DE, Deutsch EN
Arrange a call
IT security

A secure network starts with the question of who may talk to whom.

We divide your network into zones, set a rule for every access and test both automatically. You receive the vulnerabilities we find sorted by urgency.

Arrange a call Five questions for your network

Our approach

A firewall protects the outer boundary of your network. The greatest damage happens behind it. That is where an incident spreads from computer to computer. This is why we give every area its own boundary.

Services

Four building blocks for a secure network

Every project starts with a survey of all paths that are open today. The survey determines the order of the building blocks.

  1. 01

    Segmentation

    We separate administration, production, guests and servers into zones of their own. Every connection between two zones has its own rule. This keeps an incident confined to its zone.

    • Zones
    • VLAN
    • Firewall rules
    • Guest Wi-Fi
  2. 02

    Access and authentication

    We define who accesses which systems from where. Administrator accounts and remote maintenance get a second factor. We review permissions with you at fixed intervals.

    • Second factor
    • VPN
    • Permissions
    • Remote maintenance
  3. 03

    Testing and hardening

    Automated test runs look for vulnerabilities in your network architecture. You receive the findings sorted by urgency. We fix the urgent points with you first.

    • Test runs
    • Updates
    • Hardening
    • Report
  4. 04

    Incident response and recovery

    We assign the tasks for an emergency in advance. A plan sets the order of recovery. We rehearse restoring data from the backup with you beforehand.

    • Incident response plan
    • Recovery
    • Backup
    • Drill

Zoning plan

This is what a zoning plan looks like.

Each row is a zone and each column is a destination. Every cell stands for a rule in your firewall. Three to five zones are enough for most businesses.

Administration reaches its business applications. It reaches the internet through a filter and machines only through the control room.

Example of a zoning plan: which zone may talk to which
From / toAdministrationProductionServersGuestsInternet
Administrationopencontrol room onlybusiness applications onlyblockedthrough filter
Productionblockedopendatabase onlyblockedblocked
Serversblockedblockedopenblockedupdates only
Guestsblockedblockedblockedisolated from each otheropen
Internetblockedblockedpublished services onlyblockednot applicable

openonly with a dedicated ruleblocked

Process

How a security project runs

  1. 01Survey

    We check every open path and every access right.

  2. 02Zoning plan

    You receive a plan for the connections between your zones. It follows your processes.

  3. 03Implementation

    We switch over one zone at a time. The way back for every step is fixed in advance.

  4. 04Verification

    A test run checks every permission and every block individually.

Step 04 in detail

At the top is what an attacker could exploit today.

A test run quickly turns up dozens of issues. We sort them by urgency and name the affected system for each one. On Monday morning your team knows its first task.

Test report, 14 systems Example · sorted by urgency
  1. urgentRemote maintenance without a second factorFirewall, head office
  2. urgentFirmware with a known vulnerabilitySwitch, production
  3. soonGuest Wi-Fi reaches network printerGuest zone
  4. soonAdministrator account without expiry dateDirectory service
  5. plannedOutdated encryption methodMail server

Plus 37 issues of low urgency.

Self-assessment

Five questions for your network

You can answer each of them without a service provider. Your answers stay in this browser window.

Do all administrator accounts have a second factor?

Is the guest Wi-Fi separated from the company network?

Have your firewall and switches received a firmware update in the last six months?

Have you restored anything from your backup this year?

Do you know which services are reachable from outside?

In practice

From our projects

Our projects range from internet service providers to advertising agencies.

  • Regional internet service provider, Germany

    Result
    Customer networks and the provider’s own infrastructure sit in clearly separated security zones.
    Task
    Design of the firewall architecture and consulting.

  • Agency of an international advertising network

    Result
    Security updates reach every workstation from one central point in a traceable way.
    Task
    Introduction of Patchlink for all Mac workstations at the sites across Germany.
See all client projects

Questions

Frequently asked questions

Is your question missing? Call us or write to us.

+49 6123 9252933 info (at) bitcontrol.net
Does this replace our existing firewall?
Not necessarily. The existing equipment is often good and merely configured badly. The survey shows which is the case.
Will our staff notice the segmentation?
Hardly in their daily work. It becomes noticeable where a device used to be allowed more than it needed. We discuss these points with you beforehand.
Does this help us with NIS2?
NIS2 explicitly names access control, the second factor, incident response planning and the handling of vulnerabilities. Whether the law applies to your company depends on its sector and size. The Federal Office for Information Security (BSI) gives a first assessment with its NIS2 applicability check (opens in a new tab) (in German). This classification belongs in legal hands, and we take care of the technology behind it.
How often do you test?
Automated test runs take place at a fixed interval agreed with you. We also test after every major change to the network.
What happens if an incident occurs at the weekend?
We accept fault reports from Monday to Friday between 8:00 and 17:00 except public holidays. We agree fixed response times in a separate service level agreement. Until then your incident response plan sets out the tasks of your team.

Other areas

Next area AI We use AI where it gives your team hours back. Go to AI Network We build networks that stay stable under load.

Talk to us about your IT security.

Typical reasons are a questionnaire from your insurer, a new site or a near miss.

Arrange a call