BLD COUNTER - OSINT, WEBINT, SIGINT & Cyber Operations PaaS
COUNTER is an ecosystem of OSINT, WEBINT, SIGINT and Cyber Ops capabilities. Our solutions are designed to capture, acquire, identify, analyse and assess intelligence & investigations data for operators, analysts and investigators. Offering many levels of capability with service and support available from UK security cleared employees and expert partnerships.
Features
- Transfer/receive evidence intelligence up to 5TB of data securely
- Easy to deploy to capture & collect information and evidence
- Interoperability via API to search, locate and link information
- Specify target names, tags, brand names, alias or personas
- Specify and analyse nick names, pseudonyms and associations
- Comply with CPIA, RIPA and Disclosure
- Lock down sensitive investigations by role, team or department
- Prevent ‘blue-on-blue’ or compromise by auto-matching and alerting
- Qualified and expert staff to assist deployment and data capture
- API can be provided into your own intelligence system
Benefits
- Streamlined & automated analysis saving manual investigation time
- Understand the threats and risks to your organisation or agents
- Understand your targets, victims and assign personas as a fingerprint
- Prevent criminals countering or attacking your systems & tactics
- Connect via HTTPS using SSL/TLS via personas and VPNs
- Observe targets in action and understand their behaviour
- Use the gathered information for operational risk evaluation
- Use the gathered information to improve investigations and intelligence
- Use Artificial Intelligence to connect dots analysts might miss
- Automated collection runs 24/7 & can be scaled massively
Pricing
£1,000 to £2,000,000 a licence a year
- Education pricing available
- Free trial available
Service documents
Request an accessible format
Framework
G-Cloud 13
Service ID
9 2 3 8 5 4 9 9 2 8 5 0 6 4 7
Contact
Blue Lights Digital
Claire Stanley
Telephone: 07847258384
Email: claire.stanley@bluelightsdigital.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
-
- Public cloud
- Private cloud
- Community cloud
- Hybrid cloud
- Service constraints
- Campaigns require a discovery exercise to assure the correct strategy for a deception operation is in place. This includes an audit of current architecture, an assurance exercise to assure the deployment of any clients or APIs are lawful and parallel services can be protected from collateral intrusion.
- System requirements
-
- HTTPS Access via SSL/TLS1.3
- Presentation to secure gateways
- A communication channel such as slack, signal or IM
User support
- Email or online ticketing support
- Yes, at extra cost
- Support response times
-
Toolset is Fresh Service.
SLA's available are 1 hr - 8hr - next business day response.
We have dedicated e-mail and chat channels available 24/7.
Service options include 24/7 human support available Service Desk or remote.
Mon - Fri 9-5 Service Desk or remote support.
Automated bot support available on chat channels only. - User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- None or don’t know
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), Monday to Friday
- Web chat support
- Yes, at an extra cost
- Web chat support availability
- 24 hours, 7 days a week
- Web chat support accessibility standard
- None or don’t know
- How the web chat support is accessible
- Our Web chat services are built in Intercom. Intercom allows for chat-e-mail and attachments to be sent by policy managed services within this third party plug in. These services are subject to security postures.
- Web chat accessibility testing
- None. Available on request.
- Onsite support
- Yes, at extra cost
- Support levels
-
Support is on a reasonable endeavour basis and is included in our pricing.
Dedicated 'operational' support can be provided under our standard day rates for an investigating officer.
Technical developers can be provided to assist with: data modelling; Data integration; Data Parsing; Data migration; API build; software integration; Network integration and automation under our standard day rates.
Deception architects are available for design, build and operate functions for your deception campaigns. - Support available to third parties
- No
Onboarding and offboarding
- Getting started
- Onsite training is available along with Deception Ops awareness courses.
- Service documentation
- Yes
- Documentation formats
-
- HTML
- ODF
- End-of-contract data extraction
-
Any deception instances can be notated by legal agreements between the company and the client. All data can be deleted if deemed lawful to do so,
No data is retained by Blue Lights Digital unless requested to do so. This storage may incur further charges available on request. - End-of-contract process
- A contract can be done per campaign. Campaigns are varied due to the adversary faced.
Using the service
- Web browser interface
- No
- Application to install
- No
- Designed for use on mobile devices
- No
- Service interface
- No
- User support accessibility
- None or don’t know
- API
- No
- Customisation available
- Yes
- Description of customisation
- React to threats when they have been detected with automated and manual responses. Run Deception Operations (DecOps) to manipulate your adversaries’ path through the kill-chain and redirect them away from valuable information and assets. Responses can be pre-programmed, delivered by operators and analysts, or handled by artificial intelligence modules.
Scaling
- Independence of resources
- Load balancing. Clients can be allocated reserved instances for on demand scaling.
Analytics
- Service usage metrics
- Yes
- Metrics types
- Transaction by user, client to domain.
- Reporting types
- Reports on request
Resellers
- Supplier type
- Reseller providing extra features and support
- Organisation whose services are being resold
- Counter craft, CobWebs, Trapdoor, MarketScape
Staff security
- Staff security clearance
- Conforms to BS7858:2019
- Government security clearance
- Up to Developed Vetting (DV)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- Yes
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 3.0)
- Penetration testing frequency
- At least every 6 months
- Penetration testing approach
- In-house
- Protecting data at rest
- Scale, obfuscating techniques, or data storage sharding
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Data importing and exporting
- Data export approach
- Data is exported by .Doc, .CSV .PDF in e-mail or parsed by XML via an API.
- Data export formats
-
- CSV
- ODF
- Other
- Other data export formats
-
- XML
- Data import formats
-
- CSV
- ODF
- Other
- Other data import formats
- XML
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
Availability and resilience
- Guaranteed availability
-
Availability of less than 99.95% but equal to or greater than 99.0% is guaranteed by a 10% service credit for failure to meet SLA.
Availability less than 99.0% is guaranteed by a 30% service credit for failure to meet SLA. - Approach to resilience
- We utilise elastic load balancing, computing clusters, autoscaling and cloud flaring (DNS obfuscation) to add resilience to our cloud environments.
- Outage reporting
- Email alerts to users.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Limited access network (for example PSN)
- Dedicated link (for example VPN)
- Username or password
- Access restrictions in management interfaces and support channels
- Access to the Threat Finder system is limited by identity Access Management to known and vetted users only. Password and Username. Further security credentials can be added at an additional charge.
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Limited access network (for example PSN)
- Dedicated link (for example VPN)
- Username or password
- Other
- Description of management access authentication
- IP Whitelisting
Audit information for users
- Access to user activity audit information
- You control when users can access audit information
- How long user audit data is stored for
- User-defined
- Access to supplier activity audit information
- You control when users can access audit information
- How long supplier audit data is stored for
- User-defined
- How long system logs are stored for
- User-defined
Standards and certifications
- ISO/IEC 27001 certification
- No
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Cyber essentials plus
- No
- Other security certifications
- Yes
- Any other security certifications
- Cyber Essentials
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- No
- Security governance approach
- Through Cyber Essentials and NCSC cloud principles.
- Information security policies and processes
-
We use a shared responsibility model between customers and Blue Lights Digital. We operate, manage, and control the components at the operating system layer down to the physical security of the servers in which the services are provided (including updates and security patches), other associated application software, as well as the configuration of firewalls.
It is possible to enhance security and/or meet more stringent compliance requirements by leveraging technology such as host-based firewalls, host-based intrusion detection/ prevention, and encryption which can be requested by our clients at additional charges.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
-
Any changes to our systems are first managed by impact and risk assessment. Any changes to architecture, software or network access is tested within a development environment before release to production. A production snapshot is available for roll back.
Security assessment is managed through in house pentesting an testing procedures. External pen testing is subject to additional charges. - Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
-
As part of our Cyber Essentials programme we practice identifying, classifying, remediating, and mitigating vulnerabilities.
We use vulnerability scanners to identify known vulnerabilities, such as open ports, insecure software configuration, and susceptibility to malware. For unknown vulnerabilities, such as a zero-day attacks we rely on updates to our vulnerability scanners, such as OWASP ZAP. Vulnerability testing is also part of our test automation processes.
Correcting vulnerabilities involves the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.
We are active members of OWASP, CISP and Black Hat communities. - Protective monitoring type
- Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
- Protective monitoring approach
-
We license SiteLock TrueCode Static Application Security Testing (SAST) for source code analysis. Also known as "white-box" testing. TrueCode finds common vulnerabilities by analysing 100% of the source code in our applications without actually executing them and adds critical layer of security by protecting our web applications.
Our SAST is automated to send alerts if a breach or malware is detected. - Incident management type
- Supplier-defined controls
- Incident management approach
-
The activities within our incident management process include:
Incident detection and recording
Classification and initial support based upon known errors and new events
Investigation and analysis
Resolution and record
Incident ownership, monitoring, tracking and communication
We report on incidents with a full disclosure policy to ensure any impact can be contained and a resolution is satisfactory to the end user.
Incident reports are provided by e-mail to the end user.
Secure development
- Approach to secure software development best practice
- Conforms to a recognised standard, but self-assessed
Public sector networks
- Connection to public sector networks
- No
Social Value
- Fighting climate change
-
Fighting climate change
. - Covid-19 recovery
-
Covid-19 recovery
. - Tackling economic inequality
-
Tackling economic inequality
. - Equal opportunity
-
Equal opportunity
. - Wellbeing
-
Wellbeing
.
Pricing
- Price
- £1,000 to £2,000,000 a licence a year
- Discount for educational organisations
- Yes
- Free trial available
- Yes
- Description of free trial
- 10 days on OSINT Trials. Subject to shared tenancy hosting.