Rostelecom Solar: Sandbox

Main articles:

• Firewall
• Security Information and Event Management (SIEM)

2021: Service Launch

Rostelecom-Solar on March 31, 2021 announced the launch of the Sandbox service (sandbox) - to protect against complex and previously unknown threats implemented through mail and web traffic. Sandbox has supplemented the Solar MSS line of managed services. The Check Point SandBlast solution provides 98.4% user security. At the same time, on the horizon of 7 years, the service is for companies on average 30% cheaper than their own solution.

Sandbox service is designed for organizations that may encounter targeted attacks using phishing, the latest viral software and previously unknown vulnerabilities. This is especially true for government agencies, educational and medical institutions, financial organizations, industrial and energy enterprises, transport and logistics companies, as well as the field of trade.

The solution is connected in 5 days, and only the actual amount of files analyzed is paid. Sandbox is operated by Rostelecom-Solar specialists.

According to the Solar JSOC cyber attack monitoring and response center, in 2020, 39% of attacks were implemented using malware, which is a quarter higher than 2019. At the same time, for critical segments of the infrastructure (CII), attackers use advanced malware that is activated with a delay in time and is not detected by standard means - antivirus, antispam, IDS/IPS or antibot.

To protect against such complex attacks, they use the so-called sandbox - an isolated environment for securely opening files and running programs. However, the implementation of such a solution requires considerable financial costs (from 10 million rubles and higher - depending on the volume of traffic) and time. In addition, many of the sandboxes slow down the work of users with files - checking one document lasts on average about 30 minutes. In addition, some sandboxes can be bypassed, since malicious ON can recognize launch in a secure environment and hide its true functionality.

Unlike other analogues, this solution checks for malicious code before it attempts to disguise itself as legitimate software. This is possible by checking files at the CPU level rather than the operating system.

Sandbox service does not interfere with the continuous operation of the company: as long as the source file is checked in the sandbox, employees can work with its safe copy thanks to the technology of cleaning and reconstructing files. Among other things, Sandbox checks hidden threats encrypted in traffic using the/protocols. SSLTLS

Sandbox can be used separately or in conjunction with other Solar MSS ecosystem solutions - with email protection (SEG) and network threat protection (UTM) services. An integrated approach allows you to more effectively confront intruders.

According to Solar JSOC analysts, in 2020, basic security tools revealed almost 50.8% of cybersecurity incidents, the remaining 49.2% were recorded using more sophisticated intelligent systems and analysis of IB events. At the same time, a year earlier the ratio was 54.6% and 45.4%, respectively. The trend is obvious: hackers are improving their arsenal, which means that more advanced means of protection are required, "says Alexander Barinov, head of Solar MSS services at Rostelecom-Solar.