Cyber Security Services
Visual Soft helps our clients understand how cloud computing models present new and different challenges as compared to traditional data centers.
As a key part of Visual Soft’s suite of Cyber Security services, Visual Soft performs:
cloud readiness
Visual Soft’s Security and Privacy Practice provides consulting services to Federal Agencies and Commercial Clients to improve FISMA Scorecards, Security Program Documentation and Enterprise Security Programs.
In addition, Visual Soft has observed the following trends:
a. Increased Vulnerability of Mobile Devices coinciding with an increase in Bring Your Own Device (BYOD) and now Wear Your Own Device (WYOD) policies as well. Visual Soft understands that the modern Government workforce expects these new policies to be enacted, but they must be reinforced with strong security practices.
b. Greater Focus on Industrial Control Systems Security (ICSS) – As control systems evolve with Internet of Things (IoT) technologies, there is an increased focus on the need to centrally monitor and control a wide variety of devices across the enterprise. These devices typically use the open Internet by default, even reaching back to the manufacturer for software updates and to publish usage metrics or license data. Historically, these devices would not operate inside the corporate intranet. Visual Soft understands that many of these devices act like tiny web servers and must be protected as such using VPNs, Firewalls, DMZs and other network security mechanisms and policies.
c. Increased Demand for Cyber Threat Intelligence – Timely information about current and future threats, including tactical, operational and strategic intelligence, is usually collected from dedicated Government agencies in concert with industry partners. Visual Soft depends on these dedicated partners to provide policy recommendations and tools to stay ahead of state actors as well as individuals. The table below lists many of the US, European and UK-based alliances and centers dedicated to sharing cyber threat data.
| Organization | URL |
| Financial Services Information Sharing and Analysis Center (FS-ISAC) | https://www.fsisac.com |
| National Defense Information Sharing & Analysis Center (ND-ISAC) | https://ndisac.org/ |
| National Cyber-Forensics & Training Alliance (NCFTA) | www.ncfta.net |
| Research and Education Networking Information Sharing and Analysis Center (REN-ISAC) | www.ren-isac.net |
| Operations Security Trust (Ops-T) | https://portal.ops-trust.net |
| Infoblox (CYBER INTELLIGENCE UNIT) | https://www.infoblox.com/cyber-intelligence-unit/ |
| European Network and Information Security Agency (ENISA) | https://www.enisa.europa.eu |
| Computer Emergency Response Team for the EU Institutions, Bodies, and Agencies (CERT-EU) | https://cert.europa.eu/cert/filteredition/en/CERT-LatestNews.html |
| Financial Services Information Exchange (FSIE) | http://itlaw.wikia.com/wiki/Financial_Services_Information_Exchange |
| National Crime Agency (NCA) | http://www.nationalcrimeagency.gov.uk |
| National Cyber Crime Unit (NCCU) | https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime |
| UK Computer Emergency Response Team (UKCERT) | https://www.ukcert.org.uk/ |
| Cyber Security Information Sharing Partnership (CISP) | https://www.ncsc.gov.uk/information/cyber-security-information-sharing-partnership–cisp- |
d. Increasing Sophistication and Frequency of Attacks – This has been the case for many years now, as state actors from Russia, North Korea and elsewhere use cyber-attacks for political and financial gains.
e. Information Security is about more than just compliance – The market has been flooded with tools and services to protect data in motion and at rest. Visual Soft understands the best way to construct an integrated solution that meets or exceeds Federal guidelines.
f. Increase in Hackivism – This form of civil disobedience is clearly on the rise, due in part to the hyper-political environments in much of the Western world today. These hackers are especially problematic due to their tendency to broadly share the private data and vulnerabilities that they access. This class of hacker attack can be seen in comparison to a ransomware attack. In ransomware attacks, the hacker typically encrypts an organization’s key data until a ransom is paid. The data itself is generally not exposed by the ransomware, and the hacker tends to target victims with older, unpatched intranets.
g. Managed Security Systems (MSS) are growing in popularity. This new area of outsourcing is especially popular with cloud-based implementations due to the commonality of monitoring tools and relative ease of access of the cloud systems. Visual Soft will partner with these third-party vendors whenever it makes sense from a financial and security perspective.
h. IoT revolution is creating a new set of attack vectors – A study from IoT industry leader Hewlett Packard (https://www8.hp.com/us/en/hp-news/press-release.html?id=1744676) found that as many as 70% of IoT devices contain one or more critical security flaws. The most frequently found flaws are:
Privacy Issues – Iot devices frequently collect, and then do not protect, consumer data such as name, email address, home address, date of birth, credit card credentials and health information.
Insufficient authorization – Most IoT devices do not require passwords of adequate complexity and length.
Lack of encryption of data in motion – Most IoT devices analyzed do not encrypt communications to the Internet, local network and the cloud. Transport encryption is crucial since these devices transmit sensitive data across these channels.
Insecure web interface – IoT devices often use extremely lightweight web servers. These devices have security issues such as persistent XSS, poor session management, weak default credentials and
credentials transmitted in clear text. These IoT vulnerabilities would enable a potential attacker to determine valid user accounts through account enumeration or the password reset feature.
Inadequate software protection – IoT devices tend not to use encryption when downloading software updates. This makes it possible for a malicious third party to intercepted an update and replace it with code that would leave the device with code that could threaten the rest of the enterprise.
Visual Soft believes that an aggressive approach to IoT security is a requirement for any organization contemplating this still-new technology.
Visual Soft believes that an aggressive approach to IoT security is a requirement for any organization contemplating this still-new technology.
The pervasiveness of Cloud-based Service Models – These models are used by service providers to characterize standard offerings that manage different aspects of an organization’s cloud resources. The most frequently seen service models are:
Infrastructure as a Service (IAAS) is a form of cloud computing that provides virtualized computing resources such as virtual computers and storage over the Internet. AWS, Google Cloud and Microsoft Azure are the best-known examples of IAAS service providers and have massive, worldwide data centers. Their low cost, massive scalability, high availability, and ease of use make this service model almost a standard approach for modern enterprises.
Visual Soft performs Virtualization architecture, design/implementation and Network Assessment and Planning, Design and Implementation, and Management/Monitoring. Details on Visual Soft Virtualization expertise can be found here: http://www.visualsoftinc.com/Solutions/Virtualization
Platform as a Service (PAAS) is a cloud computing model that delivers applications over the Internet. PAAS applications are usually tools and development environments that let organizations leave the task of configuration, maintenance, security, and scaling to the dedicated third party. The advantage of this model is the way that standard configurations can be designed and provided to enterprise users on demand. As a result, the enterprise development efforts are more standard and less expensive.
Software as a Service (SAAS) is a software distribution model in which applications are hosted by a vendor or service provider and made available to customers over a network, typically the Internet. The software remains in the service provider’s data center, with only API exposed to their clients. All major IAAS vendors have been moving into the SAAS model in recent years, since managed storage, databases, and enterprise software such as SAS, Microsoft Exchange, Salesforce.com, etc. can be expensive to maintain.
Storage as a Service is a business model in which a large company such as AWS or Microsoft rents space in their storage infrastructure to a smaller company or individual. The cost model for this offering is aligned to the expected “write once, read many” web paradigm, so it is usually very inexpensive to store data using these services.
Communications as a Service is a solution that offers services like Voice over IP (VoIP), instant messaging, collaboration and video conference applications using fixed and mobile devices (e.g., WebEx, Teams, Zoom, BlueJeans).
Visual Soft will recommend the use of one of more of these services to their clients in almost every situation, to the point that their omission from an architecture requires justification. From a cyber security perspective, these service models provide the templates, policies and processes that make organizations more secure than custom, on-premises solutions.