IOCO SOLUTIONS LIMITED

WithSecure EPP & EDR

WithSecure™ Elements is the unified cloud-based cyber security platform designed to reduce risk, complexity, and inefficiency. WithSecure™ Elements combines powerful predictive, preventive, and responsive security capabilities – all managed and monitored through a single security center.

Features

• Advanced anti-malware
• Integrated patch management
• Fight ransomware and unknown attacks
• Application and endpoint inventories
• Reputation-based browsing protection
• Integrated device control
• Managed endpoint firewalling
• Security event alerting and reporting
• SIEM log and API integration
• Vulnerability scanning

Benefits

• Detect breaches quickly
• Block ransomware before it can act
• Automate response actions
• Extend vulnerability scanning into endpoints
• Cloud native endpoint protection
• Centralized visibility and management across all endpoints and cloud services
• Browsing protection preventing end-users from visiting malicious sites

£300 an instance a month

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michael.morey@ioco.tech. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

934035322065649

Contact

Mick Morey
0118 206 2938
michael.morey@ioco.tech

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Windows, Mac and Linux Clients available.
• System requirements:
  • Modern Web Browser (Edge, Chrome, Firefox, Safari)
  • Internet access for users
  • Supported operating systems

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Support response times; Severity 1 - 1 Hour, ; Severity 2 - 4 hours, ; Severity 3 - 8 hours, ; Severity 4 - 1 Business Day or as per service catalog
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The Service is fully supported by iOCO's 24/7 Service Desk providing a single point of access for all incidents and requests. The service is available via telephone, email or iOCO Support portal. Responses are prioritised and addressed in line with the service levels detailed in the Service Level Agreement document.; All engagements have a named Service Manager for engagement and escalations with a Technical Service Manager who attend service review meetings.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onsite or online training is available for the solution and a Getting started full set of documentation is provided with an online Help Center.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: The WithSecure solution is designed to allow the full export of data from the application. Data extracts can be requested at any time during the contract. The data extract can be requested via a service request or via the Elements control panel.
• End-of-contract process: The customer has 30 days from the end of contract to download their data.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The solution provides a IOS and Android app. Mobile version provide malware protection, browser controls and secure VPN functionality.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: WithSecure™ Elements Security Center provides visibility to improve your company’s security status. It also does asset prioritization, vulnerability identification, patch management, and incident detection; and provides a comprehensive picture of critical dependencies for full situational awareness
• Accessibility standards: None or don’t know
• Description of accessibility: N/A
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: The solution has a REpresentational State Transfer (REST) API which enables users with the proper role to perform Create/Read/Update operations on records and manage records or consume REST services.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Limited branding customization can be performed via the Elements panel by administrators.

Scaling

• Independence of resources: The WithSecure solution is a cloud native protection service designed to scale globally to accommodate any number of endpoints.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Reseller providing extra features and support
• Organisation whose services are being resold: WithSecure

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Data sanitisation type:
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Data can be exported from the solution in a number of ways: ; GUI, ; .csv formats, ; via REST API,
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats:
  • CSV
  • Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: SLA - 99.9% availability. If iOCO service fails to meet this key objective in a given calendar month, 5% of prorated monthly cloud service fee will be refunded directly to the customer account within 30 days.
• Approach to resilience: Data Centres have a high resilience setup:; • Highly secure, Tier 4 data centre environment; • Dual power circuits with UPS; • Backup power generators; • Constant environmental monitoring; • Dual network and redundant data fabric; • Software-defined storage services; • Converged and hyper-converged infrastructure; • On-going capacity planning
• Outage reporting: Dependent on customer requirements, outages can be accessed via Public URL, or notified by telephone and/or email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: The application is multi-tenanted. There is a back office management layer where tenants and users are setup. Application back office administrators are named and limited in number. The tenant admin has access to report on any action taken within their own tenant.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: No

Security governance

• Named board-level person responsible for service security: No
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Security is managed at three levels: Infrastructure, Environment, Customer. iOCO Cloud team are wholly responsible for Infrastructure security, governing DC / Hardware, Network and Security devices. iOCO team is responsible for managing the environment where the application is running - for example building and hardening the application to vendor recommendations. Customer is responsible for in-application security.(e.g. user role access) and the security of on-premise components that maybe required for integration purposes. In Public Cloud deployments the responsibility for infrastructure falls on the supplier and in the event of SaaS solutions the infrastructure and application is managed by the suppliers controls.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: The change management processes follow ISO27001 A.12.1.2 controlled mechanism for making changes to operational environments.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We subscribe to multiple vendor provided vulnerability; notification services. All vulnerabilities are reviewed and applicable patches are administered through the change control process . Mitigation measures will always be considered first, with critical patches targeted for resolution within 30 days.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Denial of Service is applied on all Internet links , with Intrusion detection\protection available to customers on request. All security events are logged\notified based on severity. Any attempted platform security compromises are dealt with 24/7 by security engineers. The responsibility remains with the customer to ensure detected intrusions are re-mediated where customershavecontrol,permission,oraccesstomodifytheir service. iOCO recommends that customers follow security best practices including, but not limited to: ; • Maintaining effective firewall rules ; • Limiting the communication ports to only the necessary, for conducting business ; • Locking down access
• Incident management type: Supplier-defined controls
• Incident management approach: The incident response process complies with industry standards for legally admissible chain-of-custody and forensic data collection management processes and controls. Response standards, procedures, and methods are implemented based on the severity level of an incident. Incident reports are produced as part of standard post incident process and provided to customers on request.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Wellbeing

  Fighting climate change

  We keep our customers safe. Our ambition is to minimize the energy consumed by our products, without compromising the results and quality of our work.

  Wellbeing

  Driven by the novel and hardest cybersecurity challenges, our diverse workforce is there when it matters most. We make sure all our employees feel like they can bring their best and true self to work and enjoy the inspiring opportunities to learn and grow. We believe that by having our employees’ wellbeing in the center of our business we can succeed.

Pricing

• Price: £300 an instance a month
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: 30 day free trial available for 25 concurrent users.; Integrations into the trial may not be supported and could be subject to a cost. This can be discussed with the prospective customer.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at michael.morey@ioco.tech. Tell them what format you need. It will help if you say what assistive technology you use.