Caretower's Managed ePO Brochure 180215
- 1. Caretower's Managed ePO Service
- 2. Overview Caretower are proposing the Managed Service Security solution for Endpoints and other products. Our managed services portfolio includes a number of IT Security solutions such as Firewalls, SIEM, Penetration Testing, Mail and Web filtering and Endpoint Security. We began our managed services offerings with our flagship product of McAfee ePO solutions outlined in this document. The product provides efficient and effective management of the McAfee Endpoint Security strategic solutions. With major service architecture, infrastructure and even more importantly mature managed services engineers, our managed services portfolio has expanded to include the Symantec Endpoint products with enhanced functionalities such as reporting. The Sophos Endpoint products will also be added in few months as well as other vendor security solutions. Caretower Managed Security Service (the Managed Service) provides remote managed security services for customers. Caretower has extensive experience of partnership with all major security vendors and provides vendor approved support for a range of security technologies and products.This document describes Managed Security Service, which is a remote managed service for managing McAfee’s ePO console with all the McAfee portfolio Endpoint products. Our Managed Service Terms and Conditions apply to all of Caretower’s managed services. Caretower Managed Security Service The Managed Service operates on the principle of proactive security management, deploying a Network Management System (NMS) that processes notifications and auto-generates tickets for proactive remote management. This facilitates proactive incident management and also incorporates a change management component. The Caretower infrastructure is housed in a hosted environment, in redundant configuration. Connectivity with the customer is achieved by a remote encrypted connection to the managed device(s) and via an NMS agent installed on customer’s site to communicate with the NMS server. Customers can raise tickets by email or phone, or by logging onto the Caretower Managed Service web portal (the Web Portal). Security Operations Centre (SOC) The Caretower SOC (Secure Operation Centre) is manned 24x7x365 by experienced network security engineers, all are certified in McAfee ePO products whilst others specialises further in firewall and SIEM technologies. The SOC is secured with swipe card access control and only authorised personnel have access. Physical and logical access is controlled via a list of authorised personnel. SOC engineers remotely manage and monitor customer devices proactively. Our managed services follow a laid down procedures, within the ITIL model.*
- 3. Caretower's Service Elements 24x7 Management The Managed Security Services are delivered through the Caretower’s Security Operations Centre (SOC), which operates 24 hours a day, 7 days a week, 365/366 days a year. Co-manage The customer may retain admin privileges to the managed device – if not on a fully managed contract. System Availability Checks Caretower SOC is available to monitor manage security devices 24x7x365. Configuration Backup Where possible a configuration backup of the device shall be made. Reporting Monthly reports will be provided for the managed device(s). Portal A Web Portal is provided to the customer to interface with the Managed Service. The Customer CSM/CSO may access the Web Portal through the Caretower Managed Service web site. Access to the Web Portal is encrypted. Additional Web Portal accounts can be requested but these incur a one-off charge and should be ordered through the Caretower account manager.
- 4. Caretower's Security Some services require an onsite appliance to act as an aggregator or management interface. Where required they are available as either Caretower supplied hardware or client provisioned and resourced virtual server. Specifications vary on required service. The Caretower Managed Security Service Appliance (CTMSSA) is a Virtual Machine that has been developed by Caretower to collect and interpret log file information at customer sites. It is sited close to the devices that are to be managed on the customer’s site. The CTMSSA reduces the amount of data that needs to be transferred to the SOC and the amount of bandwidth required to operate the Managed Service. Security Appliance (Virtual Machine) Security Appliance (Hardware) The hardware appliance is a physical device located on customer sites. The CTMSSA is a device that has been developed by Caretower to collect and interpret log information at customer sites. It is sited close to the devices that are to be monitored according to the relevant service contract. The appliance reduces the amount of data that needs to be transferred to the Caretower SOC and the amount of bandwidth required to operate the Managed Service. Changes are managed to completion within the NMS, and are requested via the Web Portal. Change requests raised by Customer will be approved by Caretower CAB if feasible, and conversely those raised by Caretower require approval from Customer before implementation. In accordance with ITIL, non-impact changes do not need to go through change control. Change Control Incident Management For the purposes of this specification reference to an 'incident' generally means an incident in ITIL, which is an unplanned interruption to an IT service or a degradation of the quality of an IT service. Reported incidents will be responded to within 30 minutes.
- 5. Managed ePO Service Prior to the Managed Service going live, due diligence is carried out of the customer’s network and devices and components must meet minimum requirements specified. A consultancy can be purchased to bring non-compliant components within scope. Set-up costs include a site visit to either a new ePO installation, or update McAfee components to current versions on existing installations. This will also include installing NMS agents where relevant. There are two models for implementation of the managed ePO service; Onsite ePO Console (existing or new installation) This can either be an existing ePO installation or else an ePO console can be installed and configured for the customer. A site to site VPN is required. This will be configured from the Caretower Firewall to the customer's Firewall, connecting to the ePO server. Cloud ePO Console Customer’s endpoints can also be managed from a hosted ePO server hosted on Caretower’s infrastructure. Remote management is again either via Site-to-site VPN from Caretower to the customer site, with the ePO server hosted by Caretower, or via client-to-site VPN. Alternatively a client-to-site VPN, from a CTMSSA is installed on the customer’s site, terminating on the Caretower firewall and sending endpoint notifications to the ePO console. An NMS agent handler will be installed on the CTMSSA on the customer site, for communication with endpoints. An NMS agent is installed on the ePO server (or on Agent Handler for the cloud based model), which sends notifications back to the NMS server. The NMS also consists of a service desk and tickets are auto- generated for alarms received from the ePO server. This system ensures that a proactive service is delivered, with incidents being investigated immediately after they occur. The NMS dashboards and tickets are monitored by experienced security engineers in Caretower. Caretower Security Operations Centre (SOC) The Caretower SOC is manned by McAfee qualified SOC engineers. They proactively check each customer ePO consoled daily by remote login, following laid down procedure. Checks include; ● ePO Dashboards ● ePO Task Log for the previous day ● ePO Detected Systems Additionally, endpoint incidents create notifications from the ePO console, which in turn auto-create tickets in the NMS service desk and send emails to the MSS mailbox. These incidents are investigated proactively, and escalated accordingly if required. Unresolved incidents are escalated as per the MSS escalation procedure until resolved**. Connectivity from the SOC is via a secure VPN connection to the MSS infrastructure for remote management of customer ePO consoles. 98% percent of ePO managed endpoints connected to network up-to-date compliance (N-1). SLA
- 6. Managed ePO Service Elements * Subject to customer fulfilling contractual requirements **Caretower will not be responsible for failures or degradation beyond Caretower’s reasonable control, such as customer infrastructure, cabling, telecoms service/equipment, power provision, utility suppliers, ISP etc.
- 7. Benefits of Caretower’s ePO Managed Security Service To provide live 24/7 Managed Service globally Dedicated GIAC Certified Digital Forensic Security Engineers (SANS (SysAdmin, Audit, Networking, and Security) Institute) Full-onsite and hosted architecture options, depending on your requirements We are CSA (Cloud Security Alliance) member and ISO 27001 Accredited Why Caretower? Speed of Implementation Flexible Dashboards and Robust Reporting 24/7 Caretower Security Operation Centre Our Managed Security (for McAfee ePO, Symantec Endpoint and other) seamlessly integrates with your network and can be up running within days, not months. We deliver instant result through visibility of events and analyse on a live dashboard with in-depth reporting. Our Managed Security brings you comprehensive technical, operational and trend reports that communicate security status and satisfy compliance requirements. Dashboards are available out-of- the-box and Caretower delivers customisable dashboards to each and every customer based on their requirements. Our Managed Security Service allows you to be a user, not an administrator. This means that you have access to view the data and run required reports whilst maintaining a certain level of privileges. The ePO service is constantly monitored by our 24/7 Security Operations Centre where the team will carry out monitoring, management and incident response to security events and alerts. Get in touch: 020 8372 1000 / [email protected] / www.caretower.com As an independent IT security specialist, with over 17 years experience, Caretower provide comprehensive solutions to individual problems, thus allowing our recommendations to be unbiased. Over the years, Caretower has quickly established many long standing relationships with all of our vendors, achieving the highest status within these organisations based on the level of expertise within our internal sales, support and professional services teams. This relationship ensures we provide our customers with key changes within the industry which assists in their on-going security management strategy.