Haven SIEM data is stored in a secure collocated data center with high availability. Our technology partners leverage cloud service providers, such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).
Depending on the deployment model that is optimal for your organization, Haven can be fully cloud-based or as a hybrid solution. If physical hardware is required, Corvid will ship a pre-configured appliance that will need to be connected to your network and set up with network connectivity. Software will need to be deployed/installed by your employees. If on-site support is required, arrangements can be made based on an agreed upon one-time fee. Full deployment of Haven takes approximately 4 weeks on average; however, it varies by customer environment and needs.
Haven is an end-to-end solution that includes monitoring, detection, response, and remediation of security threats. Other MSSPs typically focus only on monitoring, detection, and alerting, requiring the client to determine how to handle and remediate threats.
Client data is stored in a highly secure environment secured by network segmentation, user and network security groups, multi-factor authentication.
Corvid Cyberdefense provides 24x7x365 coverage. Clients may contact support via phone, helpdesk web portal, or email depending on severity and preference. See our SLA for delivery and response timing.
Logs for all systems originate on the network security appliance, and the originals are stored there.
For every stream for the purpose of monitoring and security, the logs traverse a private SSL tunnel to our main non-public data center in Raleigh, NC. These logs are then housed in an internal single-tenant environment 100% under Corvid Cyberdefense’s control. Each client’s data is housed in data verticals apart from other clients, such that no client can have bleed over access.
Onsite backups and snapshots are accomplished within the same private cluster and engage no extra-corporate services.
Tertiary backups are flowed offsite multiple times per day for continuity to a virtual private cloud at AWS, employing object storage only. No public applications or structures are in place at said VPC, and no other systems at AWS are employed to interact with this data in any way.
Data at rest in cold storage and live in-cluster are maintained for 90 days per contractual SLA. Data is cycled out after this time on the following Sunday from the expiry of said data.
At a minimum all analysts must have Network+, a certification designed to test the competency of a mid-level network technician in supporting and configuring TCP/IP clients in terms of network design, cabling, hardware setup, configuration, installation, support, and troubleshooting.
Analysts are certified in each security technology and they maintain a provided structural learning path via on-site training.
For clients with an on-premise network security appliance, vulnerability scans are conducted on the 4th and 7th of each month. This ensures that the scans occur on a weekday.
No. Haven is designed to provide you with the technology to reduce the amount threats that can impact your organization. Our 24/7 security operations center (SOC) investigates event alerts triggered by the technology to determine if additional action is needed. If there is suspicious activity that cannot be confirmed by the SOC and requires domain knowledge, or if there is activity that is confirmed to be malicious OR is determined to be suspicious with potential for a compromise in data confidentiality or integrity, you will be notified directly per the SLA: corvidcyberdefense.com/haventerms
For on-premise network security appliance installations, we will do our best to limit the amount of time the network is down. Depending on the type of installation, downtime can be anywhere between 2 minutes to 2 hours. We can also schedule installation timing to happen when this will cause the least disruption to your organization.
Corvid Cyberdefense engineers will have access to your network in order to manage and maintain it. We are happy to provide you with more information as requested.
Depending on location, our network security engineer can either be on site or connect through phone or video conference to walk you through each step and ensure the installation goes smoothly with as little downtime as possible.
Your time will be required at touch points throughout the onboarding process, and typically be about 5 hours over the 30-day deployment timeframe.
Yes, we will ask for a list of those who require access to the ticketing portal during the onboarding process. It is best to limit access to as few as possible in order to limit the individuals who have access to make changes to your organization’s security configurations.
If your Haven service agreement includes Cylance endpoint protection, it can replace your current AV. However, please do not uninstall your current AV until Cylance is installed, including a series of follow up reviews, which take approximately 7-14 days. This will allow various policy rules and exclusions to be created based on your goals and the specifics of your IT environment.
The report of actual and potential threats found is sent to the client that includes our recommendations. Actual threats will be quarantined. We ask the client to confirm the category for items that are a potential risk for the organization. If they are necessary to the organization, they can be waived/safelisted, if not, it is often recommended that they are quarantined.