The Kryptis malware recently attempted to spread through the infrastructure of one of our customers, a SME-sized company, operating in the legal sector. Countered by our teams, this threat followed the attack patterns of modern malwares,which are difficult Difficult to detect with traditional tools, this customer case highlights the weaknesses of perimeter defense logics. In this post we explain, in a pedagogical way, how we were able to block this cyber attack by exploiting the triptych: SIEM UEBA / Threat Intelligence / Human Expertise. The Kryptis malware The Reveelium UEBA SIEM started by detecting attempts to access the Dark Web, [...]

THE SOC REVEELIUM OBTAINS THE U.A.F. LABEL ITrust has obtained the UAF (Used by French Military) label, granted to our Reveelium technology, integrated into our SOC. This label, awarded by the French Ministry of the Army, is the result of several years of collaboration in the protection of vital national organizations. This recognition reinforces ITrust's position as a reference in the market of AI-enhanced sovereign cybersecurity solutions. (SIEM UEBA, XDR, Scanner and EDR) "The Reveelium SOC is the first SOC to receive the UAF label. Three French ministries are now secured by the SOC Reveelium, in order to fight against [...]

How does Reveelium UEBA / TreatHunting SIEM work? The principles that govern the operation of SIEM (Security Information Event Management) tools have been well known for years. The arrival of artificial intelligence for cybersecurity tools is less well known. We try to explain it simply here, despite the important technical knowledge usually necessary to fully understand the functioning of very innovative AI technologies.   The logical building blocks : A SIM: Security information management: it centralizes and aggregates logs from applications, equipment, security tools (FW, antivirus, proxies, etc...). An advanced SIM can generate some alerts based on (simple) search criteria [...]

Above : Feedback from the field CIOs, CISOs or managers often ask us what the best practices are to apply to protect themselves effectively and quickly. The first answer I give them is to identify the risks and to set up a simple organization (CISO, DPO, PSSI) adapted to the structure's functioning. Within ITrust for 14 years, we have had the time to form an opinion on the best practices, correlating them to those identified by the ANSSI or ENISA or SANS. We have some convictions and we wanted to confirm them with a mini study based on independent recognized [...]