Brookcourt Solutions

Intel 471 - Cybercrime Intelligence

Intel 471 provides adversary and malware intelligence for leading security teams. Our adversary intelligence is focused on infiltrating access to closed sources where threat actors collaborate, communicate and plan cyber attacks. Our malware intelligence leverages our adversary intelligence and underground capabilities to provide timely data and context on malicious infrastructure.

Features

• Dark Web/Deep Web Monitoring
• Malware Intelligence
• Threat Hunting and Research
• Near Real-time Alerting
• Cybercrime Intelligence
• Intelligence Collection and Raw Data Accessible
• Finished Intelligence Products
• Numerous 3rd Party Integrations

Benefits

• Proactively track threat actors, cybercriminals, malware, attacks and vulnerabilities
• Safely view, alert and pivot around underground discussions and malware
• Access field reporting from threat researchers located across the globe
• Track the latest malware campaigns and links between malware families

£60,000 a unit

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@brookcourtsolutions.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

448869643798857

Contact

Phil Higgins
01737886111
contact@brookcourtsolutions.com

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Supports the following browsers: Chrome, Safari, Firefox, Edge, Internet Explorer v11.; ; - Ability to enable Sendgrid and potentially whitelist within email policies for Intel 471 email delivery
• System requirements:
  • Internet Connection
  • Browsers supported: Chrome, Safari, Firefox, Edge, Internet Explorer v11

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: For customer support, usually within 2-3 hours Monday to Friday.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Critical Error - Reaction Time: Immediate reaction - Response Time: Max 4 business hours - Target maximum resolution time: Vendor will provide relief within twenty-four (24) hours and provide a Fix within three (3) days - Resolution: Fix. Significant Error - Reaction Time: Max 4 business hours - Response Time: Max 1 day - Target maximum resolution time: Max 7 days - Resolution: Delivered in next Update. Other Error - Reaction Time: Max 2 days - Response Time: Max 3 days - Target maximum resolution time: Max 14 days - Resolution: Delivered in next Update. Support is included in the cost of a subscription.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Intel 471 provides all customers online training and user support during onboarding process. Onsite training is available at an additional cost.
• Service documentation: No
• End-of-contract data extraction: On request we can manually extract the user's information at the end of a contract.
• End-of-contract process: User off-boarding is uncomplicated as the leaving user’s account will be expired, after which it can no longer be accessed and used. Expiring an account must be requested by the customer by email after which the account is closed by a member of Intel 471's support team. Once an account has been closed, a new account can be allocated to another user for the remaining time of the subscription.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Intel 471 provides a REST API enabling consumers to access all intelligence: - searching, analysing and retrieving data - creating and receiving alerts API documentation (requires authentication).
• API documentation: Yes
• API documentation formats: HTML
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: - Watchers - Intel 471 customers are able to use Intel 471 access and placement for observation and monitoring within the cybercriminal underground for unique keywords, names, terminology or distinct phrases relative to a Deloitte customer. Real-time curated results (alerts) of malicious activity known or suspected to be associated with a customer would be provided to Deloitte for dissemination. Intel 471 Alerts would provide coverage for each customer across the core domains of: Email Domain, Company Brand, Critical Technology, Intellectual Property, Key Personnel, Key 3rd Parties, Suppliers, Vendors, Contractors & Partners; - MyGIRs - Intel 471 uses their deep subject matter expertise, to classify and codify the content which we collect and produce, so as to align this content to the General Intelligence Requirements (GIR) programme. Identifying the content which satisfies these requirements, allows customers to apply their own custom selection of GIRs as an additional filter to the content in the TITAN web portal in addition to receiving a highly curated feed of content which meets their requirements. Customers are able to modify their selected GIRs at any time to reflect the dynamic threat landscape they face and to highlight notable content.

Scaling

• Independence of resources: We constantly monitor system utilization and over-provision hardware and infrastructure to handle between 2-10x expected load.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Intel 471's intelligence can be exported using our RESTful API. User data can be exported manually and upon request.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: Manual Import

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: The Service will be made available to a minimum of ninety-nine and five tenths percent (99.5%) of the time within any thirty (30) day period. The subscription fee is non-refundable unless we have failed to resolve a product support request from you for a Critical or Significant Error. In such a case, you shall have the right to terminate the service and we will refund you the subscription fee pro-rata based on the remaining time of the subscription period for which you have paid in advance.
• Approach to resilience: High availability and resilience is ensured through a combination of factors; load balanced & mirrored web and application servers, mirrored/replicated database servers and redundancy with power, internet etc.
• Outage reporting: Email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: Role-based security enforced by application layers.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Security governance is an executive level responsibility. Cross-organisational security/risk assessment team involving CEO, CTO and COO. Risks assessed, documented, regularly reviewed and addressed continuously.
• Information security policies and processes: Intel 471's information security policies cover: Data classification, access policies (according to role/scope), storage policy (encryption etc), password policies (2FA etc) and escalation procedures.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All system configuration is versioned with history. Configuration changes are verified and periodic reviews. Security assessment is done by internal security experts.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability scanning is performed continually. Intel 471 also has our own created vulnerability intelligence product (provided to customers). Patches are deployed as soon as available mapped to criticality.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Identify potential compromises through consistent and ongoing monitoring. Have the ability to respond 24/7 to security incidents with escalation paths to executives.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents are handled on a case-by-case basis. Users report incidents using standard support channels. Incident reports are sent by email to directly and indirectly affected users.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Fighting climate change:

  Fighting climate change

  N/A
• Covid-19 recovery:

  Covid-19 recovery

  N/A
• Tackling economic inequality:

  Tackling economic inequality

  N/A
• Equal opportunity:

  Equal opportunity

  N/A
• Wellbeing:

  Wellbeing

  N/A

Pricing

• Price: £60,000 a unit
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: A POC of the full service is available for 30 days and requires that (i) all POC users have had an online demo/training before the POC begins; and (ii) there are regular follow-up calls during the POC with the potential customer to discuss the POC experience and to answer questions.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@brookcourtsolutions.com. Tell them what format you need. It will help if you say what assistive technology you use.