[vc_row css_animation="" row_type="row" use_row_as_full_screen_section="no" type="grid" angled_section="no" text_align="left" background_image_as_pattern="without_pattern" background_color="#ffffff" padding_top="75" padding_bottom="75" z_index=""][vc_column][vc_column_text]
<h1 style="text-align: center;">Virtual Security Operations Center (VSOC)</h1>
[/vc_column_text][vc_empty_space height="30px"][vc_column_text]
<h3 style="text-align: center;">Comtech’s VSOC automates the functions of traditional Security Operations Centers</h3>
[/vc_column_text][vc_empty_space height="50px"][vc_column_text]
<h2>Customer Challenges</h2>
[/vc_column_text][vc_empty_space][vc_row_inner row_type="row" type="full_width" text_align="left" css_animation=""][vc_column_inner width="1/2"][vc_column_text]<span class="Apple-converted-space"> </span>Maintaining a secure Enterprise IT Infrastructure is one the most important and complex challenges facing Federal Agencies today.<span class="Apple-converted-space">  </span>With the proliferation of Internet-based attacks, viruses, worms, botnets and other emerging threats, an Agency’s Enterprise Security architecture becomes more complicated as various layers of defense are implemented.<span class="Apple-converted-space">  </span>Often, a “defense in depth” approach is used, utilizing the best-of-breed vendors and various technologies to counteract the threats.<span class="Apple-converted-space">  </span>Typically the alerts and logs from these various security devices are directed to a centralized Security Operations Center (SOC).[/vc_column_text][/vc_column_inner][vc_column_inner width="1/2"][vc_column_text]<span class="Apple-converted-space"> </span>The SOC engineers sift through the voluminous data and make determinations on whether ongoing network activity constitutes an actual security incident or event, and take action accordingly.<span class="Apple-converted-space">  </span>It can be difficult to achieve a high degree of accuracy in identifying threats to protect the network without incurring unnecessary denial of service.<span class="Apple-converted-space">  </span>Collecting and processing the information from all of the various security devices is another challenge, security engineers need a system that integrates all of the various security devices to form a unified approach towards enterprise security management.[/vc_column_text][/vc_column_inner][/vc_row_inner][/vc_column][/vc_row][vc_row css_animation="" row_type="row" use_row_as_full_screen_section="no" type="grid" angled_section="no" text_align="left" background_image_as_pattern="without_pattern" background_color="#f7f8fa" padding_top="75" padding_bottom="75" z_index=""][vc_column][vc_column_text]
<h2>Comtech's Solution</h2>
[/vc_column_text][vc_empty_space][vc_column_text]<span class="Apple-converted-space"> </span>Comtech, working with one our Government customers, developed the VSOC system to collect data from<span class="Apple-converted-space">  </span>the various security devices, normalize and correlate the data, and perform analysis based on various factors<span class="Apple-converted-space">  </span>to determine whether a security event is actionable or not.<span class="Apple-converted-space">  </span>Optionally, the VSOC system can be configured to take automated action based on prescribed policies and/or or a set of rules defined by the system owner. The VSOC is a platform-agnostic, customizable, and highly-scalable system.<span class="Apple-converted-space"> </span>

The VSOC system provides enterprise security, situational awareness and operates in real time to identify and quarantine emerging network threats. The functionality and architecture can be integrated into any agency’s network security architecture within a short period of time.[/vc_column_text][vc_empty_space][/vc_column][/vc_row][vc_row css_animation="" row_type="row" use_row_as_full_screen_section="no" type="grid" angled_section="no" text_align="left" background_image_as_pattern="without_pattern" background_color="#ffffff" padding_top="75" padding_bottom="75" z_index=""][vc_column][vc_column_text]
<h2>System Description</h2>
[/vc_column_text][vc_empty_space][vc_row_inner row_type="row" type="full_width" text_align="left" css_animation=""][vc_column_inner width="1/2"][vc_column_text]<span class="Apple-converted-space"> </span>The VSOC is made up of four major subsystems: 1) Log Collector, 2) Log Database, 3) Log Analysis, and 4) Web Interface. By keeping these subsystems logically separate, the scalability of the system is limited only by the amount of hardware the customer is willing to allocate to each subsystem. All four subsystems can run on a single platform for small enterprises or can be distributed across multiple platforms for very large networks.<span class="Apple-converted-space"> </span>[/vc_column_text][vc_column_text]The figure below shows how the VSOC system works and where it fits in the overall enterprise security architecture. The Comtech VSOC solution is scalable and can work with any vendors’ security solution.<span class="Apple-converted-space">  </span>If the device can send a log, VSOC can be made to work with it.<span class="Apple-converted-space">  </span>In addition, it’s centralized management/distributed support paradigm makes the system ideally suited for delegating remediation efforts to the regional LAN administrators/support personnel who are most likely be in contact with the end-user or source of the event.[/vc_column_text][vc_empty_space][vc_column_text]In this sample diagram, a user has triggered an alert(s), generated by one or more of the security devices in the network.<span class="Apple-converted-space">  </span>The resulting log(s) is then forwarded from the security device(s) to the VSOC Log Collector. <span class="Apple-converted-space"> </span>

The Log Collector normalizes the data from various sources by extracting the common attributes of each log (e.g., Source IP address, Destination IP address, port numbers) as well as the application layer data contained in the log (e.g., those generated by intrusion detection/prevention systems and other application-aware security appliances) and enters them into the Log Database.

[/vc_column_text][/vc_column_inner][vc_column_inner width="1/2"][image_with_text title_tag="h2" image="16362" title="VSOC Data Flow" title_color="#ca171e"][/image_with_text][/vc_column_inner][/vc_row_inner][vc_empty_space][vc_row_inner row_type="row" type="full_width" text_align="left" css_animation=""][vc_column_inner width="1/2"][vc_column_text]The Log Analysis Engine uses a highly tunable algorithm to determine what normal and abnormal network activity is. When countermeasures are required, the Analysis Engine issues a command to the router(s) to block the IP address.<span class="Apple-converted-space">  </span>To prevent unnecessary denial of service, the VSOC has built-in safeguards to prevent a massive automated “block all” situation, which could theoretically occur during a rare case of multiple false alerts.<span class="Apple-converted-space">  </span>Conversely, when there is a known security threat outbreak (e.g., Code Red, Sasser, Nimda), these safeguards are disabled and the VSOC will block all events until the outbreak is contained.<span class="Apple-converted-space"> </span>

The Log Database is not only a<span class="Apple-converted-space">  </span>report repository; it is an integral part of the system that keeps track of the location of devices (i.e., which router to block on), the systems users, the owners of specific IP address ranges, and other data necessary to provide a comprehensive view of the security posture of the enterprise. The Log Database also provides powerful search and analysis capabilities to augment forensic analysis.

[/vc_column_text][/vc_column_inner][vc_column_inner width="1/2"][vc_column_text]Network and system administrators and security engineers interact with and control the VSOC system via the front-end Web Interface.<span class="Apple-converted-space">  </span>The front-end has access controls to manage user permissions, giving the administrator total control of who can access any feature or view of the system.<span class="Apple-converted-space">  </span>The interface system is flexible and fully customizable; granular access to specific functions of the Web Interface can be applied.

The Log Analysis Engine constantly keeps an open channel with the Log Database and correlates every log into an “event”.<span class="Apple-converted-space">  </span>Loosely defined, an event is a source IP address that the system is tracking to determine whether or not it breaks security policy.<span class="Apple-converted-space">  </span>If it does, the system will take the prescribed action (block, alert, etc.) based on the defined set of rules.<span class="Apple-converted-space">  </span>So, in contrast to a firewall which takes action based on layer-3/4 characteristics, or an Intrusion Detection System which takes action based on layer-5/6/7 application data and signatures, the VSOC system combines all of these and<span class="Apple-converted-space">  </span>takes action<span class="Apple-converted-space"> </span>[/vc_column_text][/vc_column_inner][/vc_row_inner][/vc_column][/vc_row][vc_row css_animation="" row_type="row" use_row_as_full_screen_section="no" type="grid" angled_section="no" text_align="left" background_image_as_pattern="without_pattern" background_color="#f7f8fa" padding_top="75" padding_bottom="75" z_index=""][vc_column][vc_column_text]
<h2>Technical support and Maintenance Services</h2>
[/vc_column_text][vc_empty_space][vc_row_inner row_type="row" type="full_width" text_align="left" css_animation=""][vc_column_inner width="1/2"][vc_column_text]Comtech offers engineering and support services to our customers during the entire lifecycle of the VSOC solution.<span class="Apple-converted-space">  </span>Because of its open architecture, implementing the VSOC requires configuration and integration into the overall network security architecture to fully interoperate with all of the various brands and models of networking and security devices.[/vc_column_text][/vc_column_inner][vc_column_inner width="1/2"][vc_column_text]The customer can choose on site technical support and maintenance personnel or remote maintenance for software updates and fixes, as well as telephone support and troubleshooting.<span class="Apple-converted-space">  </span>Comtech also offers a Client Customization Program to provide R&amp;D/Engineering support to develop solutions for emerging client-specific requirements. <span class="Apple-converted-space"> </span>[/vc_column_text][/vc_column_inner][/vc_row_inner][vc_empty_space][vc_column_text]
<h2>Summary</h2>
[/vc_column_text][vc_empty_space][vc_column_text]Comtech’s VSOC was developed to provide a centralized system that integrates all of the various vendors’ security devices to achieve a unified approach towards enterprise security management.<span class="Apple-converted-space">  </span>Many years of collective expertise have gone into its development and refinement.<span class="Apple-converted-space">  </span>The VSOC can be deployed in any Agency’s network in a short amount of time to better protect their systems and information.<span class="Apple-converted-space"> </span>[/vc_column_text][/vc_column][/vc_row][vc_row css_animation="" row_type="row" use_row_as_full_screen_section="no" type="grid" angled_section="no" text_align="left" background_image_as_pattern="without_pattern" background_color="#ffffff" padding_top="75" padding_bottom="75" z_index=""][vc_column][vc_column_text]
<h2>Benefits</h2>
[/vc_column_text][vc_empty_space][vc_column_text]The most valuable benefit/feature of the Comtech VSOC solution is the ability to completely tailor the system to the client’s network security requirements. The VSOC system reduces the number of staff required to manage, analyze and respond to security incidents within an Agency’s IT Infrastructure.<span class="Apple-converted-space">  </span>In some cases, the need for dedicated SOC staff is eliminated, resulting in appreciable cost savings.<span class="Apple-converted-space">  </span>Additionally, the accuracy and response time is improved significantly when network security enforcement is performed by the automated system, rather than by manual intervention.[/vc_column_text][/vc_column][/vc_row][vc_row css_animation="" row_type="row" use_row_as_full_screen_section="no" type="full_width" angled_section="no" text_align="left" background_image_as_pattern="without_pattern"][vc_column][vc_row_inner row_type="row" type="full_width" text_align="left" css_animation=""][vc_column_inner][vc_column_text]
<h4 style="text-align: center;">[wpdm_package id='17128']</h4>
[/vc_column_text][/vc_column_inner][/vc_row_inner][vc_column_text][/vc_column_text][vc_empty_space height="40px"][/vc_column][/vc_row]