Softcat Limited

Varonis - Data Security Platform

Delivers low-touch, accurate security outcomes. Powerful least privilege automation capabilities, data becomes more secure by the minute. Classifying data, revoking permissions, enforcing policies, and triggering alerts for our incident response team to review on your behalf. Enable them to use Varonis' world-class automation, visibility, and support.

Features

  • Full enumeration of all directories and Access Control Lists
  • Complete mapping of directory services' user and group membership
  • Behavioural-based threat models detect abnormal data activity in real time
  • Full auditing for file data, email, and Directory Service action
  • Vast library of hundreds of out-of-the-box data classification rules
  • Automated remediation of collaboration links in Microsoft 365, Google Drive
  • Comprehensive log of permission and membership changes
  • Enriched logs to make investigations fast and comprehensive
  • Enterprise search to facilitate Data Subject Access Requests
  • Complimentary proactive incident response and forensics team services

Benefits

  • Prioritise the most at-risk data and remediate to least-privilege access
  • Automated remediation at scale
  • Analyse user and device behaviour for signs of inappropriate behaviour
  • Automate alert responses to minimise impact of ransomware/other threats
  • Identify and eliminate/manage stale and toxic data to reduce risk
  • Help satisfy auditing and compliance requirements
  • Increase efficiency through business user access provisioning and entitlement re-certification
  • Automated access remediation to ensure least privilege
  • Automated posture management to find and fix misconfigurations
  • Third-party app risk management to help visualise third-party risk

Pricing

£28.77 a unit

  • Education pricing available
  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at psitq@softcat.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

9 9 4 2 3 9 5 8 8 1 7 2 1 0 3

Contact

Softcat Limited Charles Harrison
Telephone: 01628 403403
Email: psitq@softcat.com

Service scope

Software add-on or extension
No
Cloud deployment model
  • Public cloud
  • Private cloud
  • Hybrid cloud
Service constraints
EULA Governance

Varonis can be implemented in your own cloud environment. The Varonis architecture requires to be run on Microsoft Windows Server with Active Directory for security and SQL Server for data storage, but can monitor and manage a plethora of Microsoft/LDAP/Linux/UNIX/NAS platforms
System requirements
  • Windows server 2008 R2 SP2 or newer
  • .NET framework 4.7.2 and 3.5 SP1 installed on all nodes
  • Microsoft SQL Server 2014/2016/2017 - standard/enterprise

User support

Email or online ticketing support
Email or online ticketing
Support response times
Varonis standard support is available Monday to Friday from 9am to 9pm local time. 24/7 support can be accessed for an additional cost.
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.1 AA or EN 301 549
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
Varonis Support has 3 tiers of response- FLS (T1), Tier2, Tier 3. Most cases that are open by SEs/Partners/customers will be received by FLS, and escalated according to need.
SLA is defined upon the level of Support Services the customer has purchased and the severity of the case.
For further details, please see "Varonis Support Principles" document
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Training can be done leveraging Varonis Education Services for standard training of the application and advanced/troubleshooting classes that are offered. All training is done
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
Varonis can be implemented in your own cloud environment. You control who has access to your Varonis environment, and we do not have access to your data or facilities. Varonis Systems does not host, process, or maintain access to any customer data or facilities. All data processing is performed at the customer facility, under the control of customer staff
End-of-contract process
Varonis can be implemented in your own cloud environment. You control who has access to your Varonis environment, and we do not have access to your data or facilities. All data processing is performed at the customer facility, under the control of customer staff.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
Application to install
Yes
Compatible operating systems
Other
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
N/A
Service interface
No
User support accessibility
None or don’t know
API
Yes
What users can and can't do using the API
Varonis has exposed APIs in its core DatAdvantage and DataPrivilege platforms. These APIs expose reports, file system change information, the capability to change
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
No
Customisation available
No

Scaling

Independence of resources
Varonis can be implemented in your own cloud environment. You control who has access to your Varonis environment, and we do not have access to your data or facilities. All data processing is performed at the customer facility, under the control of customer staff.

Analytics

Service usage metrics
No

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
None

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • European Economic Area (EEA)
  • Other locations
User control over data storage and processing locations
Yes
Datacentre security standards
Managed by a third party
Penetration testing frequency
Less than once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
Other
Other data at rest protection approach
Encryption of all physical media
Data sanitisation process
No
Equipment disposal approach
In-house destruction process

Data importing and exporting

Data export approach
Varonis has a number of reports and APIs which can be used to pull data from the system into various formats or feed the information into other tools.
Data export formats
  • CSV
  • Other
Other data export formats
  • PDF
  • EXCEL
  • HTML
Data import formats
Other
Other data import formats
Varonis does not import data this way

Data-in-transit protection

Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • Other
Other protection between networks
Varonis Systems does not host, process, or maintain access to any customer data or facilities. All data processing is performed at the customer facility, under the control of customer staff.
Data protection within supplier network
  • TLS (version 1.2 or above)
  • Other
Other protection within supplier network
Internally, Varonis is committed to strong IT security controls and policy which includes regular reviews by C-level.

Availability and resilience

Guaranteed availability
Components can be made highly available and we offer DR best practice documentation with our solution.
Approach to resilience
Our support and professional services are located in 3 different continents, and act as a backup for each other in case of disaster. More information is available on request.
Outage reporting
Components can be made highly available and we offer DR best practice documentation with our solution. Varonis provides email alerts if there are component connection issues, and additional details are available in the Varonis management console, and in the Event Viewer logs.

Identity and authentication

User authentication needed
Yes
User authentication
Identity federation with existing provider (for example Google Apps)
Access restrictions in management interfaces and support channels
Permsion and Role based
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Other
Description of management access authentication
Data Security Platform Installation Prerequisites | User Roles, Permissions, and Security Model (varonis.com)

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
User-defined
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
User-defined
How long system logs are stored for
User-defined

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
Yes - https://www.varonis.com/trust
ISO/IEC 27001 accreditation date
22/05/2018
What the ISO/IEC 27001 doesn’t cover
There are no exceptions, the certification covers - Deveopment, Research, Software Delivery, Support, Professional Services, Delivery Cloud Based Sofware Solutions, Sales, Training, Project Management, Design and planning of risk assessment, protectio of information systems, securtity of corporate and cloud networks.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
Yes
Any other security certifications
  • ISO 27017:2015
  • ISO 27018:2019
  • SOC2
  • ISO/IEC 27701
  • NIAP Common Criteria Certification

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Varonis maintains compliance with various standards and certification authorities. Varonis certifications are available here: https://www.varonis.com/trust.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Varonis provides customers with maintenance and upgrade releases periodically. We ensure that customers are notified of new versions via email and or the Varonis customer portal. When implemented within the customers cloud environment configuration and change management processes are the responsibility of the customer.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Varonis has a Vulnerability and Threat Management Policy. Varonis systems are scanned and results are reviewed by the CISO and IT departments. Security vulnerabilities are remediated within the timeline defined within the policy which includes procedures decided by the CISO for zero-day and other urgent patches.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Varonis' Security Operations Center, which comprise information security personnel are responsible for the review and/or monitoring of information security incidents or events.
Incident management type
Supplier-defined controls
Incident management approach
Varonis has an Incident Response Policy that includes notification to the relevant stakeholders (including customers) as needed. Varonis will notify customers with all relevant information and cooperate with reasonable requests for information. This policy is aligned with industry best practices and included prepartion, identification, reporting, containment, discovery, eradication, recovery, and post incident report.

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Social Value

Fighting climate change

Fighting climate change

We continuously strive to minimize the impact of our operations on the environment, while maximizing sustainable business practices to better serve our employees, customers, partners, shareholders and communities.
Covid-19 recovery

Covid-19 recovery

n/a
Tackling economic inequality

Tackling economic inequality

We support and strengthen our local communities by enabling employees to donate time and resources where they are most passionate, by investing in causes that have a positive social impact, and by providing skills to people around the world to help maximize their full potential. Through our giving back program, our employees have helped hundreds of students realize more of their limitless potential with consistent, hands on mentoring in life skills and academic subjects.
Equal opportunity

Equal opportunity

We are dedicated to the success of Varonis employees worldwide through an inclusive workplace experience that supports their growth and well-being. We are committed to hiring the best talent and bringing together individuals across unique backgrounds, cultures and identities. We are proud to have been recognized as one of the top places to work in several of our locations, including New York City and North Carolina.
Wellbeing

Wellbeing

N/A

Pricing

Price
£28.77 a unit
Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
Data Risk Assessment Based upon customer focus e.g. Cyber Resiliency Assesment, Insider Threat Assessment, Compliance Assessment (e.g. GDPR), Ransomware Readiness Assessment, Cloud Application assessment, Office 365 Assessement
Link to free trial
Example https://info.varonis.com/hubfs/Website_Reboot/Service_Datasheets/Services-Datasheet-Cyber-Resiliency-Assessment.pdf

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at psitq@softcat.com. Tell them what format you need. It will help if you say what assistive technology you use.