[DDHBOX Introduction Case] Robot SIer / Robot

Monitor and block C2 communications at the exit! Operations include automatic blocking, notifications, and monthly reports, allowing for management by a small team.

We would like to introduce a case where the security exit strategy "DDHBOX" was implemented for a robot SIer. In an environment with high security demands due to frequent connections to customer networks, the client required "control of external communications" and "incident response capabilities." It was also a challenge that operating a SOC with a small team was not realistic. The product was implemented at the headquarters exit, and automatic blocking of C2 communications was established. Notification emails were consolidated to the CSIRT contact point (also serving other roles), and a primary response flow was developed. Monthly reports are utilized as explanatory materials for the client. [Case Overview] ■ Challenge: It is not realistic for the company to operate a SOC with a small team. ■ Solution: Consolidated notification emails to the CSIRT contact point (also serving other roles) and developed a primary response flow. ■ Effects: - We were able to propose the implementation of exit measures in response to the client's security demands. - An additional layer was added to stop communications with attackers, allowing for continued maintenance with peace of mind. - Operations became less prone to becoming mere formalities, even with a small team. *For more details, please download the PDF or feel free to contact us.

Firewall and intrusion preventionOther security