telegroup profile - infotech.org.rs · consulting designing of telecommunication, it & energy...

TELEGROUP PROFILE

Diana Gligorijević, direktor marketingaINFOTECH 201229.5.2012. Vrnjačka Banja

TELEGROUP OVERVIEW

1992 Telegroup LTD, UK1996 TeleGroup Banja Luka2001 TeleGroup Beograd 2007 TeleGroup Sofia

One of the leading Solution Providers in the ICT & Energy areas in Western Balkan territories;

Belgrade – HQ

Consulting Designing of telecommunication, IT & energy

networks and systems Creation & implementation of ICT Solutions Sales of ICT equipment (active & passive) Engineering of telecommunication, IT & energy

infrastructure Cloud Services Software engineering End – users System Management Project Management Technical Support 24x7 Trainings

OVERALL SERVICES

ICT PORTFOLIO

UNIFIED COMMUNICATIONS

IP PBX, Contact Centers, Unified Messaging, PresenceVoice and Video conferencing systemsCritical CommunicationsRecording solutionsTotal expense managementVoIP gateways and controllersVideo surveillance, Access Control, Fire protection and Intrusion preventionWireless broadband access network systems Radio - relay and Functional systemsEnterprise Mobility Solutions

IT SOLUTIONS

Network equipment and Server systemsNetwork and Data ProtectionData storage, preserving and archiving solutionsSoftware solutionsmPayment, mHealth, mTicketing

PASSIVE EQUIPMENT

Heat shrink & cold shrink joints and pipesSplitters, modules, surge arrestors for modules, holders & connectorsCable locatorsSelf supported cable and other telecommunication accessoriesRacks, patch panels, patch cords, adapters, modules, sockets ...

TECHNICAL SUPPORT SERVICES

Laboratory testing

Testing and analysis of work of existing installed systems

Installation of equipment and commissioning

Diagnostics of irregularities in the working of the equipment

Repair of devices

Maintenance during warranty and post-warranty period

Trainings for all systems included in TeleGroup business portfolio End users are provided with training for system use and maintenance

Partners are provided with training for system installation and maintenance

INTERVENTIONPROCEDURE

3 WAYS TO CONTACT TECHNICAL SUPPORT SERVICE

Call Center +381 11 3081999 e-mail: [email protected]://helpdesk.telegroup-ltd.com

Re

spo

nse

tim

eR

eco

very

tim

e

Head engineer

Intervention report & technical level of

a fault

Starting Intervention report

Service CenterOn – site

consulting and/orRemote support

On – site intervention

team

Recovery work in progress

System recovery Completing Intervention report

Technical Support Service center

Mutual work

Contact with responsible engineer

CLOUD SECURITY

WHAT IS CLOUD?

Today everybody talks about Cloud, but the fact is that everyone uses different although similar definition depending on their positions.

One of the definitions….„Cloud is computing area in which highly scalable IT capacities are provided to the external users as a service delivered over appropriatenetwork infrastrucure!“

ACTUAL TRENDS

Global statistics is that almost 40% IT services users have migrated to Cloud services!!!

WHAT LED TO CLOUD EXPANSION?

In introducing new IT solutions, most of the time we spent on defining the infrastructure (hardware and software)

Cloud services increases productivity and enables easy upgrade

Efficient delivery of IT Solutions

Accelerations of all inovations in this area

All solutions based on Cloud are much cheaper and more efficient

All this facts led to the SOA (Service Oriented Architecture) where Cloud computing separates

applications from the infrastructure

IT TRENDS AND SECURITY

Megatrends in IT: mobility

new mobile platforms

cloud computing

Megatrends impacting security highly sophisticated threats

growing use of mobile devices

new IT delivery models (SaaS)

Rapid growth in security investment and important changes in the Security Solution Market

Worldwide security spending will reach $63 billion in 2012(10% of total IT budgets)

CLIENT INQUIRIES IN CLOUD SECURITY

Clients are still looking for basic guidance for the security issues of enterprise use of cloud services. This client inquiry data can be used to align security professionals' priorities with those of their peers who are also evaluating cloud security measures


Clients’ strong interest in this area of security. This reflects the still-evolving state of both cloud computing and cloud security

Clients are currently more concerned about identifying and assessing cloud security risks than about evaluating specific cloud security solutions

The industry segments most concerned with cloud security are those that handle sensitive data and those that are subject to rigorous regulatory requirements.

Client inquiries suggest a disproportionate interest in cloud security in Europe and among small-and-midsize enterprises.


Top 10 Cloud Security Search Terms


Industry Type


Region


Enterprise size

CRITICAL SECURITY QUESTIONS TO ASK A CLOUD

SERVICE PROVIDER

Issues Cloud security standards will not mature before

2H12

Many cloud service providers do not provide transparency into their security practices

The global nature of cloud service providers complicates their compliance with local or national security regulations and requirements.

What to do? Ensure that regulatory, corporate, industry or other

applicable security standards apply to all cloud service providers

Use checklist of independent security organizations as a starting point until cloud security standards mature

Use a third-party vulnerability assessment firm to validate the responses to this checklist or any other questionnaire approach


SERVICE PROVIDER

Security must be a key criterion in any decision to use external cloud service providers when critical customer and business information is involved. A simple checklist is no substitute for a full standards-based security assessment, but will often be the only choice at this early stage of cloud service maturity.


SERVICE PROVIDER

Network Does the cloud service provider require the use of two-factor authentication for

the administrative control of servers, routers, switches and firewalls?

Does it support IPsec or Secure Sockets Layer with Extended Validation certificates and two-factor authentication for connecting to the service?

Does it provide redundancy and load balancing for firewalls, intrusion prevention, and other critical security elements?

Does it perform external penetration tests at least quarterly, and internal network security audits at least annually?

Can it show documented requirements (and audit procedures) for network security

Does it contract for, or provide protection against, denial-of-service attacks against its Internet presence?

CRITICAL SECURITY QUESTIONS TO ASK A

CLOUD SERVICE PROVIDER

Platform Can the cloud service provider present a documented policy

for "hardening" the underlying virtualized infrastructure that its services run on?

Can it provide validated procedures for configuration management, patch installation and malware prevention for all servers and PCs involved in cloud service delivery?

Does it have a documented set of controls that it uses to ensure the separation of data and security information among customer applications?



Applications and Data How does the cloud service provider

review the security of applications and any supporting code that it develops and uses?

Does it use content monitoring and filtering, or data loss prevention inappropriate for data flows?

Does it have documented procedures for configuration management, including the installation of security patches, for all applications?

If the cloud service involves data that is covered by regulatory or other compliance requirements then does the provider meet the applicable requirements for data protection?



Operations Does the cloud service provider perform background checks on personnel with

administrative or other privileged access to servers, applications or customer data?

Does the provider have super user privilege management and database activity monitoring controls or the equivalent to detect inappropriate behavior by provider employees with administrative access?

Can it show a documented process for evaluating security alerts from OS and application vendors, shielding systems from attack until patched, and installing security patches and service packs?

Does it employ security monitoring and log management functions, and use write-once technology or other secure approaches for storing audit trails and security logs?

Can it demonstrate established procedures for vulnerability management, intrusion prevention, incident response, and incident escalation and investigation?



End Services

Does the cloud service provider's security staff average more than four years' experience in information and network security?

Does more than 75% of its security staff have security industry certification. The cloud provider also should have vendor certification for the specific firewall equipment it will manage.

Can it show documented identity management and help desk procedures for authenticating callers and resetting access controls, as well as for establishing and deleting accounts



Recommendations

Enterprises' security organizations must be involved in the evaluation of prospective cloud service providers.

Security organizations should have an established set of security requirements or standards that can be used as evaluation criteria for cloud service security providers.

If a cloud service provider is already being used without enterprise security involvement, request visibility into any security audits that the provider has undergone.

THE GROWING ADOPTION OF CLOUD-BASED

SECURITY SERVICES

Cloud-based security services offer the promise of easy deployment and lower cost of ownership, but buyers must choose appropriate controls and weigh potential benefits against operational requirements.


SECURITY SERVICES

The suitability of various security controls for cloud-based delivery controls differs across controls based on the characteristics of those controls, including ability to customize and sensitivity to network latency and capacity

The successful adoption of cloud-based security depends on the suitability of controls to that style of delivery, but also on the ability to integrate with premises-based controls

Cloud-based security controls will play an increasingly important role in securing the use of cloud computing services


SECURITY SERVICES

Benefits and Customer expectations: Efficiency Effectiveness Flexibility Availability Scalability Customization Integration Location Visibility Control Expertise


SECURITY SERVICES

List of Security Controls

Secure Email Gateway

Secure Web Gateway (SWG)

Remote Vulnerability Assessment (VA)

Security Information and Event Management (SIEM)

Distributed Denial of Service (DDoS)

Identity as a Service

Application Security Testing

Website Protection

Cloud-Based Encryption Services

Cloud Access Security Brokers (CASBs)

ENTERPRISES MUST BALANCE OPPORTUNITY

AND RISK IN CLOUD AND MOBILE SECURITY

Cloud computing and mobile devices hold the potential to make enterprises more agile, more efficient and more competitive. They also introduce new security risks that must be addressed immediately!

Gartner analysts covering security, cloud computing and mobile devices have collaborated to develop a set of key predictions for 2012 and beyond. Chief information security officers (CISOs) and other enterprise decision makers should consider these forward-looking Strategic Planning Assumptions when allocating resources and selecting products and services!

CLOUD SECURITY AND RISK STANDARDS

The current lack of agreement on cloud risk standards ensures that cloud provider risk evaluation will remain an inexact and inconvenient process for the next several years.

It is easier to evaluate operational processes than technology quality, but both are equally relevant to cloud risk assessment.

The use of questionnaires continues to grow in significance as a mechanism for evaluating service provider risk, with most buyers developing them from in-house expertise.


Several standards for cloud practices have been published and can legitimately be considered as constituting today's understanding of "best practice.„

Four current initiatives show potential for meeting the needs for a cloud security standard. All are adapting and supplementing existing standards, such as ISO/IEC 27001/27002 and BS 25999, to create a written framework of control standards directly applicable to cloud service providers:

Cloud Security Alliance

The Shared Assessments Program

Common Assurance Maturity Model (CAMM)

FedRAMP


Certification Programs:

ISO/IEC 27001 certification

American Institute of Certified Public Accountants (AICPA)

In critical situations, providers must be required to document not just whether they meet the standard, but how they meet it. They must also allow annual audits for neutral verification. Vendors that refuse transparency should be avoided for mission-critical, corporate proprietary or regulated scenarios.

SECURITY TESTING OF CLOUD SERVICES

PROVIDERS IS A MUST

All kinds of cloud services (application, data, infrastructure, security) should be tested for the security of the Web interfaces and systems they use to provide services. Such testing, often performed by application security providers, will be critical for the security of cloud services.

Security testing helps enterprises ensure that the cloud services providers they entrust with their assets and processes are secure and compliant with established policies.

Security Testing of Cloud Services

Enterprises moving business-critical information and processes into the cloud must ensure that their cloud providers meet enterprises' security policies. This will be a somewhat painful issue for many enterprises, because business benefits (for example, lower cost and faster delivery) will often favor cloud solutions, while security concerns will stand as obstacles against achieving those benefits. However, enterprises should consider cloud business benefits and security risks, and make security an explicit clause in contractual agreements with cloud providers.


PROVIDERS IS A MUST

The following models of cloud security testing could be used:

The prospective enterprise client, the cloud provider and the third-party security testing provider negotiate a trilateral agreement. The cloud provider agrees to the third-party security testing provider's inspection, which results in a report being sent to the prospective enterprise client. Based on the report, the enterprise decides whether the cloud provider's security measures meet its requirements.

The cloud provider uses independent security testing and provides proof of such testing to its cloud services prospects and clients.

The cloud provider adopts application security testing technologies, grows its own skills and expertise, and conducts its own security testing.


PROVIDERS IS A MUST

The Benefits of Independent Testing of Cloud Services Providers:

Vendor independence

Vendor expertise

Cost savings

Security Testing Certification

Certification must meet enterprise or industry security standards. Certification should include a clause assuring that the cloud provider has been continually retested.


PROVIDERS IS A MUST

VENDORS IN SECURITY

SERVICES AND CLOUD SECURITY

Security as a Service product vendors

McAfee

Symantec

Trend Micro

Zscaler

Panda Software

Websense

HP

Barracuda

COOL VENDORS IN SECURITY

SERVICES AND CLOUD SECURITY

Enterprises and technology providers are increasingly looking to service- and cloud-based models to deliver more effective, more cost-efficient security practices. Chief information security officers (CISOs) and other security professionals should familiarize themselves with Gartner's 2012 Cool Vendors in service and cloud security, as well as the potential business benefits they offer.

Services and Cloud Security Vendors: Certes Networks FireHost OpenDNS Zettaset Dasient WhiteHat Security

CONCLUSION

Cloud computing is an efficient, scalable and effective way of delivering IT services today, but as an open system is subject to numerous of security problems

However, if you use a centralized identity, access policy and appropriate standards that can dramatically increase the level of security

CONCLUSION

Cloud computing is offered as a service and part of security issues are service provider's responsibility, but a higher level of security commonly used resources and solutions that are not associated with IT service provider

If you plan to become a Cloud serviceuser soon, TeleGroup can implement all the Cloud Security control based on recognized IT security framework andindustry best practices!!!

www.telegroup-ltd.com

www.telegroup-bg.com

www.telegroup.ba

THANK YOU!

Feel free to contact us via:[email protected]

telegroup profile - infotech.org.rs · consulting designing of telecommunication, it & energy...

Documents