Tactical & Mobile

The tactical mode of the Orsec Technologies NMS (Network Monitoring Solution) system is designed for one-off audit or post-incident analysis operations. This mode is particularly useful in situations where detailed analysis and rapid response are required following a security incident or for a specific compliance review.

How tactical mode works for a one-off audit or post-incident analysis:

- Discreet and continuous data capture: In tactical mode, the NMS probe operates passively to record all network activities without interruption, acting as a digital "black box". This continuous recording capability ensures that data cannot be altered or deleted by malicious actors.

- Detailed metadata analysis: The NMS probe analyzes data packets in depth (Deep Packet Inspection (DPI) to extract precise metadata, such as source and destination IP addresses, ports, protocols used, and others relevant session attributes. This allows granular analysis of events before, during, and after an incident.

- Use of metadata for auditing and analysis: The collected metadata makes it possible to carry out a detailed audit of network activities, to detect anomalies, to identify possible security vulnerabilities exploited and to understand the progress of an incident. This wealth of information is crucial for post-incident analysis, making it possible to quickly isolate the cause, assess the extent of the damage and implement corrective measures.

- Integration with analysis tools: Although the NMS probe records and analyzes data internally, it is also designed to easily integrate collected data with other analysis or incident management tools. This allows security teams to leverage their existing tools for a more in-depth assessment and tailored response.

Main applications:

- Post-incident investigations: After an attack or security violation, tactical mode allows you to conduct a detailed investigation to trace events, identify attack vectors, and understand exploited vulnerabilities.

- Spot security audits: For compliance audits or scheduled security assessments, tactical mode provides an accurate overview of the current network status, making it easier to identify potential risks and verify compliance with security policies.

- Training and simulation: Tactical mode can also be used in a training context to simulate attacks and educate personnel on incident detection and response best practices.

NMS Tactical

Orsec Technologies' NMS system is an advanced network monitoring solution that provides complete visibility into network traffic up to Layer 7 (L7), using technologies such as Deep Packet Inspection (DPI). This solution is designed to be undetectable by hackers, thus guaranteeing the integrity and security of the data collected.

For one-off audits or post-incident analysis, the NMS system can operate in “Black Box” mode, discreetly and continuously capturing all network activity, allowing for uninterrupted monitoring and increased security. This passive and comprehensive logging capability is enhanced by DPI technology, ensuring that network activity logs are safe from deletion attempts by hackers.