span> tools automate many of the tasks required to maintain compliance with software licenses, thereby controlling software spending. They facilitate the in-depth analysis of software assets by decoding software license entitlements, automating the collection of software consumption data, establishing independent software vendor (ISV) effective license position (ELP), and optimizing software value delivery and information sharing. SAM software manage entitlements from enterprise license agreements, purchases and other records to automatically determine and optimize license position against discovered software. Infrastructure and operations (I&amp;O) leaders use SAM tools for managing software entitlement, in lieu of using spreadsheets, due to the rising complexity of software-licensing schemes.\r\nFor many organizations, the goal of implementing an asset software program is very tactical in nature, focused specifically on balancing the number of software licenses purchased with the number of actual licenses consumed or used. In addition to software license management, an effective SAM program must also ensure that the usage of all installed software is in keeping with the terms and conditions of the specific vendor license agreement. In doing so, organizations can minimize liabilities associated with software piracy in the event of an audit by a software vendor or a third party such as the Business Software Alliance (BSA). \r\nThe key business benefits of SAM software be summarized as follows::\r\n<span style=\"font-weight: bold; \">Licenses.</span> Licenses are assets that need to be managed. Each license contains specific conditions for how the software product can be installed and used. As a user, your job is to make sure your company is compliant with the terms and conditions of the license agreement.\r\n<span style=\"font-weight: bold; \">Compliance </span>is the bedrock of asset management tools. Software vendors don’t want you to use more software than you licensed. Even though SAM is much bigger than compliance, compliance is where license management becomes an essential part of your business strategy. And it’s the first goal for most companies when starting SAM.\r\n<span style=\"font-weight: bold; \">Audits. </span>To check whether you are compliant, vendors will perform software asset management audit to see how their product is being used, how it’s configured, and whether your licenses cover all of it. There are two possible outcomes of an audit: either you’re compliant, or you’re not. Non-compliance can result in unexpected fees, which, if you’re not careful, can cost you big. An audit also disrupts your business and can take months to complete without license management technology to support the process.\r\n<span style=\"font-weight: bold; \">Optimization.</span> Often businesses are over-compliant simply because they have more licenses than they need. They prefer to over-pay upfront to outsmart the audit risk. So, while they aren’t losing a ton of money at once for failing an audit, they are losing it slowly. It may not hurt at first, but over time being over-licensed costs more than failing an audit. When you fail an audit, you buy just enough licenses to close the gap, and often vendors demand you pay back-maintenance for the licenses too. It’s expensive, but the problem is a one-time cost — that can also be reduced or completely eliminated with software license management solutions.","materialsDescription":"<h1 class=\"align-center\">5 Reasons to do Software Asset Management</h1>\r\n<span style=\"font-weight: bold; \">Cost savings.</span> With a full overview of your environment and your software needs, you know exactly what you’re using and exactly what you need. So you purchase the right licenses from the start, saving you money on maintenance fees, and helping to ensure compliance. In fact, you can reduce your licensing costs up to 30%.\r\nTime savings. Organizing your licenses and setting up software asset management process will save you time:\r\n<ul><li>Have a central database of your licensing terms and conditions, making it easier and quicker to get the information you need to make better software purchasing and IT budgeting decisions</li><li>Be able to respond to audit letters within days instead of weeks</li><li>Transparency means you can respond quicker to problems, sometimes even before they arise</li></ul>\r\n<span style=\"font-weight: bold; \">Automation.</span>Nothing says effortless like automation. Automating your processes frees you up to concentrate on other things. With alerts and regular reports, you don’t need to spend time watching out for problems and looking for areas to save. Just to name a few examples an asset management program tool can automate:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Alerting you to over usage and non-compliance</li><li>&nbsp;&nbsp;&nbsp; Informing you about high-risk configurations</li><li>&nbsp;&nbsp;&nbsp; Suggesting optimization options</li><li>&nbsp;&nbsp;&nbsp; Filling software requests with existing licenses</li><li>&nbsp;&nbsp;&nbsp; Simulating your data center architecture and the resulting licensing costs</li></ul>\r\n<span style=\"color: rgb(97, 97, 97); \"><span style=\"font-weight: bold; \">Software License Optimization.</span> When you know what you have and use, you can go beyond compliance. You can compare your licenses. See what license schemes are possible and make the most sense in your environment—while easily keeping an eye on cost.</span>\r\n<span style=\"font-weight: bold; \">Strategy.</span> Enterprise asset management system gives you transparency into your current and past software needs. This in turn gives you valuable insights into your software future. It can help you plan in advance on multiple levels from data center architectures to budgets and service-charging. There are strategic benefits for every department in the company.\r\n<h1 class=\"align-center\">Choosing the Best Software Asset Management Software</h1>\r\n<span style=\"font-weight: bold; \">Software Discovery. </span>Enterprise asset management software enables IT organizations to keep track of their hardware and software inventory and monitor license compliance. In the past, this was largely a manual process where IT operators would maintain spreadsheets with information about IT assets. Each time a configuration item changed, a manual update would have to be performed which made it difficult to determine if your SAM database was truly accurate.\r\n<span style=\"font-weight: bold; \">Software and Hardware Inventory and Cataloging.</span> Software and hardware inventory cataloging is one of the main drivers of software asset management. Without sufficient oversight of inventory within the IT organization, waste is inevitable as IT managers order excess licenses, servers, and workstations without any knowledge of viable alternatives that may already be at their disposal. \r\nSoftware inventory is another key feature for SAM tools. IT organizations should look for a tool that tracks instances of software installations on the network and that can be used to determine exactly how many used or unused licenses the organization has for each application.\r\n<span style=\"font-weight: bold; \">License Compliance Monitoring.</span>Today's the leading software on asset management market include features that can help you proactively monitor your inventory of software licenses and detect non-compliance issues before they can ever be discovered in a software vendor audit. IT organizations can receive automated updates and notifications when a change in the system affects license compliance and take steps to correct the non-compliance.\r\n<span style=\"font-weight: bold; \">Asset Depreciation. </span>Software purchased for use is considered a fixed asset by general accounting principles, meaning that corporate organizations can depreciate purchased software on their taxes to obtain an income reduction and reduce their tax liability. Your software asset management system should track the total cost of any software your organization purchases and depreciate the software over time according to your accounting rules. \r\n<span style=\"font-weight: bold; \">Geo-location.</span> Software asset management tools provide IT organizations with unprecedented oversight into their hardware and software inventory and configuration items. The ability to detect hardware and software on the network, collect attribution data for those configuration items and organize that information into a searchable database that drives better asset management is already revolutionary for most IT organizations.\r\n<span style=\"font-weight: bold; \">Audit Scheduling.</span> If your IT organization purchases software licenses from a major software vendor, you should anticipate that you will receive at least one software audit request every three years. As your number of vendor partners grow, you may even receive audit requests annually. If you purchased the right software asset management application, you should be conducting your own software compliance audits on a monthly basis to truly verify your compliance with software license agreements.\r\n<span style=\"font-weight: bold;\">User-Friendly, Automated Reporting.</span> SAM tools with automated reporting features make it easy for IT managers and executive decision-makers to quickly access the high-impact information needed to make important decisions. Most software vendors have developed SAM tools that can collect software usage data or manage license compliance, but IT managers should also look at SAM tools with automated reporting features that promote ease-of-use and seamlessly deliver the information that users need from the system in a digestible and actionable format. \r\n\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Software_Asset_Management.png"},{"id":417,"title":"Product Life-Cycle Management Applications","alias":"product-life-cycle-management-applications","description":"","materialsDescription":"","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Product_Life_Cycle_Management_Applications.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6185,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti Environment Manager","vendorVerified":1,"rating":"0.00","implementationsCount":2,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-environment-manager","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"Ivanti® Environment Manager, powered by AppSense, navigates complex and mixed Windows desktop infrastructures to deliver a consistent and portable user environment, and ensu`res a smooth voyage to Windows 10 or cloud-hosted desktops.<br />Achieve breakneck logon speeds and a personalized user experience, delivered by IT with calm and tranquility.\r\n<span style=\"font-weight: bold; \">Outstanding User Experience</span>\r\n<span style=\"font-weight: bold; \"><span style=\"font-style: italic; \">Ensure a Consistent User Workspace</span></span>\r\nReward users with a familiar workspace regardless of how their desktop is composed and delivered yet ensure conditional settings can be applied—dependent on the user’s context—to meet security and compliance mandates.\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Seamless Migration to Windows 10 </span></span><br />Remove the IT complexity and user upheaval typically associated with Windows 10 migration and enable fluid movement of user settings between physical, virtual, and cloud desktops.\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Release the Full Power of Office 365 </span></span>\r\nDeliver the ultimate Office 365 experience by roaming offline caches in non-persistent VDI and RD Session Host environments.\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Boost Productivity</span></span>\r\nAccelerate logon times and increase productivity while liberating IT from the shackles of slow and complex desktop configuration tools, such as logon scripts or Group Policy.\r\n\r\n<span style=\"font-weight: bold; \">User Personalization</span>\r\n<ul><li>Automate the management of application and OS content, in real time, to remove the complexity associated with managing user profile settings.</li></ul>\r\n<ul><li>Stream personal settings, on-demand, to ensure rapid logon times.</li></ul>\r\n<ul><li>Easily rollback personal settings in the event of profile inconsistencies or corruption.</li></ul>\r\n<ul><li>Self-service tools empower users to be self-sufficient and help reduce the burden on the IT support desk.</li></ul>\r\n\r\n<span style=\"font-weight: bold; \">Policy Configuration</span>\r\n<ul><li>Apply desktop configuration actions simultaneously to speed up logon times.</li></ul>\r\n<ul><li>Ease the strain on the logon process by setting desktop-configuration actions to apply on-demand, only when needed.</li></ul>\r\n<ul><li>Complement built-in desktop configuration actions and conditions by creating custom items to cater to more complex, bespoke environments.</li></ul>\r\n<ul><li>Simplify desktop configuration for IT Teams by removing the complexity of managing and maintaining logon scripts or GPO inheritance rules.</li></ul>\r\n\r\n<span style=\"font-weight: bold; \">Key Feature: Contextual Policy Engine</span><br />\r\nProvide users with a tailored desktop dependent on how they log on, where they log on from, and on which device.<br />\r\nContext-aware conditions enable IT teams to configure custom desktop environments easily to accommodate security, compliance, and ease of use.<br />\r\nA set of rules can be combined easily to deliver Boolean logic without any complexity, enabling IT to satisfy any custom requirements.<br />\r\nDesktop configuration actions can be set to run simultaneously, to speed up processing, or consecutively, to provide different levels of dependency. This provides a simple-to-use alternative to logon scripts and GPOs, removing complexity for IT teams and improving the user experience. Where you have existing GPO settings, these can be easily imported and applied to desktops, significantly reducing your administration overhead and setup time.<br />\r\n\r\n<span style=\"font-weight: bold; \">Key Feature: Effortless User Migration</span><br />\r\nSimplify migration projects with Environment Manager’s unique User Personalization capabilities.<br />\r\nAutomatically capture and roam users’ personal settings easily across distinct operating systems and between physical, virtual, and cloud-based desktops.<br />Built-in templates provide out-of-the-box configuration settings for a host of common applications.\r\nSelf-service tools let users roll back their personal settings on a per-application or operating systemcomponent basis in the event of profile corruption or inconsistencies, to help reduce IT support calls.<br />\r\nPersonalization Analysis Tools ease management of user settings and a web-based Personalization Operations Console empowers IT to perform multi-user operations such as deleting, creating, or editing profile setting backups.<br /><br /><span style=\"font-weight: bold;\">Major Benefits</span>\r\n<ul><li>Deliver a superior user experience</li></ul>\r\n<ul><li>Reduce the IT complexity of desktop configuration</li></ul>\r\n<ul><li>Ease Windows 10 migrations</li></ul>\r\n<ul><li>Enable faster adoption of cloud services</li></ul>\r\n<ul><li>Provide an optimized Office 365 experience in nonpersistent desktop environments</li></ul>\r\n<ul><li>Proven enterprise scalability</li></ul>\r\n<ul><li>Built-in DR and failover for business continuity</li></ul>","shortDescription":"Ivanti Environment Manager позволяет создавать рабочее пространство пользователя исходя из контекстной политики и без потери данных.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti Environment Manager","keywords":"","description":"Ivanti® Environment Manager, powered by AppSense, navigates complex and mixed Windows desktop infrastructures to deliver a consistent and portable user environment, and ensu`res a smooth voyage to Windows 10 or cloud-hosted desktops.<br />Achieve breakneck log","og:title":"Ivanti Environment Manager","og:description":"Ivanti® Environment Manager, powered by AppSense, navigates complex and mixed Windows desktop infrastructures to deliver a consistent and portable user environment, and ensu`res a smooth voyage to Windows 10 or cloud-hosted desktops.<br />Achieve breakneck log","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6186,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6194,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti License Optimizer for Clients","vendorVerified":1,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-license-optimizer-for-clients","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"Ivanti® License Optimizer for Clients is a software asset management (SAM) solution that delivers clarity on what software you have – and how it’s being used – to model and improve your effective license position. Discover and inventory owned IT assets, aggregate vendor data with B2B connectors, and monitor software usage for intelligent business decision-making. Plus, you gain a broad view of how users interact with assigned software applications to ensure compliance while reducing license overspending.\r\n<span style=\"font-weight: bold;\">Discover Your IT Environment</span>\r\nThe first step in managing your IT assets is knowing what assets you have. The discovery and tracking processes in Ivanti License Optimizer for Clients identify and aggregate data on IT assets in your environment automatically, including printers and SNMP devices.<br />Determine assets in use and understand where you can optimize your investments. Accurate information about your owned assets delivered at the right time drives confidence in data and fosters informed decision-making.\r\n<span style=\"font-weight: bold;\">Close the Vendor Visibility Gap with B2B Connectors</span>\r\nEliminate spreadsheets and gain vendor visibility from the moment you acquire a new asset. Business-to-business (B2B) connectors aggregate manufacturer, vendor, and reseller data such as purchase order numbers, device types, and location mapping. Collect this information automatically from a continually growing number of connectors like Apple, Dell, HP, IBM, Lenovo, Lexmark, Verizon, CDW, En Pointe, and more.\r\n<span style=\"font-weight: bold;\">Standardize Asset Naming with Data Normalization</span>\r\nIvanti License Optimizer for Clients employs a normalization and rules engine that applies standard naming conventions automatically to collected asset data and reporting fields. This eliminates reporting and management headaches associated with varied and complex vendor naming schemes.\r\n<span style=\"font-weight: bold;\">Reclaim Your Unused Software Licenses</span>\r\nGain visibility through software monitoring and comprehend clearly what’s in use, when it was last used, and how long it was deployed to determine appropriate reclamation processes and policies. You maximize software licenses and enable users to make license requests for authorized software. No over-spending required.\r\n<span style=\"font-weight: bold;\">Gain Control Over Software Compliance</span>\r\nSoftware audits are increasingly more common. Software not purchased, maintained, or licensed correctly places organizations at risk of non-compliance. The incurred penalties and unexpected true-up costs can drain financial resources. Ivanti License Optimizer for Clients delivers detailed insight into your current software license usage so you can negotiate more favorable licensing deals, eliminate over-buying of licenses, minimize rogue purchases, and avoid fines associated with failed audits.\r\n<span style=\"font-weight: bold;\">Optimize Your Software Assets</span>\r\nMaking the most of your software assets is challenging, especially when dealing with licensing structures that are constantly changed and updated. Now you can maximize your software spend and avoid the financial risk of noncompliance by matching your usage data against license entitlements with support for the most advanced licensing regimes.","shortDescription":"IVANTI LICENSE OPTIMIZER: OPTIMIZE YOUR SOFTWARE LICENSES—RECLAIM UNUSED LICENSES, STAY COMPLIANT, ANTICIPATE TRUE‑UPS, AND CURB IT OVERSPEND.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti License Optimizer for Clients","keywords":"","description":"Ivanti® License Optimizer for Clients is a software asset management (SAM) solution that delivers clarity on what software you have – and how it’s being used – to model and improve your effective license position. Discover and inventory owned IT assets, aggreg","og:title":"Ivanti License Optimizer for Clients","og:description":"Ivanti® License Optimizer for Clients is a software asset management (SAM) solution that delivers clarity on what software you have – and how it’s being used – to model and improve your effective license position. Discover and inventory owned IT assets, aggreg","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6195,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6196,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti Optimizer для SAP","vendorVerified":1,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-optimizer-dlja-sap","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"Complex SAP licensing necessitates organizations to find a better way to optimize their SAP investments and manage their SAP licenses effectively. Ivanti Optimizer for SAP provides efficient control over SAP license management by combining user inspection, user behavior-analysis methods and best practices.\r\nIvanti Optimizer for SAP provides full visibility to optimize and manage your entire SAP license environment which can lead to significant financial savings and reduce liabilities from indirect access or misclassified users. The solution provides organizations with the insight and intelligence needed to ensure they are correctly licensed based on actual usage and arm them with the proper analysis during contract negotiations.<br />\r\n<span style=\"font-weight: bold;\">Reclassify Licenses Based on Actual Usage</span><br />\r\nWhile many organizations choose to classify SAP licenses based on theoretical calculation methods, Ivanti Optimizer for SAP allocates SAP licenses based on actual usage and not based on the structure of the organization, titles of employees or authorizations that are assigned in the SAP systems. Organizations can rest assured they will never be under- or over-licensed.<br />\r\n<span style=\"font-weight: bold;\">Reclaim Unused Licenses</span><br />\r\nIvanti Optimizer for SAP includes a built-in analysis to optimize your SAP licensing and reduce the amount of licenses. The solution pinpoints inactive users enabling organizations to reallocate these licenses to other users. It can also eliminate duplicate and redundant users by automatically matching users across different systems and applications to avoid duplicate license counts.<br />\r\n<span style=\"font-weight: bold;\">Indirect Access Usage</span><br />\r\nIvanti Optimizer for SAP helps organizations to identify indirect access which allows them to either reduce the amount of access or simply restrict the use. The solution allows companies to model their current exposure and financial risks from indirect access, and receive immediate alerts regarding any new suspicious SAP data consumption so they can review the activity and stop unnecessary SAP access on the spot.<br />\r\n<span style=\"font-weight: bold;\">On-going License Management Control</span><br />\r\nMaintain on-going control of SAP licenses and allocations up to the minute by automatically assigning the proper license type based on the actual usage. Ivanti Optimizer for SAP provides the ultimate control over SAP licensing by combining user inspections, user behavior-analysis methods and best practices.This gives organizations the visibility and insights to know exactly how many SAP licenses they currently have, maintain contractual compliance, and defend audits at any time.<br />\r\n<span style=\"font-weight: bold;\">Achieve Optimized Models for SAP Engines</span><br />\r\nIvanti Optimizer for SAP enables organizations to assess their SAP engines, providing a clear understanding of which engines are actually being used and provides insight to the best possible payment models. This provides an accurate reading and reflects real usage of engines.<br />\r\n<span style=\"font-weight: bold;\">Reduce Costs</span><br />\r\nBy providing a clear view of the current licensing and available licenses, organizations no longer need to pay for duplicates or unused licenses. Ivanti Optimizer for SAP reduces the cost of SAP licensing and maintenance costs, as well as, the manual efforts to prepare and execute license audits. Organizations can save between 50%-90% for each re-classified license, 100% on dormant and multiple username accounts, 50% on license management resources, and OVER 15% on total maintenance fees.1<br />\r\n<span style=\"font-weight: bold;\">Robust Reporting</span><br />\r\nIn a multi-system, multi-environment organization, the question of “What is our current SAP licensing position?” can be very tricky to answer. To generate a rough SAP licensing report would entail mapping all existing SAP systems, receiving a SAP licensing report from each one, and mapping multiple user accounts to employees. With Ivanti Optimizer for SAP, this can be done in a matter of minutes; you can receive usage data and licensing data from each SAP application automatically and map SAP accounts from different SAP systems to employee records, understand the current situation and identify immediate saving potentials using combined views and best practices.<br /><span style=\"font-weight: bold;\">Rapid Deployment</span><br />\r\nIvanti Optimizer for SAP can be implemented within days depending on the customer’s environment. It is a stand alone solution outside of the SAP environment, and requires no changes to the SAP systems.","shortDescription":"IVANTI OPTIMIZER FOR SAP: TAKE CONTROL OF YOUR SAP LICENSE MANAGEMENT","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti Optimizer для SAP","keywords":"","description":"Complex SAP licensing necessitates organizations to find a better way to optimize their SAP investments and manage their SAP licenses effectively. Ivanti Optimizer for SAP provides efficient control over SAP license management by combining user inspection, use","og:title":"Ivanti Optimizer для SAP","og:description":"Complex SAP licensing necessitates organizations to find a better way to optimize their SAP investments and manage their SAP licenses effectively. Ivanti Optimizer for SAP provides efficient control over SAP license management by combining user inspection, use","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6197,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":5685,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/CyberHat.png","logo":true,"scheme":false,"title":"Cyrebro","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"cyrebro","companyTitle":"CyberHat","companyTypes":["supplier","vendor"],"companyId":8600,"companyAlias":"cyberhat","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">What Makes CYREBRO a Smart SOC?</span></p>\r\nCyberHat’s unique cyber security readiness assessment is based on years of practical offensive expertise. Company designed and built a unique, on-site, professional assessment that provides clear and tangible insights of an organizations cyber defense capabilities.\r\nThey evaluate a client’s security readiness and provide a roadmap of remedial actions which address three core elements:\r\n<ol><li><span style=\"font-weight: bold;\">Resilience</span></li><li><span style=\"font-weight: bold;\">Response</span></li><li><span style=\"font-weight: bold;\">Recovery abilities</span></li></ol>\r\nMethodology is focused on the gap between theory and fact. The assessment creates a clear and coherent picture of the true cyber security posture of the organization and it’s ability to handle real life cyber incidents. Attack scenario analysis – CyberHat’s methodology includes a comprehensive analysis that is carried out by tracing known attack phases and examining how a potential attacker could exploit the organization’s existing gaps throughout the different attack vectors. \r\n<ul><li><span style=\"font-weight: bold;\">Technology Agnostic</span></li></ul>\r\nThe only managed SOC solution that is 100% technology agnostic. Manages more than 13 SIEM and log aggregation technologies.\r\n<ul><li> <span style=\"font-weight: bold;\">Hacker Point of View </span></li></ul>\r\nThe design and operation of CYREBRO has the hacker point of view at its core, enabling us to provide the highest grade of professional cyber services. \r\n<ul><li><span style=\"font-weight: bold;\">SIEM Optimization</span></li></ul>\r\n Optimizes customers’ existing SIEM technologies to reduce false positives, ensure true viability and verify the highest level of utilization. \r\n<ul><li><span style=\"font-weight: bold;\">Seamless Integration</span></li></ul>\r\nCYREBRO’s unique lab team is dedicated solely to the research and execution of new and complex log sources and platforms. \r\n<ul><li><span style=\"font-weight: bold;\">Incident Response </span></li></ul>\r\nCYREBRO I.R. team prepares the organization during the onboarding process and executes a professional response to any cyber threat. \r\n<ul><li><span style=\"font-weight: bold;\">Forensic Investigation </span></li></ul>\r\nCYREBRO in-house forensic investigation team is responsible for all levels of advanced forensic investigation, from the host to the network level. \r\n<ul><li><span style=\"font-weight: bold;\">Threat Intelligence </span></li></ul>\r\nCYREBRO in-house intelligence team provides daily threat intelligence analysis, synchronizing directly to the CYREBRO platform to enrich monitoring capabilities.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">CYREBRO Business Models </span></p>\r\n<ul><li><span style=\"font-weight: bold;\">CYREBRO Core.</span> Helping clients utilize their existing technologies</li><li><span style=\"font-weight: bold;\">CYREBRO One.</span> A full turnkey solution that gets you up and running quickly and professionally</li><li><span style=\"font-weight: bold;\">CYREBRO X.</span> Enabling SMBs' the most professional managed SOC with fortune 100 grade </li></ul>","shortDescription":"The World’s most Professional Managed SOC","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":17,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Cyrebro","keywords":"","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">What Makes CYREBRO a Smart SOC?</span></p>\r\nCyberHat’s unique cyber security readiness assessment is based on years of practical offensive expertise. Company designed and built a unique, on-site, profess","og:title":"Cyrebro","og:description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">What Makes CYREBRO a Smart SOC?</span></p>\r\nCyberHat’s unique cyber security readiness assessment is based on years of practical offensive expertise. Company designed and built a unique, on-site, profess","og:image":"https://old.roi4cio.com/fileadmin/user_upload/CyberHat.png"},"eventUrl":"","translationId":5686,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":77,"title":"SOC - Situation Centre","alias":"soc-situation-centre","description":"One of the most pressing tasks facing government bodies and commercial structures is to increase the efficiency of management activities. A modern tool for solving this problem is situational centers, which are complex hardware and software systems for collecting, analyzing and displaying information in a form convenient for making critical decisions.\r\nSituational centers are created for the heads of federal, regional and municipal government bodies, ministries and departments, and large companies. Their main task is to provide information and analytical support for procedures and processes that allow managers to make effective decisions on the current management of headed structures, formulating their development strategies, as well as preventing or eliminating crisis and emergency situations. The structure and composition of the situational site are determined by the specifics of the tasks being solved. As a rule, this is a complex technical complex that includes many subsystems.\r\nThere are many types of command centers. They include: data center management, business application management, civil management, emergency (crisis) management.","materialsDescription":" <span style=\"font-weight: bold;\">What is a Security Operations Center (SOC)?</span>\r\nA SOC is an outsourced office that is completely dedicated to analyzing traffic flow and monitoring for threats and attacks. In today’s world of cyberattacks and data breaches, companies of all sizes need to place an emphasis on securing their technology assets. But due to budget constraints and competing priorities, many organizations can’t afford to employ a full-time in-house IT security team. The smart solution to this problem is to look at partnering with a SOC or security operations center.\r\n<span style=\"font-weight: bold;\">How does a security operations center work?</span>\r\nUntil the recent rise of cloud computing, standard security practice was for a company to choose a traditional software as a product (SaaP) malware scanning solution either via download or, in ancient days, a CD-Rom that arrived via mail. They’d add to that a firewall installed at the edge of the network, and trust that those measures would keep their data and systems safe. Today’s reality is a far different environment, with threats being cast all across the net as hackers invent new ways to launch profitable and sophisticated attacks like ransomware.\r\nA SOC is an example of the software as a service (SaaS) software model in that it operates in the cloud as a subscription service. In this context, it provides a layer of rented expertise to a company’s cybersecurity strategy that operates 24/7 so that networks and endpoints are constantly being monitored. If a vulnerability is found or an incident is discovered, the SOC will engage with the on-site IT team to respond to the issue and investigate the root cause.\r\nIndividual SOC cybersecurity providers offer different suites of products and services. However, there is a core set of operational functions that a SOC must perform in order to add value to an organization.\r\n<ol><li><span style=\"font-weight: bold;\">Asset Survey:</span> In order for a SOC to help a company stay secure, they must have a complete understanding of what resources they need to protect. Otherwise, they may not be able to protect the full scope of the network. An asset survey should identify every server, router, firewall under enterprise control, as well as any other cybersecurity tools actively in use.</li><li><span style=\"font-weight: bold;\">Log Collection:</span> Data is the most important thing for a SOC to function properly and logs serve as the key source of information regarding network activity. The SOC should set up direct feeds from enterprise systems so that data is collected in real-time. Obviously, humans cannot digest such large amounts of information, which is why log scanning tools powered by artificial intelligence algorithms are so valuable for SOCs, though they do pose some interesting side effects that humanity is still trying to iron out.</li><li><span style=\"font-weight: bold;\">Preventative Maintenance:</span> In the best-case scenario, the SOC is able to prevent cyberattacks from occurring by being proactive with their processes. This includes installing security patches and adjusting firewall policies on a regular basis. Since some cyberattacks actually begin as insider threats, a SOC must also look within the organization for risks also.</li><li><span style=\"font-weight: bold;\">Continuous Monitoring:</span> In order to be ready to respond to a cybersecurity incident, the SOC must be vigilant in its monitoring practices. A few minutes can be the difference between blocking an attack and letting it take down an entire system or website. SOC tools run scans across the company’s network to identify potential threats and other suspicious activity.</li><li><span style=\"font-weight: bold;\">Alert Management:</span> Automated systems are great at finding patterns and following scripts. But the human element of a SOC proves it's worth it when it comes to analyzing automated alerts and ranking them based on their severity and priority. SOC staff must know what responses to take and how to verify that an alert is legitimate.</li><li><span style=\"font-weight: bold;\">Root Cause Analysis:</span> After an incident occurs and is resolved, the job of the SOC is just beginning. Cybersecurity experts will analyze the root cause of the problem and diagnose why it occurred in the first place. This feeds into a process of continuous improvement, with security tools and rules being modified to prevent future occurrences of the same incident.</li><li><span style=\"font-weight: bold;\">Compliance Audits:</span> Companies want to know that their data and systems are safe but also that they are being managed in a lawful manner. SOC providers must perform regular audits to confirm their compliance in the regions where they operate. What is a SOC report and what is a SOC audit? Anything that pulls data or records from cybersecurity functions of an organization. What is SOC 2? It’s a special auditing procedure related to information security and privacy.</li></ol>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/SOC_-_Situation_Centre.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4407,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/Verve_Industrial_Protection.png","logo":true,"scheme":false,"title":"Verve Security Center","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"verve-security-center","companyTitle":"Verve Industrial Protection","companyTypes":["supplier","vendor"],"companyId":6827,"companyAlias":"verve-industrial-protection","description":"<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Proven, Comprehensive, Efficient Solutions</span></span></p>\r\n<span style=\"font-weight: bold;\">PROVEN</span>\r\n<ul><li>Proven Team: 25 years of ICS expertise</li><li>Proven OT Cyber Security Platform: Deployed across all major control system OEMs</li><li>Proven Delivery: Hundreds of succesful customer deployments across DCS and SCADA environments</li></ul>\r\n<span style=\"font-weight: bold;\">COMPREHENSIVE</span>\r\n<ul><li>Comprehensive Solution: Integrated Software &amp; Services with no need for handoffs</li><li>Comprehensive Coverage: Vendor-agnostic solutions for all controls equipment (HMIs, Networking, PLCs, IEDs, etc.)</li><li>Comprehensive Cyber Security: Complete coverage for NIST CSF, NERC CIP, CIS CSC20, IEC 62443</li></ul>\r\n<span style=\"font-weight: bold;\">EFFICIENT</span>\r\n<ul><li>Efficient design: Low cost solutions from experienced ICS architects</li><li>Efficient cyber security software platform: No need for hardware or expensive taps or span-port infrastructure</li><li>Efficient maintenance: Integrated platform for monitoring and reporting</li></ul>\r\n<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">One Integrated Solution</span></span></p>\r\n<p class=\"align-left\">The Verve Security Center is the only vendor-agnostic end point protection, detection &amp; response solution designed for OT/ICS</p>\r\n<ul><li>Asset Inventory: 100% visibility and aggregation of OT end point data on all OT devices</li><li>OT-safe automated vulnerability assessment</li><li>Secure Configuration analysis and management</li><li>Log event management</li><li> Anomaly detection</li><li>Not only detect, but remediate with integrated actionability</li><li>Cross-vendor patch management</li><li>Integrated compliance reporting for all major standards: NIST CSF, CIS CSC20, NERC CIP, IEC 62443, etc.</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">VIP SERVICES</span></p>\r\n<p class=\"align-left\">Verve Industrial Protection (VIP) Services is built on 25 years’ experience in industrial controls engineering.</p>\r\n<ul><li>Vendor-agnostic control system automation engineering</li><li>Secure data historian design &amp; maintenance</li><li>Network design and segmentation</li><li>Software-enabled Vulnerability Assessments</li><li>“Re-commissioning” to harden end points with deep controls-system experts</li><li>OT cyber security process &amp; procedure development</li><li>Remote managed security &amp; reliability services</li><li>End-to-end patch services (discovery, evaluation, deployment)</li></ul>\r\n<p class=\"align-left\">&nbsp;</p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\">Automation Controls.</span> 25 year’s of experience in vendor-agnostic design and programming of DCS, SCADA, PLC and other industrial control systems</p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\">ICS Network Design &amp; Segmentation.</span> Expert assessment and design of ICS networks for security and reliability.<br />Data Historian Design &amp; Management. Expert design of control system data historian systems (OSI PI, AspenTech, Schneider, etc.) to ensure data availability even in highly segmented, segregated networks.</p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\">ICS Vulnerability &amp; Security Assessments.</span> Comprehensive end point, network, and policy/procedure assessment, leveraging 25 years’ experience and the unique Verve Security Center functionality.</p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\">Ongoing Patch &amp; Vulnerability Management.</span> Managed patch and vulnerability service providing detection &amp; evaluation, as well as deployment support of ICS patches.</p>\r\n<p class=\"align-left\"><span style=\"font-weight: bold;\">Remote Monitoring for Security, Compliance and Reliability.</span> Integrated security &amp; reliability managed services to provide scale and expertise across distributed controls networks.<br /><br /><br /><br /></p>","shortDescription":"The ability to see the full range of vulnerabilities from missing patches to insecure configurations on end points, to inappropriate network design and firewall rules in a single platform.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":16,"sellingCount":8,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Verve Security Center","keywords":"","description":"<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Proven, Comprehensive, Efficient Solutions</span></span></p>\r\n<span style=\"font-weight: bold;\">PROVEN</span>\r\n<ul><li>Proven Team: 25 years of ICS expertise</li><li>Prov","og:title":"Verve Security Center","og:description":"<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Proven, Comprehensive, Efficient Solutions</span></span></p>\r\n<span style=\"font-weight: bold;\">PROVEN</span>\r\n<ul><li>Proven Team: 25 years of ICS expertise</li><li>Prov","og:image":"https://old.roi4cio.com/fileadmin/user_upload/Verve_Industrial_Protection.png"},"eventUrl":"","translationId":4408,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":40,"title":"Endpoint security","alias":"endpoint-security","description":"In network security, endpoint security refers to a methodology of protecting the corporate network when accessed via remote devices such as laptops or other wireless and mobile devices. Each device with a remote connecting to the network creates a potential entry point for security threats. Endpoint security is designed to secure each endpoint on the network created by these devices.\r\nUsually, endpoint security is a security system that consists of security software, located on a centrally managed and accessible server or gateway within the network, in addition to client software being installed on each of the endpoints (or devices).&nbsp; The server authenticates logins from the endpoints and also updates the device software when needed. While endpoint security software differs by vendor, you can expect most software offerings to provide antivirus, antispyware, firewall and also a host intrusion prevention system (HIPS).\r\nEndpoint security is becoming a more common IT security function and concern as more employees bring consumer mobile devices to work and companies allow its mobile workforce to use these devices on the corporate network.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What are endpoint devices?</span>\r\nAny device that can connect to the central business network is considered an endpoint. Endpoint devices are potential entry points for cybersecurity threats and need strong protection because they are often the weakest link in network security.\r\n<span style=\"font-weight: bold;\">What is endpoint security management?</span>\r\nA set of rules defining the level of security that each device connected to the business network must comply with. These rules may include using an approved operating system (OS), installing a virtual private network (VPN), or running up-to-date antivirus software. If the device connecting to the network does not have the desired level of protection, it may have to connect via a guest network and have limited network access.\r\n<span style=\"font-weight: bold;\">What is endpoint security software?</span>\r\nPrograms that make sure your devices are protected. Endpoint protection software may be cloud-based and work as SaaS (Software as a Service). Endpoint security software can also be installed on each device separately as a standalone application.\r\n<span style=\"font-weight: bold;\">What is endpoint detection and response (EDR)?</span>\r\nEndpoint detection and response (EDR) solutions analyze files and programs, and report on any threats found. EDR solutions monitor continuously for advanced threats, helping to identify attacks at an early stage and respond rapidly to a range of threats.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Endpoint_security.png"},{"id":77,"title":"SOC - Situation Centre","alias":"soc-situation-centre","description":"One of the most pressing tasks facing government bodies and commercial structures is to increase the efficiency of management activities. A modern tool for solving this problem is situational centers, which are complex hardware and software systems for collecting, analyzing and displaying information in a form convenient for making critical decisions.\r\nSituational centers are created for the heads of federal, regional and municipal government bodies, ministries and departments, and large companies. Their main task is to provide information and analytical support for procedures and processes that allow managers to make effective decisions on the current management of headed structures, formulating their development strategies, as well as preventing or eliminating crisis and emergency situations. The structure and composition of the situational site are determined by the specifics of the tasks being solved. As a rule, this is a complex technical complex that includes many subsystems.\r\nThere are many types of command centers. They include: data center management, business application management, civil management, emergency (crisis) management.","materialsDescription":" <span style=\"font-weight: bold;\">What is a Security Operations Center (SOC)?</span>\r\nA SOC is an outsourced office that is completely dedicated to analyzing traffic flow and monitoring for threats and attacks. In today’s world of cyberattacks and data breaches, companies of all sizes need to place an emphasis on securing their technology assets. But due to budget constraints and competing priorities, many organizations can’t afford to employ a full-time in-house IT security team. The smart solution to this problem is to look at partnering with a SOC or security operations center.\r\n<span style=\"font-weight: bold;\">How does a security operations center work?</span>\r\nUntil the recent rise of cloud computing, standard security practice was for a company to choose a traditional software as a product (SaaP) malware scanning solution either via download or, in ancient days, a CD-Rom that arrived via mail. They’d add to that a firewall installed at the edge of the network, and trust that those measures would keep their data and systems safe. Today’s reality is a far different environment, with threats being cast all across the net as hackers invent new ways to launch profitable and sophisticated attacks like ransomware.\r\nA SOC is an example of the software as a service (SaaS) software model in that it operates in the cloud as a subscription service. In this context, it provides a layer of rented expertise to a company’s cybersecurity strategy that operates 24/7 so that networks and endpoints are constantly being monitored. If a vulnerability is found or an incident is discovered, the SOC will engage with the on-site IT team to respond to the issue and investigate the root cause.\r\nIndividual SOC cybersecurity providers offer different suites of products and services. However, there is a core set of operational functions that a SOC must perform in order to add value to an organization.\r\n<ol><li><span style=\"font-weight: bold;\">Asset Survey:</span> In order for a SOC to help a company stay secure, they must have a complete understanding of what resources they need to protect. Otherwise, they may not be able to protect the full scope of the network. An asset survey should identify every server, router, firewall under enterprise control, as well as any other cybersecurity tools actively in use.</li><li><span style=\"font-weight: bold;\">Log Collection:</span> Data is the most important thing for a SOC to function properly and logs serve as the key source of information regarding network activity. The SOC should set up direct feeds from enterprise systems so that data is collected in real-time. Obviously, humans cannot digest such large amounts of information, which is why log scanning tools powered by artificial intelligence algorithms are so valuable for SOCs, though they do pose some interesting side effects that humanity is still trying to iron out.</li><li><span style=\"font-weight: bold;\">Preventative Maintenance:</span> In the best-case scenario, the SOC is able to prevent cyberattacks from occurring by being proactive with their processes. This includes installing security patches and adjusting firewall policies on a regular basis. Since some cyberattacks actually begin as insider threats, a SOC must also look within the organization for risks also.</li><li><span style=\"font-weight: bold;\">Continuous Monitoring:</span> In order to be ready to respond to a cybersecurity incident, the SOC must be vigilant in its monitoring practices. A few minutes can be the difference between blocking an attack and letting it take down an entire system or website. SOC tools run scans across the company’s network to identify potential threats and other suspicious activity.</li><li><span style=\"font-weight: bold;\">Alert Management:</span> Automated systems are great at finding patterns and following scripts. But the human element of a SOC proves it's worth it when it comes to analyzing automated alerts and ranking them based on their severity and priority. SOC staff must know what responses to take and how to verify that an alert is legitimate.</li><li><span style=\"font-weight: bold;\">Root Cause Analysis:</span> After an incident occurs and is resolved, the job of the SOC is just beginning. Cybersecurity experts will analyze the root cause of the problem and diagnose why it occurred in the first place. This feeds into a process of continuous improvement, with security tools and rules being modified to prevent future occurrences of the same incident.</li><li><span style=\"font-weight: bold;\">Compliance Audits:</span> Companies want to know that their data and systems are safe but also that they are being managed in a lawful manner. SOC providers must perform regular audits to confirm their compliance in the regions where they operate. What is a SOC report and what is a SOC audit? Anything that pulls data or records from cybersecurity functions of an organization. What is SOC 2? It’s a special auditing procedure related to information security and privacy.</li></ol>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/SOC_-_Situation_Centre.png"},{"id":204,"title":"Managed Detection and Response","alias":"managed-detection-and-response","description":" MDR, which stands for Managed Detection &amp; Response, is an all-encompassing threat detection system, which arose from the need for small/medium-sized organizations who lack resources to be able to monitor their network systems in-house. It provides a cost-effective alternative to SIEM (Security Information and Event Management).\r\nEveryday, the capabilities of attackers get more sophisticated and the volume of alerts becomes overwhelming and unmanageable. In-house teams might struggle to analyze and log data, which makes it harder than ever to determine if these threats are harmful. MDR can put a stop to attacks before they even happen. MDR technology monitors your systems and detects any unusual behavior, whilst our expert team responds to the threats detected within your business.\r\nMDR offers real-time threat intelligence, and is able to analyse behaviour which can be missed by traditional endpoint security technology. MDR also provides rapid identification of known threats, which in turn minimises overall attacks. Having remote incident investigation will minimise damage to your business, and will allow you to get back to work in no time. It’s important to note that using MDR services will allow third party access to your company's data. You need to consider working with a provider who understands and respects your data policy.","materialsDescription":" <span style=\"font-weight: bold;\">What is Managed Detection and Response?</span>\r\nManaged Detection and Response (MDR) is a managed cybersecurity service that provides intrusion detection of malware and malicious activity in your network, and assists in rapid incident response to eliminate those threats with succinct remediation actions. MDR typically combines a technology solution with outsourced security analysts that extend your technologies and team.\r\n<span style=\"font-weight: bold;\">Isn’t that What MSSPs or Managed SIEMs Do?</span>\r\nNo. Managed Security Service Providers (MSSPs) monitor network security controls and may send alerts when anomalies are identified. MSSPs typically do not investigate the anomalies to eliminate false positives, nor do they respond to real threats. This means that abnormalities in network usage are forwarded to your IT personnel who must then dig through the data to determine if there is a real threat and what to do about it.\r\n<span style=\"font-weight: bold;\">Doesn’t My Firewall Protect My Network?</span>\r\nFirewalls and other preventive forms of cybersecurity are very important and effective at preventing basic cyberattacks. However, over the past decade, it has become clear that preventive cybersecurity technologies are not enough to secure an organization’s network. Further, they are yet another source of alerts, log messages, and events that contribute to the “alert fatigue” being universally suffered today. Recent major hacks such as the Marriot Hack of 2018, the Anthem Hack of 2015, and the Target Hack of 2013 demonstrate how easily cybercriminals can breach networks at enterprise organizations to steal millions of credit card numbers, medical records, and other forms of PII/PHI.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/Endpoint_Detection_and_Response.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":834,"title":"IoT - Internet of Things Security","alias":"iot-internet-of-things-security","description":" IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).\r\nIoT involves adding internet connectivity to a system of interrelated computing devices, mechanical and digital machines, objects, animals and/or people. Each &quot;thing&quot; is provided a unique identifier and the ability to automatically transfer data over a network. Allowing devices to connect to the internet opens them up to a number of serious vulnerabilities if they are not properly protected.\r\nIoT security has become the subject of scrutiny after a number of high-profile incidents where a common IoT device was used to infiltrate and attack the larger network. Implementing security measures is critical to ensuring the safety of networks with IoT devices connected to them.\r\nIoT security hacks can happen in any industry, from smart home to a manufacturing plant to a connected car. The severity of impact depends greatly on the individual system, the data collected and/or the information it contains.\r\nAn attack disabling the brakes of a connected car, for example, or on a connected health device, such as an insulin pump hacked to administer too much medication to a patient, can be life-threatening. Likewise, an attack on a refrigeration system housing medicine that is monitored by an IoT system can ruin the viability of a medicine if temperatures fluctuate. Similarly, an attack on critical infrastructure -- an oil well, energy grid or water supply -- can be disastrous.\r\nSo, a robust IoT security portfolio must allow protecting devices from all types of vulnerabilities while deploying the security level that best matches application needs. Cryptography technologies are used to combat communication attacks. Security services are offered for protecting against lifecycle attacks. Isolation measures can be implemented to fend off software attacks. And, finally, IoT security should include tamper mitigation and side-channel attack mitigation technologies for fighting physical attacks of the chip.","materialsDescription":" <span style=\"font-weight: bold;\">What are the key requirements of IoT Security?</span>\r\nThe key requirements for any IoT security solution are:\r\n<ul><li>Device and data security, including authentication of devices and confidentiality and integrity of data</li><li>Implementing and running security operations at IoT scale</li><li>Meeting compliance requirements and requests</li><li>Meeting performance requirements as per the use case</li></ul>\r\n<span style=\"font-weight: bold;\">What do connected devices require to participate in the IoT Securely?</span>\r\nTo securely participate in the IoT, each connected device needs a unique identification – even before it has an IP address. This digital credential establishes the root of trust for the device’s entire lifecycle, from initial design to deployment to retirement.\r\n<span style=\"font-weight: bold;\">Why is device authentication necessary for the IoT?</span>\r\nStrong IoT device authentication is required to ensure connected devices on the IoT can be trusted to be what they purport to be. Consequently, each IoT device needs a unique identity that can be authenticated when the device attempts to connect to a gateway or central server. With this unique ID in place, IT system administrators can track each device throughout its lifecycle, communicate securely with it, and prevent it from executing harmful processes. If a device exhibits unexpected behavior, administrators can simply revoke its privileges.\r\n<span style=\"font-weight: bold;\">Why is secure manufacturing necessary for IoT devices?</span>\r\nIoT devices produced through unsecured manufacturing processes provide criminals opportunities to change production runs to introduce unauthorized code or produce additional units that are subsequently sold on the black market.\r\nOne way to secure manufacturing processes is to use hardware security modules (HSMs) and supporting security software to inject cryptographic keys and digital certificates and to control the number of units built and the code incorporated into each.\r\n<span style=\"font-weight: bold;\">Why is code signing necessary for IoT devices?</span>\r\nTo protect businesses, brands, partners, and users from software that has been infected by malware, software developers have adopted code signing. In the IoT, code signing in the software release process ensures the integrity of IoT device software and firmware updates and defends against the risks associated with code tampering or code that deviates from organizational policies.\r\nIn public key cryptography, code signing is a specific use of certificate-based digital signatures that enables an organization to verify the identity of the software publisher and certify the software has not been changed since it was published.\r\n<span style=\"font-weight: bold;\">What is IoT PKI?</span>\r\nToday there are more things (devices) online than there are people on the planet! Devices are the number one users of the Internet and need digital identities for secure operation. As enterprises seek to transform their business models to stay competitive, rapid adoption of IoT technologies is creating increasing demand for Public Key Infrastructures (PKIs) to provide digital certificates for the growing number of devices and the software and firmware they run.\r\nSafe IoT deployments require not only trusting the devices to be authentic and to be who they say they are, but also trusting that the data they collect is real and not altered. If one cannot trust the IoT devices and the data, there is no point in collecting, running analytics, and executing decisions based on the information collected.\r\nSecure adoption of IoT requires:\r\n<ul><li>Enabling mutual authentication between connected devices and applications</li><li>Maintaining the integrity and confidentiality of the data collected by devices</li><li>Ensuring the legitimacy and integrity of the software downloaded to devices</li><li>Preserving the privacy of sensitive data in light of stricter security regulations</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/iot.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6202,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti User Workspace Manager (UWM)","vendorVerified":1,"rating":"0.00","implementationsCount":1,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-user-workspace-manager-uwm","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"Ivanti User Workspace Manager enables an unparalleled user experience, increases productivity, and liberates IT from the shackles of slow and complex desktop tools.\r\nWith Ivanti, migration to Windows 10 and adoption of cloud services, including Office 365, is smooth, risk-free, and simplified for both IT and users alike.\r\n\r\n<ul><li><span style=\"font-weight: bold;\">Effortless user migration.</span>Migrate user profiles, settings, and files to Windows 10 with or without hardware refresh—with no disruption to the user and minimal effort for IT.</li></ul>\r\n<ul><li><span style=\"font-weight: bold;\">Ease the move to the cloud.</span> Smooth your journey to the cloud by roaming the user experience seamlessly between on-premises and cloud infrastructure using scalable, robust web services.</li></ul>\r\n<ul><li><span style=\"font-weight: bold;\">Ensure a great user experience.</span> Eliminate logon scripts, eradicate complex group policy configuration, and deliver just-in-time personalization for lightning logon times. Ensure fast desktop and application response. </li></ul>\r\n<span style=\"font-weight: bold;\"><br />Simplify Digital Workspace Management</span>\r\nIvanti User Workspace Manager enables organizations to reap the benefits of Ivanti solutions such as Environment Manager, File Director, Performance Manager, Application Control, and Insight: \r\n<ul><li><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Agile Windows migration.</span></span> Achieve future-proof, continuous migration with ease</li></ul>\r\n<ul><li><span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">Easy file management.</span></span> Eliminate data sprawl and reduce data center costs</li></ul>\r\n<ul><li><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Faster cloud adoption.</span></span> Consistent on-premises, hybrid, or full-cloud desktops</li></ul>\r\n<ul><li><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Better user experience.</span></span> Higher user acceptance of desktop transformation projects</li></ul>\r\n<ul><li><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Greater security and compliance.</span></span> Out-of-the-box protection against unknown threats</li></ul>\r\n<br /><span style=\"font-weight: bold;\">Transform the User Workspace</span>\r\nWith User Workspace Manager, you can deliver responsive, secure desktops that users love, save money on server hardware, reduce IT management, and eliminate security risks.\r\nDetect challenges affecting user experience, quantify what is causing the issues, and benchmark how IT changes can optimize your endpoints.\r\nPatented resource management techniques ensure users are provided with the best desktop performance possible and increase user density in virtual desktop environments — often by as much as 40 percent.\r\nAbstracting users’ personal settings and files from the underlying device and operating system enables effortless migration to new desktops, platforms, or services, providing a consistent and familiar workspace for mobile users.<br />\r\nPowerful application control and privilege management capabilities ensure secure desktop and server environments and ease the burden of satisfying regulatory compliance.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: User Personalization</span><br />\r\nOn-demand personalization eliminates typical problems associated with roaming profiles including slow logon times due to profile bloat, and loss of personal settings and helpdesk calls due to profile corruption.<br />\r\nStream personal settings as required, at application start or stop, to alleviate the burden on the logon process and provide rapid logon times.<br />\r\nRoll back personal settings on a per-application basis to reduce profile-related support calls and eliminate user downtime. Bulk updates on centrally-stored profile data equip IT with new problem-solving capabilities and ease the process of rolling out network changes to user sessions.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: Desktop Configuration</span><br />\r\nThe multi-threaded logon engine in User Workspace Manager replaces slow and complex logon scripts and GPO settings with context-aware actions that can be applied simultaneously at logon, rather than one-after-the-other.<br />\r\nDesktop configuration items typically configured to apply at logon can alternatively be set up to occur throughout the user session, on-demand, to reduce the burden on the logon process. This provides even quicker logon times and a much-improved user experience.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: File Sync and Migration</span><br />\r\nThe granular sync mechanism in User Workspace Manager allows users’ files to be synced to on-premises or cloudbased storage from anywhere within their user profile — either in the background, on-demand, or in real-time—to provide effortless migration of users’ files and eliminate the issue of data sprawl where user files are saved across different devices.<br />\r\nWhat’s more, migrating user files from on-premises storage to the cloud also means you reap the benefits of the 1TB of free OneDrive for Business storage per user with every license of Office 365. ","shortDescription":"IVANTI USER WORKSPACE MANAGER: SLASH DIGITAL WORKPLACE COSTS, LIBERATE IT, EMPOWER USERS.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti User Workspace Manager (UWM)","keywords":"","description":"Ivanti User Workspace Manager enables an unparalleled user experience, increases productivity, and liberates IT from the shackles of slow and complex desktop tools.\r\nWith Ivanti, migration to Windows 10 and adoption of cloud services, including Office 365, is ","og:title":"Ivanti User Workspace Manager (UWM)","og:description":"Ivanti User Workspace Manager enables an unparalleled user experience, increases productivity, and liberates IT from the shackles of slow and complex desktop tools.\r\nWith Ivanti, migration to Windows 10 and adoption of cloud services, including Office 365, is ","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6203,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":3,"title":"MDM - Mobile Device Management","alias":"mdm-mobile-device-management","description":" <span style=\"font-weight: bold; \">Mobile device management (MDM)</span> is an industry term for the administration of mobile devices, such as smartphones, tablet computers and laptops. Device management system is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices.\r\nMDM is typically a deployment of a combination of on-device applications and configurations, corporate policies and certificates, and backend infrastructure, for the purpose of simplifying and enhancing the IT management of end user devices. In modern corporate IT environments, the sheer number and diversity of managed devices (and user behavior) has motivated device management tools that allow the management of devices and users in a consistent and scalable way. The overall role of MDM is to increase device supportability, security, and corporate functionality while maintaining some user flexibility.\r\nMany organizations administer devices and applications using MDM products/services. Mobile device management software primarily deals with corporate data segregation, securing emails, securing corporate documents on devices, enforcing corporate policies, integrating and managing mobile devices including laptops and handhelds of various categories. MDM implementations may be either on-premises or cloud-based.\r\nMDM functionality can include over-the-air distribution of applications, data and configuration settings for all types of mobile devices, including mobile phones, smartphones, tablet computers, ruggedized mobile computers, mobile printers, mobile POS devices, etc. Most recently laptops and desktops have been added to the list of systems supported as Mobile Device Management becomes more about basic device management and less about the mobile platform itself. \r\nSome of the <span style=\"font-weight: bold; \">core functions</span> of mobile management software include:\r\n<ul><li>Ensuring that diverse user equipment is configured to a consistent standard/supported set of applications, functions, or corporate policies</li><li>Updating equipment, applications, functions, or policies in a scalable manner</li><li>Ensuring that users use applications in a consistent and supportable manner</li><li>Ensuring that equipment performs consistently</li><li>Monitoring and tracking equipment (e.g. location, status, ownership, activity)</li><li>Being able to efficiently diagnose and troubleshoot equipment remotely</li></ul>\r\nDevice management solutions are leveraged for both company-owned and employee-owned (Bring Your Own Device) devices across the enterprise or mobile devices owned by consumers. Consumer demand for BYOD is now requiring a greater effort for MDM and increased security for both the devices and the enterprise they connect to, especially since employers and employees have different expectations concerning the types of restrictions that should be applied to mobile devices.\r\nBy controlling and protecting the data and configuration settings of all mobile devices in a network, enterprise device management software can reduce support costs and business risks. The intent of MDM is to optimize the functionality and security of a mobile communications network while minimizing cost and downtime.\r\nWith mobile devices becoming ubiquitous and applications flooding the market, mobile monitoring is growing in importance. The use of mobile device management across continues to grow at a steady pace, and is likely to register a compound annual growth rate (CAGR) of nearly 23% through 2028. The US will continue to be the largest market for mobile device management globally. ","materialsDescription":"<h1 class=\"align-center\">How Mobile Device Management works?</h1>\r\nMobile device management relies on endpoint software called an MDM agent and an MDM server that lives in a data center. IT administrators configure policies through the MDM server's management console, and the server then pushes those policies over the air to the MDM agent on the device. The agent applies the policies to the device by communicating with application programming interfaces (APIs) built directly into the device operating system.\r\nSimilarly, IT administrators can deploy applications to managed devices through the MDM server. Mobile software management emerged in the early 2000s as a way to control and secure the personal digital assistants and smartphones that business workers began to use. The consumer smartphone boom that started with the launch of the Apple iPhone in 2007 led to the bring your own device trend, which fueled further interest in MDM.\r\nModern MDM management software supports not only smartphones but also tablets, Windows 10 and macOS computers and even some internet of things devices. The practice of using MDM to control PCs is known as unified endpoint management.\r\n<h1 class=\"align-center\">Key Benefits of Mobile Device Management Software</h1>\r\n<span style=\"font-weight: bold;\">Reduce IT Administration.</span> Instead of manually configuring and testing each new mobile device, mobile device software takes care of the repetitive tasks for you. That gives IT staff more time to work on challenging projects that improve productivity.<span style=\"font-weight: bold;\"></span> \r\n<span style=\"font-weight: bold;\">Improve End-user Productivity. </span>Mobile device management helps end users become more productive because the process of requesting new mobile devices can be cut down from days to hours. Once end users have the device in their hands, mobile device management program helps them get set up on their corporate network much faster. That means less time waiting to get access to email, internal websites, and calendars.<span style=\"font-weight: bold;\"></span> \r\n<span style=\"font-weight: bold;\">Reduce IT Risk.</span> Mobile devices, especially if your organization allows “Bring Your Own Device” (BYOD), create increased risk exposures. Typically, IT managers respond to these risks in one of two ways, neither of which help. First, you may say “no” to mobile device requests. That’s a fast way to become unpopular. Second, you may take a manual approach to review and oversee each device.<span style=\"font-weight: bold;\"></span> \r\n<span style=\"font-weight: bold;\">Enable Enterprise Growth. </span>If your enterprise added a thousand employees this quarter through hiring, acquisition, or other changes, could IT handle the challenge? If you’re honest, you can probably imagine going through plenty of struggles and missing SLAs. That kind of disappointment and missed service expectations make end users respect IT less. \r\nBy using enterprise device management thoroughly, you'll enable enterprise growth. You'll have the systems and processes to manage 100 users or 10,000 users. That means IT will be perceived as enabling growth not standing in the way.\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_MDM_Mobile_Device_Management.png"},{"id":5,"title":"Security Software","alias":"security-software","description":" Computer security software or cybersecurity software is any computer program designed to enhance information security. Security software is a broad term that encompasses a suite of different types of software that deliver data and computer and network security in various forms. \r\nSecurity software can protect a computer from viruses, malware, unauthorized users and other security exploits originating from the Internet. Different types of security software include anti-virus software, firewall software, network security software, Internet security software, malware/spamware removal and protection software, cryptographic software, and more.\r\nIn end-user computing environments, anti-spam and anti-virus security software is the most common type of software used, whereas enterprise users add a firewall and intrusion detection system on top of it. \r\nSecurity soft may be focused on preventing attacks from reaching their target, on limiting the damage attacks can cause if they reach their target and on tracking the damage that has been caused so that it can be repaired. As the nature of malicious code evolves, security software also evolves.<span style=\"font-weight: bold; \"></span>\r\n<span style=\"font-weight: bold; \">Firewall. </span>Firewall security software prevents unauthorized users from accessing a computer or network without restricting those who are authorized. Firewalls can be implemented with hardware or software. Some computer operating systems include software firewalls in the operating system itself. For example, Microsoft Windows has a built-in firewall. Routers and servers can include firewalls. There are also dedicated hardware firewalls that have no other function other than protecting a network from unauthorized access.\r\n<span style=\"font-weight: bold; \">Antivirus.</span> Antivirus solutions work to prevent malicious code from attacking a computer by recognizing the attack before it begins. But it is also designed to stop an attack in progress that could not be prevented, and to repair damage done by the attack once the attack abates. Antivirus software is useful because it addresses security issues in cases where attacks have made it past a firewall. New computer viruses appear daily, so antivirus and security software must be continuously updated to remain effective.\r\n<span style=\"font-weight: bold; \">Antispyware.</span> While antivirus software is designed to prevent malicious software from attacking, the goal of antispyware software is to prevent unauthorized software from stealing information that is on a computer or being processed through the computer. Since spyware does not need to attempt to damage data files or the operating system, it does not trigger antivirus software into action. However, antispyware software can recognize the particular actions spyware is taking by monitoring the communications between a computer and external message recipients. When communications occur that the user has not authorized, antispyware can notify the user and block further communications.\r\n<span style=\"font-weight: bold; \">Home Computers.</span> Home computers and some small businesses usually implement&nbsp; security software at the desktop level - meaning on the PC itself. This category of computer security and protection, sometimes referred to as end-point security, remains resident, or continuously operating, on the desktop. Because the software is running, it uses system resources, and can slow the computer's performance. However, because it operates in real time, it can react rapidly to attacks and seek to shut them down when they occur.\r\n<span style=\"font-weight: bold; \">Network Security.</span> When several computers are all on the same network, it's more cost-effective to implement security at the network level. Antivirus software can be installed on a server and then loaded automatically to each desktop. However firewalls are usually installed on a server or purchased as an independent device that is inserted into the network where the Internet connection comes in. All of the computers inside the network communicate unimpeded, but any data going in or out of the network over the Internet is filtered trough the firewall.<br /><br /><br />","materialsDescription":"<h1 class=\"align-center\"> <span style=\"font-weight: normal; \">What is IT security software?</span></h1>\r\nIT security software provides protection to businesses’ computer or network. It serves as a defense against unauthorized access and intrusion in such a system. It comes in various types, with many businesses and individuals already using some of them in one form or another.\r\nWith the emergence of more advanced technology, cybercriminals have also found more ways to get into the system of many organizations. Since more and more businesses are now relying their crucial operations on software products, the importance of security system software assurance must be taken seriously – now more than ever. Having reliable protection such as a security software programs is crucial to safeguard your computing environments and data. \r\n<p class=\"align-left\">It is not just the government or big corporations that become victims of cyber threats. In fact, small and medium-sized businesses have increasingly become targets of cybercrime over the past years. </p>\r\n<h1 class=\"align-center\"><span style=\"font-weight: normal; \">What are the features of IT security software?</span></h1>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Automatic updates. </span>This ensures you don’t miss any update and your system is the most up-to-date version to respond to the constantly emerging new cyber threats.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Real-time scanning.</span> Dynamic scanning features make it easier to detect and infiltrate malicious entities promptly. Without this feature, you’ll risk not being able to prevent damage to your system before it happens.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Auto-clean.</span> A feature that rids itself of viruses even without the user manually removing it from its quarantine zone upon detection. Unless you want the option to review the malware, there is no reason to keep the malicious software on your computer which makes this feature essential.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Multiple app protection.</span> This feature ensures all your apps and services are protected, whether they’re in email, instant messenger, and internet browsers, among others.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Application level security.</span> This enables you to control access to the application on a per-user role or per-user basis to guarantee only the right individuals can enter the appropriate applications.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Role-based menu.</span> This displays menu options showing different users according to their roles for easier assigning of access and control.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Row-level (multi-tenant) security.</span> This gives you control over data access at a row-level for a single application. This means you can allow multiple users to access the same application but you can control the data they are authorized to view.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Single sign-on.</span> A session or user authentication process that allows users to access multiple related applications as long as they are authorized in a single session by only logging in their name and password in a single place.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">User privilege parameters.</span> These are customizable features and security as per individual user or role that can be accessed in their profile throughout every application.</li></ul>\r\n\r\n<ul><li><span style=\"font-weight: bold; \">Application activity auditing.</span> Vital for IT departments to quickly view when a user logged in and off and which application they accessed. Developers can log end-user activity using their sign-on/signoff activities.</li></ul>\r\n<p class=\"align-left\"><br /><br /><br /><br /></p>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Security_Software.png"},{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":321,"title":"Workload Scheduling and Automation Software","alias":"workload-scheduling-and-automation-software","description":"","materialsDescription":"","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Workload_Scheduling_and_Automation_Software.png"},{"id":858,"title":"Secure File Sharing","alias":"secure-file-sharing","description":" Secure file sharing is the process of sharing one or more files securely or privately.\r\nIt enables sharing files between different users/organizations confidentially and/or within a protected mode, secure from intruders or unauthorized users.\r\nSecure file sharing is also known as protected file sharing.\r\nSecure file sharing is generally performed by encrypting the file, either before sharing or when being transmitted over the network. This is done through an encryption algorithm. The file can be shared within a local network or over a standard Internet connection. Secure file sharing can also be done through a private network connection such as a VPN.\r\nMost file-sharing services or software enable secure file sharing by restricting access to the file, such as only granting authorized personnel rights to access, view and download the file.","materialsDescription":" <span style=\"font-weight: bold; \">What is file-sharing security?</span>\r\nFile sharing has grown in popularity and frequency as people work remotely and enterprises move to the cloud. However, any time employees use technology to share files between devices, there are security risks involved. File-sharing can introduce risks of malware infection, hacking, and loss or exposure of sensitive information. Without proper security measures in place, the benefits of file sharing can be significantly outweighed by the potential for exposing your company’s sensitive data to new security threats.\r\n<span style=\"font-weight: bold; \">What Are The Pros and Cons of File Sharing?</span>\r\nThere are a number of factors to keep in mind before you start actively file sharing.\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Pros:</span></span>\r\n<ul><li>It allows you to transfer large files over a network connection.</li><li>It makes it easier to collaborate with other people across the globe.</li><li>It reduces the need to maintain a central file server that is always online.</li></ul>\r\n<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Cons:</span></span>\r\n<ul><li>The amount of bandwidth required can be costly.</li><li>Hard to trace what happens to a file after it is shared publicly.</li><li>Higher risk of acquiring a virus or other type of malware from a remote file.</li></ul>\r\n<span style=\"font-weight: bold; \">What are file-sharing stats?</span>\r\nWhen the topic of file-sharing comes up, most people recall the days of tools like Napster which became popular methods for illegally transferring music content around the internet in the ’90s. Today, however, file sharing is a key function for many businesses and other use cases.\r\n<ul><li>39% of business data that is uploaded to the cloud is used for file-sharing purposes.</li><li>The average company shares files with over 800 different online domains, which includes partners and vendors.</li><li>About 60% of files uploaded to a file sharing service are never actually shared with other people and are instead used as a backup copy.</li><li>About 70% of shared files are spread to only internal users in an organization.</li></ul>\r\n<span style=\"font-weight: bold; \">Secure file-sharing for businesses</span>\r\nSome of the best practices when it comes to ensuring your file-sharing sessions are secure at all times.\r\n<ul><li>Pick a service that offers <span style=\"font-weight: bold; \">end-to-end encryption.</span> This protects you from external hackers and also prevents the host itself from viewing your data.</li><li>Always <span style=\"font-weight: bold; \">double-check permission settings.</span> Most services allow for a public sharing option, but that means that anyone with the right link can obtain your files.</li><li>Run <span style=\"font-weight: bold; \">audits on your files</span> to see who is accessing them. If a file is no longer needed, remove it from your cloud system entirely.</li></ul>\r\n<span style=\"font-weight: bold;\">What are the types of file sharing?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">File Transfer Protocol (FTP)</span></span>\r\nFTP was one of the first methods invented for moving data across networks and it remains very popular today thanks to its reliability and efficiency. FTP actions can be run through a command prompt window or a tool with a user interface. All it requires is for you to specify the source file you want to move and the destination where it should be placed.\r\n<ul><li><span style=\"font-weight: bold;\">Great for:</span> Large files, unusual file types, or legacy data.</li><li><span style=\"font-weight: bold;\">Example programs:</span> FileZilla, Telnet, WinSCP.</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Peer to Peer (P2P)</span></span>\r\nThe purpose of a P2P file transfer is to remove the need for a central server that hosts the data. Instead, individual clients connect to a distributed network of peers and complete the file transfers over their own network connections. P2P might eventually be used to create an unstoppable TOR. Whether or not The Onion Router (TOR) is a truly P2P environment depends on many factors, but its popularity in creating a more secure online connection is unquestioned.\r\n<ul><li><span style=\"font-weight: bold;\">Great for:</span> Sharing files with a small group of people, files that are unavailable in public repositories.</li><li><span style=\"font-weight: bold;\">Example programs:</span> Limewire, Gnutella, BearShare.</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Cloud Services</span></span>\r\nWith a cloud file sharing service, one user uploads their data to a central repository and then other users can download the files to their own devices. All data is hosted by a third party provider, although users can specify what types of permission levels to put on the files.\r\n<ul><li><span style=\"font-weight: bold;\">Great for:</span> Fast sharing of files, creating backups of data.</li><li><span style=\"font-weight: bold;\">Example programs:</span> Dropbox, Box, OneDrive, iCloud.</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Email Providers</span></span>\r\nSome people don’t realize that email can actually function as a file transfer system. Every time you attach a document to an outgoing message, you are initiating a transfer of that data over the open internet.\r\n<ul><li><span style=\"font-weight: bold;\">Great for:</span> Small files, data that need explanation.</li><li><span style=\"font-weight: bold;\">Example programs:</span> Gmail, Outlook, Yahoo! Mail.</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Removable Storage</span></span>\r\nWhen no network-based option will fulfill your needs, you can always rely on a physical drive to serve as your file transfer operation. This means you are literally copying data to a USB flash drive or external hard drive and plugging that device into the destination computer.\r\n<ul><li><span style=\"font-weight: bold;\">Great for:</span> Massive files, sensitive data.</li><li><span style=\"font-weight: bold;\">Example programs:</span> USB thumb drives or external hard drives.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/sharefiledocumentcopying-icon.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6204,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti Workspace Control","vendorVerified":1,"rating":"0.00","implementationsCount":1,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-workspace-control","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"<span style=\"font-weight: bold;\">Controlling User Access while Delivering a Personalized Experience</span>\r\nIT organizations must balance control of applications, services, and assets with enabling personalized user access. What apps and services do workers need? What printers should they have access to? What resources should be blocked if they’re on an unsecure public network? IT teams typically handle these issues manually, often relying on scripts that must be managed and maintained, overloading the team and preventing them from working on more strategic projects. The results are often:\r\n<ul><li>Delays in providing workers access to the digital resources they need</li></ul>\r\n<ul><li>Inadequate definition and enforcement of access policies—especially restriction of privileges when users work from non-secure devices or locations</li></ul>\r\n<ul><li>Valuable IT staff time consumed by routine administration</li></ul>\r\nThese problems impact the business in the form of lost productivity, security risks, poor compliance, user frustration, high IT expenses, and compromised user productivity.\r\nIvanti® Workspace Control, powered by RES, allows IT to centrally manage and control the user workspace across physical, virtual, and hybrid environments. Workspace Control drives user productivity by providing workers with a familiar and seamless experience that adjusts to changes in their work context.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: Easy Workspace Personalization</span>\r\nWorkspace Control lets IT create a highly personalized user workspace for workers based on what they need to do their jobs—and what they can access based on IT and corporate policy.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: Context Awareness</span>\r\nAllows IT to apply the appropriate policies to each user’s desktop session, whether that session is delivered via VDI, app virtualization, or conventional thick-client architecture.<br />Context rules detect aspects of the user’s current state related to access policies (like location, network connection type, device type, time of day, etc.) and controls access accordingly.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: Web-based Management</span>\r\nWorkspace Control provides IT with an easy-to-use, webbased interface for managing user and application security settings and allowing the IT helpdesk to troubleshoot the desktop configuration.\r\n\r\n<span style=\"font-weight: bold;\">Key Feature: File Certificate-based Application Whitelisting</span>\r\nFile certificates allow IT to create rules to whitelist applications from a specific vendor or product name using the certificates of signed executables—providing the same level of security as file hashes, but with fewer rules and a lot less maintenance.<br /><br />\r\n<span style=\"font-weight: bold;\">Key Feature: Application Whitelist Monitor</span>\r\nSimplifies security whitelisting across a large, dynamic application set by automating the generation and maintenance of hashes and file certificates.<br /><br />\r\n<span style=\"font-weight: bold;\">Transform Digital Workspaces</span>\r\nIvanti Workspace Control is an ideal complement to VDI, mobility, and other digital workplace transformation strategies, since it provides an automated, policy-based way of mapping individual users to their digital workspaces across devices and delivery platforms. Users can roam seamlessly across hybrid environments for full productivity.\r\nAnd, because Workspace Control decouples the desktop experience from underlying infrastructure, IT upgrade projects are easier to execute and less disruptive to users.<br /><br />\r\n<span style=\"font-weight: bold;\">Deliver a Consistent User Experience</span>\r\nWorkspace Control helps IT provide a consistent user experience across desktops, laptops, tablets, and smartphones—while still applying the appropriate resource limitations as workers move from office to home to the road.<br /><br />\r\n<span style=\"font-weight: bold;\">Regulatory and Corporate Compliance</span>\r\nWhether it’s meeting software licensing agreements or adhering to regulatory restrictions, Workspace Control allows IT to set, enforce, and report on granular policy rules at the user level. IT gains control over user behavior while still providing the necessary access to resources to keep users productive, plus the ability to document and demonstrate compliance.<br /><br />\r\n<span style=\"font-weight: bold;\">Citrix XenApp and XenDesktop Support </span>\r\nWorkspace Control is compatible with Citrix XenApp/XenDesktop 7.15 LTSR.<br /><br />\r\n<span style=\"font-weight: bold;\">Updated macOS and Linux Support</span>\r\nThe macOS and Linux agents have been updated to support the latest releases of macOS, CentOS, and Red Hat Enterprise Linux.<br />Ivanti Workspace Control reduces the complexity of managing the user workspace to deliver:\r\n<ul><li>A more productive and engaged workforce</li></ul>\r\n<ul><li>Improved corporate and regulatory compliance</li></ul>\r\n<ul><li>Lower cost of IT operations</li></ul>\r\n<ul><li>Better allocation of IT staff and skills</li></ul>\r\n<ul><li>Greater organizational agility</li></ul>\r\n<ul><li>Simplified infrastructure upgrades</li></ul>","shortDescription":"IVANTI WORKSPACE CONTROL: WORKSPACE MANAGEMENT FOR CONTEXT AWARE DIGITAL WORKSPACES ACROSS PHYSICAL, VIRTUAL AND CLOUD ENVIRONMENTS","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti Workspace Control","keywords":"","description":"<span style=\"font-weight: bold;\">Controlling User Access while Delivering a Personalized Experience</span>\r\nIT organizations must balance control of applications, services, and assets with enabling personalized user access. What apps and services do workers ne","og:title":"Ivanti Workspace Control","og:description":"<span style=\"font-weight: bold;\">Controlling User Access while Delivering a Personalized Experience</span>\r\nIT organizations must balance control of applications, services, and assets with enabling personalized user access. What apps and services do workers ne","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6205,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":3,"title":"MDM - Mobile Device Management","alias":"mdm-mobile-device-management","description":" <span style=\"font-weight: bold; \">Mobile device management (MDM)</span> is an industry term for the administration of mobile devices, such as smartphones, tablet computers and laptops. Device management system is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices.\r\nMDM is typically a deployment of a combination of on-device applications and configurations, corporate policies and certificates, and backend infrastructure, for the purpose of simplifying and enhancing the IT management of end user devices. In modern corporate IT environments, the sheer number and diversity of managed devices (and user behavior) has motivated device management tools that allow the management of devices and users in a consistent and scalable way. The overall role of MDM is to increase device supportability, security, and corporate functionality while maintaining some user flexibility.\r\nMany organizations administer devices and applications using MDM products/services. Mobile device management software primarily deals with corporate data segregation, securing emails, securing corporate documents on devices, enforcing corporate policies, integrating and managing mobile devices including laptops and handhelds of various categories. MDM implementations may be either on-premises or cloud-based.\r\nMDM functionality can include over-the-air distribution of applications, data and configuration settings for all types of mobile devices, including mobile phones, smartphones, tablet computers, ruggedized mobile computers, mobile printers, mobile POS devices, etc. Most recently laptops and desktops have been added to the list of systems supported as Mobile Device Management becomes more about basic device management and less about the mobile platform itself. \r\nSome of the <span style=\"font-weight: bold; \">core functions</span> of mobile management software include:\r\n<ul><li>Ensuring that diverse user equipment is configured to a consistent standard/supported set of applications, functions, or corporate policies</li><li>Updating equipment, applications, functions, or policies in a scalable manner</li><li>Ensuring that users use applications in a consistent and supportable manner</li><li>Ensuring that equipment performs consistently</li><li>Monitoring and tracking equipment (e.g. location, status, ownership, activity)</li><li>Being able to efficiently diagnose and troubleshoot equipment remotely</li></ul>\r\nDevice management solutions are leveraged for both company-owned and employee-owned (Bring Your Own Device) devices across the enterprise or mobile devices owned by consumers. Consumer demand for BYOD is now requiring a greater effort for MDM and increased security for both the devices and the enterprise they connect to, especially since employers and employees have different expectations concerning the types of restrictions that should be applied to mobile devices.\r\nBy controlling and protecting the data and configuration settings of all mobile devices in a network, enterprise device management software can reduce support costs and business risks. The intent of MDM is to optimize the functionality and security of a mobile communications network while minimizing cost and downtime.\r\nWith mobile devices becoming ubiquitous and applications flooding the market, mobile monitoring is growing in importance. The use of mobile device management across continues to grow at a steady pace, and is likely to register a compound annual growth rate (CAGR) of nearly 23% through 2028. The US will continue to be the largest market for mobile device management globally. ","materialsDescription":"<h1 class=\"align-center\">How Mobile Device Management works?</h1>\r\nMobile device management relies on endpoint software called an MDM agent and an MDM server that lives in a data center. IT administrators configure policies through the MDM server's management console, and the server then pushes those policies over the air to the MDM agent on the device. The agent applies the policies to the device by communicating with application programming interfaces (APIs) built directly into the device operating system.\r\nSimilarly, IT administrators can deploy applications to managed devices through the MDM server. Mobile software management emerged in the early 2000s as a way to control and secure the personal digital assistants and smartphones that business workers began to use. The consumer smartphone boom that started with the launch of the Apple iPhone in 2007 led to the bring your own device trend, which fueled further interest in MDM.\r\nModern MDM management software supports not only smartphones but also tablets, Windows 10 and macOS computers and even some internet of things devices. The practice of using MDM to control PCs is known as unified endpoint management.\r\n<h1 class=\"align-center\">Key Benefits of Mobile Device Management Software</h1>\r\n<span style=\"font-weight: bold;\">Reduce IT Administration.</span> Instead of manually configuring and testing each new mobile device, mobile device software takes care of the repetitive tasks for you. That gives IT staff more time to work on challenging projects that improve productivity.<span style=\"font-weight: bold;\"></span> \r\n<span style=\"font-weight: bold;\">Improve End-user Productivity. </span>Mobile device management helps end users become more productive because the process of requesting new mobile devices can be cut down from days to hours. Once end users have the device in their hands, mobile device management program helps them get set up on their corporate network much faster. That means less time waiting to get access to email, internal websites, and calendars.<span style=\"font-weight: bold;\"></span> \r\n<span style=\"font-weight: bold;\">Reduce IT Risk.</span> Mobile devices, especially if your organization allows “Bring Your Own Device” (BYOD), create increased risk exposures. Typically, IT managers respond to these risks in one of two ways, neither of which help. First, you may say “no” to mobile device requests. That’s a fast way to become unpopular. Second, you may take a manual approach to review and oversee each device.<span style=\"font-weight: bold;\"></span> \r\n<span style=\"font-weight: bold;\">Enable Enterprise Growth. </span>If your enterprise added a thousand employees this quarter through hiring, acquisition, or other changes, could IT handle the challenge? If you’re honest, you can probably imagine going through plenty of struggles and missing SLAs. That kind of disappointment and missed service expectations make end users respect IT less. \r\nBy using enterprise device management thoroughly, you'll enable enterprise growth. You'll have the systems and processes to manage 100 users or 10,000 users. That means IT will be perceived as enabling growth not standing in the way.\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_MDM_Mobile_Device_Management.png"},{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":44,"title":"IAM - Identity and Access Management","alias":"iam-identity-and-access-management","description":"<span style=\"font-weight: bold; \">Identity management</span> (IdM), also known as <span style=\"font-weight: bold; \">identity and access management</span> (IAM or IdAM), is a framework of policies and technologies for ensuring that the proper people in an enterprise have the appropriate access to technology resources. IdM systems fall under the overarching umbrellas of IT security and Data Management.\r\nWith an IAM framework in place, information technology (IT) managers can control user access to critical information within their organizations. Identity and access management software offers role-based access control, which lets system administrators regulate access to systems or networks based on the roles of individual users within the enterprise. In this context, access is the ability of an individual user to perform a specific task, such as view, create or modify a file. Roles are defined according to job competency, authority and responsibility within the enterprise.\r\nSystems used for identity and access management include single sign-on systems, multi-factor authentication and privileged access management (PAM). These technologies also provide the ability to securely store identity and profile data as well as data governance functions to ensure that only data that is necessary and relevant is shared. IAM systems can be deployed on premises, provided by a third-party vendor through a cloud-based subscription model or deployed in a hybrid cloud.\r\n<span style=\"font-weight: bold; \">Basic components of IAM.</span> On a fundamental level, IAM encompasses the following components:\r\n<ul><li>How individuals are identified in a system.</li><li>How roles are identified in a system and how they are assigned to individuals.</li><li>Adding, removing and updating individuals and their roles in a system.</li><li>Assigning levels of access to individuals or groups of individuals.</li><li>Protecting the sensitive data within the system and securing the system itself.</li></ul>\r\nAccess identity management system should consist of all the necessary controls and tools to capture and record user login information, manage the enterprise database of user identities and orchestrate the assignment and removal of access privileges. That means that systems used for IAM should provide a centralized directory service with oversight as well as visibility into all aspects of the company user base.\r\nTechnologies for identity access and management should simplify the user provisioning and account setup process. User access management software should reduce the time it takes to complete these processes with a controlled workflow that decreases errors as well as the potential for abuse while allowing automated account fulfillment. An identity and access management system should also allow administrators to instantly view and change access rights.\r\nIAM systems should be used to provide flexibility to establish groups with specific privileges for specific roles so that access rights based on employee job functions can be uniformly assigned. Identity access management software should also provide request and approval processes for modifying privileges because employees with the same title and job location may need customized, or slightly different, access.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\"><span style=\"font-weight: bold; \">What is the difference between identity and access management?</span></h1>\r\nAfter authentication, there needs to be an access control decision. The decision is based on the information available about the user. The difference between identity management and access management is thus:\r\n<ul><li>Identity Management is about managing the attributes related to the user.</li><li>Access Management is about evaluating the attributes based on policies and making Yes/No decisions.</li></ul>\r\nThere are three types of Access Control Systems: \r\n<ul><li>Discretionary Access Control (DAC)</li><li>Mandatory Access Control (MAC)</li><li>Role-Based Access Control (RBAC)</li></ul>\r\n<h1 class=\"align-center\">What are the main benefits of identity management?</h1>\r\nIdentity access and management are useful in many ways: it ensures regulatory compliance, enables cost savings, and simplifies the lives of your customers by enhancing their experience. These are the main benefits of having an IAM solution:\r\n<ul><li><span style=\"font-weight: bold; \">Easily accessible anywhere</span></li></ul>\r\nNowadays, people need their identities all the time to use services and resources. In that sense, they require access to any platform without limits using their IDs, thus eliminating barriers for customers to enter the platform anytime, anywhere.\r\n<ul><li><span style=\"font-weight: bold; \">It encourages the connection between the different parts</span></li></ul>\r\nThe digital transformation that is taking place among more and more organizations forces the need for people, applications and devices to stay connected to each other. And, as expected, all of these processes bring with them some security threats.\r\nHowever, IAM software is a solution that guarantees correct administration with the best identity providers, such as Salesforce, Twitter and Google. Authentication and security are two of the strengths of Identity and Access Management, as well as being extendable and ready for future advances.&nbsp; \r\n<ul><li><span style=\"font-weight: bold; \">It improves productivity</span></li></ul>\r\nIdentity software automates the entry of new personnel and facilitates access to all components of the system with which the company operates. This allows reducing times in the delivery of access so that they begin to produce immediately. For this reason, business agility is also increased by using the advantages that technology makes available to meet the demands of today’s world. \r\n<ul><li><span style=\"font-weight: bold; \">It optimizes user experience</span></li></ul>\r\nRemembering so many usernames and passwords to access social networks, banks and other services on the Internet becomes a challenge for people. Thanks to user identity management system, people can get an identity that provides access to different systems. Single sign-on (SSO) allows customers and partners to access different internal and external applications with the same access method. That way the user experience will not be affected.\r\n<ul><li><span style=\"font-weight: bold; \">Secure your brand at all levels</span></li></ul>\r\nThere will be no risk of security breach, regardless of whether a connection is made from multiple identity providers. Identity management software and access management software enables strong authentication to keep your business and brand secure. Detailed verification of all identities entering the system is performed, in addition to allowing various licenses to limit access levels. At the same time, it monitors through analysis, fraud detection and alert functions that indicate a possible real risk. In short, enterprise identity management system is a reliable tool that employs technology to support digital transformation. A software that provides agility, security and satisfaction to the company’s customers. ","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_IAM.png"},{"id":50,"title":"IPC - Information Protection and Control","alias":"ipc-information-protection-and-control","description":"Information Protection and Control (IPC) is a technology for protecting confidential information from internal threats. IPC solutions are designed to protect information from internal threats, prevent various types of information leaks, corporate espionage, and business intelligence. The term IPC combines two main technologies: encryption of storage media at all points of the network and control of technical channels of information leakage using Data Loss Prevention (DLP) technologies. Network, application and data access control is a possible third technology in IPC class systems. IPC includes solutions of the Data Loss Prevention (DLP) class, a system for encrypting corporate information and controlling access to it. The term IPC was one of the first to use IDC analyst Brian Burke in his report, Information Protection and Control Survey: Data Loss Prevention and Encryption Trends.\r\nIPC technology is a logical continuation of DLP technology and allows you to protect data not only from leaks through technical channels, that is, insiders, but also from unauthorized user access to the network, information, applications, and in cases where the direct storage medium falls into the hands of third parties. This allows you to prevent leaks in those cases when an insider or a person who does not have legal access to data gain access to the direct carrier of information. For example, removing a hard drive from a personal computer, an insider will not be able to read the information on it. This allows you to prevent the compromise of confidential data even in the event of loss, theft or seizure (for example, when organizing operational events by special services specialists, unscrupulous competitors or raiders).\r\nThe main objective of IPC systems is to prevent the transfer of confidential information outside the corporate information system. Such a transfer (leak) may be intentional or unintentional. Practice shows that most of the leaks (more than 75%) do not occur due to malicious intent, but because of errors, carelessness, carelessness, and negligence of employees - it is much easier to detect such cases. The rest is connected with the malicious intent of operators and users of enterprise information systems, in particular, industrial espionage and competitive intelligence. Obviously, malicious insiders, as a rule, try to trick IPC analyzers and other control systems.","materialsDescription":"<span style=\"font-weight: bold; \">What is Information Protection and Control (IPC)?</span>\r\nIPC (English Information Protection and Control) is a generic name for technology to protect confidential information from internal threats.\r\nIPC solutions are designed to prevent various types of information leaks, corporate espionage, and business intelligence. IPC combines two main technologies: media encryption and control of technical channels of information leakage (Data Loss Prevention - DLP). Also, the functionality of IPC systems may include systems of protection against unauthorized access (unauthorized access).\r\n<span style=\"font-weight: bold; \">What are the objectives of IPC class systems?</span>\r\n<ul><li>preventing the transfer of confidential information beyond the corporate information system;</li><li>prevention of outside transmission of not only confidential but also other undesirable information (offensive expressions, spam, eroticism, excessive amounts of data, etc.);</li><li>preventing the transmission of unwanted information not only from inside to outside but also from outside to inside the organization’s information system;</li><li>preventing employees from using the Internet and network resources for personal purposes;</li><li>spam protection;</li><li>virus protection;</li><li>optimization of channel loading, reduction of inappropriate traffic;</li><li>accounting of working hours and presence at the workplace;</li><li>tracking the reliability of employees, their political views, beliefs, collecting dirt;</li><li>archiving information in case of accidental deletion or damage to the original;</li><li>protection against accidental or intentional violation of internal standards;</li><li>ensuring compliance with standards in the field of information security and current legislation.</li></ul>\r\n<span style=\"font-weight: bold; \">Why is DLP technology used in IPC?</span>\r\nIPC DLP technology supports monitoring of the following technical channels for confidential information leakage:\r\n<ul><li>corporate email;</li><li>webmail;</li><li>social networks and blogs;</li><li>file-sharing networks;</li><li>forums and other Internet resources, including those made using AJAX technology;</li><li>instant messaging tools (ICQ, Mail.Ru Agent, Skype, AOL AIM, Google Talk, Yahoo Messenger, MSN Messenger, etc.);</li><li>P2P clients;</li><li>peripheral devices (USB, LPT, COM, WiFi, Bluetooth, etc.);</li><li>local and network printers.</li></ul>\r\nDLP technologies in IPC support control, including the following communication protocols:\r\n<ul><li>FTP;</li><li>FTP over HTTP;</li><li>FTPS;</li><li>HTTP;</li><li>HTTPS (SSL);</li><li>NNTP;</li><li>POP3;</li><li>SMTP.</li></ul>\r\n<span style=\"font-weight: bold; \">What information protection facilities does IPC technology include?</span>\r\nIPC technology includes the ability to encrypt information at all key points in the network. The objects of information security are:\r\n<ul><li>Server hard drives;</li><li>SAN;</li><li>NAS;</li><li>Magnetic tapes;</li><li>CD/DVD/Blue-ray discs;</li><li>Personal computers (including laptops);</li><li>External devices.</li></ul>\r\nIPC technologies use various plug-in cryptographic modules, including the most efficient algorithms DES, Triple DES, RC5, RC6, AES, XTS-AES. The most used algorithms in IPC solutions are RC5 and AES, the effectiveness of which can be tested on the project [distributed.net]. They are most effective for solving the problems of encrypting data of large amounts of data on server storages and backups.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/IPC_-_Information_Protection_and_Control.png"},{"id":489,"title":"Network Security Policy Management","alias":"network-security-policy-management","description":" <span style=\"font-weight: bold; \">Network security policy management </span>streamlines security policy design and enforcement. It applies rules and best practices to manage firewalls and other devices more effectively, efficiently, and consistently. Administrators need network security management solutions to get a high level of visibility into network behavior, automate device configuration, enforce global policies, view firewall traffic, generate reports, and provide a single management interface for physical and virtual systems.\r\nSecurity policies govern the integrity and safety of the network. They provide rules for accessing the network, connecting to the Internet, adding or modifying devices or services, and more. However, rules are only effective when they are implemented. Network security management policy helps organizations stay compliant and secure by ensuring that their policies are simplified, consistent, and enforced. It helps reduce manual tasks and human errors by simplifying administration with security policy and workflow tools through a centralized management interface.\r\nNetwork security management can reduce risk across the network and protect data by leveraging the information on threats, network vulnerabilities and their criticality, evaluating potential options to block an attack, and providing intelligence for decision support. Policy administration is improved by unifying common policy tasks within a single interface, automating policy change workflow, including compliance audits and the management of multiple firewall vendors. This simplified and automated security policy management enables IT teams to save time, avoid manual errors, and reduce risk. \r\nThere are the whole network security policy management market with different tools and solutions available. Businesses use them to automate administrative tasks, which can improve accuracy and save time. The solutions can make management processes less tedious and time consuming, and can free up personnel for higher-value projects. These solutions also help IT teams avoid misconfigurations that can cause vulnerabilities in their networks. And if problems arise, network security policy management solutions can ease troubleshooting and remediation. ","materialsDescription":"<h1 class=\"align-center\">Benefits of network security policy management</h1>\r\n<span style=\"font-weight: bold;\">Streamline security policy design and enforcement</span>\r\nA network security policy management solution can help organizations achieve:\r\n<ul><li><span style=\"font-weight: bold;\">Better security.</span> Network security policy management streamlines security policy design and enforcement.</li><li><span style=\"font-weight: bold;\">Ease of use.</span> Network security policy management tools orchestrate policy design and implementation.</li><li><span style=\"font-weight: bold;\">Consistency. </span>Solutions provide templates, model policies, and configurations.</li><li><span style=\"font-weight: bold;\">Time savings.</span> Deployments are faster, and automation helps empower staff to focus on other business priorities.</li><li><span style=\"font-weight: bold;\">Lower costs.</span>&nbsp; Cloud-based solutions scale to thousands of devices, requiring fewer resources and allowing for centralized management.</li></ul>\r\n<span style=\"font-weight: bold;\">Apply best practices to meet challenges in firewall management</span>\r\nOver time, firewalls collect more and more configuration rules and objects. Network security policy management solutions can help combat this bloat and improve security by addressing:\r\n<ul><li><span style=\"font-weight: bold;\">Object auditing.</span> Administrators need to merge and reduce duplicate objects, determine which unused objects should be deleted, and identify inconsistent objects. Network security policy management tools help them achieve a cleaner, more consistent configuration that is less of a nuisance to manage and less vulnerable to attacks.</li><li><span style=\"font-weight: bold;\">Policy inconsistencies.</span> The network security policy management tools locate unused or shadow policies and assist IT to fix possible problems.</li><li><span style=\"font-weight: bold;\">Version control and upgrades.</span> Network security policy management solutions ease these transitions with filters that simplify and automate processes and ensure high availability.</li></ul>\r\n<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Security_Policy_Management.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6212,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png","logo":true,"scheme":false,"title":"Ivanti Xtraction","vendorVerified":1,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":2,"alias":"ivanti-xtraction","companyTitle":"Ivanti (LANDESK)","companyTypes":["supplier","vendor"],"companyId":3047,"companyAlias":"ivanti-landesk","description":"Reporting across IT is a challenge. You gather and overlay data from IT applications by hand, wrestle to create highquality visuals, and then rework everything for another audience. There’s a better way. Ivanti Xtraction is a selfservice, real-time reporting and dashboard solution that helps you meet your IT business intelligence needs with less effort. Merge your vendor tools data—including Ivanti tools—in one place. Power your IT decisions based on real-time, comprehensive views of your IT environment.\r\n\r\n<span style=\"font-weight: bold;\">Simple Self Service</span><br />\r\nSpend less time waiting for or chasing down reports. Be in control, and depend less on specialized staff. Designed with the user in mind, Xtraction provides an easy-to-use, flexible interface. Anyone can create personalized reports or dashboards and recut them at any time. Get to your data on demand directly from source. Drag-and-drop or point-and-click, without coding or complex commands. Select data from your connected systems, choose the display format, and let Xtraction&nbsp; do the rest.<br /><br />\r\n<span style=\"font-weight: bold;\">Unite Data with Connectors</span><br />\r\nMaximize your IT investments and leverage your key IT data. No need to open each application and wade through masses of data. Use connectors pre-built for Ivanti tools and other common applications—ITSM, ITAM, operational security, endpoint management, and relational databases. Unify, crossreference, and cherry-pick only the data you need. Execute a level of analysis unachievable with siloed tools and data. Spot unused services by department. Assess the financial impact of major outages. Track excessive times to patch or devices in need of OS migration and more, without breaking a sweat.<br /><br />\r\n<span style=\"font-weight: bold;\">Achieve Real-time Visibility</span><br />\r\nDon’t just analyze your data after the fire is out. Monitor, explore, and share critical information in real time with autorefresh. Visualize point-in-time data on dashboards at your leisure. Consume information in common formats such as pie, bar, or line charts. Export to popular file formats for business reports or presentations. Count on reliable, accurate and timely information in data-driven meetings and decisions.<br /><br />\r\n<span style=\"font-weight: bold;\">Discover Hidden Information</span><br />\r\nXtraction isn’t limited to fixed or flat dashboard views. Drill down through dashboards with ease. Filter results to focus on points of interest or areas of concern for real-time insights. With the right access, you can even open a record in the underlying application. Gain a deeper understanding of your data. Find lost assets, identify new service opportunities, or pinpoint vulnerable and offline devices. Protect worker productivity, strengthen security policies, and impact your bottom line.<br /><br />\r\n<span style=\"font-weight: bold;\">Automate Scheduling and Alerts</span><br />\r\nSchedule report delivery at a time that suits you—daily, weekly, or monthly. Have reports mailed straight to your in-box. Mitigate IT risk. Take a proactive approach with Xtraction’s alerting capability. Send information dashboards automatically. Receive advanced warning about service level breaches, out-ofcompliance devices, or other critical indicators before it’s too late to act.<br /><br />\r\n<span style=\"font-weight: bold;\">Minimize Data Access Risks</span><br />\r\nMaintain control over who sees your business data. Expose your data, reports, and dashboards to authorized users only with role-based access. Xtraction includes integrated authentication with Active Directory. Gain secure access that doesn’t impact user productivity.<br /><br />\r\n<span style=\"font-weight: bold;\">Rapid Implementation</span><br />\r\nWe’ve done the heavy lifting, so you don’t have to. The solution installs quickly and extends with the pre-defined connectors to the most popular IT systems. You’ll be up and running on the day of installation.","shortDescription":"Ivanti Xtraction представляет собой систему самообслуживания, отчетность в реальном времени и панель инструментов, которая помогает справляться с потребностями вашей ИТ-аналитики с меньшими усилиями","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Ivanti Xtraction","keywords":"","description":"Reporting across IT is a challenge. You gather and overlay data from IT applications by hand, wrestle to create highquality visuals, and then rework everything for another audience. There’s a better way. Ivanti Xtraction is a selfservice, real-time reporting a","og:title":"Ivanti Xtraction","og:description":"Reporting across IT is a challenge. You gather and overlay data from IT applications by hand, wrestle to create highquality visuals, and then rework everything for another audience. There’s a better way. Ivanti Xtraction is a selfservice, real-time reporting a","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ivanti-logo-01.png"},"eventUrl":"","translationId":6231,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4678,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/The_Chertoff_Group.jpg","logo":true,"scheme":false,"title":"The Chertoff Group Cyber Security Risk Management","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"the-chertoff-group-cyber-security-risk-management","companyTitle":"The Chertoff Group","companyTypes":["supplier","vendor"],"companyId":7067,"companyAlias":"the-chertoff-group","description":"<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Cyber effectiveness</span></span>\r\nThe last decade has seen major increases in cyber regulation and investment, and yet cyber risk has only grown. 2017 occasioned some of the most costly and disruptive cyber attacks in history. Executives across sectors are asking, how do we know if we have an effective cyber security program?\r\n<ul><li>Apply an offense-informed defense analysis to assess technology environments from the mindset of an adversary</li><li>Approach prioritizes preventive measures based on risk.</li><li>Design-in the changing nature of inherent risk into program oversight, and our methodology also accounts for implementation risks so organizations avoid trip-ups as they build their programs</li><li>Ensure programs address inherited risk from third-party dependencies</li><li>Stress the importance of testing and continuous monitoring of mitigation measures to demonstrate security performance</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Who The Chertoff Group do it for</span></p>\r\n<ul><li>Organizations needing a comprehensive evaluation of a security program with technical validation</li><li>Executives who need quick-turn program evaluation or critical third party review</li><li>Organizations needing a comprehensive program build, designed for effectiveness</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">How they do it</span></p>\r\nApproach is grounded in the belief that effective security is not an end-state so much as it is a continuing process – founded in a cycle of activity to assess, mitigate and monitor security risk. \r\nTeam works continuously to incorporate insights they learn from client projects, discussions with government stakeholders and interactions with solution providers into the security risk management framework. \r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Risk Assessment</span></p>\r\nCompliance mandates are a “necessary but not sufficient” – planning must reflect changing business, technology, customer, regulatory and threat drivers. Countermeasures must be aligned to reasonably foreseeable threat tactics, techniques and procedures.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Risk Mitigation</span></p>\r\nConstrain rapid spread and enable security operations to quickly and authoritatively identify, contain and recover from a compromise. Anticipate implementation risks.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Risk Monitoring</span></p>\r\nBuild in meaningful opportunities to measure program advancement through multiple lenses (risk-based countermeasures, operational performance, testing, etc.).\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Solutions</span></p>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Cyber Risk Management Program Build</span></span>\r\n<span style=\"font-style: italic;\">Governance Assessment: DEEP-DIVE RISK ASSESSMENT plus…</span>\r\n<ul><li>Security strategy document</li><li>Review of policies / standards library</li><li>Implementation planning guidance</li></ul>\r\n<span style=\"font-style: italic;\">Countermeasure Design: DEEP-DIVE RISK ASSESSMENT plus…</span>\r\n<ul><li>Security Planning, Implementation &amp; Reporting, informed by lessons-learned from testing, managed services, incident response and exercises</li><li>Security Tool Optimization</li><li>Managed Services as an option</li><li>Incident Response Services as an option</li><li>Exercises</li></ul>\r\n<span style=\"font-style: italic;\">Testing &amp; Validation: DEEP-DIVE RISK ASSESSMENT plus…</span>\r\n<ul><li>Program metrics</li><li>Ongoing measurement &amp; interpretation</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Deep Dive Risk Assessment</span></span>\r\n<span style=\"font-style: italic;\">Governance Assessment: PRELIMINARY RISK ASSESSMENT plus…</span>\r\n<ul><li>Evaluation of inherent risk factors</li><li>Consideration of key implementation risks</li></ul>\r\n<span style=\"font-style: italic;\">Countermeasure Assessment: PRELIMINARY RISK ASSESSMENT plus…</span>\r\n<ul><li>Full controls assessment mapped to authoritative framework</li><li>TTP/threat pathway analysis based on MITRE ATT&amp;CK model</li><li>Insights from technical testing</li></ul>\r\n<span style=\"font-style: italic;\">Testing &amp; Validation: PRELIMINARY RISK ASSESSMENT plus…</span>\r\n<ul><li>Vulnerability assessment</li><li>Internal and external pen testing</li><li>Tool optimization analysis</li></ul>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Preliminary Risk Assessment&nbsp;&nbsp;</span></span>&nbsp; \r\n<span style=\"font-weight: bold;\"><span style=\"font-style: italic;\">Governance Assessment:</span></span> Review of core governance functions (oversight, risk management, training, third party risk, policies)<br /><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Countermeasure Assessment:</span></span> Focus on most risk-reducing controls. As an option, weighted score range based on level of implementation and perceived risk reduction<br /><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Testing &amp; Validation:</span></span> Analyze results from external risk scoring vendor as an option<br /><br /><br />","shortDescription":"Solution helps clients to build effective cyber and physical security programs by assessing, managing and monitoring enterprise threats. ","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":13,"sellingCount":16,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"The Chertoff Group Cyber Security Risk Management","keywords":"","description":"<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Cyber effectiveness</span></span>\r\nThe last decade has seen major increases in cyber regulation and investment, and yet cyber risk has only grown. 2017 occasioned some of the most costly and ","og:title":"The Chertoff Group Cyber Security Risk Management","og:description":"<span style=\"font-style: italic; \"><span style=\"font-weight: bold; \">Cyber effectiveness</span></span>\r\nThe last decade has seen major increases in cyber regulation and investment, and yet cyber risk has only grown. 2017 occasioned some of the most costly and ","og:image":"https://old.roi4cio.com/fileadmin/user_upload/The_Chertoff_Group.jpg"},"eventUrl":"","translationId":4679,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":204,"title":"Managed Detection and Response","alias":"managed-detection-and-response","description":" MDR, which stands for Managed Detection &amp; Response, is an all-encompassing threat detection system, which arose from the need for small/medium-sized organizations who lack resources to be able to monitor their network systems in-house. It provides a cost-effective alternative to SIEM (Security Information and Event Management).\r\nEveryday, the capabilities of attackers get more sophisticated and the volume of alerts becomes overwhelming and unmanageable. In-house teams might struggle to analyze and log data, which makes it harder than ever to determine if these threats are harmful. MDR can put a stop to attacks before they even happen. MDR technology monitors your systems and detects any unusual behavior, whilst our expert team responds to the threats detected within your business.\r\nMDR offers real-time threat intelligence, and is able to analyse behaviour which can be missed by traditional endpoint security technology. MDR also provides rapid identification of known threats, which in turn minimises overall attacks. Having remote incident investigation will minimise damage to your business, and will allow you to get back to work in no time. It’s important to note that using MDR services will allow third party access to your company's data. You need to consider working with a provider who understands and respects your data policy.","materialsDescription":" <span style=\"font-weight: bold;\">What is Managed Detection and Response?</span>\r\nManaged Detection and Response (MDR) is a managed cybersecurity service that provides intrusion detection of malware and malicious activity in your network, and assists in rapid incident response to eliminate those threats with succinct remediation actions. MDR typically combines a technology solution with outsourced security analysts that extend your technologies and team.\r\n<span style=\"font-weight: bold;\">Isn’t that What MSSPs or Managed SIEMs Do?</span>\r\nNo. Managed Security Service Providers (MSSPs) monitor network security controls and may send alerts when anomalies are identified. MSSPs typically do not investigate the anomalies to eliminate false positives, nor do they respond to real threats. This means that abnormalities in network usage are forwarded to your IT personnel who must then dig through the data to determine if there is a real threat and what to do about it.\r\n<span style=\"font-weight: bold;\">Doesn’t My Firewall Protect My Network?</span>\r\nFirewalls and other preventive forms of cybersecurity are very important and effective at preventing basic cyberattacks. However, over the past decade, it has become clear that preventive cybersecurity technologies are not enough to secure an organization’s network. Further, they are yet another source of alerts, log messages, and events that contribute to the “alert fatigue” being universally suffered today. Recent major hacks such as the Marriot Hack of 2018, the Anthem Hack of 2015, and the Target Hack of 2013 demonstrate how easily cybercriminals can breach networks at enterprise organizations to steal millions of credit card numbers, medical records, and other forms of PII/PHI.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/Endpoint_Detection_and_Response.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":834,"title":"IoT - Internet of Things Security","alias":"iot-internet-of-things-security","description":" IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).\r\nIoT involves adding internet connectivity to a system of interrelated computing devices, mechanical and digital machines, objects, animals and/or people. Each &quot;thing&quot; is provided a unique identifier and the ability to automatically transfer data over a network. Allowing devices to connect to the internet opens them up to a number of serious vulnerabilities if they are not properly protected.\r\nIoT security has become the subject of scrutiny after a number of high-profile incidents where a common IoT device was used to infiltrate and attack the larger network. Implementing security measures is critical to ensuring the safety of networks with IoT devices connected to them.\r\nIoT security hacks can happen in any industry, from smart home to a manufacturing plant to a connected car. The severity of impact depends greatly on the individual system, the data collected and/or the information it contains.\r\nAn attack disabling the brakes of a connected car, for example, or on a connected health device, such as an insulin pump hacked to administer too much medication to a patient, can be life-threatening. Likewise, an attack on a refrigeration system housing medicine that is monitored by an IoT system can ruin the viability of a medicine if temperatures fluctuate. Similarly, an attack on critical infrastructure -- an oil well, energy grid or water supply -- can be disastrous.\r\nSo, a robust IoT security portfolio must allow protecting devices from all types of vulnerabilities while deploying the security level that best matches application needs. Cryptography technologies are used to combat communication attacks. Security services are offered for protecting against lifecycle attacks. Isolation measures can be implemented to fend off software attacks. And, finally, IoT security should include tamper mitigation and side-channel attack mitigation technologies for fighting physical attacks of the chip.","materialsDescription":" <span style=\"font-weight: bold;\">What are the key requirements of IoT Security?</span>\r\nThe key requirements for any IoT security solution are:\r\n<ul><li>Device and data security, including authentication of devices and confidentiality and integrity of data</li><li>Implementing and running security operations at IoT scale</li><li>Meeting compliance requirements and requests</li><li>Meeting performance requirements as per the use case</li></ul>\r\n<span style=\"font-weight: bold;\">What do connected devices require to participate in the IoT Securely?</span>\r\nTo securely participate in the IoT, each connected device needs a unique identification – even before it has an IP address. This digital credential establishes the root of trust for the device’s entire lifecycle, from initial design to deployment to retirement.\r\n<span style=\"font-weight: bold;\">Why is device authentication necessary for the IoT?</span>\r\nStrong IoT device authentication is required to ensure connected devices on the IoT can be trusted to be what they purport to be. Consequently, each IoT device needs a unique identity that can be authenticated when the device attempts to connect to a gateway or central server. With this unique ID in place, IT system administrators can track each device throughout its lifecycle, communicate securely with it, and prevent it from executing harmful processes. If a device exhibits unexpected behavior, administrators can simply revoke its privileges.\r\n<span style=\"font-weight: bold;\">Why is secure manufacturing necessary for IoT devices?</span>\r\nIoT devices produced through unsecured manufacturing processes provide criminals opportunities to change production runs to introduce unauthorized code or produce additional units that are subsequently sold on the black market.\r\nOne way to secure manufacturing processes is to use hardware security modules (HSMs) and supporting security software to inject cryptographic keys and digital certificates and to control the number of units built and the code incorporated into each.\r\n<span style=\"font-weight: bold;\">Why is code signing necessary for IoT devices?</span>\r\nTo protect businesses, brands, partners, and users from software that has been infected by malware, software developers have adopted code signing. In the IoT, code signing in the software release process ensures the integrity of IoT device software and firmware updates and defends against the risks associated with code tampering or code that deviates from organizational policies.\r\nIn public key cryptography, code signing is a specific use of certificate-based digital signatures that enables an organization to verify the identity of the software publisher and certify the software has not been changed since it was published.\r\n<span style=\"font-weight: bold;\">What is IoT PKI?</span>\r\nToday there are more things (devices) online than there are people on the planet! Devices are the number one users of the Internet and need digital identities for secure operation. As enterprises seek to transform their business models to stay competitive, rapid adoption of IoT technologies is creating increasing demand for Public Key Infrastructures (PKIs) to provide digital certificates for the growing number of devices and the software and firmware they run.\r\nSafe IoT deployments require not only trusting the devices to be authentic and to be who they say they are, but also trusting that the data they collect is real and not altered. If one cannot trust the IoT devices and the data, there is no point in collecting, running analytics, and executing decisions based on the information collected.\r\nSecure adoption of IoT requires:\r\n<ul><li>Enabling mutual authentication between connected devices and applications</li><li>Maintaining the integrity and confidentiality of the data collected by devices</li><li>Ensuring the legitimacy and integrity of the software downloaded to devices</li><li>Preserving the privacy of sensitive data in light of stricter security regulations</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/iot.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6749,"logo":false,"scheme":false,"title":"Netscout nGeniusONE","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":1,"alias":"netscout-ngeniusone","companyTitle":"NetScout","companyTypes":["vendor"],"companyId":2747,"companyAlias":"netscout","description":"<span lang=\"EN-US\">The nGeniusONE Service Assurance platform provides real-time visibility into the performance of business-critical applications such as web-based applications, voice and video communications, database, financial, or other services by analyz ing wire data as it crosses the network, on premises or in the cloud. nGeniusONE with NETSCOUT’s patented Adaptive Service Intelligence (ASI) technology leverages this wire data to generate “smart data” for smarter analytics to assure performance, manage risk, and facilitate superior decision making regarding application and network services.</span>\r\n<span lang=\"EN-US\">&nbsp;</span>\r\n<span lang=\"EN-US\">The nGeniusONE platform delivers valuable macro-level insights into the status and</span><span lang=\"EN-US\">performance of enterprise-wide services, application components, individual hosts or groups of clients or servers. This expands the IT architect’s understanding of service consumption patterns, application component dependencies, and overall user experience to better support resource optimization and capacity planning.</span> \r\n<span lang=\"EN-US\">&nbsp;</span>\r\n<span lang=\"EN-US\">Powered by ASI technology, NETSCOUT’s highly scalable Deep Packet Inspection (DPI) engine relies on wire data to provide real-time, contextual analysis of network and service performance, availability and quality. With these insights, nGeniusONE can provide customers end-to-end visibility in complex physical, virtualized, and cloud-based deployments, allowing enterprises to regain visibility into business critical applications and services even in difficult to instrument locations.</span>\r\n\r\n<span style=\"font-weight: bold;\">Main features:</span>\r\n<ul><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Next Generation platform for network and application visibility, monitoring, analytics, reporting, and troubleshooting</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Patented and scalable ASI technology based on wire data increases the integrity, fidelity, and quality of analysis</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Provides insight into the performance of all infrastructure and application components involved in service delivery</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Supports Unified Communications &amp; Collaboration service features including call setup/teardown and call quality analysis</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Dashboard, Service and Traffic Monitors with contextual Session Analysis and Packet Analysis drill downs</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Real-time proactive alerting notifies of problems before they become service impacting, user affecting events</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Customizable reporting module provides day- to-day business and operational reports which can be scheduled for daily, weekly and monthly delivery</span></span></li><li><span class=\"jlqj4b\"><span lang=\"EN-US\">Scalable, enterprise-class architecture supports large scale geographically distributed deployments in physical, virtualized, hybrid, or cloud-based environments with single pane of glass</span></span></li></ul>","shortDescription":"The nGeniusONE Service Assurance platform provides real-time visibility into the performance of business-critical applications such as web-based applications, voice and video communications, database","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Netscout nGeniusONE","keywords":"","description":"<span lang=\"EN-US\">The nGeniusONE Service Assurance platform provides real-time visibility into the performance of business-critical applications such as web-based applications, voice and video communications, database, financial, or other services by analyz i","og:title":"Netscout nGeniusONE","og:description":"<span lang=\"EN-US\">The nGeniusONE Service Assurance platform provides real-time visibility into the performance of business-critical applications such as web-based applications, voice and video communications, database, financial, or other services by analyz i"},"eventUrl":"","translationId":6749,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":223,"title":"Data Access, Analysis, and Delivery Software","alias":"data-access-analysis-and-delivery-software","description":" Data access, analysis and delivery software are end-user oriented tools for ad hoc data access, analysis and reporting as well as production reporting. These products are most commonly used by information consumers or power users rather than professional programmers.\r\nThe processing and analysis of group data is a flexible, iterative method for processing and analyzing data to efficiently provide predictive analytics solutions and intelligent applications. This allows you to improve learning and teamwork. It contains selected recommendations and structures from Microsoft and other developers in the industry that ensure the successful implementation of data processing and analysis solutions. All this is to help companies take full advantage of their analytics software.","materialsDescription":"<span style=\"font-weight: bold; \">Data access</span>\r\nData access is a generic term referring to a process which has both an IT-specific meaning and other connotations involving access rights in a broader legal and/or political sense. In the former it typically refers to software and activities related to storing, retrieving, or acting on data housed in a database or other repository. Two fundamental types of data access exist:\r\n<ol><li>sequential access (as in magnetic tape, for example)</li><li>random access (as in indexed media)</li></ol>\r\nData access crucially involves authorization to access different data repositories. Data access can help distinguish the abilities of administrators and users. For example, administrators may have the ability to remove, edit and add data, while general users may not even have &quot;read&quot; rights if they lack access to particular information.\r\nHistorically, each repository (including each different database, file system, etc.), might require the use of different methods and languages, and many of these repositories stored their content in different and incompatible formats.\r\nOver the years standardized languages, methods, and formats, have developed to serve as interfaces between the often proprietary, and always idiosyncratic, specific languages and methods. Such standards include SQL (1974- ), ODBC (ca 1990- ), JDBC, XQJ, ADO.NET, XML, XQuery, XPath (1999- ), and Web Services.\r\nSome of these standards enable translation of data from unstructured (such as HTML or free-text files) to structured (such as XML or SQL).\r\nStructures such as connection strings and DBURLs[1] can attempt to standardise methods of connecting to databases.\r\n<span style=\"font-weight: bold; \">A program for data analysis</span>\r\nA data analysis program is a specially developed software that can analyze any information. This is usually a database program. It is within the database that you can store any information in any amount. A functional program allows incoming and stored data to analyze. Software development can be done for any tasks, which means that the program for data analysis can be customized for any activity. If, for example, you have a trade organization, then your data analysis program will analyze products, customers, funds, product balance, and more.\r\n<span style=\"font-weight: bold;\">On-demand software delivery</span>\r\nA type of software delivery service where the software is provided to the customer through a network (such as the Internet) as a service. On-demand software delivery is also called software on-demand. The terms on-demand software and Software as a Service (SaaS) are often used interchangeably.\r\nData access, analysis and delivery software are end-user oriented tools for ad hoc data access, analysis and reporting as well as production reporting.&nbsp; These products are most commonly used by information consumers or power users rather than professional programmers.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/Data_Access__Analysis__and_Delivery_Software1.png"},{"id":225,"title":"End-User Query, Reporting, and Analysis","alias":"end-user-query-reporting-and-analysis","description":" Class systems of Query &amp; Reporting are designed to form queries to information systems in user terms, as well as their execution, integration of data from different sources, viewing data with the possibilities of detailing and summarizing and building full-fledged reports, both on-screen and printed. Visualization of query results can be presented to the user in various forms - flat or multidimensional tables, graphs, charts, various specialized interfaces.\r\nEnd-user tools for querying and building reports are delivered in two ways:\r\n<ul><li>as part of OLAP-systems</li><li>in the form of specialized Query &amp; Reporting</li></ul>\r\nVirtually every OLAP class system is equipped with Query &amp; Reporting. These funds can be either embedded in the main product or separated into a separate product.\r\nThere are also specialized systems for generating and distributing reports. At the same time, these systems incorporate their own OLAP-means. Therefore, to draw a clear line between OLAP-systems and systems of class Query &amp; Reporting is almost impossible.","materialsDescription":" <span style=\"font-weight: bold; \">What are the reporting tools?</span>\r\nReporting tools are widely used to support decision making and to measure organizational and team performance. Companies use them for financial consolidation, for evaluation of strategies and policies and often just for plain reporting. Today most of these tools are integrated with Business Intelligence tools.\r\n<span style=\"font-weight: bold; \">What are the advantages of these tools for your organization?</span>\r\nReporting tools allow companies to create attractive reports easily. In tabular or graphical format. With data from Excel, a data warehouse or the organization’s ERP system. With the reports containing the right information, people are able to manage and improve the business processes more easily.\r\n<span style=\"font-weight: bold; \">Which reporting tools are available in the market?</span>\r\nThere are many Business Intelligence Reporting tools in the market available. This list of reporting tools shows you a complete overview of all the major tools currently available and thoroughly studied by our industry analysts. To name a few: Cognos Query and reporting, Oracle Enterprise Reporting, Crystal Reports, Microsoft Reporting Services (SSRS), etc.\r\n<span style=\"font-weight: bold; \">Is there a difference between reporting tools and BI tools?</span>\r\nAlmost every company, large or small, needs a reporting tool or they have already one in place. But, what is the difference between reporting software and Business Intelligence tools? They are not the same. In general reporting tools tell us where we have been but are not very good at analyzing data (at real time) and telling us where we are going (predictive).\r\n<span style=\"font-weight: bold;\">What is the difference between a query and a report?</span>\r\nA query is a way to create a list of accounts or journal entries that match your criteria. Requests serve as an advanced search engine that finds and groups accounts or journal entries and can only create a list.\r\nA report is a detailed report of a group of accounts or journal entries. Reports analyze data and are designed to calculate and present data in a more formal form.\r\nTypically, a query finds information in the database for you, and a report is a more powerful way to display and analyze information about the accounts or log entries you want to view.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/End-User_Query__Reporting__and_Analysis.png"},{"id":325,"title":"Performance Management Software","alias":"performance-management-software","description":" <span style=\"font-weight: bold; \">Performance management software </span>— also referred to as a <span style=\"font-weight: bold; \">performance management system</span>— helps a company track, analyze, and evaluate its employees’ performance. is designed to improve business performance by spurring employee productivity. It works to ensure individual employees and teams are engaged and in alignment with organizational goals. Employee review software replaces an annual performance review process with real-time performance tracking, goal setting and feedback.\r\nPerformance management software systems are overseen by the HR department. They fit under the umbrella of <span style=\"font-style: italic; \">talent management systems.</span>\r\nAs next-generation HR software, performance management tools help companies address the modern goals of continually monitoring performance while giving employees feedback and support. Performance review software can track individual contributions to a team, as well as that team's ability to meet business objectives, thus tying performance into the company's bottom line.\r\nImproving employee engagement is another goal of performance management software. An employee can see current individual performance goals and their progress toward meeting them. This includes tracking efforts on specific projects. Managers measure individual performance against goals, and employees get a better idea of where they stand.\r\nThese systems use dashboards for quick and collaborative reviews. They can report individual performance, as well as project and team performance. The systems may also include employee ranking.\r\nAn effective performance management program must interact with other tools - in particular, workforce analytics. Data can be analyzed, for instance, against reporting from financial management systems and sales performance management systems.","materialsDescription":"<h1 class=\"align-center\">Why Implement Performance Management Software?</h1>\r\n<ul><li><span style=\"font-weight: bold; \">Easily-Navigable Dashboard </span></li></ul>\r\nThe top advantage to performance management tools are their ability to bring all key data and performance into one, organized location. Award-winning business performance management software do that. They make it easy to navigate the data and information and help leaders make better decisions for their workforce. \r\n<ul><li><span style=\"font-weight: bold; \">Performance Review Cycles </span></li></ul>\r\nTraditional annual review cycle or not, performance management system software can help coordinate, organize, schedule and store review information. The software will send reminders to leaders, manage permissions as leadership changes and provide structure to the overall process, including scripts based on company values and the employee’s role.\r\n<ul><li><span style=\"font-weight: bold; \">360 Degree and Peer Reviews </span></li></ul>\r\nPerformance and talent management tool can help ensure the process goes smoothly by providing structured and anonymous assessments. In some cases, there might be more than a few people involved in the performance review of one employee, so the software can track the progress of feedback to ensure each manager or leader has provided necessary input in a timely manner.\r\n<ul><li><span style=\"font-weight: bold; \">Customizable Review and Assessment Scripts </span></li></ul>\r\nIt is best practice to base performance on the unique values and goals of your organization, which means the annual review script should be different for a manager than it is for an executive, and nothing like the script of another organization. \r\n<ul><li><span style=\"font-weight: bold; \">Goal and Performance Tracking </span></li></ul>\r\nContinuous performance and goal tracking allows leadership to see the progress of projects clearly while keeping in mind which employees are hitting the mark and which need guidance. And because automated performance management system available to the employee as well, everyone will be on the same page and aligned to the work being done, even between departments in real-time.\r\n<ul><li><span style=\"font-weight: bold; \">Development &amp; Succession Planning </span></li></ul>\r\nEmployees need continuous support in order to become effective contributors to the organization, especially in the long run. With performance management tools, you can track development progress, assign long term goals and ensure you understand the direction of talent and the business as a whole.\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Performance_Management_Software.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4446,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/ControlScan.png","logo":true,"scheme":false,"title":"ControlScan Managed SIEM","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"controlscan-managed-siem","companyTitle":"ControlScan","companyTypes":["supplier","vendor"],"companyId":6861,"companyAlias":"controlscan","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Gain visibility into attacks on your environment</span></p>\r\n<br />Basic security measures are no longer sufficient to protect your business against today’s rapidly evolving cyber threats; this reality is made glaringly evident by the constant stream of breaches reported in the news. \r\nTraditional perimeter security technologies such as firewalls and Intrusion Prevention Systems (IPS)—as well as endpoint security like anti-malware—do not provide the broad and deep visibility across your IT infrastructure needed to detect these threats. \r\nEvidence of attacks and incursions within your environment can be found in log records and machine data generated by your networked systems, security devices and applications, but how do you unlock these critical insights?\r\n Most businesses struggle with the continuous investment in technology and people required to maintain ongoing monitoring of their security posture.\r\nThe ControlScan Managed SIEM service combines enterprise-class SIEM technology from the ControlScan Cyphon platform with our deep security expertise and service excellence. \r\nComprehensive service collects, correlates, analyzes and stores log data from network infrastructure, servers and applications in order to identify and mitigate security incidents while facilitating compliance with requirements within PCI, HIPAA, GLBA, SOX and other frameworks.\r\n<span style=\"font-weight: bold;\">The secure, cloud-based Cyphon platform collects log data generated by devices such as firewalls, IPS solutions, servers, desktops and applications.</span> Correlation logic is applied to the aggregated logs to identify potential security threats, and alerts are generated and sent in real time, on a 24x7x365 basis. \r\nControlScan Security Analysts are on hand to support the assessment and investigation of critical alerts and to provide guidance on proper response.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Key features of the ControlScan Managed SIEM Service</span></p>\r\n<ul><li>Log Collection for your entire IT infrastructure</li><li>Event Correlation and Analysis leverages multi-sourced log data and advanced correlation rule sets to detect security incidents</li><li>Prioritization and 24 x 7 Alerting</li><li>12 Months of Log Retention for compliance requirements, including PCI DSS requirement 10</li><li>Reporting and Data Access available to you through ControlScan's web-based platform</li><li>Advance Functionality including:</li><li>File Integrity Monitoring (FIM)</li><li>Custom real-time dashboards</li></ul>\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">A Unique Solution to Solving the Security Challenge.</span></p>\r\nAs the leader in providing cloud-based, unified security and compliance solutions, ControlScan offers unique value through its Managed SIEM service. \r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Deploy with ControlScan and get benefits that include the following:</span></p>\r\n<span style=\"font-weight: bold;\">Security-as-a-Service</span> – Avoid costly, up-front investments in hardware, software and technical expertise with ControlScan’s cloud-based services. You’ll be up and running quickly and effectively with an enterprise-class, scalable solution.\r\n<span style=\"font-weight: bold;\">A solution that gets better with time </span>– Ongoing upgrades and enhancements to the Managed SIEM service ensure the addition of new capabilities for identifying evolving attack methods. \r\nAt the same time, your ControlScan security team is continually creating and tuning correlation rules for your environment to ensure maximum visibility to true, critical alerts.\r\n<span style=\"font-weight: bold;\">A staff of security experts watching your back</span> – Only the largest organizations can afford a staff of resources maintaining security and compliance day-in and day-out. \r\nControlScan brings extensive knowledge and experience in both areas, validated by the range of IT Security, PCI and HIPAA certifications held by our team of experts. This knowledge continues to grow as threats become more advanced.\r\nA single solution for your biggest challenges – The ControlScan Managed SIEM service delivers functionality you need on three different fronts: \r\n<span style=\"font-weight: bold;\">1) Security </span>\r\n<span style=\"font-weight: bold;\">2) Compliance </span>\r\n<span style=\"font-weight: bold;\">3) Operations. </span>\r\nBy collecting, aggregating, correlating and analyzing data from your environment, you gain visibility to your organization’s overall security posture, support for key controls in most compliance frameworks, and assurance of the health of your networked systems.<br /><br /><br />","shortDescription":"Service collects, correlates, analyzes and stores log data from network infrastructure, servers and applications in order to identify and mitigate security incidents while facilitating compliance.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":9,"sellingCount":5,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"ControlScan Managed SIEM","keywords":"","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Gain visibility into attacks on your environment</span></p>\r\n<br />Basic security measures are no longer sufficient to protect your business against today’s rapidly evolving cyber threats; this reality i","og:title":"ControlScan Managed SIEM","og:description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Gain visibility into attacks on your environment</span></p>\r\n<br />Basic security measures are no longer sufficient to protect your business against today’s rapidly evolving cyber threats; this reality i","og:image":"https://old.roi4cio.com/fileadmin/user_upload/ControlScan.png"},"eventUrl":"","translationId":4447,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":40,"title":"Endpoint security","alias":"endpoint-security","description":"In network security, endpoint security refers to a methodology of protecting the corporate network when accessed via remote devices such as laptops or other wireless and mobile devices. Each device with a remote connecting to the network creates a potential entry point for security threats. Endpoint security is designed to secure each endpoint on the network created by these devices.\r\nUsually, endpoint security is a security system that consists of security software, located on a centrally managed and accessible server or gateway within the network, in addition to client software being installed on each of the endpoints (or devices).&nbsp; The server authenticates logins from the endpoints and also updates the device software when needed. While endpoint security software differs by vendor, you can expect most software offerings to provide antivirus, antispyware, firewall and also a host intrusion prevention system (HIPS).\r\nEndpoint security is becoming a more common IT security function and concern as more employees bring consumer mobile devices to work and companies allow its mobile workforce to use these devices on the corporate network.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What are endpoint devices?</span>\r\nAny device that can connect to the central business network is considered an endpoint. Endpoint devices are potential entry points for cybersecurity threats and need strong protection because they are often the weakest link in network security.\r\n<span style=\"font-weight: bold;\">What is endpoint security management?</span>\r\nA set of rules defining the level of security that each device connected to the business network must comply with. These rules may include using an approved operating system (OS), installing a virtual private network (VPN), or running up-to-date antivirus software. If the device connecting to the network does not have the desired level of protection, it may have to connect via a guest network and have limited network access.\r\n<span style=\"font-weight: bold;\">What is endpoint security software?</span>\r\nPrograms that make sure your devices are protected. Endpoint protection software may be cloud-based and work as SaaS (Software as a Service). Endpoint security software can also be installed on each device separately as a standalone application.\r\n<span style=\"font-weight: bold;\">What is endpoint detection and response (EDR)?</span>\r\nEndpoint detection and response (EDR) solutions analyze files and programs, and report on any threats found. EDR solutions monitor continuously for advanced threats, helping to identify attacks at an early stage and respond rapidly to a range of threats.<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Endpoint_security.png"},{"id":45,"title":"SIEM - Security Information and Event Management","alias":"siem-security-information-and-event-management","description":"<span style=\"font-weight: bold; \">Security information and event management (SIEM)</span> is an approach to security management that combines SIM (security information management) and SEM (security event management) functions into one security management system. \r\n The underlying principles of every SIEM system is to aggregate relevant data from multiple sources, identify deviations from the norm and take appropriate action. At the most basic level, a SIEM system can be rules-based or employ a statistical correlation engine to establish relationships between event log entries. Advanced SIEM products have evolved to include user and entity behavior analytics (UEBA) and security orchestration and automated response (SOAR). \r\nThe acronyms SEM, SIM and SIEM have sometimes been used interchangeably, but generally refer to the different primary focus of products:\r\n<ul><li><span style=\"font-weight: bold;\">Log management:</span> Focus on simple collection and storage of log messages and audit trails.</li><li><span style=\"font-weight: bold;\">Security information management (SIM):</span> Long-term storage as well as analysis and reporting of log data.</li><li><span style=\"font-weight: bold;\">Security event manager (SEM):</span> Real-time monitoring, correlation of events, notifications and console views.</li><li><span style=\"font-weight: bold;\">Security information event management (SIEM):</span> Combines SIM and SEM and provides real-time analysis of security alerts generated by network hardware and applications.</li><li><span style=\"font-weight: bold;\">Managed Security Service (MSS) or Managed Security Service Provider (MSSP):</span> The most common managed services appear to evolve around connectivity and bandwidth, network monitoring, security, virtualization, and disaster recovery.</li><li><span style=\"font-weight: bold;\">Security as a service (SECaaS):</span> These security services often include authentication, anti-virus, anti-malware/spyware, intrusion detection, Penetration testing and security event management, among others.</li></ul>\r\nToday, most of SIEM technology works by deploying multiple collection agents in a hierarchical manner to gather security-related events from end-user devices, servers, network equipment, as well as specialized security equipment like firewalls, antivirus or intrusion prevention systems. The collectors forward events to a centralized management console where security analysts sift through the noise, connecting the dots and prioritizing security incidents.\r\nSome of the most important features to review when evaluating Security Information and Event Management software are:\r\n<ol><li><span style=\"font-weight: bold; \">Integration with other controls:</span> Can the system give commands to other enterprise security controls to prevent or stop attacks in progress?</li><li><span style=\"font-weight: bold; \">Artificial intelligence:</span> Can the system improve its own accuracy by through machine and deep learning?</li><li><span style=\"font-weight: bold; \">Threat intelligence feeds:</span>&nbsp; Can the system support threat intelligence feeds of the organization's choosing or is it mandated to use a particular feed?</li><li><span style=\"font-weight: bold; \">Robust compliance reporting:</span>&nbsp; Does the system include built-in reports for common compliance needs and the provide the organization with the ability to customize or create new compliance reports?</li><li><span style=\"font-weight: bold; \">Forensics capabilities:</span>&nbsp; Can the system capture additional information about security events by recording the headers and contents of packets of interest? </li></ol>\r\n\r\n\r\n","materialsDescription":"<h1 class=\"align-center\"> Why is SIEM Important?</h1>\r\nSIEM has become a core security component of modern organizations. The main reason is that every user or tracker leaves behind a virtual trail in a network’s log data. SIEM software is designed to use this log data in order to generate insight into past attacks and events. A SIEM solution not only identifies that an attack has happened, but allows you to see how and why it happened as well.\r\nAs organizations update and upscale to increasingly complex IT infrastructures, SIEM has become even more important in recent years. Contrary to popular belief, firewalls and antivirus packages are not enough to protect a network in its entirety. Zero-day attacks can still penetrate a system’s defenses even with these security measures in place.\r\nSIEM addresses this problem by detecting attack activity and assessing it against past behavior on the network. A security event monitoring has the ability to distinguish between legitimate use and a malicious attack. This helps to increase a system’s incident protection and avoid damage to systems and virtual property.\r\nThe use of SIEM also helps companies to comply with a variety of industry cyber management regulations. Log management is the industry standard method of auditing activity on an IT network. SIEM management provides the best way to meet this regulatory requirement and provide transparency over logs in order to generate clear insights and improvements.\r\n<h1 class=\"align-center\">Evaluation criteria for security information and event management software:</h1>\r\n<ul><li>Threat identification: Raw log form vs. descriptive.</li><li>Threat tracking: Ability to track through the various events, from source to destination.</li><li>Policy enforcement: Ability to enforce defined polices.</li><li>Application analysis: Ability to analyze application at Layer 7 if necessary.</li><li>Business relevance of events: Ability to assign business risk to events and have weighted threat levels.</li><li>Measuring changes and improvements: Ability to track configuration changes to devices.</li><li>Asset-based information: Ability to gather information on devices on the network.</li><li>Anomalous behavior (server): Ability to trend and see changes in how it communicates to others.</li><li>Anomalous behavior (network): Ability to trend and see how communications pass throughout the network.</li><li>Anomalous behavior (application): Ability to trend and see changes in how it communicates to others.</li><li>User monitoring: User activity, logging in, applications usage, etc.</li></ul>\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SIEM.png"},{"id":489,"title":"Network Security Policy Management","alias":"network-security-policy-management","description":" <span style=\"font-weight: bold; \">Network security policy management </span>streamlines security policy design and enforcement. It applies rules and best practices to manage firewalls and other devices more effectively, efficiently, and consistently. Administrators need network security management solutions to get a high level of visibility into network behavior, automate device configuration, enforce global policies, view firewall traffic, generate reports, and provide a single management interface for physical and virtual systems.\r\nSecurity policies govern the integrity and safety of the network. They provide rules for accessing the network, connecting to the Internet, adding or modifying devices or services, and more. However, rules are only effective when they are implemented. Network security management policy helps organizations stay compliant and secure by ensuring that their policies are simplified, consistent, and enforced. It helps reduce manual tasks and human errors by simplifying administration with security policy and workflow tools through a centralized management interface.\r\nNetwork security management can reduce risk across the network and protect data by leveraging the information on threats, network vulnerabilities and their criticality, evaluating potential options to block an attack, and providing intelligence for decision support. Policy administration is improved by unifying common policy tasks within a single interface, automating policy change workflow, including compliance audits and the management of multiple firewall vendors. This simplified and automated security policy management enables IT teams to save time, avoid manual errors, and reduce risk. \r\nThere are the whole network security policy management market with different tools and solutions available. Businesses use them to automate administrative tasks, which can improve accuracy and save time. The solutions can make management processes less tedious and time consuming, and can free up personnel for higher-value projects. These solutions also help IT teams avoid misconfigurations that can cause vulnerabilities in their networks. And if problems arise, network security policy management solutions can ease troubleshooting and remediation. ","materialsDescription":"<h1 class=\"align-center\">Benefits of network security policy management</h1>\r\n<span style=\"font-weight: bold;\">Streamline security policy design and enforcement</span>\r\nA network security policy management solution can help organizations achieve:\r\n<ul><li><span style=\"font-weight: bold;\">Better security.</span> Network security policy management streamlines security policy design and enforcement.</li><li><span style=\"font-weight: bold;\">Ease of use.</span> Network security policy management tools orchestrate policy design and implementation.</li><li><span style=\"font-weight: bold;\">Consistency. </span>Solutions provide templates, model policies, and configurations.</li><li><span style=\"font-weight: bold;\">Time savings.</span> Deployments are faster, and automation helps empower staff to focus on other business priorities.</li><li><span style=\"font-weight: bold;\">Lower costs.</span>&nbsp; Cloud-based solutions scale to thousands of devices, requiring fewer resources and allowing for centralized management.</li></ul>\r\n<span style=\"font-weight: bold;\">Apply best practices to meet challenges in firewall management</span>\r\nOver time, firewalls collect more and more configuration rules and objects. Network security policy management solutions can help combat this bloat and improve security by addressing:\r\n<ul><li><span style=\"font-weight: bold;\">Object auditing.</span> Administrators need to merge and reduce duplicate objects, determine which unused objects should be deleted, and identify inconsistent objects. Network security policy management tools help them achieve a cleaner, more consistent configuration that is less of a nuisance to manage and less vulnerable to attacks.</li><li><span style=\"font-weight: bold;\">Policy inconsistencies.</span> The network security policy management tools locate unused or shadow policies and assist IT to fix possible problems.</li><li><span style=\"font-weight: bold;\">Version control and upgrades.</span> Network security policy management solutions ease these transitions with filters that simplify and automate processes and ensure high availability.</li></ul>\r\n<br /><br />","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Security_Policy_Management.png"},{"id":834,"title":"IoT - Internet of Things Security","alias":"iot-internet-of-things-security","description":" IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).\r\nIoT involves adding internet connectivity to a system of interrelated computing devices, mechanical and digital machines, objects, animals and/or people. Each &quot;thing&quot; is provided a unique identifier and the ability to automatically transfer data over a network. Allowing devices to connect to the internet opens them up to a number of serious vulnerabilities if they are not properly protected.\r\nIoT security has become the subject of scrutiny after a number of high-profile incidents where a common IoT device was used to infiltrate and attack the larger network. Implementing security measures is critical to ensuring the safety of networks with IoT devices connected to them.\r\nIoT security hacks can happen in any industry, from smart home to a manufacturing plant to a connected car. The severity of impact depends greatly on the individual system, the data collected and/or the information it contains.\r\nAn attack disabling the brakes of a connected car, for example, or on a connected health device, such as an insulin pump hacked to administer too much medication to a patient, can be life-threatening. Likewise, an attack on a refrigeration system housing medicine that is monitored by an IoT system can ruin the viability of a medicine if temperatures fluctuate. Similarly, an attack on critical infrastructure -- an oil well, energy grid or water supply -- can be disastrous.\r\nSo, a robust IoT security portfolio must allow protecting devices from all types of vulnerabilities while deploying the security level that best matches application needs. Cryptography technologies are used to combat communication attacks. Security services are offered for protecting against lifecycle attacks. Isolation measures can be implemented to fend off software attacks. And, finally, IoT security should include tamper mitigation and side-channel attack mitigation technologies for fighting physical attacks of the chip.","materialsDescription":" <span style=\"font-weight: bold;\">What are the key requirements of IoT Security?</span>\r\nThe key requirements for any IoT security solution are:\r\n<ul><li>Device and data security, including authentication of devices and confidentiality and integrity of data</li><li>Implementing and running security operations at IoT scale</li><li>Meeting compliance requirements and requests</li><li>Meeting performance requirements as per the use case</li></ul>\r\n<span style=\"font-weight: bold;\">What do connected devices require to participate in the IoT Securely?</span>\r\nTo securely participate in the IoT, each connected device needs a unique identification – even before it has an IP address. This digital credential establishes the root of trust for the device’s entire lifecycle, from initial design to deployment to retirement.\r\n<span style=\"font-weight: bold;\">Why is device authentication necessary for the IoT?</span>\r\nStrong IoT device authentication is required to ensure connected devices on the IoT can be trusted to be what they purport to be. Consequently, each IoT device needs a unique identity that can be authenticated when the device attempts to connect to a gateway or central server. With this unique ID in place, IT system administrators can track each device throughout its lifecycle, communicate securely with it, and prevent it from executing harmful processes. If a device exhibits unexpected behavior, administrators can simply revoke its privileges.\r\n<span style=\"font-weight: bold;\">Why is secure manufacturing necessary for IoT devices?</span>\r\nIoT devices produced through unsecured manufacturing processes provide criminals opportunities to change production runs to introduce unauthorized code or produce additional units that are subsequently sold on the black market.\r\nOne way to secure manufacturing processes is to use hardware security modules (HSMs) and supporting security software to inject cryptographic keys and digital certificates and to control the number of units built and the code incorporated into each.\r\n<span style=\"font-weight: bold;\">Why is code signing necessary for IoT devices?</span>\r\nTo protect businesses, brands, partners, and users from software that has been infected by malware, software developers have adopted code signing. In the IoT, code signing in the software release process ensures the integrity of IoT device software and firmware updates and defends against the risks associated with code tampering or code that deviates from organizational policies.\r\nIn public key cryptography, code signing is a specific use of certificate-based digital signatures that enables an organization to verify the identity of the software publisher and certify the software has not been changed since it was published.\r\n<span style=\"font-weight: bold;\">What is IoT PKI?</span>\r\nToday there are more things (devices) online than there are people on the planet! Devices are the number one users of the Internet and need digital identities for secure operation. As enterprises seek to transform their business models to stay competitive, rapid adoption of IoT technologies is creating increasing demand for Public Key Infrastructures (PKIs) to provide digital certificates for the growing number of devices and the software and firmware they run.\r\nSafe IoT deployments require not only trusting the devices to be authentic and to be who they say they are, but also trusting that the data they collect is real and not altered. If one cannot trust the IoT devices and the data, there is no point in collecting, running analytics, and executing decisions based on the information collected.\r\nSecure adoption of IoT requires:\r\n<ul><li>Enabling mutual authentication between connected devices and applications</li><li>Maintaining the integrity and confidentiality of the data collected by devices</li><li>Ensuring the legitimacy and integrity of the software downloaded to devices</li><li>Preserving the privacy of sensitive data in light of stricter security regulations</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/iot.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":838,"title":"Endpoint Detection and Response","alias":"endpoint-detection-and-response","description":"Endpoint Detection and Response (EDR) is a cybersecurity technology that addresses the need for continuous monitoring and response to advanced threats. It is a subset of endpoint security technology and a critical piece of an optimal security posture. EDR differs from other endpoint protection platforms (EPP) such as antivirus (AV) and anti-malware in that its primary focus isn't to automatically stop threats in the pre-execution phase on an endpoint. Rather, EDR is focused on providing the right endpoint visibility with the right insights to help security analysts discover, investigate and respond to very advanced threats and broader attack campaigns stretching across multiple endpoints. Many EDR tools, however, combine EDR and EPP.\r\nWhile small and mid-market organizations are increasingly turning to EDR technology for more advanced endpoint protection, many lack the resources to maximize the benefits of the technology. Utilizing advanced EDR features such as forensic analysis, behavioral monitoring and artificial intelligence (AI) is labor and resource intensive, requiring the attention of dedicated security professionals.\r\nA managed endpoint security service combines the latest technology, an around-the-clock team of certified CSOC experts and up-to-the-minute industry intelligence for a cost-effective monthly subscription. Managed services can help reduce the day-to-day burden of monitoring and responding to alerts, enhance security orchestration and automation (SOAR) and improve threat hunting and incident response.","materialsDescription":"<span style=\"font-weight: bold; \">What is Endpoint detection and response (EDR)?</span>\r\nEndpoint detection and response is an emerging technology that addresses the need for continuous monitoring and response to advanced threats. One could even make the argument that endpoint detection and response is a form of advanced threat protection.\r\n<span style=\"font-weight: bold;\">What are the Key Aspects of EDR Security?</span>\r\nAccording to Gartner, effective EDR must include the following capabilities:\r\n<ul><li>Incident data search and investigation</li><li>Alert triage or suspicious activity validation</li><li>Suspicious activity detection</li><li>Threat hunting or data exploration</li><li>Stopping malicious activity</li></ul>\r\n<span style=\"font-weight: bold;\">What to look for in an EDR Solution?</span>\r\nUnderstanding the key aspects of EDR and why they are important will help you better discern what to look for in a solution. It’s important to find EDR software that can provide the highest level of protection while requiring the least amount of effort and investment — adding value to your security team without draining resources. Here are the six key aspects of EDR you should look for:\r\n<span style=\"font-weight: bold;\">1. Visibility:</span> Real-time visibility across all your endpoints allows you to view adversary activities, even as they attempt to breach your environment and stop them immediately.\r\n<span style=\"font-weight: bold;\">2. Threat Database:</span> Effective EDR requires massive amounts of telemetry collected from endpoints and enriched with context so it can be mined for signs of attack with a variety of analytic techniques.\r\n<span style=\"font-weight: bold;\">3. Behavioral Protection:</span> Relying solely on signature-based methods or indicators of compromise (IOCs) lead to the “silent failure” that allows data breaches to occur. Effective endpoint detection and response requires behavioral approaches that search for indicators of attack (IOAs), so you are alerted of suspicious activities before a compromise can occur.\r\n<span style=\"font-weight: bold;\">4. Insight and Intelligence:</span> An endpoint detection and response solution that integrates threat intelligence can provide context, including details on the attributed adversary that is attacking you or other information about the attack.\r\n<span style=\"font-weight: bold;\">5. Fast Response:</span> EDR that enables a fast and accurate response to incidents can stop an attack before it becomes a breach and allow your organization to get back to business quickly.\r\n<span style=\"font-weight: bold;\">6. Cloud-based Solution:</span> Having a cloud-based endpoint detection and response solution is the only way to ensure zero impact on endpoints while making sure capabilities such as search, analysis and investigation can be done accurately and in real time.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/hgghghg.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":4448,"logoURL":"https://old.roi4cio.com/fileadmin/user_upload/cronus_cyber.png","logo":true,"scheme":false,"title":"CyBot","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":0,"alias":"cybot","companyTitle":"Cronus Cyber Technologies","companyTypes":["supplier","vendor"],"companyId":6866,"companyAlias":"cronus-cyber-technologies","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Save time &amp; money</span></p>\r\nIncrease security by focusing on remediating&nbsp; vulnerabilities that are a part of a validated attack path to a business process or critical asset\r\n<p class=\"align-center\"><span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Key features:</span></span></p>\r\n<ul><li>Creates actionable insights based on critical vulnerabilities that threaten your business process for immediate alerts and remediation with one click</li><li>Continuous silent vulnerability scanning on all IP based devices on premise or in the cloud</li><li>Automatically detects critical assets and finds how hackers could reach and threaten them, no human involvement required.</li><li>Cronus is certified for Penetration Testing by CREST </li><li>Help comply with GDPR –require regular pen testing, vulnerability management and greatly reduces the risk of breach to your sensitive data.</li></ul>\r\n<span style=\"font-weight: bold;\">Continuous.</span> Perform continuous scans all year round, valid for both vulnerability management and penetration testing to stay on top of your network’s security 24/7. See live map and get real-time alerts on current threats to your business processes.\r\n<span style=\"font-weight: bold;\">Global</span>. Cybot can be deployed globally and showcase global Attack Path Scenarios ™ so you can see how a hacker can hop from a workstation in the UK to a router in Germany to a database in the US. This capability is unique both for penetration testing as well as for vulnerability management.&nbsp; The various CyBot Pros will be managed by a single Enterprise dashboard.\r\n<span style=\"font-weight: bold;\">Business Process Focused.</span> CyBot brings context to each asset it scans, checking how it could affect a business process. In this way, you can funnel all your vulnerabilities and first focus on those that are exploitable and that are a part of an attack path to a critical asset or business process. This greatly reduces the resources needed for patching and ensures business continuity.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Which CyBot is right for me?</span></p>\r\nCyBot is a next-generation vulnerability management tool as well as the world’s first Automated pen testing solution, that continuously showcases validated, global, multi-vector, Attack Path Scenarios ™ (APS), so you can focus your time and resources on those vulnerabilities that threaten your critical assets and business processes. <span style=\"font-weight: bold;\">CyBot has one core engine: CyBot Pro, plus two additional management consoles. One for Enterprises and one for MSSPs.</span>\r\n<span style=\"font-weight: bold;\">CyBot Pro</span> is the workhorse of the product suite. It is a patented autonomous machine-based penetration test which initially scans the networks, its assets, its vulnerabilities and then takes the next step to map out and validate all the routes a hacker could take to reach your critical assets and business processes. \r\nMuch like the process a human penetration tester would follow, but continuously and at a much larger scale and scope.\r\n<span style=\"font-weight: bold;\">CyBot Enterprise</span> manages several CyBot Pros. This is great for larger organizations with global networks who wish to gain insights on global Attack Path Scenarios ™ between their branches, each using a different CyBot machine. \r\nCyBot Enterprise will aggregate information from all CyBot Pros for in-depth global insights on cyber threats to your business processes.\r\n<span style=\"font-weight: bold;\">CyBot MSSP</span> provides large managed security service providers with full control of their Enterprise customers, each with their various CyBot Enterprise and CyBot Pro accounts. Schedule their scans, get alerts to your SIEM and much more<br /><br />","shortDescription":"A next-generation vulnerability management tool as well as the world’s first Automated pen testing solution, that continuously showcases validated, global, multi-vector, Attack Path Scenarios.","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":7,"sellingCount":13,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"CyBot","keywords":"","description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Save time &amp; money</span></p>\r\nIncrease security by focusing on remediating&nbsp; vulnerabilities that are a part of a validated attack path to a business process or critical asset\r\n<p class=\"align-ce","og:title":"CyBot","og:description":"<p class=\"align-center\"><span style=\"font-weight: bold;\">Save time &amp; money</span></p>\r\nIncrease security by focusing on remediating&nbsp; vulnerabilities that are a part of a validated attack path to a business process or critical asset\r\n<p class=\"align-ce","og:image":"https://old.roi4cio.com/fileadmin/user_upload/cronus_cyber.png"},"eventUrl":"","translationId":4449,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":34,"title":"ITSM - IT Service Management","alias":"itsm-it-service-management","description":"<span style=\"font-weight: bold; \">IT service management (ITSM)</span> is the process of designing, delivering, managing, and improving the IT services an organization provides to its end users. ITSM is focused on aligning IT processes and services with business objectives to help an organization grow.\r\nITSM positions IT services as the key means of delivering and obtaining value, where an internal or external IT service provider works with business customers, at the same time taking responsibility for the associated costs and risks. ITSM works across the whole lifecycle of a service, from the original strategy, through design, transition and into live operation.\r\nTo ensure sustainable quality of IT services, ITSM establishes a set of practices, or processes, constituting a service management system. There are industrial, national and international standards for IT service management solutions, setting up requirements and good practices for the management system. \r\nITSM system is based on a set of principles, such as focusing on value and continual improvement. It is not just a set of processes – it is a cultural mindset to ensure that the desired outcome for the business is achieved. \r\n<span style=\"font-weight: bold; \">ITIL (IT Infrastructure Library)</span> is a framework of best practices and recommendations for managing an organization's IT operations and services. IT service management processes, when built based on the ITIL framework, pave the way for better IT service operations management and improved business. To summarize, ITIL is a set of guidelines for effective IT service management best practices. ITIL has evolved beyond the delivery of services to providing end-to-end value delivery. The focus is now on the co-creation of value through service relationships. \r\n<p class=\"align-center\"><span style=\"font-weight: bold; \">ITSM processes typically include five stages, all based on the ITIL framework:</span></p>\r\n<span style=\"font-weight: bold; \">ITSM strategy.</span> This stage forms the foundation or the framework of an organization's ITSM process building. It involves defining the services that the organization will offer, strategically planning processes, and recognizing and developing the required assets to keep processes moving. \r\n<span style=\"font-weight: bold; \">Service design.</span> This stage's main aim is planning and designing the IT services the organization offers to meet business demands. It involves creating and designing new services as well as assessing current services and making relevant improvements.\r\n<span style=\"font-weight: bold; \">Service transition.</span> Once the designs for IT services and their processes have been finalized, it's important to build them and test them out to ensure that processes flow. IT teams need to ensure that the designs don't disrupt services in any way, especially when existing IT service processes are upgraded or redesigned. This calls for change management, evaluation, and risk management. \r\n<span style=\"font-weight: bold; \">Service operation. </span>This phase involves implementing the tried and tested new or modified designs in a live environment. While in this stage, the processes have already been tested and the issues fixed, but new processes are bound to have hiccups—especially when customers start using the services. \r\n<span style=\"font-weight: bold;\">Continual service improvement (CSI).</span> Implementing IT processes successfully shouldn't be the final stage in any organization. There's always room for improvement and new development based on issues that pop up, customer needs and demands, and user feedback.\r\n\r\n","materialsDescription":"<h1 class=\"align-center\">Benefits of efficient ITSM processes</h1>\r\nIrrespective of the size of business, every organization is involved in IT service management in some way. ITSM ensures that incidents, service requests, problems, changes, and IT assets—in addition to other aspects of IT services—are managed in a streamlined way.\r\nIT teams in your organization can employ various workflows and best practices in ITSM, as outlined in ITIL. Effective IT service management can have positive effects on an IT organization's overall function.\r\nHere are the 10 key benefits of ITSM:\r\n<ul><li>&nbsp;&nbsp;&nbsp; Lower costs for IT operations</li><li>&nbsp;&nbsp;&nbsp; Higher returns on IT investments</li><li>&nbsp;&nbsp;&nbsp; Minimal service outages</li><li>&nbsp;&nbsp;&nbsp; Ability to establish well-defined, repeatable, and manageable IT processes</li><li>&nbsp;&nbsp;&nbsp; Efficient analysis of IT problems to reduce repeat incidents</li><li>&nbsp;&nbsp;&nbsp; Improved efficiency of IT help desk teams</li><li>&nbsp;&nbsp;&nbsp; Well-defined roles and responsibilities</li><li>&nbsp;&nbsp;&nbsp; Clear expectations on service levels and service availability</li><li>&nbsp;&nbsp;&nbsp; Risk-free implementation of IT changes</li><li>&nbsp;&nbsp;&nbsp; Better transparency into IT processes and services</li></ul>\r\n<h1 class=\"align-center\">How to choose an ITSM tool?</h1>\r\nWith a competent IT service management goal in mind, it's important to invest in a service desk solution that caters to your business needs. It goes without saying, with more than 150 service desk tools to choose from, selecting the right one is easier said than done. Here are a few things to keep in mind when choosing an ITSM products:\r\n<span style=\"font-weight: bold; \">Identify key processes and their dependencies. </span>Based on business goals, decide which key ITSM processes need to be implemented and chart out the integrations that need to be established to achieve those goals. \r\n<span style=\"font-weight: bold; \">Consult with ITSM experts.</span> Participate in business expos, webinars, demos, etc., and educate yourself about the various options that are available in the market. Reports from expert analysts such as Gartner and Forrester are particularly useful as they include reviews of almost every solution, ranked based on multiple criteria.\r\n<span style=\"font-weight: bold; \">Choose a deployment option.</span> Every business has a different IT infrastructure model. Selecting an on-premises or software as a service (SaaS IT service management) tool depends on whether your business prefers to host its applications and data on its own servers or use a public or private cloud.\r\n<span style=\"font-weight: bold; \">Plan ahead for the future.</span> Although it's important to consider the &quot;needs&quot; primarily, you shouldn't rule out the secondary or luxury capabilities. If the ITSM tool doesn't have the potential to adapt to your needs as your organization grows, it can pull you back from progressing. Draw a clear picture of where your business is headed and choose an service ITSM that is flexible and technology-driven.\r\n<span style=\"font-weight: bold;\">Don't stop with the capabilities of the ITSM tool.</span> It might be tempting to assess an ITSM tool based on its capabilities and features but it's important to evaluate the vendor of the tool. A good IT support team, and a vendor that is endorsed for their customer-vendor relationship can take your IT services far. Check Gartner's magic quadrant and other analyst reports, along with product and support reviews to ensure that the said tool provides good customer support.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_ITSM.png"},{"id":79,"title":"VM - Vulnerability management","alias":"vm-vulnerability-management","description":"Vulnerability management is the &quot;cyclical practice of identifying, classifying, prioritizing, remediating and mitigating&quot; software vulnerabilities. Vulnerability management is integral to computer security and network security, and must not be confused with a Vulnerability assessment.\r\nVulnerability management is an ongoing process that includes proactive asset discovery, continuous monitoring, mitigation, remediation and defense tactics to protect your organization's modern IT attack surface from Cyber Exposure.\r\nVulnerabilities can be discovered with a vulnerability scanner, which analyzes a computer system in search of known vulnerabilities, such as open ports, insecure software configurations, and susceptibility to malware infections. They may also be identified by consulting public sources, such as NVD, or subscribing to a commercial vulnerability alerting services. Unknown vulnerabilities, such as a zero-day, may be found with fuzz testing, which can identify certain kinds of vulnerabilities, such as a buffer overflow with relevant test cases. Such analysis can be facilitated by test automation. In addition, antivirus software capable of heuristic analysis may discover undocumented malware if it finds software behaving suspiciously (such as attempting to overwrite a system file).\r\nCorrecting vulnerabilities may variously involve the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.\r\nNetwork vulnerabilities represent security gaps that could be abused by attackers to damage network assets, trigger a denial of service, and/or steal potentially sensitive information. Attackers are constantly looking for new vulnerabilities to exploit — and taking advantage of old vulnerabilities that may have gone unpatched.\r\nHaving a vulnerability management framework in place that regularly checks for new vulnerabilities is crucial for preventing cybersecurity breaches. Without a vulnerability testing and patch management system, old security gaps may be left on the network for extended periods of time. This gives attackers more of an opportunity to exploit vulnerabilities and carry out their attacks.\r\nOne statistic that highlights how crucial vulnerability management was featured in an Infosecurity Magazine article. According to survey data cited in the article, of the organizations that “suffered a breach, almost 60% were due to an unpatched vulnerability.” In other words, nearly 60% of the data breaches suffered by survey respondents could have been easily prevented simply by having a vulnerability management plan that would apply critical patches before attackers leveraged the vulnerability.","materialsDescription":" <span style=\"font-weight: bold;\">What is vulnerability management?</span>\r\nVulnerability management is a pro-active approach to managing network security by reducing the likelihood that flaws in code or design compromise the security of an endpoint or network.\r\n<span style=\"font-weight: bold;\">What processes does vulnerability management include?</span>\r\nVulnerability management processes include:\r\n<ul><li><span style=\"font-style: italic;\">Checking for vulnerabilities:</span> This process should include regular network scanning, firewall logging, penetration testing or use of an automated tool like a vulnerability scanner.</li><li><span style=\"font-style: italic;\">Identifying vulnerabilities:</span> This involves analyzing network scans and pen test results, firewall logs or vulnerability scan results to find anomalies that suggest a malware attack or other malicious event has taken advantage of a security vulnerability, or could possibly do so.</li><li><span style=\"font-style: italic;\">Verifying vulnerabilities:</span> This process includes ascertaining whether the identified vulnerabilities could actually be exploited on servers, applications, networks or other systems. This also includes classifying the severity of a vulnerability and the level of risk it presents to the organization.</li><li><span style=\"font-style: italic;\">Mitigating vulnerabilities:</span> This is the process of figuring out how to prevent vulnerabilities from being exploited before a patch is available, or in the event that there is no patch. It can involve taking the affected part of the system off-line (if it's non-critical), or various other workarounds.</li><li><span style=\"font-style: italic;\">Patching vulnerabilities:</span> This is the process of getting patches -- usually from the vendors of the affected software or hardware -- and applying them to all the affected areas in a timely way. This is sometimes an automated process, done with patch management tools. This step also includes patch testing.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/VM_-_Vulnerability_management1.png"},{"id":445,"title":"Penetration Testing","alias":"penetration-testing","description":" A <span style=\"font-weight: bold; \">penetration test</span>, colloquially known as a pen test, <span style=\"font-weight: bold; \">pentest </span>or <span style=\"font-weight: bold; \">ethical hacking</span>, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.\r\nStandard penetration test is performed to identify both weaknesses (also referred to as <span style=\"font-weight: bold; \">vulnerabilities</span>), including the potential for unauthorized parties to gain access to the system's features and data, as well as strengths, enabling a full risk assessment to be completed. \r\nThe main objective of system penetration testing is to identify security weaknesses. Vulnerability testing can also be used to test an organization's security policy, its adherence to compliance requirements, its employees' security awareness and the organization's ability to identify and respond to security incidents.\r\nTypically,<span style=\"font-size:11pt; font-family:Arial; font-style:normal; \">professional penetration testing</span>provides information about security weaknesses that are identified or exploited through pen testing is aggregated and provided to the organization's IT and network system managers, enabling them to make strategic decisions and prioritize remediation efforts. \r\nA wide variety of <span style=\"font-weight: bold; \">software security testing tools </span>are available to assist with penetration testing, including free-of-charge, free software, and commercial software. Penetration tools scan code in order to identity malicious code in applications that could result in a security breach. Pen testing tools examine data encryption techniques and can identify hard-coded values, such as usernames and passwords, to verify security vulnerabilities in the system.\r\n&nbsp;Important aspect of any penetration testing program is defining the scope within which the pen testers must operate. Usually, the scope defines what systems, locations, techniques and tools can be used in a penetration test. Limiting the scope of the penetration test helps focus team members - and defenders - on the systems over which the organization has control.\r\n<p class=\"align-center\"><span style=\"font-weight: bold;\">Here are several of the main vulnerability penetration testing approaches:</span></p>\r\n<ul><li><span style=\"font-weight: bold;\">Targeted testing</span> is performed by the organization's IT team and the penetration testing team working together. It's sometimes referred to as a &quot;lights turned on&quot; approach because everyone can see the test being carried out.</li><li><span style=\"font-weight: bold;\">External testing</span> targets a company's externally visible servers or devices including domain name servers, email servers, web servers or firewalls. The<span style=\"font-size:11pt; font-family:Arial; font-style:normal; \">objective of penetration testing</span>is to find out if an outside attacker can get in and how far they can get in once they've gained access.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Internal testing</span> mimics an inside attack behind the firewall by an authorized user with standard access privileges. This kind of test is useful for estimating how much damage a disgruntled employee could cause.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Blind testing simulates</span> the actions and procedures of a real attacker by severely limiting the information given to the person or team performing the test beforehand. Typically, the pen testers may only be given the name of the company.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Double-blind testing</span> takes the blind test and carries it a step further. In this type of pen test, only one or two people within the organization might be aware a test is being conducted. Double-blind tests can be useful for testing an organization's security monitoring and incident identification as well as its response procedures.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Black box</span> testing is basically the same as blind testing, but the tester receives no information before the test takes place. Rather, the pen testers must find their own way into the system.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">White box</span> testing provides the penetration testers information about the target network before they start their work. This information can include such details as IP addresses, network infrastructure schematics and the protocols used plus the source code.</li></ul>","materialsDescription":"<h1 class=\"align-center\"> <span style=\"font-weight: normal;\">What Is Penetration Testing?</span></h1>\r\nThere is a considerable amount of confusion in the industry regarding the differences between vulnerability assessment and penetration testing tool,as the two phrases are commonly interchanged. However, their meaning and implications are very different. A <span style=\"font-weight: bold; \">vulnerability assessment </span>simply identifies and reports noted vulnerabilities, whereas a pentest attempts to exploit the vulnerabilities to determine whether unauthorized access or other malicious activity is possible.<span style=\"font-weight: bold; \"> Penetration testing</span> typically includes network penetration testing and web application security testing as well as controls and processes around the networks and applications, and should occur from both outside the network trying to come in (external testing) and from inside the network.\r\n<h1 class=\"align-center\"><span style=\"font-weight: normal;\">What is a pentesting tool ?</span></h1>\r\n<p class=\"align-left\">Penetration tools are used as part testing to automate certain tasks, improve testing efficiency and discover issues that might be difficult to find using manual analysis techniques alone. Two common penetration testing tools are <span style=\"font-weight: bold; \">static analysis </span>tools and <span style=\"font-weight: bold; \">dynamic analysis</span> tools. Tools for attack include software designed to produce <span style=\"font-weight: bold; \">brute-force attacks</span> or <span style=\"font-weight: bold; \">SQL injections</span>. There is also hardware specifically designed for pen testing, such as small inconspicuous boxes that can be plugged into a computer on the network to provide the hacker with remote access to that network. In addition, an ethical hacker may use social engineering techniques to find vulnerabilities. For example, sending phishing emails to company employees, or even disguising themselves as delivery people to gain physical access to the building.</p>\r\n<h1 class=\"align-center\"><span style=\"font-weight: normal;\">What are the benefits of penetration testing?</span></h1>\r\n<ul><li><span style=\"font-weight: bold;\">Manage the Risk Properly. </span>For many organizations, one of the most popular benefits of pen testing services is that they will give you a baseline to work upon to cure the risk in a structured and optimal way. It will show you the list of vulnerabilities in the target environment and the risks associated with it.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Increase Business Continuity.</span> Business continuity is the prime concern for any successful organization. A break in the business continuity can happen for many reasons. Lack of security loopholes is one of them. Insecure systems suffer more breaches in their availability than the secured ones. Today attackers are hired by other organizations to stop the continuity of business by exploiting the vulnerabilities to gain the access and to produce a denial of service condition which usually crashes the vulnerable service and breaks the server availability.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Protect Clients, Partners, and Third Parties.</span> A security breach can affect not only the target organization but also their associated clients, partners and third parties working with it. However, if company schedules a penetration test regularly and takes necessary actions towards security, it will help professionals build trust and confidence in the organization.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Helps to Evaluate Security Investment.&nbsp;</span> The pen test results will give us an independent view of the effectiveness of existing security processes, ensuring that configuration management practices have been followed correctly. This is an ideal opportunity to review the efficiency of the current security investment. What needs to be improved and what is working and what is not working and how much investment needed to build the more secure environment in the organization.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Help Protect Public Relationships and Guard the reputation of your company.</span>A good public relationship and company reputation are built up after taking many years struggle and hard work and with a huge amount of investment. This can be suddenly changed due to a single security breach.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Protection from Financial Damage.</span> A simple breach of the security system may cause millions of dollars of damage. Penetration testing can protect your organization from such damages.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Helps to tests cyber-defense capability.</span> During a penetration test, the target company’s security team should be able to detect multiple attacks and respond accordingly on time. Furthermore, if an intrusion is detected, the security and forensic teams should start investigations, and the penetration testers should be blocked and their tools removed. The effectiveness of your protection devices like IDS, IPS or WAF can also be tested during a penetration test.<span style=\"font-weight: bold;\"></span></li><li><span style=\"font-weight: bold;\">Client-side Attacks. </span>Pen tests are an effective way of ensuring that successful highly targeted client-side attacks against key members of your staff. Security should be treated with a holistic approach. Companies only assessing the security of their servers run the risk of being targeted with client-side attacks exploiting vulnerabilities in software like web browsers, pdf readers, etc. It is important to ensure that the patch management processes are working properly updating the operating system and third-party applications.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Penetration_Testing.png"},{"id":467,"title":"Network Forensics","alias":"network-forensics","description":" Network forensics is a sub-branch of digital forensics relating to the monitoring and analysis of computer network traffic for the purposes of information gathering, legal evidence, or intrusion detection. Unlike other areas of digital forensics, network investigations deal with volatile and dynamic information. Network traffic is transmitted and then lost, so network forensics is often a pro-active investigation.\r\nNetwork forensics generally has two uses. The first, relating to security, involves monitoring a network for anomalous traffic and identifying intrusions. An attacker might be able to erase all log files on a compromised host; network-based evidence might therefore be the only evidence available for forensic analysis. The second form relates to law enforcement. In this case analysis of captured network traffic can include tasks such as reassembling transferred files, searching for keywords and parsing human communication such as emails or chat sessions.\r\nTwo systems are commonly used to collect network data; a brute force &quot;catch it as you can&quot; and a more intelligent &quot;stop look listen&quot; method.\r\nNetwork forensics is a comparatively new field of forensic science. The growing popularity of the Internet in homes means that computing has become network-centric and data is now available outside of disk-based digital evidence. Network forensics can be performed as a standalone investigation or alongside a computer forensics analysis (where it is often used to reveal links between digital devices or reconstruct how a crime was committed).\r\nMarcus Ranum is credited with defining Network forensics as &quot;the capture, recording, and analysis of network events in order to discover the source of security attacks or other problem incidents&quot;.\r\nCompared to computer forensics, where evidence is usually preserved on disk, network data is more volatile and unpredictable. Investigators often only have material to examine if packet filters, firewalls, and intrusion detection systems were set up to anticipate breaches of security.\r\nSystems used to collect network data for forensics use usually come in two forms:\r\n<ul><li>&quot;Catch-it-as-you-can&quot; – This is where all packets passing through a certain traffic point are captured and written to storage with analysis being done subsequently in batch mode. This approach requires large amounts of storage.</li><li>&quot;Stop, look and listen&quot; – This is where each packet is analyzed in a rudimentary way in memory and only certain information saved for future analysis. This approach requires a faster processor to keep up with incoming traffic.</li></ul>","materialsDescription":" <span style=\"font-weight: bold;\">Why is network forensics important?</span>\r\nNetwork forensics is important because so many common attacks entail some type of misuse of network resources.\r\n<span style=\"font-weight: bold;\">What are the different ways in which the network can be attacked?</span>\r\nAttacks typically target availability confidentiality and integrity. Loss of any one of these items constitutes a security breach.\r\n<span style=\"font-weight: bold;\">Where is the best place to search for information?</span>\r\nInformation can be found by either doing a live analysis of the network, analyzing IDS information, or examining logs that can be found in routers and servers.\r\n<span style=\"font-weight: bold;\">How does a forensic analyst know how deeply to look for information?</span>\r\nSome amount of information can be derived from looking at the skill level of the attacker. Attackers with little skill are much less likely to use advanced hiding techniques.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Network_Forensics.png"},{"id":834,"title":"IoT - Internet of Things Security","alias":"iot-internet-of-things-security","description":" IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).\r\nIoT involves adding internet connectivity to a system of interrelated computing devices, mechanical and digital machines, objects, animals and/or people. Each &quot;thing&quot; is provided a unique identifier and the ability to automatically transfer data over a network. Allowing devices to connect to the internet opens them up to a number of serious vulnerabilities if they are not properly protected.\r\nIoT security has become the subject of scrutiny after a number of high-profile incidents where a common IoT device was used to infiltrate and attack the larger network. Implementing security measures is critical to ensuring the safety of networks with IoT devices connected to them.\r\nIoT security hacks can happen in any industry, from smart home to a manufacturing plant to a connected car. The severity of impact depends greatly on the individual system, the data collected and/or the information it contains.\r\nAn attack disabling the brakes of a connected car, for example, or on a connected health device, such as an insulin pump hacked to administer too much medication to a patient, can be life-threatening. Likewise, an attack on a refrigeration system housing medicine that is monitored by an IoT system can ruin the viability of a medicine if temperatures fluctuate. Similarly, an attack on critical infrastructure -- an oil well, energy grid or water supply -- can be disastrous.\r\nSo, a robust IoT security portfolio must allow protecting devices from all types of vulnerabilities while deploying the security level that best matches application needs. Cryptography technologies are used to combat communication attacks. Security services are offered for protecting against lifecycle attacks. Isolation measures can be implemented to fend off software attacks. And, finally, IoT security should include tamper mitigation and side-channel attack mitigation technologies for fighting physical attacks of the chip.","materialsDescription":" <span style=\"font-weight: bold;\">What are the key requirements of IoT Security?</span>\r\nThe key requirements for any IoT security solution are:\r\n<ul><li>Device and data security, including authentication of devices and confidentiality and integrity of data</li><li>Implementing and running security operations at IoT scale</li><li>Meeting compliance requirements and requests</li><li>Meeting performance requirements as per the use case</li></ul>\r\n<span style=\"font-weight: bold;\">What do connected devices require to participate in the IoT Securely?</span>\r\nTo securely participate in the IoT, each connected device needs a unique identification – even before it has an IP address. This digital credential establishes the root of trust for the device’s entire lifecycle, from initial design to deployment to retirement.\r\n<span style=\"font-weight: bold;\">Why is device authentication necessary for the IoT?</span>\r\nStrong IoT device authentication is required to ensure connected devices on the IoT can be trusted to be what they purport to be. Consequently, each IoT device needs a unique identity that can be authenticated when the device attempts to connect to a gateway or central server. With this unique ID in place, IT system administrators can track each device throughout its lifecycle, communicate securely with it, and prevent it from executing harmful processes. If a device exhibits unexpected behavior, administrators can simply revoke its privileges.\r\n<span style=\"font-weight: bold;\">Why is secure manufacturing necessary for IoT devices?</span>\r\nIoT devices produced through unsecured manufacturing processes provide criminals opportunities to change production runs to introduce unauthorized code or produce additional units that are subsequently sold on the black market.\r\nOne way to secure manufacturing processes is to use hardware security modules (HSMs) and supporting security software to inject cryptographic keys and digital certificates and to control the number of units built and the code incorporated into each.\r\n<span style=\"font-weight: bold;\">Why is code signing necessary for IoT devices?</span>\r\nTo protect businesses, brands, partners, and users from software that has been infected by malware, software developers have adopted code signing. In the IoT, code signing in the software release process ensures the integrity of IoT device software and firmware updates and defends against the risks associated with code tampering or code that deviates from organizational policies.\r\nIn public key cryptography, code signing is a specific use of certificate-based digital signatures that enables an organization to verify the identity of the software publisher and certify the software has not been changed since it was published.\r\n<span style=\"font-weight: bold;\">What is IoT PKI?</span>\r\nToday there are more things (devices) online than there are people on the planet! Devices are the number one users of the Internet and need digital identities for secure operation. As enterprises seek to transform their business models to stay competitive, rapid adoption of IoT technologies is creating increasing demand for Public Key Infrastructures (PKIs) to provide digital certificates for the growing number of devices and the software and firmware they run.\r\nSafe IoT deployments require not only trusting the devices to be authentic and to be who they say they are, but also trusting that the data they collect is real and not altered. If one cannot trust the IoT devices and the data, there is no point in collecting, running analytics, and executing decisions based on the information collected.\r\nSecure adoption of IoT requires:\r\n<ul><li>Enabling mutual authentication between connected devices and applications</li><li>Maintaining the integrity and confidentiality of the data collected by devices</li><li>Ensuring the legitimacy and integrity of the software downloaded to devices</li><li>Preserving the privacy of sensitive data in light of stricter security regulations</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/iot.png"},{"id":836,"title":"DRP - Digital Risk Protection","alias":"drp-digital-risk-protection","description":"Digital risks exist on social media and web channels, outside most organization's line of visibility. Organizations struggle to monitor these external, unregulated channels for risks targeting their business, their employees or their customers.\r\nCategories of risk include cyber (insider threat, phishing, malware, data loss), revenue (customer scams, piracy, counterfeit goods) brand (impersonations, slander) and physical (physical threats, natural disasters).\r\nDue to the explosive growth of digital risks, organizations need a flexible, automated approach that can monitor digital channels for organization-specific risks, trigger alerts and remediate malicious posts, profiles, content or apps.\r\nDigital risk protection (DRP) is the process of protecting social media and digital channels from security threats and business risks such as social engineering, external fraud, data loss, insider threat and reputation-based attacks. DRP reduces risks that emerge from digital transformation, protecting against the unwanted exposure of a company’s data, brand, and attack surface and providing actionable insight on threats from the open, deep, and dark web.<br /><br />","materialsDescription":"<span style=\"font-weight: bold;\">What is a digital risk?</span>\r\nDigital risks can take many forms. Most fundamentally, what makes a risk digital? Digital risk is any risk that plays out in one form or another online, outside of an organization’s IT infrastructure and beyond the security perimeter. This can be a cyber risk, like a phishing link or ransomware via LinkedIn, but can also include traditional risks with a digital component, such as credit card money flipping scams on Instagram.\r\n<span style=\"font-weight: bold;\">What are the features of Digital Risk Protection?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">The features are:</span></span>\r\n<ul><li>Protecting yourself from digital risk by building a watchtower, not a wall. A new Forrester report identifies two objectives for any digital risk protection effort: identifying risks and resolving them.</li><li>Digital risk comes in many forms, like unauthorized data disclosure, threat coordination from cybercriminals, risks inherent in the technology you use and in your third-party associates and even from your own employees.</li><li>The best solutions should automate the collection of data and draw from many sources; should have the capabilities to map, monitor, and mitigate digital risk and should be flexible enough to be applied in multiple use cases — factors that many threat intelligence solutions excel in.</li></ul>\r\n<span style=\"font-weight: bold;\">What elements constitute a digital risk?</span>\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Unauthorized Data Disclosure</span></span>\r\nThis includes the theft or leakage of any kind of sensitive data, like the personal financial information of a retail organization’s customers or the source code for a technology company’s proprietary products.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Threat Coordination Activity</span></span>\r\nMarketplaces and criminal forums on the dark web or even just on the open web are potent sources of risk. Here, a vulnerability identified by one group or individual who can’t act on it can reach the hands of someone who can. This includes the distribution of exploits in both targeted and untargeted campaigns.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Supply Chain Issues</span></span>\r\nBusiness partners, third-party suppliers, and other vendors who interact directly with your organization but are not necessarily following the same security practices can open the door to increased risk.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Employee Risk</span></span>\r\nEven the most secure and unbreakable lock can still easily be opened if you just have the right key. Through social engineering efforts, identity or access management and manipulation, or malicious insider attacks coming from disgruntled employees, even the most robust cybersecurity program can be quickly subverted.\r\n<span style=\"font-style: italic;\"><span style=\"font-weight: bold;\">Technology Risks</span></span>\r\nThis broad category includes all of the risks you must consider across the different technologies your organization might rely on to get your work done, keep it running smoothly, and tell people about it.\r\n<ul><li><span style=\"font-weight: bold;\">Physical Infrastructure:</span> Countless industrial processes are now partly or completely automated, relying on SCADA, DCS, or PLC systems to run smoothly — and opening them up to cyber- attacks (like the STUXNET attack that derailed an entire country’s nuclear program).</li><li><span style=\"font-weight: bold;\">IT Infrastructure:</span> Maybe the most commonsensical source of digital risk, this includes all of the potential vulnerabilities in your software and hardware. The proliferation of the internet of things devices poses a growing and sometimes underappreciated risk here.</li><li><span style=\"font-weight: bold;\">Public-Facing Presence:</span> All of the points where you interact with your customers and other public entities, whether through social media, email campaigns, or other marketing strategies, represent potential sources of risk.</li></ul>","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Digital_Risk_Protection.png"},{"id":838,"title":"Endpoint Detection and Response","alias":"endpoint-detection-and-response","description":"Endpoint Detection and Response (EDR) is a cybersecurity technology that addresses the need for continuous monitoring and response to advanced threats. It is a subset of endpoint security technology and a critical piece of an optimal security posture. EDR differs from other endpoint protection platforms (EPP) such as antivirus (AV) and anti-malware in that its primary focus isn't to automatically stop threats in the pre-execution phase on an endpoint. Rather, EDR is focused on providing the right endpoint visibility with the right insights to help security analysts discover, investigate and respond to very advanced threats and broader attack campaigns stretching across multiple endpoints. Many EDR tools, however, combine EDR and EPP.\r\nWhile small and mid-market organizations are increasingly turning to EDR technology for more advanced endpoint protection, many lack the resources to maximize the benefits of the technology. Utilizing advanced EDR features such as forensic analysis, behavioral monitoring and artificial intelligence (AI) is labor and resource intensive, requiring the attention of dedicated security professionals.\r\nA managed endpoint security service combines the latest technology, an around-the-clock team of certified CSOC experts and up-to-the-minute industry intelligence for a cost-effective monthly subscription. Managed services can help reduce the day-to-day burden of monitoring and responding to alerts, enhance security orchestration and automation (SOAR) and improve threat hunting and incident response.","materialsDescription":"<span style=\"font-weight: bold; \">What is Endpoint detection and response (EDR)?</span>\r\nEndpoint detection and response is an emerging technology that addresses the need for continuous monitoring and response to advanced threats. One could even make the argument that endpoint detection and response is a form of advanced threat protection.\r\n<span style=\"font-weight: bold;\">What are the Key Aspects of EDR Security?</span>\r\nAccording to Gartner, effective EDR must include the following capabilities:\r\n<ul><li>Incident data search and investigation</li><li>Alert triage or suspicious activity validation</li><li>Suspicious activity detection</li><li>Threat hunting or data exploration</li><li>Stopping malicious activity</li></ul>\r\n<span style=\"font-weight: bold;\">What to look for in an EDR Solution?</span>\r\nUnderstanding the key aspects of EDR and why they are important will help you better discern what to look for in a solution. It’s important to find EDR software that can provide the highest level of protection while requiring the least amount of effort and investment — adding value to your security team without draining resources. Here are the six key aspects of EDR you should look for:\r\n<span style=\"font-weight: bold;\">1. Visibility:</span> Real-time visibility across all your endpoints allows you to view adversary activities, even as they attempt to breach your environment and stop them immediately.\r\n<span style=\"font-weight: bold;\">2. Threat Database:</span> Effective EDR requires massive amounts of telemetry collected from endpoints and enriched with context so it can be mined for signs of attack with a variety of analytic techniques.\r\n<span style=\"font-weight: bold;\">3. Behavioral Protection:</span> Relying solely on signature-based methods or indicators of compromise (IOCs) lead to the “silent failure” that allows data breaches to occur. Effective endpoint detection and response requires behavioral approaches that search for indicators of attack (IOAs), so you are alerted of suspicious activities before a compromise can occur.\r\n<span style=\"font-weight: bold;\">4. Insight and Intelligence:</span> An endpoint detection and response solution that integrates threat intelligence can provide context, including details on the attributed adversary that is attacking you or other information about the attack.\r\n<span style=\"font-weight: bold;\">5. Fast Response:</span> EDR that enables a fast and accurate response to incidents can stop an attack before it becomes a breach and allow your organization to get back to business quickly.\r\n<span style=\"font-weight: bold;\">6. Cloud-based Solution:</span> Having a cloud-based endpoint detection and response solution is the only way to ensure zero impact on endpoints while making sure capabilities such as search, analysis and investigation can be done accurately and in real time.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/hgghghg.png"},{"id":840,"title":"ICS/SCADA Cyber Security","alias":"icsscada-cyber-security","description":"SCADA security is the practice of protecting supervisory control and data acquisition (SCADA) networks, a common framework of control systems used in industrial operations. These networks are responsible for providing automated control and remote human management of essential commodities and services such as water, natural gas, electricity and transportation to millions of people. They can also be used to improve the efficiencies and quality in other less essential (but some would say very important!) real-world processes such as snowmaking for ski resorts and beer brewing. SCADA is one of the most common types of industrial control systems (ICS).\r\nThese networks, just like any other network, are under threat from cyber-attacks that could bring down any part of the nation's critical infrastructure quickly and with dire consequences if the right security is not in place. Capital expenditure is another key concern; SCADA systems can cost an organization from tens of thousands to millions of dollars. For these reasons, it is essential that organizations implement robust SCADA security measures to protect their infrastructure and the millions of people that would be affected by the disruption caused by an external attack or internal error.\r\nSCADA security has evolved dramatically in recent years. Before computers, the only way to monitor a SCADA network was to deploy several people to each station to report back on the state of each system. In busier stations, technicians were stationed permanently to manually operate the network and communicate over telephone wires.\r\nIt wasn't until the introduction of the local area network (LAN) and improvements in system miniaturization that we started to see advances in SCADA development such as the distributed SCADA network. Next came networked systems that were able to communicate over a wide area network (WAN) and connect many more components together.\r\nFrom local companies to federal governments, every business or organization that works with SCADA systems are vulnerable to SCADA security threats. These threats can have wide-reaching effects on both the economy and the community. Specific threats to SCADA networks include the following:\r\n<span style=\"font-weight: bold;\">Hackers.</span> Individuals or groups with malicious intent could bring a SCADA network to its knees. By gaining access to key SCADA components, hackers could unleash chaos on an organization that can range from a disruption in services to cyber warfare.\r\n<span style=\"font-weight: bold;\">Malware.</span> Malware, including viruses, spyware and ransomware can pose a risk to SCADA systems. While malware may not be able to specifically target the network itself, it can still pose a threat to the key infrastructure that helps to manage the SCADA network. This includes mobile SCADA applications that are used to monitor and manage SCADA systems.\r\n<span style=\"font-weight: bold;\">Terrorists.</span> Where hackers are usually motivated by sordid gain, terrorists are driven by the desire to cause as much mayhem and damage as possible.\r\n<span style=\"font-weight: bold;\">Employees.</span> Insider threats can be just as damaging as external threats. From human error to a disgruntled employee or contractor, it is essential that SCADA security addresses these risks.\r\nManaging today's SCADA networks can be a challenge without the right security precautions in place. Many networks are still without the necessary detection and monitoring systems and this leaves them vulnerable to attack. Because SCADA network attacks exploit both cyber and physical vulnerabilities, it is critical to align cybersecurity measures accordingly.","materialsDescription":"<span style=\"font-weight: bold;\">What is the difference between ICS/SCADA cybersecurity and information security?</span>\r\nAutomated process control systems (SCADA) have a lot of differences from “traditional” corporate information systems: from the destination, specific data transfer protocols and equipment used and ending with the environment in which they operate. In corporate networks and systems, as a rule, the main protected resource is information that is processed, transmitted and stored in automated systems, and the main goal is to ensure its confidentiality. In ICS, the protected resource, first of all, is the technological process itself, and the main goal is to ensure its continuity (accessibility of all nodes) and integrity (including information transmitted between the nodes of the ICS). Moreover, the field of potential risks and threats to ICS, in comparison with corporate systems, expands with risks of potential damage to life and health of personnel and the public, damage to the environment and infrastructure. That is why it is incorrect to talk about “information security” in relation to ICS/SCADA. In English sources, the term “cybersecurity” is used for this, a direct translation of which (cybersecurity) is increasingly found in our market in relation to the protection of process control systems.\r\n<span style=\"font-weight: bold;\">Is it really necessary?</span>\r\nIt is necessary. There are a number of myths about process control systems, for example: “process control systems are completely isolated from the outside world”, “process control systems are too specific for someone to crack”, “process control systems are reliably protected by the developer”, or even “No one will ever try us, hacking us is not interesting. ” All this is no longer true. Many modern distributed process control systems have one or another connection with the corporate network, even if the system owners are unaware of this. Communication with the outside world greatly simplifies the task of the attacker, but does not remain the only possible option. Automated process control software and data transfer protocols are, as a rule, very, very insecure against cyber threats. This is evidenced by numerous articles and reports of experts involved in the study of the protection of industrial control systems and penetration tests. The PHDays III section on hacking automated process control systems impressed even ardent skeptics. Well, and, of course, the argument “they have NOT attacked us, therefore they will not” - can hardly be considered seriously. Everyone has heard about Stuxnet, which dispelled almost all the myths about the safety of ICS at once.\r\n<span style=\"font-weight: bold;\">Who needs this?</span>\r\nWith the phrase ICS/SCADA, most imagine huge plants, automated CNC machines or something similar. However, the application of process control systems is not limited to these objects - in the modern age of automation, process control systems are used everywhere: from large production facilities, the oil and gas industry, transport management to smart home systems. And, by the way, with the protection of the latter, as a rule, everything can be much worse, because the developer silently and imperceptibly shifts responsibility to the shoulders of the user.\r\nOf course, some of the objects with automated process control systems are more interesting for attackers, others less. But, given the ever-growing number of vulnerabilities discovered and published in the ICS, the spread of &quot;exclusive&quot; (written for specific protocols and ICS software) malware, considering your system safe &quot;by default&quot; is unreasonable.\r\n<span style=\"font-weight: bold;\">Are ICS and SCADA the same thing?</span>\r\nNo. SCADA systems (supervisory control and data acquisition, supervisory control and data collection) are part of the control system. Usually, a SCADA system means centralized control and management systems with the participation of a person as a whole system or a complex of industrial control systems. SCADA is the central link between people (human-machine interfaces) and PLC levels (programmable logic controller) or RTU (remote terminal unit).\r\n<span style=\"font-weight: bold;\">What is ICS/SCADA cybersecurity?</span>\r\nIn fact, ICS cybersecurity is a process similar to “information security” in a number of properties, but very different in details. And the devil, as you know, lies in them. ICS/SCADA also has similar information security-related processes: asset inventory, risk analysis and assessment, threat analysis, security management, change management, incident response, continuity, etc. But these processes themselves are different.<br />The cyber security of ICSs has the same basic target qualities - confidentiality, integrity and accessibility, but the significance and point of application for them are completely different. It should be remembered that in ICS/SCADA we, first of all, protect the technological process. Beyond this - from the risks of damage to human health and life and the environment.","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_SCADA_Cyber_Security.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]},{"id":6752,"logo":false,"scheme":false,"title":"Netscout nGenius Pulse","vendorVerified":0,"rating":"0.00","implementationsCount":0,"suppliersCount":0,"supplierPartnersCount":1,"alias":"netscout-ngenius-pulse","companyTitle":"NetScout","companyTypes":["vendor"],"companyId":2747,"companyAlias":"netscout","description":"The <span style=\"font-weight: bold;\">nGeniusPulse</span> is the addition to the nGenius Platform, adding synthetic testing and infrastructure health monitoring. nGeniusPULSE extends the service-oriented approach of nGeniusONE and ASI. When a problem is identified by nGeniusONE a nd isolated as a potential infrastructure element, IT can drill down directly from the nGeniusONE console to the underlying infrastructure. With one contextual workflow, IT doesn’t need stop the process and start using a separate infrastructure component monitoring tool.\r\n<span style=\"font-weight: bold;\">Compliments Real User Measurement Testing and Packet Analysis in Netscout’s nGeniusONE</span>\r\nCombined with nGeniusONE, nGeniusPULSE delivers total visibility of the enterprise by routinely and automatically monitoring applications and services for performance and availability, while also monitoring the health of the underlying infrastructure that delivers those services. nGeniusPULSE extends the service-centric approach of the nGenius platform with workflows giving visibility from all the way out to SaaS applications and down to infrastructure elements for faster problem resolution.\r\nTo monitor the health of the infrastructure, nGeniusPULSE Server uses SNMP and WinRM to monitor servers, and SNMP to monitor network devices. nGeniusPULSE also captures and displays syslog information to easily correlate issues found in the infrastructure.\r\nFor business services from Cloud to conventional applications, active testing automatically and routinely simulates real user actions accessing the service – even if no active users of the application are on the system, in order to proactively alert for issues or outages.\r\nThe nGeniusPULSE solution is deployed in a data center on a hardware or virtual server providing security and control of your information. Agents, called “nPoints,” can be placed virtually anywhere to run active tests and send results to the nGeniusPULSE Server.\r\nFrom the nGeniusPULSE server, results are displayed in an intuitive interface that includes dashboards, drilldowns, and alerts; as well as easy-to-use configuration and administration functions. nGeniusPULSE also includes direct technical support from NETSCOUT’s best-in-class support teams with 24x7 support services.\r\n<span style=\"font-weight: bold;\">Main capabilities:</span>\r\n<ul><li>Test up to 50 different business services from up to 1,500 differ ent locations on a single server</li><li>Measure service levels form anywhere users are located - even when they’re not there</li><li>Create your own custom active tests such as Ping, bandwidth utilization, speed, etc.</li><li>Monitor up to 25,000 infrastructure elements (servers, interfaces, routers, switches) on a single server</li></ul>","shortDescription":"Netscout nGenius Pulse is the addition to the nGenius Platform, adding synthetic testing and infrastructure health monitoring","type":null,"isRoiCalculatorAvaliable":false,"isConfiguratorAvaliable":false,"bonus":100,"usingCount":0,"sellingCount":0,"discontinued":0,"rebateForPoc":0,"rebate":0,"seo":{"title":"Netscout nGenius Pulse","keywords":"","description":"The <span style=\"font-weight: bold;\">nGeniusPulse</span> is the addition to the nGenius Platform, adding synthetic testing and infrastructure health monitoring. nGeniusPULSE extends the service-oriented approach of nGeniusONE and ASI. When a problem is identif","og:title":"Netscout nGenius Pulse","og:description":"The <span style=\"font-weight: bold;\">nGeniusPulse</span> is the addition to the nGenius Platform, adding synthetic testing and infrastructure health monitoring. nGeniusPULSE extends the service-oriented approach of nGeniusONE and ASI. When a problem is identif"},"eventUrl":"","translationId":6752,"dealDetails":null,"roi":null,"price":null,"bonusForReference":null,"templateData":[],"testingArea":"","categories":[{"id":325,"title":"Performance Management Software","alias":"performance-management-software","description":" <span style=\"font-weight: bold; \">Performance management software </span>— also referred to as a <span style=\"font-weight: bold; \">performance management system</span>— helps a company track, analyze, and evaluate its employees’ performance. is designed to improve business performance by spurring employee productivity. It works to ensure individual employees and teams are engaged and in alignment with organizational goals. Employee review software replaces an annual performance review process with real-time performance tracking, goal setting and feedback.\r\nPerformance management software systems are overseen by the HR department. They fit under the umbrella of <span style=\"font-style: italic; \">talent management systems.</span>\r\nAs next-generation HR software, performance management tools help companies address the modern goals of continually monitoring performance while giving employees feedback and support. Performance review software can track individual contributions to a team, as well as that team's ability to meet business objectives, thus tying performance into the company's bottom line.\r\nImproving employee engagement is another goal of performance management software. An employee can see current individual performance goals and their progress toward meeting them. This includes tracking efforts on specific projects. Managers measure individual performance against goals, and employees get a better idea of where they stand.\r\nThese systems use dashboards for quick and collaborative reviews. They can report individual performance, as well as project and team performance. The systems may also include employee ranking.\r\nAn effective performance management program must interact with other tools - in particular, workforce analytics. Data can be analyzed, for instance, against reporting from financial management systems and sales performance management systems.","materialsDescription":"<h1 class=\"align-center\">Why Implement Performance Management Software?</h1>\r\n<ul><li><span style=\"font-weight: bold; \">Easily-Navigable Dashboard </span></li></ul>\r\nThe top advantage to performance management tools are their ability to bring all key data and performance into one, organized location. Award-winning business performance management software do that. They make it easy to navigate the data and information and help leaders make better decisions for their workforce. \r\n<ul><li><span style=\"font-weight: bold; \">Performance Review Cycles </span></li></ul>\r\nTraditional annual review cycle or not, performance management system software can help coordinate, organize, schedule and store review information. The software will send reminders to leaders, manage permissions as leadership changes and provide structure to the overall process, including scripts based on company values and the employee’s role.\r\n<ul><li><span style=\"font-weight: bold; \">360 Degree and Peer Reviews </span></li></ul>\r\nPerformance and talent management tool can help ensure the process goes smoothly by providing structured and anonymous assessments. In some cases, there might be more than a few people involved in the performance review of one employee, so the software can track the progress of feedback to ensure each manager or leader has provided necessary input in a timely manner.\r\n<ul><li><span style=\"font-weight: bold; \">Customizable Review and Assessment Scripts </span></li></ul>\r\nIt is best practice to base performance on the unique values and goals of your organization, which means the annual review script should be different for a manager than it is for an executive, and nothing like the script of another organization. \r\n<ul><li><span style=\"font-weight: bold; \">Goal and Performance Tracking </span></li></ul>\r\nContinuous performance and goal tracking allows leadership to see the progress of projects clearly while keeping in mind which employees are hitting the mark and which need guidance. And because automated performance management system available to the employee as well, everyone will be on the same page and aligned to the work being done, even between departments in real-time.\r\n<ul><li><span style=\"font-weight: bold; \">Development &amp; Succession Planning </span></li></ul>\r\nEmployees need continuous support in order to become effective contributors to the organization, especially in the long run. With performance management tools, you can track development progress, assign long term goals and ensure you understand the direction of talent and the business as a whole.\r\n\r\n","iconURL":"https://old.roi4cio.com/fileadmin/user_upload/icon_Performance_Management_Software.png"}],"characteristics":[],"concurentProducts":[],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":[],"materials":[],"useCases":[],"best_practices":[],"values":[],"implementations":[]}],"jobRoles":[],"organizationalFeatures":[],"complementaryCategories":[],"solutions":["High costs of routine operations","No automated business processes"],"materials":[],"useCases":[],"best_practices":[],"values":["Reduce Costs","Enhance Staff Productivity","Ensure Security and Business Continuity"],"implementations":[{"id":159,"title":"MICROSOFT SYSTEM CENTER CONFIGURATION MANAGER (SCCM) for Russian Railways","url":"https://old.roi4cio.com/vnedrenija/vnedrenie/microsoft-system-center-configuration-manager-sccm-for-russian-railways/"},{"id":905,"title":"Microsoft System Center 2012 Configuration Manager for bank","url":"https://old.roi4cio.com/vnedrenija/vnedrenie/microsoft-system-center-2012-configuration-manager-for-bank/"},{"id":921,"title":"Windows Server 2008 R2, MS SQL Server 2008 R2, Microsoft System Center 2012 for Smart-Holding","url":"https://old.roi4cio.com/vnedrenija/vnedrenie/windows-server-2008-r2-ms-sql-server-2008-r2-microsoft-system-center-2012-for-smart-holding/"},{"id":1074,"title":"Microsoft System Center 2012, Microsoft Exchange Server and Microsoft Lync Server for a large Ukrainian agricultural holding","url":"https://old.roi4cio.com/vnedrenija/vnedrenie/microsoft-system-center-2012-microsoft-exchange-server-and-microsoft-lync-server-for-a-large-ukrainian-agricultural-holding/"},{"id":1075,"title":"Microsoft Exchange, Microsoft Sharepoint, Microsoft SCMM for University","url":"https://old.roi4cio.com/vnedrenija/vnedrenie/microsoft-exchange-microsoft-sharepoint-microsoft-scmm-for-university/"}],"presenterCodeLng":"","productImplementations":[{"id":159,"title":"MICROSOFT SYSTEM CENTER CONFIGURATION MANAGER (SCCM) for Russian Railways","description":"Description is not ready yet","alias":"microsoft-system-center-configuration-manager-sccm-for-russian-railways","roi":0,"seo":{"title":"MICROSOFT SYSTEM CENTER CONFIGURATION MANAGER (SCCM) for Russian Railways","keywords":"","description":"Description is not ready yet","og:title":"MICROSOFT SYSTEM CENTER CONFIGURATION MANAGER (SCCM) for Russian Railways","og:description":"Description is not ready yet"},"deal_info":"","user":{},"supplier":{},"vendors":[{"id":163,"title":"Microsoft","logoURL":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png","alias":"microsoft","address":"Microsoft","roles":[],"description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software products are the Microsoft Windows line of operating systems, Microsoft Office office suite, and Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface tablet lineup. As of 2011, it was the world's largest software maker by revenue, and one of the world's most valuable companies.","companyTypes":[],"products":{},"vendoredProductsCount":39,"suppliedProductsCount":39,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":0,"vendorImplementationsCount":66,"vendorPartnersCount":0,"supplierPartnersCount":272,"b4r":0,"categories":{},"companyUrl":"www.microsoft.com","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Microsoft","keywords":"Microsoft, software, world, products, hardware, Xbox, video, game","description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:title":"Microsoft","og:description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:image":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png"},"eventUrl":""}],"products":[],"countries":[],"startDate":"0000-00-00","endDate":"0000-00-00","dealDate":"0000-00-00","price":0,"status":"finished","isImplementation":true,"isAgreement":false,"confirmed":1,"implementationDetails":{},"categories":[],"additionalInfo":{"budgetNotExceeded":"","functionallyTaskAssignment":"","projectWasPut":"","price":0,"source":{"url":"http://digdes.ru/project/1464","title":"-"}},"comments":[],"referencesCount":0},{"id":905,"title":"Microsoft System Center 2012 Configuration Manager for bank","description":"Description is not ready yet","alias":"microsoft-system-center-2012-configuration-manager-for-bank","roi":0,"seo":{"title":"Microsoft System Center 2012 Configuration Manager for bank","keywords":"","description":"Description is not ready yet","og:title":"Microsoft System Center 2012 Configuration Manager for bank","og:description":"Description is not ready yet"},"deal_info":"","user":{"id":1187,"title":"Sberbank of Russia","logoURL":"https://old.roi4cio.com/uploads/roi/company/Sberbank_01.png","alias":"sberbank-rossii","address":"","roles":[],"description":"The history of the Subsidiary Bank of Sberbank of Russia Joint Stock Company in Kazakhstan begins at the end of 2006, when Sberbank of Russia, the flagship of the Russian financial system, the largest financial institution in Central and Eastern Europe, acquires 99.99% of TexakBank, recognized as the bank with the best level of customer service according to the National Business magazine.\r\nIn 2007, the Bank obtained a license to conduct banking and other operations carried out by banks in national and foreign currencies. In the same year, the Bank’s authorized capital was increased almost 15 times and amounted to 29 billion tenges (more than $ 240 million), which allowed SB Sberbank JSC to become one of the 10 largest banks in the Republic of Kazakhstan in terms of authorized capital. SB Sberbank JSC has extensive connections with the largest banks in the world, as well as vast experience working with clients and partners engaged in various areas of the economy.\r\nTo date, SB Sberbank JSC has a branch network consisting of 91 structural units, 16 of which are branches.\r\nThe central office of the Bank is located in Almaty.\r\nThe main shareholder of SB Sberbank JSC is Sberbank PJSC.","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":0,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":3,"supplierImplementationsCount":0,"vendorImplementationsCount":0,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"https://www.sberbank.kz/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Sberbank of Russia","keywords":"Sberbank, Russia, financial, when, institution, largest, flagship, system","description":"The history of the Subsidiary Bank of Sberbank of Russia Joint Stock Company in Kazakhstan begins at the end of 2006, when Sberbank of Russia, the flagship of the Russian financial system, the largest financial institution in Central and Eastern Europe, acquir","og:title":"Sberbank of Russia","og:description":"The history of the Subsidiary Bank of Sberbank of Russia Joint Stock Company in Kazakhstan begins at the end of 2006, when Sberbank of Russia, the flagship of the Russian financial system, the largest financial institution in Central and Eastern Europe, acquir","og:image":"https://old.roi4cio.com/uploads/roi/company/Sberbank_01.png"},"eventUrl":""},"supplier":{"id":246,"title":"SI BIS","logoURL":"https://old.roi4cio.com/uploads/roi/company/sibis-logo.png","alias":"si-bis","address":"г. Киев, 04073, ул. Рылеева, 10-А +38 (044) 499-12-12","roles":[],"description":"SI BIS Company specializes in implementing complex projects for the creation of modern communications infrastructure, based on the principles of integration of IT and business solutions. The company was founded in 2003 and has more than 12 years a reliable IT partner for more than 400 Ukrainian companies.\r\n\r\nSI BIS has a high competence in the promotion of integrated IBM solutions, Cisco and the Microsoft, is a recognized leader in the provision of services and technical support, implementing complex consulting projects and provides a wide range of services to optimize the information and business processes for organizations.\r\n\r\nUsing industry experience and global best practices, deep technological expertise, a balanced portfolio of solutions and predictive model of service and technical support, the company SI BIS helps customers to simplify and rationalize the management of their business.","companyTypes":[],"products":{},"vendoredProductsCount":6,"suppliedProductsCount":203,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":42,"vendorImplementationsCount":16,"vendorPartnersCount":9,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://sibis.com.ua/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"SI BIS","keywords":"solutions, business, technical, services, support, than, more, company","description":"SI BIS Company specializes in implementing complex projects for the creation of modern communications infrastructure, based on the principles of integration of IT and business solutions. The company was founded in 2003 and has more than 12 years a reliable IT ","og:title":"SI BIS","og:description":"SI BIS Company specializes in implementing complex projects for the creation of modern communications infrastructure, based on the principles of integration of IT and business solutions. The company was founded in 2003 and has more than 12 years a reliable IT ","og:image":"https://old.roi4cio.com/uploads/roi/company/sibis-logo.png"},"eventUrl":""},"vendors":[{"id":163,"title":"Microsoft","logoURL":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png","alias":"microsoft","address":"Microsoft","roles":[],"description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software products are the Microsoft Windows line of operating systems, Microsoft Office office suite, and Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface tablet lineup. As of 2011, it was the world's largest software maker by revenue, and one of the world's most valuable companies.","companyTypes":[],"products":{},"vendoredProductsCount":39,"suppliedProductsCount":39,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":0,"vendorImplementationsCount":66,"vendorPartnersCount":0,"supplierPartnersCount":272,"b4r":0,"categories":{},"companyUrl":"www.microsoft.com","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Microsoft","keywords":"Microsoft, software, world, products, hardware, Xbox, video, game","description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:title":"Microsoft","og:description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:image":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png"},"eventUrl":""}],"products":[],"countries":[],"startDate":"0000-00-00","endDate":"0000-00-00","dealDate":"0000-00-00","price":0,"status":"finished","isImplementation":true,"isAgreement":false,"confirmed":1,"implementationDetails":{},"categories":[],"additionalInfo":{"budgetNotExceeded":"-1","functionallyTaskAssignment":"-1","projectWasPut":"-1","price":0,"source":{"url":"https://www.sibis.com.ua/project/vprovadzhennya-sistemi-upravlinnya-konfiguratsiyami/","title":"-"}},"comments":[],"referencesCount":0},{"id":921,"title":"Windows Server 2008 R2, MS SQL Server 2008 R2, Microsoft System Center 2012 for Smart-Holding","description":"Description is not ready yet","alias":"windows-server-2008-r2-ms-sql-server-2008-r2-microsoft-system-center-2012-for-smart-holding","roi":0,"seo":{"title":"Windows Server 2008 R2, MS SQL Server 2008 R2, Microsoft System Center 2012 for Smart-Holding","keywords":"","description":"Description is not ready yet","og:title":"Windows Server 2008 R2, MS SQL Server 2008 R2, Microsoft System Center 2012 for Smart-Holding","og:description":"Description is not ready yet"},"deal_info":"","user":{"id":553,"title":"Smart-Holding","logoURL":"https://old.roi4cio.com/uploads/roi/company/smart-kholding.jpg","alias":"smart-kholding","address":"","roles":[],"description":"Smart-Holding is one of the largest production and investment groups in Ukraine, comprised of companies that share common strategic goals and business principles. Smart-Holding focuses on the industries that are the key sectors of the country’s economy. Smart-Holding invests in enterprises in such areas as metals and mining, oil and gas, banking, agriculture, retail, shipbuilding and real estate. Smart-Holding also participates in other projects as a portfolio investor. \r\nSmart-Holding’s strategy aims to deliver the effective management of a diversified portfolio of investments, ensuring long term growth in its value. Smart-Holding’s enterprises are continuously looking for new business lines that could become development drivers both for the enterprises and the economy of Ukraine. ","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":0,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":3,"supplierImplementationsCount":0,"vendorImplementationsCount":0,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://www.smart-holding.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Smart-Holding","keywords":"Smart-Holding, that, enterprises, economy, business, Smart-Holding’s, Ukraine, portfolio","description":"Smart-Holding is one of the largest production and investment groups in Ukraine, comprised of companies that share common strategic goals and business principles. Smart-Holding focuses on the industries that are the key sectors of the country’s economy. Smart-","og:title":"Smart-Holding","og:description":"Smart-Holding is one of the largest production and investment groups in Ukraine, comprised of companies that share common strategic goals and business principles. Smart-Holding focuses on the industries that are the key sectors of the country’s economy. Smart-","og:image":"https://old.roi4cio.com/uploads/roi/company/smart-kholding.jpg"},"eventUrl":""},"supplier":{"id":246,"title":"SI BIS","logoURL":"https://old.roi4cio.com/uploads/roi/company/sibis-logo.png","alias":"si-bis","address":"г. Киев, 04073, ул. Рылеева, 10-А +38 (044) 499-12-12","roles":[],"description":"SI BIS Company specializes in implementing complex projects for the creation of modern communications infrastructure, based on the principles of integration of IT and business solutions. The company was founded in 2003 and has more than 12 years a reliable IT partner for more than 400 Ukrainian companies.\r\n\r\nSI BIS has a high competence in the promotion of integrated IBM solutions, Cisco and the Microsoft, is a recognized leader in the provision of services and technical support, implementing complex consulting projects and provides a wide range of services to optimize the information and business processes for organizations.\r\n\r\nUsing industry experience and global best practices, deep technological expertise, a balanced portfolio of solutions and predictive model of service and technical support, the company SI BIS helps customers to simplify and rationalize the management of their business.","companyTypes":[],"products":{},"vendoredProductsCount":6,"suppliedProductsCount":203,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":42,"vendorImplementationsCount":16,"vendorPartnersCount":9,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://sibis.com.ua/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"SI BIS","keywords":"solutions, business, technical, services, support, than, more, company","description":"SI BIS Company specializes in implementing complex projects for the creation of modern communications infrastructure, based on the principles of integration of IT and business solutions. The company was founded in 2003 and has more than 12 years a reliable IT ","og:title":"SI BIS","og:description":"SI BIS Company specializes in implementing complex projects for the creation of modern communications infrastructure, based on the principles of integration of IT and business solutions. The company was founded in 2003 and has more than 12 years a reliable IT ","og:image":"https://old.roi4cio.com/uploads/roi/company/sibis-logo.png"},"eventUrl":""},"vendors":[{"id":163,"title":"Microsoft","logoURL":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png","alias":"microsoft","address":"Microsoft","roles":[],"description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software products are the Microsoft Windows line of operating systems, Microsoft Office office suite, and Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface tablet lineup. As of 2011, it was the world's largest software maker by revenue, and one of the world's most valuable companies.","companyTypes":[],"products":{},"vendoredProductsCount":39,"suppliedProductsCount":39,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":0,"vendorImplementationsCount":66,"vendorPartnersCount":0,"supplierPartnersCount":272,"b4r":0,"categories":{},"companyUrl":"www.microsoft.com","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Microsoft","keywords":"Microsoft, software, world, products, hardware, Xbox, video, game","description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:title":"Microsoft","og:description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:image":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png"},"eventUrl":""}],"products":[],"countries":[],"startDate":"0000-00-00","endDate":"0000-00-00","dealDate":"0000-00-00","price":0,"status":"finished","isImplementation":true,"isAgreement":false,"confirmed":1,"implementationDetails":{},"categories":[],"additionalInfo":{"budgetNotExceeded":"-1","functionallyTaskAssignment":"-1","projectWasPut":"-1","price":0,"source":{"url":"https://www.sibis.com.ua/project/vnedrenie-microsoft-private-cloud/","title":"-"}},"comments":[],"referencesCount":0},{"id":1074,"title":"Microsoft System Center 2012, Microsoft Exchange Server and Microsoft Lync Server for a large Ukrainian agricultural holding","description":"<span style=\"font-style: italic;\">Description is not ready yet</span>","alias":"microsoft-system-center-2012-microsoft-exchange-server-and-microsoft-lync-server-for-a-large-ukrainian-agricultural-holding","roi":0,"seo":{"title":"Microsoft System Center 2012, Microsoft Exchange Server and Microsoft Lync Server for a large Ukrainian agricultural holding","keywords":"","description":"<span style=\"font-style: italic;\">Description is not ready yet</span>","og:title":"Microsoft System Center 2012, Microsoft Exchange Server and Microsoft Lync Server for a large Ukrainian agricultural holding","og:description":"<span style=\"font-style: italic;\">Description is not ready yet</span>"},"deal_info":"","user":{"id":554,"title":"HarvEast Holding","logoURL":"https://old.roi4cio.com/uploads/roi/company/HarvEast_Holding_01.png","alias":"harveast-holding","address":"","roles":[],"description":"HarvEast - Ukrainian company, which manages agricultural assets in the Kyiv, Zhytomyr, Donetsk region.\r\nLand bank - 123 thousand hectares.\r\nEstablished on 10 March 2011, the Holding took control over the agricultural assets of Ilyich Steel Plant.\r\nThe holding is actively introducing irrigation systems, developing a seed line - since 2017, it has been cooperating with world seed producers, and in 2018 launched its own seed line.\r\nHarvEast farms produce premium quality milk.\r\nHarvEast mission is to lead in agricultural production in Ukraine through experience and innovation, working as a team and being guided by the principles of transparency and responsibility towards employees and society.","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":0,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":1,"supplierImplementationsCount":0,"vendorImplementationsCount":0,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://harveast.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"HarvEast Holding","keywords":"Holding, business, main, lines, Company, wheat, sunflower, growing","description":"HarvEast - Ukrainian company, which manages agricultural assets in the Kyiv, Zhytomyr, Donetsk region.\r\nLand bank - 123 thousand hectares.\r\nEstablished on 10 March 2011, the Holding took control over the agricultural assets of Ilyich Steel Plant.\r\nThe holding ","og:title":"HarvEast Holding","og:description":"HarvEast - Ukrainian company, which manages agricultural assets in the Kyiv, Zhytomyr, Donetsk region.\r\nLand bank - 123 thousand hectares.\r\nEstablished on 10 March 2011, the Holding took control over the agricultural assets of Ilyich Steel Plant.\r\nThe holding ","og:image":"https://old.roi4cio.com/uploads/roi/company/HarvEast_Holding_01.png"},"eventUrl":""},"supplier":{"id":6447,"title":"AM Integrator (AMI)","logoURL":"https://old.roi4cio.com/uploads/roi/company/am_integrator.png","alias":"am-integrator","address":"Illinska St., 14/6 Kiev, 04070 Ukraine","roles":[],"description":"AM INTEGRATOR Group of Companies is one of the leading IT operators in Ukraine, being a supplier and integrator of a wide range of solutions in the field of modern IT infrastructure, multimedia solutions, engineering infrastructure, business applications and integrated business security systems for medium and large enterprises, as well as the public sector. AM Integrator helps companies:\r\n<ul><li>increase risk manageability and business productivity;</li></ul>\r\n<ul><li>reduce costs;</li></ul>\r\n<ul><li>protect data.</li></ul>\r\nAM Integrator offers intelligent and flexible solutions, including cloud services, that will help you strategically transform your business using technologies and platforms of industry leaders.<br />The company offers solutions for increasing productivity, effective collaboration, mobility and relationship management, identity-driven, advanced analytics, or the Internet of things. AM Integrator also helps with core infrastructure, from support to creating disaster recovery solutions. The team of company experts has been working with cloud technologies for more than 5 years, with virtual environments - more than 10 years.","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":116,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":21,"vendorImplementationsCount":0,"vendorPartnersCount":8,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://www.amintegrator.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"AM Integrator (AMI)","keywords":"","description":"AM INTEGRATOR Group of Companies is one of the leading IT operators in Ukraine, being a supplier and integrator of a wide range of solutions in the field of modern IT infrastructure, multimedia solutions, engineering infrastructure, business applications and i","og:title":"AM Integrator (AMI)","og:description":"AM INTEGRATOR Group of Companies is one of the leading IT operators in Ukraine, being a supplier and integrator of a wide range of solutions in the field of modern IT infrastructure, multimedia solutions, engineering infrastructure, business applications and i","og:image":"https://old.roi4cio.com/uploads/roi/company/am_integrator.png"},"eventUrl":""},"vendors":[{"id":163,"title":"Microsoft","logoURL":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png","alias":"microsoft","address":"Microsoft","roles":[],"description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software products are the Microsoft Windows line of operating systems, Microsoft Office office suite, and Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface tablet lineup. As of 2011, it was the world's largest software maker by revenue, and one of the world's most valuable companies.","companyTypes":[],"products":{},"vendoredProductsCount":39,"suppliedProductsCount":39,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":0,"vendorImplementationsCount":66,"vendorPartnersCount":0,"supplierPartnersCount":272,"b4r":0,"categories":{},"companyUrl":"www.microsoft.com","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Microsoft","keywords":"Microsoft, software, world, products, hardware, Xbox, video, game","description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:title":"Microsoft","og:description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:image":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png"},"eventUrl":""}],"products":[],"countries":[],"startDate":"0000-00-00","endDate":"0000-00-00","dealDate":"0000-00-00","price":0,"status":"finished","isImplementation":true,"isAgreement":false,"confirmed":1,"implementationDetails":{},"categories":[],"additionalInfo":{"budgetNotExceeded":"-1","functionallyTaskAssignment":"-1","projectWasPut":"-1","price":0,"source":{"url":"https://ko.com.ua/ami_sozdala_infrastrukturnuyu_platformu_cod_dlya_harvist_jessets_72480","title":"-"}},"comments":[],"referencesCount":0},{"id":1075,"title":"Microsoft Exchange, Microsoft Sharepoint, Microsoft SCMM for University","description":"<span style=\"font-style: italic;\">Description is not ready yet</span>","alias":"microsoft-exchange-microsoft-sharepoint-microsoft-scmm-for-university","roi":0,"seo":{"title":"Microsoft Exchange, Microsoft Sharepoint, Microsoft SCMM for University","keywords":"","description":"<span style=\"font-style: italic;\">Description is not ready yet</span>","og:title":"Microsoft Exchange, Microsoft Sharepoint, Microsoft SCMM for University","og:description":"<span style=\"font-style: italic;\">Description is not ready yet</span>"},"deal_info":"","user":{"id":7887,"title":"Lugansk State Medical University","logoURL":"https://old.roi4cio.com/uploads/roi/company/LGMU.jpg","alias":"luganskii-gosudarstvennyi-medicinskii-universitet","address":"","roles":[],"description":" Lugansk State Medical University is a higher educational institution of Lugansk.<br />It was founded in 1956. Received university status in 1994. Initially, there was a medical faculty. In 1983, the faculties of foreign students and the pediatric were opened. In 1998, the pharmaceutical and dental faculties were opened. There is also a faculty of postgraduate students. In 2014, in connection with the war in the Donbass, the university was officially evacuated to Rubezhnoye. However, most of the students and teachers of the university remained in Lugansk, where they continue their studies and work at the St. Luke Lugansk State Medical University.<br />The university is actively involved in international activities. Students from the Middle East (Iran, Iraq), Africa (Ghana, Nigeria, Egypt, Libya, Morocco) and Southeast Asia (India, Malaysia, Singapore) are studying. The university trains doctors of various specialties, pharmacists. The university has three educational buildings, a pharmacy studio, a dental clinic, a stadium, as well as a number of departments and clinics in the medical institutions of the city. Also at the university there is a &quot;House of Books.&quot;","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":0,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":1,"supplierImplementationsCount":0,"vendorImplementationsCount":0,"vendorPartnersCount":0,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://lgmu.ru/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Lugansk State Medical University","keywords":"","description":" Lugansk State Medical University is a higher educational institution of Lugansk.<br />It was founded in 1956. Received university status in 1994. Initially, there was a medical faculty. In 1983, the faculties of foreign students and the pediatric were opened.","og:title":"Lugansk State Medical University","og:description":" Lugansk State Medical University is a higher educational institution of Lugansk.<br />It was founded in 1956. Received university status in 1994. Initially, there was a medical faculty. In 1983, the faculties of foreign students and the pediatric were opened.","og:image":"https://old.roi4cio.com/uploads/roi/company/LGMU.jpg"},"eventUrl":""},"supplier":{"id":6447,"title":"AM Integrator (AMI)","logoURL":"https://old.roi4cio.com/uploads/roi/company/am_integrator.png","alias":"am-integrator","address":"Illinska St., 14/6 Kiev, 04070 Ukraine","roles":[],"description":"AM INTEGRATOR Group of Companies is one of the leading IT operators in Ukraine, being a supplier and integrator of a wide range of solutions in the field of modern IT infrastructure, multimedia solutions, engineering infrastructure, business applications and integrated business security systems for medium and large enterprises, as well as the public sector. AM Integrator helps companies:\r\n<ul><li>increase risk manageability and business productivity;</li></ul>\r\n<ul><li>reduce costs;</li></ul>\r\n<ul><li>protect data.</li></ul>\r\nAM Integrator offers intelligent and flexible solutions, including cloud services, that will help you strategically transform your business using technologies and platforms of industry leaders.<br />The company offers solutions for increasing productivity, effective collaboration, mobility and relationship management, identity-driven, advanced analytics, or the Internet of things. AM Integrator also helps with core infrastructure, from support to creating disaster recovery solutions. The team of company experts has been working with cloud technologies for more than 5 years, with virtual environments - more than 10 years.","companyTypes":[],"products":{},"vendoredProductsCount":0,"suppliedProductsCount":116,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":21,"vendorImplementationsCount":0,"vendorPartnersCount":8,"supplierPartnersCount":0,"b4r":0,"categories":{},"companyUrl":"http://www.amintegrator.com/","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"AM Integrator (AMI)","keywords":"","description":"AM INTEGRATOR Group of Companies is one of the leading IT operators in Ukraine, being a supplier and integrator of a wide range of solutions in the field of modern IT infrastructure, multimedia solutions, engineering infrastructure, business applications and i","og:title":"AM Integrator (AMI)","og:description":"AM INTEGRATOR Group of Companies is one of the leading IT operators in Ukraine, being a supplier and integrator of a wide range of solutions in the field of modern IT infrastructure, multimedia solutions, engineering infrastructure, business applications and i","og:image":"https://old.roi4cio.com/uploads/roi/company/am_integrator.png"},"eventUrl":""},"vendors":[{"id":163,"title":"Microsoft","logoURL":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png","alias":"microsoft","address":"Microsoft","roles":[],"description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software products are the Microsoft Windows line of operating systems, Microsoft Office office suite, and Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface tablet lineup. As of 2011, it was the world's largest software maker by revenue, and one of the world's most valuable companies.","companyTypes":[],"products":{},"vendoredProductsCount":39,"suppliedProductsCount":39,"supplierImplementations":[],"vendorImplementations":[],"userImplementations":[],"userImplementationsCount":0,"supplierImplementationsCount":0,"vendorImplementationsCount":66,"vendorPartnersCount":0,"supplierPartnersCount":272,"b4r":0,"categories":{},"companyUrl":"www.microsoft.com","countryCodes":[],"certifications":[],"isSeller":false,"isSupplier":false,"isVendor":false,"presenterCodeLng":"","seo":{"title":"Microsoft","keywords":"Microsoft, software, world, products, hardware, Xbox, video, game","description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:title":"Microsoft","og:description":"Microsoft Corporation is an multinational technology company headquartered in Redmond, Washington, that develops, manufactures, licenses, supports and sells computer software, consumer electronics and personal computers and services. Its best known software pr","og:image":"https://old.roi4cio.com/uploads/roi/company/ms_dshchpshch.png"},"eventUrl":""}],"products":[],"countries":[],"startDate":"0000-00-00","endDate":"0000-00-00","dealDate":"0000-00-00","price":0,"status":"finished","isImplementation":true,"isAgreement":false,"confirmed":1,"implementationDetails":{},"categories":[],"additionalInfo":{"budgetNotExceeded":"-1","functionallyTaskAssignment":"-1","projectWasPut":"-1","price":0,"source":{"url":"https://www.pcweek.ua/themes/detail.php?ID=142523&THEME_ID=13882","title":"-"}},"comments":[],"referencesCount":0}]}},"aliases":{},"links":{},"meta":{},"loading":false,"error":null,"useProductLoading":false,"sellProductLoading":false,"templatesById":{},"comparisonByTemplateId":{}},"filters":{"filterCriterias":{"loading":false,"error":null,"data":{"price":{"min":0,"max":6000},"users":{"loading":false,"error":null,"ids":[],"values":{}},"suppliers":{"loading":false,"error":null,"ids":[],"values":{}},"vendors":{"loading":false,"error":null,"ids":[],"values":{}},"roles":{"id":200,"title":"Roles","values":{"1":{"id":1,"title":"User","translationKey":"user"},"2":{"id":2,"title":"Supplier","translationKey":"supplier"},"3":{"id":3,"title":"Vendor","translationKey":"vendor"}}},"categories":{"flat":[],"tree":[]},"countries":{"loading":false,"error":null,"ids":[],"values":{}}}},"showAIFilter":false},"companies":{"companiesByAlias":{},"aliases":{},"links":{},"meta":{},"loading":false,"error":null},"implementations":{"implementationsByAlias":{},"aliases":{},"links":{},"meta":{},"loading":false,"error":null},"agreements":{"agreementById":{},"ids":{},"links":{},"meta":{},"loading":false,"error":null},"comparison":{"loading":false,"error":false,"templatesById":{},"comparisonByTemplateId":{},"products":[],"selectedTemplateId":null},"presentation":{"type":null,"company":{},"products":[],"partners":[],"formData":{},"dataLoading":false,"dataError":false,"loading":false,"error":false},"catalogsGlobal":{"subMenuItemTitle":""}}