Frequently Asked Questions

PC World is a good option if you are a small business who can take IT equipment into your local store to get basic problems fixed.

You may find that the response times to solve issues are very different from what a managed provider like CIS can offer. If you’re happy to wait 10-14 days for a solution to your problem, then certainly consider them, although you might also find them more expensive than a typical provider.
 

While your external network is the easiest to access for hackers, and available for attack 24/7, your internal systems can also be reached with a little extra effort. For example, by an email containing a malicious attachment, or link to a web page that exploits known unpatched software on an employee’s device. Similarly, unpatched software or the lack of hardening of internal systems can help an attacker move around internal systems once they’ve gained an initial foothold.

Having a well patched and hardened internal environment will help you avoid this next level of attack, and can be important for compliance with many security standards, or customer security questionnaires. It also helps further protect perimeter systems, by providing next-level information that can’t be gained from the outside.

Authenticated web application scanning allows you to find vulnerabilities which exist behind the login pages of your applications. Each web application is different, but some of the most critical functionality in an application exists behind a login page, such as the ability to add data to your account, edit data, delete data, upload files and interact with other users.

As a result, a large percentage of the attack surface of an application can exist behind a login page.

See Our Guides

There are lots of aspects to consider to ensure you and your systems are secure. You may have other questions but we have outlined a few points to consider in this simple “Guide to IT Security”
 
 

Generally, when it comes to identifying and fixing vulnerabilities on your internal network, there are two competing (but not mutually exclusive) approaches: network-based internal vulnerability scanning and agent-based internal vulnerability scanning. Our CYDEFENCE internal scanner uses an agent that you need to install onto each device that you wish to scan. You can scan anything supporting Windows, Linux or MacOS operating systems.

• What is network-based scanning?
  Network-based internal vulnerability scanning is the more traditional approach, running internal network scans on a box known as a scanning ‘appliance’ that sits on your infrastructure (or more recently, on a Virtual Machine in your internal cloud).
• What is agent-based scanning?
  Agent-based internal vulnerability scanning is considered the more modern approach, running ‘agents’ on your devices that report back to a central server. 

We work with a range of customers from large to small. We have clients with hundreds of devices and some with just 2 to 3. What matters to us are helping you solve the IT and technical challenges that you have within your business which allows you to focus on growing and thriving.
 

CYDEFENCE’s external vulnerability scanning assesses your internet-facing infrastructure for known vulnerabilities that an attacker, who doesn’t have access to your organisation’s private networks, could exploit.

Inveresly, internal vulnerability scanning is concerned with finding weaknesses on your private network, which is typically hidden behind a firewall and is only accessible by your employees or trusted partners.

Web application vulnerability scanners are a specialised type of vulnerability scanner which focus on finding weaknesses in web applications and websites. Traditionally, they work by ‘crawling’ through a site or application in a similar way as a search engine would, sending a range of probes to each page or form it finds to look for weaknesses.

CYDEFENCE Internal scans check for similar types of issues as our external scans, but can do so from a trusted position on the device, gathering even more data to help secure your systems.

• Common mistakes & configuration weaknesses
  Even the most secure software can often be configured in an insecure way. Simple mistakes such as leaving default passwords, not enabling encryption or other security settings. CYDEFENCE has thousands of checks for these kinds of mistakes, making sure all your business sensitive systems are hardened as much as they need to be.‍
• Missing patches
  Patch management is a fundamental part of keeping your digital estate secure, as missing patches can quickly be detected and exploited by attackers.
  CYDEFENCE’s internal security scans can detect insecure versions of many thousands of software components and frameworks, from web servers to operating systems and network devices.
• Encryption weaknesses
  It is common to find that services which are capable of secure encryption, have either not been configured, or mistakenly configured to be less secure.
  CYDEFENCE has checks for all the latest known encryption weaknesses, some of which include: Heartbleed, SSL/TLS weaknesses, and VPN encryption weaknesses.

Each training plan and course is bespoke to the client and the cost is agreed in advance as a fixed fee.

Our e-Learning platform is a monthly subscription and is linked to the number of user accounts required.

CYDEFENCE generates detailed, easy-to-comprehend reports which may be exported to PDF and CSV formats. The generated report covers the following areas:

• Scan Summary
• Exposure Over Time
• Difference Since Last Assessment
• Total Checks
• Targets
• Issues Discovered – Summary & In-Depth

If you have an IT company in place, then that is great to hear, and we hope this is working well for you.

It is always a good thing to check service levels and the value you get from your current provider in case we can provide you with a different level of service or expertise. How do you feel about your current provider? Are they doing everything you would want them to do? If you aren’t 100% sure, then why not at least find out what someone else could offer?
 

Ideally you should do both. That being said, the majority of data breaches are caused by hackers exploiting vulnerabilities that are visible from the internet, so you want to make sure that your external systems are protected from the outset. External scanners are also able to detect multiple web-layer issues, so if you’re new to vulnerability scanning, they are often the best tools to start with.

The two services complement each other, so ideally you should do both. An experienced penetration tester can find issues that are not detectable by machines, for example, by chaining several minor weaknesses together to discover a hidden critical vulnerability. On the other hand, vulnerability scanners can help you automate your security checks and provide continuous protection in the periods between manual in-depth tests.

It’s important to point out though that penetration testers typically perform vulnerability scanning as part of their assessments, so if you’re just getting started and want to gain an overview of the state of your security, you will benefit from running a vulnerability scan first.

We recommend conducting vulnerability scans at least monthly; however, your optimum scanning frequency will largely depend on the type of organisation you’re tasked with securing, or the type of systems that you wish to scan.

Courses can run from a half-day through to a week depending on the subject and depth of training required.

Courses may be split between periods of time if appropriate to the business to allow the initial training to be immediately put to good use, and then followed up with completion training to build on the initial knowledge.

Our support contracts work very simply and are based on the number of people and devices we provide cover on and the different levels of protection and service you require.

At CIS, we are transparent about any work that is charged, and this appears in the online portal that we provide to any customer who works with CIS. If at any time, you are unsure about what part of our service could cost, your Technical Account Manager will be able to answer the question you have.

Whether its hardware or software, we know that for you and your business, whatever the issue is, it’s a problem!

It stops you and your team from doing your jobs and keeping your business functioning which is vital in the modern world we live in. Our approach is to solve the problem and that’s what our team of over 20 engineers work to do.

Yes, we support all types of systems. Talk to us about the technology you use so we can understand the challenges you are facing and what assistance you may need.

Yes, we do! At CIS we have a team of certified expert security professionals who are skilled in many types of penetration testing services, including external network and web application testing.

We normally recommend training away from your premises if it is a traditional group course, and we have access to modern fully equipment training premises in Oxfordshire.

Where e-training is appropriate, those courses are available from any location using a computer.
 

CYDEFENCE’s internal vulnerability scanner is agent-based and does not support the scanning of network devices such as routers and switches.

No, it is not possible to add an internal IP as a CYDEFENCE target, instead, you need to install an agent onto each device that you wish to scan. It’s worth noting, the agent will only scan the device onto which it has been installed and nothing else.

Yes, you can carry out authenticated web application scans using CYDEFENCE. This includes modern web apps and single page applications.

CIS is a specialist in 5 key areas which we know from our 31 years of experience companies have. We believe that the biggest threat companies face right now is from cyber criminals all over the world who are intent on hacking and destroying great businesses through malware and other means

We work to protect the clients, we work with from these disasters and when we hear the stories of those companies who come to us asking us to solve a problem, we know that being a specialist in this area is a good thing!