Network Operations Center (NOC)

Monitoring

You learn about a fault from us and not from your staff. Monitoring is the basis for everything else in the NOC. Without measured values, every statement about the operational state is only an assumption.

Very few outages come out of nowhere. A switch becomes unstable. A data backup no longer completes. A server has been reporting errors for days. Anyone who does not look continuously notices this only once production has stopped. By then a small fault has turned into an expensive standstill.

We monitor your network hardware such as switches and routers, your servers and the services that are critical for you. Technically we work with SNMP and ICMP. SNMP delivers the status values from the devices themselves. ICMP checks availability by ping. On request, the queries run over secured VPN connections. In addition, we monitor the data backup and the asset inventory. Both are otherwise often left undone, because nobody feels responsible for them.

Monitoring takes place per object and per site. For this we use dedicated monitoring nodes, one per network segment. That way we also gain visibility into segments that are deliberately separated from one another. You do not have to weaken your segmentation for this.

Not every device needs the same attention. There are therefore three availability levels, A, B and C. The level depends on your protection requirement. It determines how closely an object is monitored and which response time has been agreed for it. A core switch in the plant is treated differently from a printer in the administration office. This keeps costs low where downtime is tolerable.

The technical basis is the Central Operations Dashboard (COD). This is a vendor-independent platform from extocode GmbH. Systems from different manufacturers come together there in a single monitoring view. As a result you get one picture of your infrastructure instead of several isolated solutions.

Firewall service

Your firewall stays maintained, up to date and monitored. You do not need to keep specialists of your own for this.

A firewall is only as good as its maintenance. Rules become outdated. Threats change. One wrongly placed tick opens the door wide. Many rule sets have grown over years. At some point nobody dares to delete a rule any more.

We take over the setup and maintenance of the rule set in line with your protection requirement. Added to this are ongoing updates, hardening and monitoring. Operations also include the monitoring of network security and the operation of intrusion prevention.

The second part is the connection of your sites. We link them by site-to-site VPN. Staff receive secure remote access by client-to-site VPN. We publish services that have to be reachable from the internet through a reverse proxy. We avoid direct exposure to the internet.

There are two routes for operations. We operate the firewall that is already in place at your premises. Or you obtain it as firewall-as-a-service from the inducio data centre and need no hardware of your own for it. The second route is of particular interest when a replacement is due anyway.

The operation of the firewall belongs in the NOC. It consists of rule set maintenance, updates and monitoring. Detecting attacks on this component is the task of threat detection in the SOC. Both work on the same firewall, but with a different remit.

Network and automation service

You receive planning, build and operation from a single provider. This spares you the handover between planner, installer and support provider. It is at exactly this handover that responsibility tends to get lost.

Networks grow with the company. A new hall is added. A site is connected. In between, someone helps out with a switch from the drawer. After a few years nobody knows exactly what is connected where and why. At the latest with the next rebuild, this costs time and nerves.

We record the current state and the requirements, design the concept and implement it. After that we maintain, monitor and document on an ongoing basis. The scope in detail:

• Planning and implementation of LAN and WAN infrastructures, including the configuration of active components such as switches and routers
• Structured cabling and professional measurement
• WLAN planning, coverage design, WLAN measurement and enterprise WLAN
• Network security with security policies and VPN
• Consulting, network concepts and maintained documentation

Firewalls are part of this as well. Their operation is described by the Firewall service building block. Continuous monitoring is provided by Monitoring, and help in the event of a fault by 24/7 support.

We are vendor-independent. We select components according to your needs and not according to a manufacturer we would be tied to. We continue to operate existing systems instead of replacing them without need.

The second part of this building block is automation. Recurring rollouts and configurations run automatically instead of by hand. This does not just save manual steps. Above all it removes the deviations that arise from manual work over the years. Every change goes into the Documentation, so that the network remains traceable.

Endpoint Management

Your devices receive software, updates and configuration automatically. This spares your IT staff the round from workstation to workstation.

Manual device maintenance takes up time and leaves gaps. A laptop was away on holiday and missed several update rounds. Another machine is still running an old version because it was not reachable during the last rollout. Gaps like these only come to light when someone exploits them.

We manage PCs, laptops, servers, smartphones and tablets centrally through one platform. Software distribution and patch management run automatically, for operating systems and for applications. Added to this are remote access, remote maintenance and support, as well as licence and application management. The technical basis is baramundi.

You decide how far this goes. Either you take the licence alone as a monthly subscription, the Software Management Licence, and work with it yourself. Or you take the management including our services. In that case we take on connection, automation, rollout and operation.

The distinction matters. Endpoint Management manages and updates your devices. It does not protect them against threats. That task belongs to Endpoint Protection in the SOC, with anti-virus and Endpoint Detection and Response. The two belong together, but they are not the same thing. An up-to-date patch level reduces the attack surface. Detection catches what gets through regardless.

Documentation

In the event of a fault, everyone knows immediately how your IT is built. This spares the search for the one colleague who still has it in their head.

Missing or outdated documentation costs time at exactly the moment when none is available. Someone is looking for the password for a device that a different person set up two years ago. Knowledge sits with individual people. If that person is on holiday, the resolution comes to a halt.

We record your network and IT infrastructure and document it in a structured and consistent way. When something changes, we bring the documentation up to date. Documentation that was written only once during the build is worthless after a year. Storage is central and maintained. Your team and we see the same state.

The way it is prepared serves two purposes. In day-to-day operations it acts as a reference work. For auditors and supervisory bodies it serves as evidence. For audits and for KRITIS evidence, traceable documentation is often mandatory. You will find the wider context under Critical Infrastructures.

The documentation is deliberately placed here in the operations section. It arises continuously out of operations. Its value in an audit is the result of this work and not its reason. Documentation that is written only for the auditor becomes outdated between two audits.

24/7 support

You have one central point of contact for all IT problems, at night and at weekends as well. This spares you an on-call rota of your own and the question of whom to call at three in the morning.

IT problems do not keep to office hours. A standstill during the night shift costs just as much as one in the morning. Faults, security threats and questions about day-to-day operations all run through support. You report everything to one place. You do not have to work out which service provider is responsible for which device.

Behind this stands access to expert knowledge for complex IT systems and specialist applications. That is the actual point. A reporting channel on its own solves nothing. What matters is that someone at the other end understands the system and is allowed to repair it.

Support complements monitoring, it does not replace it. Monitoring reports on its own what is measurable. Support is the route for everything that only your people can see. Both routes end at the same point of contact. That way no case is left lying between two areas of responsibility. Short downtimes have less effect on revenue and reputation. How the reporting route, prioritisation and response times are regulated is set out below under How we work.

Onboarding, the route into the NOC

This section is project business and not a continuous service. It describes how you get into operations. Only what is in an operable state can be operated. That is why a managed service as a rule begins with a project.

Good technology is only of use if it is introduced properly. We begin with an analysis of your existing IT environment. This is followed by the design of a future-oriented solution architecture, with an eye to mobility, Modern Workplace and the data centre.

During implementation we take on systems engineering, configuration and installation of new hardware and software. In doing so we work with standardised and with customer-specific installation processes. We integrate new systems. Existing ones we migrate smoothly into your current infrastructure. Clear project management sits over the whole project and coordinates everyone involved.

At the end there is a proper handover. Whether you then operate the environment yourself or hand it over to our NOC is your decision. The second route is the simpler one. Build and operation are then in one pair of hands, and the systems have already been recorded and documented.

Request a project

Recording. We survey the current state, the requirements and the protection requirement. From this it follows which objects are monitored and which availability level applies to which system.

Connection. We set up the monitoring nodes, one per network segment. We connect your devices to our monitoring and implement rule sets and VPNs.

Operation. We monitor, patch and back up continuously. We record every change in the documentation.

Fault. We raise the alarm proactively and prioritise according to the agreed availability level. In complex incidents we escalate along the paths laid down in incident management. That way it is clear who decides, before it gets serious.