GDPR Requirements

SGBox’s Features

Article17

(“right to erasure/right to be forgotten”)

GDPR requires to define data-destruction policy (retention period) that respects the right to obey data of the concerned party.

SGBox allows not only registering all users’ accesses to company’s files via server audit and NAS but also to prove that secure personal data cancellation procedures are respected.

Article 24

(“responsibility of the controller”)

Article 25

(“data protection by design and by default”)

Article 28

(“processor”)

• Monitoring of users access to resources (authentication systems, VPN accesses, file server, NAS, email server, etc);
• Monitoring of system administrators accesses to resources (access log, details of operations made in the system);
• Monitoring of traffic logs of perimeter firewalls (information about network connections from internal systems, communication with Command and Control systems, possible actions of data exfiltration identification);
• Monitoring of generated logs from Endpoint Protection platforms (EPP) and Endpoint Detection and Response (EDR) allowing malware identification or possible attacks aimed to avoid company data;
• Monitoring of logs generated by Host Intrusion Prevention and Detection (IPS, IDS) tools, also Host-based intrusion detection system (HIDS);
• Monitoring of logs generated by File Integrity Monitoring (FIM) and Data Leakage Protection (DLP) solutions aimed to protect company data;
• Decrease attack surface with vulnerability management activities (NVS module), identification of data asset vulnerabilities caused by updates lack or by incorrect configuration (hardening); threats classification;
• Collection of Open Source Threat Intelligence Feed of third parties (LM and LCE modules) to reduce number of false positive and provide accurate information to technical staff;
• Advanced features of data analysis and presentation to facilitate the IT incidents management process.

Taking advantage of collected data, Log Correlation Engine module (LCE) allows to identify risk scenarios with correlation rules that can apply automatic countermeasures.

Article32

(“Security of processing”)

SGBox allows to demonstrate adequacy of technical and informative measures via security system data centralization (firewall, IDS / IPS, EOO, EDR, DLP, FIM, VPN, directory service, etc).
A powerful log recognition and normalization engine with a simple and intuitive interface allows users to aggregate logs produced by different platforms in the company. The collected data can be centrally analyzed and managed in real time. It can be done in logs history as well. The analyzed data can be presented with graphs and detailed personalized reports (dashboards).

When it is necessary to take advantage of a strong authentication, it is possible to use authentication mechanisms of an external directory server to connect to SGBox web console.

Article 33

(“notification of a personal data breach to the supervisory authority”)

Article 34

(“communication of a personal data breach to the data subject”)

SGBox encourages the detection of system violation (Articles 33 and 34) using automatic features based on behavioral models of User Behavior analytics (UBA).
The platform offers a complete visibility (24×7) of security events (dashboard, views, etc.) to identify an attack and accelerate response time in case of an IT incident.

Information centralization (with a possibility to set up a personalized retention time to respect the security system needs and proportion principle) encourages investigations and allows to set up root cause of a data breach

Article 35

(“data protection impact assessment”)

SGBox offers a possibility to differentiate the access to logs information according to least privilege and need to know principles.
On request, SGBox allows to disguise information about navigation of users from proxy servers logs in visualization (via parser), in order to allow access only to authorized users (data obfuscation).
With SGBox, it is possible to correctly apply role-based access control technics to limit access to data of logs included in SIEM platform.

The platform offers asset discovery features as well as those related to definition of dynamic groups of host related to specific company functions (perimeter systems ISO 27001, human personnel systems, etc).