Security Matters by Boxing Orange

SECURITY MATTERS The corporate newsletter from Boxing Orange

Boxing Orange SOC Team move into state-of-the-art mission control facility

Also in this issue:

Special Feature - DDoS: Are you protected? Ask The Expert - Our firewall specialist tells all Boxing Orange PCI ASV accreditation re-affirmed In association with Check Point

AUTUMN / WINTER 2008

WELCOME

Record Year for

Boxing Orange

SECURITY MATTERS In this issue:

AUTUMN / WINTER 2008

Welcome

Customer Focus – Ecclesiastical

Partner Focus – Webscreen

Special Feature – DDoS

Partner Focus –Check Point

Ask the Expert

Special Feature – Business Compliance

New Security Operations Centre

Future events

Our next seminar

BOXING ORANGE LTD 5 Beaconsfield Court, Garforth, Leeds LS25 1QH UK T: 0113 232 2330 F: 0113 287 0124 E: info@boxingorange.com W: www.boxingorange.com

Printed on 9 Lives 80 FSC certified coated paper from responsibly managed forests with an 80% recycled fibre content.

I hope you find Security Matters Hello and welcome to Boxing Orange’s brand new newsletter, enjoyable and useful reading. Security Matters. Finally, I would like to extend a Security Matters is something of a thank you, not only to our clients celebration for us as we’ve enjoyed and partners for their continuing the best year in our history so you’ll support, but also to our dedicated be able to read about some of our team who have made Boxing Orange the success it is today. success stories here in the first Our rigorous technical training issue. You can see some of our programme is not for the faintachievements opposite. hearted so congratulations to all the team on their ever-increasing Security Matters isn’t just an portfolio of qualifications which result opportunity for us to share our success stories. We’ve endeavoured in the numerous accreditations that to include articles of real, practical Boxing Orange enjoy. value to help you and your business combat the ever increasing rise in Kind regards. security threats. Jarrod Potter Managing Director Our partner focus this month on page 6 is on Check Point, a world Boxing Orange leader in firewall security who’ve recently appointed Boxing Orange as a Certified Collaborative Support “We’re very proud to Provider. have been appointed In what will become a regular feature in future editions of Security Matters, we invite one of our experts into the spotlight to talk about their specialist knowledge. Our resident firewall expert takes centre stage on page 7.

the Webscreen reseller of the year.”

We’re very proud to have been appointed the Webscreen reseller of the year and so on page 4 we take a look at their high performance WS series platforms that help us protect many of our customers from the threat of DDoS attacks. Speaking of performance, we held our annual karting event again earlier this year so on page 10 you can take a look at the teams in action! That covers just a few of the articles in this issue that I’m sure you’ll find of interest.

0113 232 2330 info@boxingorange.com

New business wins Major Insurance Company – Security Information Event Management (SIEM) UK Government Department – Managed IDS Service Online Betting Organisation – Managed DDoS Service Retail Network – Managed WAN, PCI services UK Government Department – Managed HIPS UK Banking Group – Forensics Worldwide Charity – Managed WAN UK Government Department – Check Point Software Technologies, UTM

Boxing Orange named as Webscreen Reseller of the year 2008 Following a succession of new business wins over the past 12 months including William Hill, Skybet, Axill Europe, DataCash and IG Index, Boxing Orange has been named Webscreen Reseller of the Year for 2008. Alistair Nield, Head of Sales at Webscreen said “The rise in the number of high profile DDoS attacks in the past year has spurred many companies to review their network and web server defences. Boxing Orange has been able to take advantage of this trend and had an outstanding year for us, they fully deserve this recognition.”

Phil Ineson, Sales Director Boxing Orange Alistair Nield, Head of Sales, Webscreen

CU STOMER FOCU S

Three years enhanced cover for Ecclesiastical Leading international insurance company Ecclesiastical has made a further three year commitment with Boxing Orange to manage their IT requirements. Boxing Orange has successfully managed Ecclesiastical’s WAN for the last three years and as part of the new contract they are now upgrading them to a high speed, resilient network based on Ethernet and VPLS (Virtual Private LAN Service) technology.

The relationship has further been strengthened by Boxing Orange’s installation and management of a corporate wide CISCO IP telephony system which is used across all their nine call centres encompassing 1100 seats in total. Implementation of this system is well underway and is currently progressing well.

“At the end of the original contract with Boxing Orange we took the opportunity to thoroughly review our IT requirements for the whole group, including alternative managed services partners. After a very exhaustive exercise we concluded that Boxing Orange was still the best company for the job and we were delighted to extend our relationship for a further 3 years” said Mike Burnup, Ecclesiastical Group.

www.ecclesiastical.com

Ecclesiastical was founded in 1887 by churchmen to protect their buildings from fire damage. Today the Group operates globally and focusses on ethical insurance targeted at charities, educational, heritage and care organisations. Additionally, Ecclesiastical provides general commercial insurance and a range of more specialised insurance products.

BOXING ORANGE / SECURITY MATTERS www.boxingorange.com

C U ST O M ER FO CU S

Axill opts for Managed DDoS solution Axill Europe Ltd., one of the world’s fastest growing e-publishing businesses has selected Boxing Orange to supply and support Webscreen DDoS technology to protect its European data centre. Axill provides a total solution for advertisers and web publishers delivering online campaign services for some of the world’s major consumer brands, streamlining the process of uploading banner advertisements and campaign management through a single interface.

Positioned in the main data stream, at the network gateway, Webscreen WS1000 fail safe appliances will monitor the behaviour of all the in and out bound web connections, dynamically blocking DDoS attacks and low priority traffic whilst guaranteeing service for clients and other legitimate users.

problem for our business credibility and loss of revenue. Boxing Orange’s solution not only automatically blocks botnet based flood traffic but also ensures that the connection to our servers is not interrupted during an attack or unusually high levels of web activity.”

Dorababu Penumarthi, Axill’s European Please go to: Manager commented “Our business is all www.boxingorange.com about delivering traffic and revenue for www.webscreen-technology.com publisher’s web sites and servicing inbound www.axill.co.uk links for advertisers. Non availability of either of these services would be a major

PARTNER FOCUS

WS Series platforms – the great defenders Webscreen deliver Guarantee of Ser vice Webscreen’s award winning DDoS mitigation technology is currently guaranteeing service for some of the world’s busiest and highest revenue generating web sites.

Working in partnership with Webscreen, •Behaviour based analysis provides Boxing Orange is able to offer DDoS dynamic DDoS protection mitigation solutions for any size of business, •Guarantee of Service for priority users backed with the option of a full 24/7/365 •Reports worst offending IP addresses managed service.

Designed to automatically block malicious traffic without disrupting legitimate users, Webscreen is the perfect technology for maintaining availability when sites are under attack or just dealing with excessively high volumes of genuine page requests. (See opposite for more about DDoS).

Designed for mid to large scale enterprise data centre environments, the WS Series platforms can monitor up to 16 million external IP addresses and defend up to 4096 internal network nodes supporting connection speeds of between 100Mb – 10 GB/s.

•Simple installation and configuration

Please visit www.webscreen-technology.com or call Boxing Orange on 0113 232 2330.

0113 232 2330 info@boxingorange.com

SPECIAL FEATURE

Are you protected from DDoS? Webscreen protects Don’t be a victim of cyber-crime Distributed Denial of Service attacks are increasingly used by cyber criminals to take vulnerable web sites off line. DDoS has been compared to having 1,000’s of random people calling a company switchboard all at the same time the real customers can't get through and eventually the system collapses under the strain.

The UK has the fastest growing online sales in Europe, reaching £12.8 billion in 2007 and is forecast to rocket to £44 billion by 2012, making it imperative that web sites are protected from DDoS.

FREE DDoS Vulnerability Assessment Don’t risk it - have your system's vulnerability tested by one of our security experts. • at your own premises • anywhere in the UK • detailed risk analysis provided To arrange your DDoS Vulnerability Assessment contact us today on 0113 232 2332

Asian online casinos Philippines based Bayview Technologies, the IT services division of South East Asia’s fastest growing gambling company, AsianLogic have installed WS series appliances to protect their online casino and poker web sites from DDoS attacks. This technology is widely deployed by some of the world’s largest online gaming and betting companies to stop their web sites from being taken off line by targeted attacks that are typically timed to coincide with major sporting events or other heavy betting periods. The AsianLogic Group operates a number of online casinos offering over 100 interactive games via the Bayview servers located in the Philippines. The Webscreen appliances are part of its integrated security shield to monitor all internet traffic before it reaches the web servers, guaranteeing service for regular players. www.asianlogic.com

DDoS – the facts • Approximately 3% of all internet traffic is DDoS • DDoS attacks reached 5000 a day in 2007 It is estimated that between 2% and 5% of all internet traffic is part of a DDoS attack which originate from networks of hijacked PCs known as “Botnets”. These are controlled by hackers to simultaneously send huge volumes of web page requests to a target URL, flooding the server resources and rendering it inoperable. Aimed at causing maximum commercial damage and blackmailing businesses in return for stopping the attacks, online, ecommerce based businesses are a favourite target. Sectors at risk include online bookmakers, major retailers and ticketing companies.

• Firewalls have only limited ability to combat an attack • Many web sites simply never recover from DDoS •Attacks can be prolonged, often for months • Many ISPs have no protection from DDoS attacks

What our customers say...

“Although many security vendors claim to have DDoS mitigation capabilities the reality is that they are not engineered for the task and proved ineffective.” Mustafa Ozkececigil, Chief Executive, VistaLogic “Whilst we cannot afford to be complacent, one of the major benefits of choosing the Webscreen solution is that in future we can be very confident that we can maintain our client’s system availability despite the best efforts of the hackers to stop them from operating.” Iain Simms, Tain Operations “We selected Webscreen because of the technology’s proven capability to automatically track and block attack traffic and the company’s excellent 24/7 hardware and software support services.” Itamar Shamshins, Director, AsianLogic

BOXING ORANGE / SECURITY MATTERS www.boxingorange.com

Check Point Software Technologies appoints Boxing Orange PARTNER FOCUS

as Certified Collaborative Support Partner

Superior Technical Support Complements Market-leading Products Boxing Orange has been appointed a Check Point Certified Collaborative Support Partner (CCSP) in recognition of the consistently highest level of support that Boxing Orange customers have received since they become a Check Point partner. This enables Boxing Orange to gain unlimited access to support tools that until now have been the preserve of Check Point’s own technical staff to provide customers with an even faster, more efficient and more cost-effective service. The evaluation process that Boxing Orange has undergone to be admitted to the CCSP programme is rigorous, the criteria for which includes employing

the requisite number of qualified Check Point certified engineers and rigid adherence to technical support response times set by Check Point. Boxing Orange also participated in customer satisfaction surveys set by Check Point who praised Boxing Orange on their superior levels of service.

T RNE INTE SION U INTERVENTION PR

Total Security UTM-1 appliances – new models! All inclusive, all secured, comprehensive network protection UTM-1™ Total Security appliances are all-inclusive, turn-key solutions that include everything you need to secure your network in a simple and cost-effective way. Each appliance includes a comprehensive set of security features along with complete security updates, hardware support, and discounted customer support for up to three years. This new expanded UTM-1 line, including UTM-1 Total Security 270, 570 and 3070, provides a new entry-level model and increased performance ranges. UTM-1 Total Security appliances offer a complete set of security features including firewall, intrusion prevention, antivirus, anti-spyware, messaging security including antispam, web application firewall, VoIP security, instant messaging (IM) and peer-to-peer (P2P) blocking, web filtering, as well as secure site-to-site and remote access connectivity.

The most complete Unified Threat Management (UTM) • 3 years Hardware Warranty included • 1 year or 3 years all-inclusive models with reduced support rates

For further information, please visit http://www.checkpoint.com or http://www.boxingorange.com and click on the Check Point Software Technologies logo.

• Messaging Security – 6 dimensional protections with anti-spam and antivirus updates services included • Integrated SmartDefense Intrusion Prevention updates included • Gateway AntiVirus for web, FTP update services included • Content Inspection Web (URL) Filtering update service included • Product Software Updates (Software Subscription) included

0113 232 2330 info@boxingorange.com

Andy Perkins ASK THE EXPERT

Firewall Specialist What does a firewall do?

Protect against main threats with UTM

Over the last few years, security threats to companies and their defenses have grown and changed dramatically. If your firewall was installed before 2005 then your network security is probably not up to date.

One of the best ways to protect against the main threats not covered by traditional firewalls is to use Unified Threat Management (UTM). These are multipurpose security solutions/devices that at a minimum have a firewall, VPN, antivirus, and intrusion detection/prevention system (IDS/IPS). UTMs are usually lower cost than buying and installing several security components separately. They are also typically greener, as one solution uses much less power than multiple solutions. 90% of all firewalls could be optimised for greater performance and this is something Boxing Orange can help you achieve.

What firewalls do Firewalls prevent unauthorised access to or from a private computer network and protect an organisation’s confidential information to stop malicious users from entering the network by distinguishing between good and bad traffic. In recent years firewalls have evolved to deal with the new breed of security threats so it is important to ensure that the right product is specified to protect the business and the network architecture. In the current security and business compliance climate the best firewalls are those that can offer protection from a range of blended threats and cover different functions; gateway defense; carrying out defined security policies; hiding and protecting internal network addresses; reporting on threats and activity; and segregating activity between a trusted network, the internet, and a DMZ. What can’t firewalls do? Even with a firewall, there are still many areas of network risk, most obviously malware or malicious software which includes Trojan horses, viruses, worms, spyware/adware, and phishing- and pharming-infected emails and web pages. Malware is usually acquired by clicking on email attachments or email links. Another well-known threat, not covered by traditional firewalls, is unsolicited commercial email or spam. It can seriously affect productivity, and because spam often contains viruses and phishing attempts, it is a direct security threat.

If you would like to know more about firewalls and which is the best option for your network, please get in touch with Boxing Orange by phone on 0113 232 2330 or email info@boxingorange.com

Boxing Orange Service Update

Network Security Boxing Orange has established a number of exciting new partnerships with Network Security vendors. The new partnerships will allow Boxing Orange to expand the products and managed services that they offer.

SIEM Services Boxing Orange is to offer a Security Information and Event Management service. The service will offer; •24/7/365 alert and log monitoring •Advanced correlation •Immediate incident response •On-demand reporting

Security Advisory Services (SAS) A new security advisory service (SAS) is being introduced by Boxing Orange. The focus of the SAS team will be on compliance and regulatory solutions.

Secure Hosted Services Boxing Orange is to introduce a secure hosted service facility in early 2009. The facility is in response to increased customer requests and a broadening of the services offered by Boxing Orange to their clients.

Securing Virtual Environments The use of virtual environments within businesses has presented significant security challenges. The challenges that are faced are not met by conventional security tool sets and so Boxing Orange has developed a service using best of breed products, which allows companies to segment, encrypt and secure their virtual environments. Please call 0113 232 2330 for more information or email info@boxingorange.com

BOXING ORANGE / SECURITY MATTERS www.boxingorange.com

SPECIAL FEATURE

Boxing Orange Re-Affirms Commitment to PCI Standard Boxing Orange is delighted to announce its successful re-accreditation as a PCI DSS approved scanning vendor. One of the first UK network security specialists to be awarded ASV status in 2006, Boxing Orange is also now one of the first to be re-accredited under the more rigorous testing procedures linked to the updated PCI v1.2 that came into force on October 1st.

The PCI Data Security Standard became mandated for any company that stores or transmits card payment data in June this year. PCI v1.2 is the first planned revision of the standard for two years and is part of the move to ensure greater compliance across the whole of the ecommerce sector.

Business Compliance - proposed new data breach legislation could mean jail for offenders Proposed new changes to the Government’s Data Protection Act legislation and the announcement of the latest version of the PCI DSS (v1.2) standard has added even more pressure on businesses to ensure that their IT security systems are fully compliant.

Today virtually any business could inadvertently find itself in difficulty, including imprisonment if the new law is passed, if it does not take its security seriously. This means not just ensuring that the latest security technology is deployed to protect the network but also that rigorous security policies and procedures are in place to help maintain year round regulatory compliance. If your organisation stores, processes or transmits card payment information you are required to have your network

independently audited for vulnerabilities at least twice per year in order to stay PCI accredited. With non-compliance potentially resulting in withdrawal of payment facilities or significant fines for a serious data breach, businesses cannot afford to ignore this particular requirement. Internal security is equally important as is controlling what employees are using the network for, particularly in terms of their internet access. Company directors can find themselves liable for any illegal activity that their employees are engaged in whether that involves stealing data or using the company’s internet access for criminal or immoral purposes. Boxing Orange offers organisations a range of business compliance services from PCI accreditation and full penetration testing through to a detailed forensic audit of the entire network. To find out how Boxing Orange can help you stay compliant and avoid potential fines or possible imprisonment call 0113 232 2330 and ask to speak to one of our Business Compliance team.

Boxing Orange provide two services to ensure your PCI compliance. 1. PCI DSS Compliant Security Scan Boxing Orange performs quarterly scans to comply with PCI standards. 2.PCI DSS Pre-Audit Assessment Penetration testing or ethical hacking to evaluate the security of your network by simulating a malicious attack and highlight operational weaknesses. This also includes: • Initial Review • Physical Network Audit • Penetration Testing • Gap Analysis • Compliance Readiness Statement To find out more about PCI, please visit www.pcicomplianceguide.org

Looking for clues on Forensics? Do you know: •who is viewing what sites on your time? •if anyone is stealing your data? •of employee’s illegal online activities? •the sites your employees are visiting? •how long they spend on these sites? If any of your personnel are caught doing anything illegal on the internet, do you also know that you may be legally responsible? You can avoid all of these problems by talking to Boxing Orange about forensics and implementing an internet viewing policy for your organisation. Call 0113 232 2330 for more details.

0113 232 2330 info@boxingorange.com

CORPORATE

Boxing Orange SOC team move into state-of-the-art mission control facility Boxing Orange is delighted to announce distribution of spam and phishing emails, the opening of their new Security to the propagation of malicious code in the Operations Centre. form of a Trojan. Immediate action provided our customers with the information needed As the nerve centre of our headquarters, our to immunise their web sites and to write SOC is now managed by our dedicated team signatures/rules across other security of security professionals 24/7/365 days a platforms to prevent any damage. year analysing over 3.5 million security Equipment managed and supported by our alerts per month for over 100 fully managed SOC includes Cisco, Check Point Software services customers. Technologies, RSA, Celestix, Microsoft, Webscreen and iPass and our Secure Portal Our new SOC has been created to promotes flexible, fast and completely secure dynamically protect networks and business communications with our clients. traffic and is the culmination of many

experience, many of whom are long-term Boxing Orange personnel. A comprehensive training programme ensures we continue to uphold our objective of being the most sophisticated SOC in the world today. Whilst this major development represents a £300,000 investment for Boxing Orange, it is responsible for the protection of £15 billion of client revenues and places Boxing Orange in a market leadership position.

months development. Carefully selecting technology to build a world-class infrastructure allows us to continuously monitor networks for security incidents in real time and react immediately when threats arise.

“…responsible for over £15 billion of client revenues...”

Balancing the industry-leading technology are the SOC team who have been chosen for their high levels of knowledge and

For further information, please call 0113 232 2330 or email info@boxingorange.com

SOC Benefits • Rapid reaction to all security incidents • Elimination of your network’s downtime • Protection of your data and traffic • Spike assessment and response • Complies with your security policies • Analyses incidence to show trends • Protects valuable revenue streams • Preservation of your reputation • Adherence to external legislation

The new SOC was put to the test by the ASPROX outbreak. The SOC’s Incident Response Team quickly identified the Botnet, that had recently changed behaviour from

Public Sector Focus Building on our success in delivering security and networking solutions for a wide range of government departments, Boxing Orange is rapidly developing its reputation as a specialist provider to the public services sector. Recent projects include managed security services for Defra, the Human Tissue Authority (HTA),

Stafford Borough Council and the Centre for Environment, Fisheries and Aquaculture Sciences (Cefas). With major new projects in the pipeline, Boxing Orange is committed to maintaining its technical training and specialist recruitment programme in line with the latest requirements specified for

government contract work. For more information on Boxing Orange’s public sector services call 0113 232 2330 and ask to speak to one of our Government Accounts Team or email: government@boxingorange.com

BOXING ORANGE / SECURITY MATTERS www.boxingorange.com

Boxing Orange GP 2008 EVENTS

A day of high-speed thrills at the Daytona Milton Keynes circuit. After a very successful event in 2007 Boxing Orange returned to the track early this year to try to make it an even better performance.

DXI Networks sped in to the winning spot followed by Ernst & Young in 2nd and one of the Ecclesiastical teams close behind in 3rd.

With a fantastic turnout of 22 teams of Boxing Orange customers, partners and staff, everyone got kitted out and briefed ready for the big race. It was a glorious day with sunny skies but the real heat was on the track! Top speeds of almost 70 mph meant the pace was fast around the 1.3 km International Circuit. The winning 3 teams all topped 100 laps in the 150 minute endurance race.

Future events CH CH W S S

Autumn/Winter 08/09 Leeds United Corporate Hospitality at Elland Road Various dates available

15th November 2008 Rugby - Autumn International England v Australia - Twickenham Limited spaces available

28th November 2008 Boxing Orange Webinar - latest industry hot topics Please see www.boxingorange.com for details 11th December 2008 Data Leakage Free Seminar Central London Please see page 11 for more details Seminar

Webinar

S G

Golf

31st January 2009 Boxing Orange Webinar - latest industry hot topics Please see www.boxingorange.com for details 5th February 2009 Boxing Orange thought leading security forum - Leeds Followed by dinner with guest speakers

20th March 2009 Boxing Orange thought leading security forum - London Followed by dinner with guest speakers Go Karting

27th February 2009 Boxing Orange Free Seminar at St Pauls Cathedral Security Information & Event Management

27th March 2009 Boxing Orange Webinar - latest industry hot topics Please see www.boxingorange.com for details 29th/30th April 2009 Golf Trip - K Club - Ireland Limited spaces available 13th May 2009 Boxing Orange Annual Go Karting Grand Prix Daytona Milton Keynes International Track 20th August 2009 York Races - Ebor Festival Corporate Hospitality with Boxing Orange

Corporate Hospitality

For details on any of the events please call us on 0113 232 2330 or email events@boxingorange.com

0113 232 2330 info@boxingorange.com

SEMINAR

DATA LEAKAGE

In association with Check Point

SECURE AND CENTRALLY MANAGE WITH CHECK POINT SOLUTIONS WHAT – Check Point Software Technologies in partnership with Boxing Orange would like to invite you to a FREE half day seminar including lunch WHEN – Thursday 11th December 2008 WHERE – 1 Threadneedle Street, London EC2R 8AW AGENDA – 1:00 Registration & lunch 2:00 Introduction

Co the mplete to re reply c serv ard plac e your e

Boxing Orange – Phil Ineson

2:15 Overview Botnet Attacks Guest Speaker 2:35 Unified Threat Management Check Point Software Technologies 3:15 Coffee/tea break with open workshops in break out rooms 3:45 Endpoint Security Check Point Software Technologies 4:30 Summary & Close Boxing Orange – Phil Ineson 5:00 Open invitation for drinks with the team To confirm your place visit www.boxingorange.com or complete and return the prepaid postcard included in this newsletter. If you would like to speak to a Boxing Orange representative or would like more information please call 0113 232 2330 or email seminars@boxingorange.com

New appointments To keep pace with the rapid growth of the company, we have made a number of new appointments in the last six months across all departments and would like to take this opportunity to welcome them all to the Boxing Orange team.

BOXING ORANGE / SECURITY MATTERS www.boxingorange.com

ONE The new number of agents required for total endpoint security.

For comprehensive endpoint security from a single agent, there’s only one solution — Check Point Endpoint Security™. With best-of-breed security components in a multilevel security solution, Check Point Endpoint Security simplifies management and reduces your total cost of ownership while it prevents data loss and system downtime, mitigates data breach exposure, stops unsafe PCs from infecting networks, and ensures confidential remote communications. To get all this endpoint security protection from a single agent, Check Point Endpoint Security is the ONE to look at.

Find out more at www.boxingorange.com