Grove Information Systems

Darktrace - Malicious Network Activity Detection Tool

Powered by industry-leading AI, the Enterprise Immune System is a self-learning cyber defense platform capable of detecting and responding to cyber-attacks in real-time. Requiring no set-up, the technology is relied on by organisations to protect their entire digital enterprise, including the cloud, virtualised environments, SaaS applications, and industrial control systems.

Features

  • Enterprise Immune System
  • Autonomous Response
  • Darktrace Threat Visualizer
  • AI & Machine Learning
  • industry-leading AI

Benefits

  • Learns and adapts its understanding of ‘normal’
  • Autonomously detects and responds to cyber-threats before crisis hits.
  • Works across the on-premise network, cloud, SaaS, industrial control systems
  • Installs in minutes. No lengthy set-up or manual tuning
  • Provides complete visibility of every user and device

Pricing

£1,500 to £12,500 a device a month

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at pwitheridge@groveis.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

3 7 2 7 6 2 9 2 3 8 2 6 0 4 7

Contact

Grove Information Systems Philip Witheridge
Telephone: +44 207 493 6741
Email: pwitheridge@groveis.com

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
No
System requirements
None - Infrastructure, Application and System-agnostic

User support

Email or online ticketing support
Yes, at extra cost
Support response times
We operate in a non-stop, global business environment —24 hours a day, 365 days a year—offering a range of specially tailored support packages. Grove’s Premier Support options include dedicated technical success managers, priority responses, customised escalations, weekly and monthly reports as well as clear service level agreement (SLA) guidelines.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
None or don’t know
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Base Support: Helpdesk / remote problem diagnosis and support.
Best-effort 'Ask the expert' assistance.
Support available to third parties
No

Onboarding and offboarding

Getting started
Assist Admins with installation process.
Interface training.
Assist with breach analsys during Proof of Value phase and after contract signed, if required.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
Possibility of Admins able to back up the pcap data after contract end, if required (usually not).
Due data sensitivity, data is purged from appliance before sent back to provider.
End-of-contract process
Data is purged from appliance. Appliance then shipped back to provider.
No additional costs.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
Desktop works specifically through a browser.
A lighter version is available or mobile - downloadable from Google Playstore or Apple Store.

App displays same information as browser except for large geographical map, which only the browser displays.
Service interface
No
User support accessibility
None or don’t know
API
Yes
What users can and can't do using the API
Restful API can be used by SIEM's to pull breach information from Darktrace.
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
No
Customisation available
No

Scaling

Independence of resources
Each client has a dedicated environment

Analytics

Service usage metrics
Yes
Metrics types
CPU
HTTP request and response status
Network
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Reseller providing extra support
Organisation whose services are being resold
TBC

Staff security

Staff security clearance
Staff screening not performed
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
In-house
Protecting data at rest
Physical access control, complying with CSA CCM v3.0
Data sanitisation process
No
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Due to the nature of the system, no 'simple' export is available. Admins are able to back up pcap data from the appliance to a separate location via a back-end console.
Data export formats
Other
Other data export formats
  • Libcap
  • Ncap
Data import formats
Other
Other data import formats
Data ingested using port-mirroring from switches. No user import available.

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • IPsec or TLS VPN gateway
Data protection within supplier network
IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
Platform availability to 99.95%
Approach to resilience
Architectural, platform and datacentre resilience.

Directly on Product:
All data on appliance is encrypted.
Only specified Admins have access.
External access can only be done using SSH on encrypted Ports 22 or 443.
Each client has their own SSH key which is required for external access.
Outage reporting
Client communications via agreed channels.

Product specific:
Email alerts can be sent if appliance is running over capacity.
If appliance goes offline, provider up-time system will indicate this.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Username or password
Access restrictions in management interfaces and support channels
Role based access restrictions enforced
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
The British Standards Institute
ISO/IEC 27001 accreditation date
04/05/2016
What the ISO/IEC 27001 doesn’t cover
Nothing - it relates to all services around the distribution and delivery of Darkforce service
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
Yes
Any other security certifications
Cyber Essentials

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
Cyber Essentials
Information security policies and processes
In line with ISO27001 accreditation and governance procedures.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
In line with ISO 27001 accredited governance procedure.
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
In line with ISO 27001 accredited governance procedure
Protective monitoring type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Protective monitoring approach
In line with ISO 27001 accredited governance procedure
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
In line with ISO 27001 accredited governance procedure

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Social Value

Fighting climate change

Fighting climate change

We acknowledge the scientific consensus, led by the Intergovernmental Panel on Climate Change, that climate change is a reality and that human activities are largely responsible for increasing concentrations of greenhouse gases in the earth’s atmosphere. We believe that climate change is one of the most significant environmental challenges of the 21st century and is linked to other important issues such as economic growth and development, poverty alleviation, access to clean water, and adequate energy supplies. How governments and societies choose to address climate change will fundamentally affect the way present and future generations live their lives. We are very concerned by the threat to our natural environment, to humans and to the economy presented by climate change and believe that it requires the urgent attention of and action by governments, business, consumers and civil society to curb greenhouse gas emissions.

To carry out our commitment, it is our policy to strive to ensure that all aspects of the business have the least harmful effect on the environment by implementing an environmental management system to:

● Be fully aware of all environmental legislation and ensure that regulatory requirements are met and, where feasible, improved upon
● Monitor the implementation of the policy by carrying out periodic audits of compliance and, when appropriate, introduce remedial measures
● Ensure all employees, in the course of their duties, act in accordance with the environmental policy. Encourage suppliers, contractors and vendors to act in accordance with our environmental standards
● In addition, areas of particular attention within the business will be the selection of non-polluting technology, waste minimisation, reuse/recycling and the reduction of energy consumption
● We also make a positive environmental contribution in the local community by encouraging open communication, general environmental awareness and the promotion of community projects

Pricing

Price
£1,500 to £12,500 a device a month
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
A free Darktrace Proof of Value (POV) is an easy way to discover the value of Darktrace’s unique technology for your organization.

Over 4 weeks, allow the Darktrace technology to visualize your network’s activity in real time, and detect in-progress threats or anomalies that you would not otherwise know about.
Link to free trial
https://www.groveis.com/events/book-a-darktrace-demo

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at pwitheridge@groveis.com. Tell them what format you need. It will help if you say what assistive technology you use.