Cybersecurity is complex,
Network Box
makes it simple
Offensive Security
While businesses may be aware
of the importance of cybersecurity,
it is less common for them to actively
seek out vulnerabilities that hackers
ALL-IN-ONE
could exploit. Network Box can
help you with your risk assess-
ment, and audit or compliance
Cybersecurity Solution
requirements with the following
Network Box Red Team services:
■ Vulnerability Assessment
and Services ■ Penetration Testing/Red Teaming
■ Attack Simulation
Network Box can ■ Incident Response
Cyber attacks are ongoing, and only help to protect your and more...
having a firewall is not enough! business against:
Staying protected requires comprehensive ■ Hackers
cybersecurity and a dedicated team of ■ Network Intrusions
security engineers to monitor and protect ■ Viruses / Malware
your network. Unfortunately, most business- ■ Zero-Day Threats
es do not have the time or resources to ■ Ransomware
implement these effectively. To help, ■ Phishing Campaigns
Network Box offers world-class, enter- ■ DDoS Attacks
prise-grade managed cybersecurity ■ and other malicious
services that are effective and affordable. cyber threats
Multi-Award-Winning 24x7x365 Monitoring and Reporting
Cybersecurity Technologies Local Support Network Box provides various
Comprehensive protection, no Network Box Security Operations monitoring and reporting options
additional solutions needed. Centre (SOC) protects your to analyse your network.
■ Hybrid Firewall network continuously. ■ Real-time notification and alerts
■ Intrusion Detection & Prevention ■ Quadruple ISO-Certified SOC for critical security incidents
■ Anti-Malware (inc. Zero-Day) ■ 24-hour network Monitoring, ■ HTML-5 Dashboard / GUI
■ Web Content Filtering Management, and Protection ■ Android / iOS App
■ Anti-Spam & Email Protection ■ In-house staff able to respond in ■ Weekly KPI, Security Scan and
■ VPN / DLP / Virtual Patching real-time, no third-parties involved Risk Management Reports
and more... ■ No additional IT staff needed ■ Quarterly Best Practice Reports
NETWORK BOX HONG KONG LIMITED [Link]
16th Floor, Metro Loft, 38 Kwai Hei Street, Kwai Chung, Hong Kong.
+852 2736 2083 +852 2736 2778 info@[Link]
It looks like a product, but it is actually
a 24x7x365 cybersecurity service
24x7x365 Management
of your network’s cybersecurity
and company security policies
24x7x365 Monitoring
of your network, hardware and
global cyber threats
24x7x365 Mitigation
of emerging cyber threats; automated
and performed in real-time
Network Box HQ’s ISO 9001 / ISO 20000 / ISO 27001 / ISO 31000 certified Security Operations Centre (SOC), ensures your network is
protected 24/7. To properly monitor cyber threats, the SOC processes over 800 million statistical data packets each day. If new threats are
detected, security patches are automatically PUSHed out and installed in your Network Box system in real-time.
Managed Unified Threat Management Plus (UTM+)
Cybersecurity Services Company Overview
■ Next Generation Hybrid Firewall NETWORK BOX HONG KONG LIMITED
■ Anti-DDoS [LITE] Tel: +852 2736 2083 Fax: +852 2736 2778
■ Intrusion Detection, Intrusion Prevention
■ Virtual Private Network, SD-WAN
Email: info@[Link]
■ Anti-Malware, Anti-Zero-Day-Malware, Anti-Mobile-Malware [Link]
■ Email Protection, Anti-Spam, Anti-Phishing
■ Data Leakage Protection
■ Web Content Filtering
Network Box: Securing Organisations 25+ Years
■ Application Scanning, Application Control [LITE] Security Operations Centre: 24x7x365 Management.
■ Infected LAN Monitoring, IoT Protection
■ Entity Management, Enhanced Policy Control
Global Security Operations Centres: USA, Europe, Asia
■ Virtual Patching Organisations Secured:
■ Cloud Email Backup, Cloud DNS Backup (High Speed, Security Hardened) 2,500+ Organisations, Across 3,500+ Sites
■ Cloud IP/Domain/SSL Reputation Service
■ Customisable Dashboards, Customisable Reports
■ Cloud SIEM+ (rolling 90 days data storage)
■ 24x7x365 Monitoring, Response and Support
■ Real-Time Security Updates
■ Hardware Monitoring and Backups
International Certifications, Compliances,
and Attestations
Optional Add-On Cybersecurity Services ■ ISO 9001: Quality Management
■ ISO 20000: IT Management
■ ISO 27001: IT Security Management
■ Web Application Firewall (WAF) ■ ISO 31000: Risk Management
■ FULL Anti-DDoS Protection ■ PCI DSS: Visa, MasterCard, American Express
■ FULL Application Scanning and Control ■ SSAE 18 SOC2 (USA): Security and Privacy
■ Dark Web Monitoring ■ SG Cyber Safe (Singapore): Cyber Trust Advocate Certified
■ Full Cloud SIEM+ (usage as determined by client) ■ IPv6 Gold Core Phase II
■ Zero Trust and End Point Managed Detect Response ■ Hardware Certifications: CE, FCC, and RoHS
■ Offensive Security: Penetration Testing, Vulnerability Assessment, Attack ■ Computer Information System Security Product Quality Supervision and
Simulation, Incident Response, Application Audits, Forensics, Red Teaming Inspection Center of the Ministry of Public Security (Mainland China)
Service Response Times Auditing and Reporting
Average PUSH Update Time: External View Security Scan: Weekly, Risk Management
Once Every 8 Seconds; 10,800 Times/Day
Average Response Time: Best Practice Reporting: Quarterly, Risk Management
1 Minute 34 Seconds, Response to End Users
KPI Management Reporting: Weekly, Risk Management
Service Delivery Platform:
Physical Hardware, Virtual, Cloud (MESH Cybersecurity Architecture) Customised Audit Reporting: As Per Client Requirements
Why a true 24×7×365
Security Operations Centre
is indispensable for modern
organisations’ Cyber adversaries never rest. They probe for
vulnerabilities at three in the morning, at
weekends and on bank holidays. Hackers,
cybersecurity
malware, and undesirable content are
always trying to get into your networks.
Cybercriminals are always trying to steal your
confidential data. Without uninterrupted
monitoring, there is a window—sometimes
measured in seconds—between the first sign
of compromise and the moment attackers
entrench themselves.
Network Box Security Article Why a true 24×7×365 SOC is indispensable for organisations’ cybersecurity [Link]
A genuine 24×7×365 Security Operations The financial advantage
Centre (SOC), operating from a pur- The financial case for a managed SOC is compelling.
pose-built facility with analysts working Staffing costs for analysts working unsociable hours
eight-hour shifts around the clock, ensures demand premium pay. Infrastructure licences and
there are no blind spots. In contrast, a recurring fees for SIEM, endpoint detection and
so-called cloud or virtual SOC run in-house response tools, threat intelligence subscriptions, and
by a limited team typically lacks full-time secure log storage quickly mount up. Training budgets
balloon as each engineer continually updates certifica-
human presence, relying instead on auto-
tions—CISSP, GIAC GCIH, CREST, OSCP and
mated alerts during business hours and vendor-specific accreditations—even if they engage
manual intervention when personnel are on only sporadically with incidents. In a managed SOC,
call. The difference is not merely semantic: these expenses are shared across a broad client
it is the divide between constant vigilance base, delivering economies of scale and predictable
and reactive firefighting. pricing. In-house virtual setups, by contrast, struggle
with unpredictable overtime, licence renewals, and the
Attempting to replicate this with an internal cloud-driv- false economy of nominal 24×7×365 coverage.
en solution can appear superficially attractive. You
lease virtual infrastructure, deploy a Security Informa-
tion and Event Management (SIEM) platform,
Expertise beyond your firewall
subscribe to threat feeds and designate a handful of Expertise is another gulf. A true 24×7×365 centre
security engineers to monitor dashboards during the fields Tier 1 and Tier 2 analysts, threat intelligence
working day. However, when the office closes, that specialists, incident responders and forensic engineers.
limited team relies on on-call rotas, VPN access, and They dissect diverse attack vectors, from zero-day
personal devices to respond. Response times length- exploits to supply-chain intrusions, drawing on collective
en, fatigue soars, and minor incidents can escalate experience across multiple sectors. An in-house team
into major breaches. By contrast, a physical SOC tethered to internal systems sees only your network’s
staffed 24×7×365 guarantees analysts see, investi- alerts, missing attack patterns shaped by other indus-
gate, and contain threats at any hour without depend- tries, large-scale red team exercises, and sophisticat-
ence on after-hours call-outs. ed incident-response playbooks. They lack the
breadth to anticipate what lies beyond your firewall.
Certified excellence
Maintaining top-tier international certifications further
emphasises the disparity. A properly certified SOC
holds ISO 9001 (Quality Management), ISO 20000
(IT Service Management), ISO 27001 (Information
Security Management), ISO 31000 (Risk Manage-
ment), PCI DSS (Payment Card Industry Data Securi-
ty Standard) and other accreditations such as SG
CyberSafe and GB Cybersecurity. Each requires signifi-
cant investment and engagement with expert consult-
ants such as SGS of Switzerland or TÜV of Germany.
Network Box Security Article Why a true 24×7×365 SOC is indispensable for organisations’ cybersecurity [Link]
Real-time shared intelligence Elevating strategic focus
Shared intelligence is a potent force multiplier availa- Outsourcing 24×7×365 operations liberates internal
ble only to external SOCs. When one client’s systems teams to focus on strategic projects such as embedding
report a novel ransomware variant at 3:00 am, the security into development lifecycles, architecting zero
managed SOC adapts its detection rules globally in trust frameworks and automating compliance checks.
real time. A siloed cloud SOC must wait for internal Freed from the grind of night-time alert queues, core
incident reviews before updating its ruleset, leaving staff can drive digital transformation and risk-mitiga-
your defences exposed. Managed providers aggre- tion initiatives—accelerating business growth.
gate threat data across geographies and industries,
rapidly bolstering defences—often augmented with
AI—against emergent campaigns and harnessing a
collective view that no single enterprise can replicate Continuous compliance validation
behind a virtual perimeter. Finally, reputable SOC providers submit to rigorous
audits—SOC 2 Type II, ISO 27001 and PCI DSS—
and engage in periodic red team/blue team exercises.
Holistic capabilities This continuous cycle of validation and refinement
A genuine SOC also assembles a comprehensive skill prevents complacency. In contrast, a cloud or virtual
set: alert triage, deep-dive investigation, threat in-house set-up may achieve an initial compliance
hunting, vulnerability assessment, incident contain- milestone but struggles to sustain it over time as staff
ment, compliance mapping, and dark web monitoring. churn and budget realignments erode capabilities.
In-house teams often lack one or more of these
functions, outsourcing or deferring complex tasks. The
outcome is patch-and-pray security rather than a The gulf between a brick-and-mortar SOC
holistic strategy. External SOCs integrate governance, staffed 24×7×365 with eight-hour shift
risk, and compliance experts who translate technical rotations and a cloud or virtual SOC man-
telemetry into board-level reports—ensuring regulato- aged by a small in-house team is stark.
ry alignment and actionable recommendations. One guarantees unwavering real-time
defence underpinned by shared intelli-
Metrics that matter gence and a full complement of special-
ists. The other, limited by capacity, exper-
Metrics matter. Managed SOCs deliver transparent
tise, and reactive workflows, leaves gaps
Key Performance Indicators (KPIs): mean time to
detect, mean time to respond, false-positive rates, and
that determined adversaries will exploit.
threat-coverage percentages mapped to recognised Investing in a true SOC is not a discretion-
frameworks. These KPIs frame business decisions ary cost but an essential strategic asset. It
and demonstrate the effectiveness of your security transforms cybersecurity from a cost centre
programme. In-house cloud SOCs typically lack the into a shield of resilience—ensuring your
disciplined service-level agreements and reporting organisation remains secure, responsive
rigour, leaving stakeholders dependent on anecdotal and ready; every hour, of every day, of
updates rather than quantifiable evidence. every year.
Network Box Security Article Why a true 24×7×365 SOC is indispensable for organisations’ cybersecurity [Link]
Artificial
Intelligence and
Machine Learning
In recent years we have seen the gradual We’ve grown accustomed to the predictability of computer-
introduction of Artificial Intelligence and ized systems - given the same input, the same outputs will
Machine Learning (AI/ML) technologies into be derived time and time again. 2+2 will always equal 4. But
our everyday lives. From talking to our these new AI/ML systems behave much more randomly -
Siri/Alexa/Google Home devices, to providing the ability to adapt to changing inputs - some-
automated chat response systems, computer times impressing with their comprehension of what we are
vision, and self-driving cars - these new asking, but also dramatically failing in bizarre ways.
systems are no longer ‘programmed’
procedurally. Instead, they are ‘taught’ or As with all such tools, the technology has both good and
‘trained’ in what is expected and respond bad sides. In this month’s article, we’ll talk about the
with ‘how’ to do it, decided by the machine positives of AI/ML by providing three examples of how it is
model itself. being used today for Computer Security.
Network Box Security Article Artificial Intelligence and Machine Learning [Link]
1. Access Denied 2. General Behaviour Analysis
Security Events Analysis While heuristics have worked well for access denied
For decades, we’ve been using Heuristics to analyze access security events, they haven’t been generally useful for
denied security events. An example would be setting a network behavior analysis. The idea here is to set thresholds
threshold for network port access denies per minute and and criteria for what normal network traffic might look like,
alerting/blocking should that threshold be exceeded. The so we can alert on anything abnormal. There has been some
classic ‘Portscan’ deny. success here with protocol enforcement (such as defining
what particular packet types for a specific protocol might
The problem with this approach is twofold: reasonably look like), but such a whitelisting approach is
laborious and must be customized for each and every
1. The threshold must be manually set and tuned depending protocol and application.
on the individual network configuration
2. Slow scans (where the attacker deliberately scans very AI/ML holds great promise for this. Rather than procedur-
slowly) are not detected. ally programming the behavior and thresholds for each and
every protocol, we merely train the model with known good
These types of heuristics are classic examples of procedural behavior and have it alert on anything different.
programming - if this, then that.
3. Meta Analysis
While general behavior analysis looks at protocols and
applications, meta analysis looks at network traffic attributes
(such as the source and destination IP addresses, authenti-
cated users, countries, networks, times of day, etc.). Here,
AI/ML can be trained with normal network traffic and
alert on anything different. An example of this would be
network logins on a Sunday from users who typically work
Monday to Friday.
Despite the meteoric rise of ChatGPT, AI/ML is still
in its infancy, particularly with respect to its use in
AI/ML models provide an alternative approach. Here, we
computer security. Computers have historically
train the model with examples of normal access denied been most useful in situations with clearly defined
traffic and targeted attack traffic. We teach the model by inputs, outputs, and procedural processes - and
example and have it set the thresholds automatically based have struggled with more vague problems such as
on that training. Like a child, the computer learns - we pattern matching. AI/ML is more ‘fuzzy’ and the
don’t tell it how to detect a targeted attack, but merely train requirements less well defined - the main issue
it to what such an attack might look like. After training, we being false positives. AI/ML often impresses with its
can then feed a stream of real network events into the accuracy but equally often fails dramatically for
model, and it can tell us if it sees anything that looks like an no discernable reason.
attack worth responding to (so that we can
Network Box Security Response continues to work
alter/block/respond appropriately). deploying AI/ML models at the moment, primarily
to our NBSIEM+ Event Analysis and Incident
This approach can be used not just for port scan detection Response systems. Over the coming months and
but also for more general high-level access denies such as years, we expect this tool to become more useful
application logins, detecting brute force, or user enumera- for this and start to be deployed to perimeter
tion type attacks. gateway protection and endpoints.
Network Box Security Article Artificial Intelligence and Machine Learning [Link]
Generative AI in
Cybersecurity:
Balancing
Artificial intelligence (AI) has
revolutionized various domains,
and cybersecurity is no excep-
tion. Generative AI, a subset of
Risks and AI that focuses on creating new
content, presents both significant
opportunities and challenges for
Rewards
securing our digital world. In this
article, we’ll explore the poten-
tial dangers and benefits of gen-
erative AI in cybersecurity.
Network Box Security Article Generative AI in Cybersecurity: Balancing Risks and Rewards [Link]
The Risks The Rewards
Adversarial Attacks: Threat Identification:
■ Generative AI models can be manipulated to generate ■ Generative AI can enhance threat detection by analyzing
adversarial examples that deceive other AI systems. patterns and anomalies in network traffic, identifying
These crafted inputs can bypass security measures, potential cyber threats.
compromise machine learning models, and lead to ■ It can help security teams stay ahead of evolving attack techniques.
unauthorized access.
■ For instance, an attacker could create a realistic-looking Automated Response:
image that fools an AI-based facial recognition system, ■ While full automation remains a challenge, generative AI
granting unauthorized access to a secure facility. can assist in automating routine tasks, freeing up human
analysts to focus on more complex issues.
Deepfakes and Misinformation: ■ For instance, it can automatically block suspicious IP
■ Generative AI enables the creation of deepfakes—realis- addresses or quarantine infected devices.
tic videos or audio clips that manipulate content. These
can be used to spread misinformation, damage reputa- Enhanced Authentication:
tions, or even influence elections. ■ Generative AI can improve authentication methods. For
■ As detection techniques struggle to keep up, the risk of example, it can create unique biometric templates or
deepfake-driven disinformation campaigns grows. analyze behavioral patterns for user identification.
■ This strengthens security while minimizing user inconvenience.
Self-Evolving Malware:
■ Bad actors are exploring generative AI’s potential to Vulnerability Patching:
create self-evolving malware. These malicious programs ■ AI can predict vulnerabilities by analyzing code and system
can adapt and mutate over time, making them harder to behavior. Generative AI models can then suggest patches
detect and combat. or fixes.
■ Traditional signature-based antivirus solutions may ■ This proactive approach helps prevent zero-day exploits.
struggle to keep pace with such dynamic threats.
Ethical Concerns:
■ Generative AI raises ethical questions about its use. For
example, should we allow AI-generated content to be Conclusion
used in court as evidence? How do we ensure transparen- Generative AI is a double-edged sword in cybersecurity.
cy and accountability? While it offers immense potential for threat detection and
■ The lack of clear guidelines and regulations poses risks to response, it also introduces new risks. Striking the right
privacy, fairness, and justice. balance requires collaboration between governments, tech
companies, and cybersecurity experts. We must harness the
benefits while mitigating the dangers to ensure a secure
digital future for all.
In summary, generative AI holds promise, but its deploy-
ment must be guided by ethical considerations and a
commitment to safeguarding our digital infrastructure.
For those intrigued or concerned about the promise of Generative AI, I wonder how many readers got this far
into the article before they realized that the above text wasn’t written by a human but entirely by Microsoft
Copilot (a publicly available Generative AI system)?
As one can see, when given a task (in this case, something like ‘write an article about the risks and rewards of
generative AI in cybersecurity’), these systems can pull together information from various sources and present it
in a clear well-written way with perfect spelling and grammar. What if, instead of a benign article, the AI was
instructed to prepare something malicious? This should concern us all. Like most such tools, Generative AI is a
two-edged sword offering both risks and rewards - and not understanding the implications of those is a far
greater threat than the technology itself.
Network Box Security Article Generative AI in Cybersecurity: Balancing Risks and Rewards [Link]
THE HUMAN FIREWALL:
Why cybersecurity still needs
a human touch Network Box’s Managed Cybersecurity Services, for
example, utilises AI for continuous monitoring and threat
analysis with exceptional efficiency. Yet, interpreting these
alerts and making decisive interventions still relies on
human expertise to understand the context and apply
nuanced judgement.
In the age of AI, it is easy to assume
that machines can manage all Imagine a scenario where AI detects unusual activity within
aspects of cybersecurity. However, an organisation’s network. While AI can flag this behaviour,
human expertise remains essential. it takes a human security analyst to determine whether it is
a legitimate threat, a false alarm, or an insider threat.
Combining human intuition with AI’s Humans provide critical thinking and decision-making skills
precision creates a robust defence that AI cannot yet replicate. This balance between human
against cyber threats. insight and machine learning forms the strongest defence.
Cybersecurity requires both creative problem-solving and The evolving cyber threat landscape demands human creativity
scientific accuracy. AI excels at identifying patterns, detect- and adaptability. For instance, during the 2017 WannaCry
ing anomalies, and processing vast amounts of data to flag ransomware attack, cybersecurity experts swiftly devised
potential threats. innovative solutions to help businesses mitigate the crisis.
Network Box Security Article The Human Firewall: Why Cybersecurity Still Needs a Human Touch [Link]
AI vs AI: The Battle of the Closing the Gap: Recommenda-
Security Machines tions for CISOs and Data Leaders
The cyber battleground has evolved into a high-tech arena To strengthen security, CISOs and data leaders must promote
where AI systems compete against one another. Organisa- a balanced approach that combines human expertise with
tions deploy sophisticated AI tools to enhance security, while AI-driven solutions. Key recommendations include:
cybercriminals utilise AI to develop advanced attacks.
Invest in Training: Ensure security teams are continuously
AI’s role in cybersecurity has grown exponentially. Modern upskilled to interpret AI-generated data and make informed
solutions now employ deep learning to automate threat decisions. Encourage industry certifications and participa-
detection and response, significantly reducing reaction time. tion in cybersecurity communities to enhance expertise and
By analysing big data, these AI systems identify patterns collaboration.
and anomalies that may be missed by human analysts,
providing an additional layer of security. Adopt Advanced AI Tools: Integrate AI-driven cybersecuri-
ty solutions, such as Network Box, to enhance security. Ensure
However, cybercriminals have access to the same techno- these tools work in conjunction with human expertise.
logical advancements. They use AI to craft highly sophisti- Promote Intelligence Sharing: Actively participate in
cated phishing attacks, develop adaptive malware, and intelligence-sharing platforms and encourage open collabo-
automate reconnaissance. This arms race requires cyberse- ration within the industry to strengthen cyber defences.
curity professionals to stay ahead of AI innovations and
anticipate their potential misuse. Foster a Security-First Culture: Develop cybersecurity
awareness within your organisation through regular training
One particularly concerning example is AI-driven attacks by and simulations. These can help employees recognise and
Advanced Persistent Threat (APT) groups. These groups respond effectively to threats.
utilise AI to execute prolonged, highly targeted ‘low and
slow’ cyberattacks that evade conventional security meas- Develop an Incident Response Plan: Implement an
ures. In response, companies like Network Box integrate incident response strategy that incorporates AI capabilities
AI-driven threat intelligence to counter these risks with while retaining human decision-making. Regularly test and
real-time updates and adaptive security protocols. refine the plan to adapt to evolving threats.
Ultimately, AI should be viewed as a powerful tool that
enhances human capabilities rather than replacing them. AI
can automate data analysis, allowing security professionals
to focus on strategic decision-making and complex
problem-solving. This collaboration between human
intelligence and AI represents the future of cybersecurity.
The Community Shield: The Impor-
tance of Intelligence Sharing
In the ongoing fight against cyber threats, collaboration is As cyber threats continue to grow in sophistica-
key. Intelligence sharing is crucial, yet the cybersecurity tion, human expertise remains indispensable in
community often fails to embrace it fully. cybersecurity. AI and machine learning provide
powerful tools, but human creativity, critical thinking,
Many organisations hesitate to share security information and judgement ensure their effective application.
due to concerns over reputational damage, legal liabilities,
or competitive disadvantages. However, this reluctance Combined with comprehensive intelligence
significantly weakens collective cybersecurity efforts. sharing, this holistic approach strengthens security
Without shared intelligence, critical information that could readiness and resilience. By recognising the
prevent attacks remains inaccessible, leaving businesses strengths and limitations of both AI and humans,
vulnerable to potential threats. Uncoordinated security organisations can build a formidable defence
measures create gaps that cybercriminals can exploit. against evolving cyber threats.
Network Box Security Article The Human Firewall: Why Cybersecurity Still Needs a Human Touch [Link]
AUTOMATED
ADVICE
for NBSIEM+ Today , we are proud to announce the release of our
first system based purely on Generative AI technology:
Incident Tickets Automated Advice for NBSIEM+
Incident Tickets
We have all noticed the explosion in the Until now, when NBSIEM+ decides to escalate a reported
availability and use of Generative AI in recent event to create an incident ticket (whether that determination
months. This came to the forefront with the release to escalate to an incident is via AI, Heuristic, or Signature
of ChatGPT, but the technology has been rules), it simply uses some templated text as the raised ticket.
simmering under the surface for some time now.
Today’s enhancement to this is to use our trained Genera-
Network Box has been using AI in our products for 20+ tive AI model (using the raised incident ticket text and the
years. Whether that is statistical (bayesian and other event itself as contextual attachments) to generate automat-
such learning systems), heuristic, or neural ed advice to be provided as part of the raised ticket text.
network-based, we have used these technologies with This advice provides background information, explaining the
success in our malware, spam, frontline, and other event, and recommendations on handling it. As always,
intrusion engines—as well as in backend systems such customers can simply continue the discussion on the ticket
as URL categorization, malware analysis, and others. It itself to obtain expert human advice from our Security
has been clear for over a decade that simple signa- Operation Centre engineers.
ture-based detection cannot cope with the onslaught of
malware, and we have only managed to stay ahead of This advice can never be 100% accurate and can never be
the bad guys by embracing non-signature-based as good as a human analyst could provide, but it can
detection methodologies. occasionally determine information that an analyst may
have overlooked and can be useful as baseline information
However, our enthusiasm must be tempered with a realiza- to make decisions on. We clearly label these as ‘Automated
tion of the limitations of ‘AI’ technology. While Artificial Analysis”, and the customer always has the option to
Intelligence (particularly generative AI) can yield phenome- discuss further with a real human security analyst.
nally impressive results, it can also produce the most
appalling garbage output. As the saying goes, “To err is You may have seen this automated analysis appearing on
human, but to mess up takes a computer.” I would add, some NBSIEM+ Incident tickets raised from 25th March
“...and to truly crash and burn needs AI”. At this point in 2025 onwards, and today, we release this globally to all
time, AI simply can’t be trusted to make decisions without users. We are also pleased to say that there will be no extra
human oversight. We can’t trust it completely to drive our charge for this service.
cars, power our robots, or decide whether to permit/deny
network traffic. Whilst it might get it right 99% of the time, Similarly, the second Generative AI system we will be
the remaining 1% often exemplify the most appalling mistakes. launching with the upcoming major NBSIEM+ overhaul
(scheduled for release in Q2 this year) is Automated Advice
on events themselves. The user will be able to click on an
event to receive a summary, analysis, and recommenda-
tions on how to handle it best. There will be no extra charge
for this service, and most event automated analysis will be
able to be completely delivered within 10 to 15 seconds.
As mentioned, exciting times are ahead, and we
hope that these first releases of Generative AI
technology in Network Box products will be able
to help our customers better understand and
manage these events and incidents.
Network Box Security Article Automated Advice for NBSIEM+ Incident Tickets [Link]
Understanding
Quantum Cryptography:
A Guide for Quantum vs Traditional Computers
Traditional computers, such as the servers and laptops you
IT Administrators
manage daily, operate using bits - binary units that are
either 0 or 1. They process information sequentially, solving
problems by breaking them down into steps that are executed
one after another. This classical approach has powered
everything from email servers to cloud storage for decades.
In today’s rapidly evolving digital Quantum computers, on the other hand, leverage the
principles of quantum mechanics, a branch of physics
landscape, quantum cryptography is dealing with particles at the atomic scale. Instead of bits,
emerging as a critical topic for securing they use qubits, which can exist in multiple states simultane-
sensitive information. As IT administrators, ously. This enables quantum computers to perform complex
you’re already familiar with managing calculations in parallel, tackling problems that would take
classical computers years, or even centuries, in mere
networks, firewalls, and encryption
seconds or minutes. Think of quantum computers as
protocols. But quantum computing specialised tools for specific tasks, not replacements for
introduces new challenges and your everyday hardware.
opportunities that could reshape how we
protect data. In this article, we examine Quantum technology is still in its early stages, with current
systems limited by their small number of qubits and high
the fundamentals behind this technology, error rates. Major players, such as IBM and Google, are
its potential impact on you, and what you advancing prototypes, but widespread practical use is likely
need to know to stay ahead. years away.
Network Box Security Article Understanding Quantum Cryptography: A Guide for IT Administrators [Link]
Why do Quantum Computers What is Post-Quantum
pose a Threat? Cryptography?
Traditional cryptography secures data by encoding it with Post-quantum cryptography (PQC) refers to new algorithms
algorithms that rely on mathematical problems assumed to designed to withstand quantum attacks while running on
be hard to solve. Public-key systems, such as RSA and classical hardware. These include lattice-based, hash-
ECC (which underpin protocols like HTTPS and VPNs), use based, and code-based schemes, which base security on
keys where one is public (for encryption) and the other problems quantum computers struggle with. Unlike quantum
private (for decryption). These same algorithms are also key distribution (which requires specialised hardware), PQC
used for digital signatures, and their security stems from the integrates seamlessly into existing systems, such as servers
difficulty of factoring large primes or solving discrete and browsers.
logarithms - tasks that classical computers handle
inefficiently for extremely large numbers. PQC is making headlines in 2025 due to milestones,
including NIST finalising standards in August, which include
Quantum computers threaten this foundation. Algorithms algorithms such as ML-KEM, ML-DSA, and SLH-DSA.
like Shor’s, developed in 1994, could factor those large Governments and tech giants, including Microsoft and
numbers exponentially faster on a sufficiently powerful Google, are promoting the adoption of quantum computing
quantum machine. This means an attacker with quantum through programs aimed at preparing for potential risks.
capabilities could derive private keys from public ones,
rendering much of today’s encryption obsolete. Symmetric This ties directly to TLS 1.3, the latest secure communica-
cyphers like AES are more resilient but could still face risks tion protocol, which the world is slowly moving to use for
from Grover’s algorithm, which speeds up brute-force web traffic. TLS 1.3 emphasises forward secrecy and
attacks. For IT admins, this isn’t just theoretical. It could efficiency, but to achieve post-quantum security, it incorpo-
expose encrypted communications, stored data, and digital rates hybrid key exchanges - combining classical methods
signatures to breaches. like X25519 with PQC ones like ML-KEM. This ensures
security even if one algorithm fails. The IETF has standard-
ised these hybrids for TLS 1.3, and implementations are
Harvest Now, Decrypt Later appearing in OpenSSL and browsers. Older TLS versions
lack this flexibility, making migration to 1.3 essential for PQC
One particularly insidious risk is the “harvest now, decrypt readiness. For your networks, enabling PQC in TLS means
later” strategy. Adversaries, such as nation-states or updating certificates and configs to support these hybrids,
cybercriminals, could intercept and store encrypted data balancing security with performance.
today using traditional methods. This data, like financial
records or intellectual property transmitted over TLS,
remains secure for now because cracking it with classical
computers is impractical.
The good news is you don’t have to tackle
this alone. The latest Network Box NBRS-8
However, once scalable quantum computers become firmware includes support for post-quantum
available, possibly within the next decade or two, those cryptography, allowing you to configure
same actors could potentially retroactively decrypt the hybrid TLS setups and quantum-resistant
harvested data. Imagine emails or database backups algorithms. This feature lets concerned users
transmitted securely, encrypted over the Internet in 2025, activate PQC for critical connections without
being unlocked in 2035, revealing secrets long after they’ve disrupting operations. However, we must
been sent. This “harvest now, decrypt later” attack amplifies
temper our enthusiasm, balancing the desire
the urgency, as data with long-term sensitivity (for example,
medical records or government secrets) is vulnerable even if
to move forward against the need to main-
quantum threats aren’t immediate. As an IT admin, auditing tain compatibility with legacy systems. This is
your data retention policies and considering the lifespan of especially important for key technologies
your encrypted assets is a smart, proactive step. such as SMTPS mail and HTTPS web.
Network Box Security Article Understanding Quantum Cryptography: A Guide for IT Administrators [Link]
Seeing
RED... by Richard Stagg
Managing Consultant
Network Box Red Team Services
We do this ourselves, too.
We go for “executive health checkups” even when we
feel great. It’s reassuring to know that your blood
pressure and cholesterol are normal, and you can
Network Box Red Team adjust your behaviour or seek an intervention to fix
any hidden problems that might emerge.
My cat just turned sixteen. The day after her tradi- This aspect of information security governance,
tional birthday sashimi dinner, I took her to see the however, is often overlooked. Businesses understand
vet. The checkup was not because of anything wrong; the need for “defensive security” very well. They will
she seemed in excellent health - active, hungry, and spend wisely on firewalls, endpoint protection, SIEM,
playful. We went for a “senior checkup”, and her blood MDM, and whatever else they need to deter attacks,
tests revealed a slight but significant – and silent – dip detect breaches, respond and recover. Having arrayed
in kidney functions, so now she has a new diet and these defences, they can hunker down and await the
some supplements. coming of the unlucky attackers.
Network Box Security Article Seeing Red... Network Box Red Team Services [Link]
Offensive Security
It is far less common for an organisation to actively This is not just conjecture. Every ransomware incident
hunt for weaknesses that a skilled threat actor could response that I have worked on – every single one –
exploit. The old cliché that prevention is better than showed that the attack vector could have been
cure is especially true in information security. This is detected and remediated by offensive security tech-
why Network Box is now offering “offensive security” niques. The unfortunate victims did not plan for such
services. You may have heard of penetration testing or an activity or, in some cases, delayed it, and suddenly it
red teaming, and these terms simply mean exposing was too late. They were exploited because they did not
your office or cloud infrastructure or your e-commerce assess their own weaknesses, and the cost of this
or mobile apps to a well-designed, thorough, safe and failure is always an order of magnitude higher than
controlled attack by our team of skilled, ethical and the cost of the assessment itself.
certified hackers.
Consider the impact to your business if your informa-
tion resources are abruptly encrypted beyond use.
Consider the impact to your reputation if your data
were to be exfiltrated. With a threat of disclosure
hanging over you unless you pay an extortionate
ransom. The stress, sleepless nights, news headlines,
wasted time, and – above all – the costs arising from
these incidents are not inevitable. Offensive security
offers the alternative scenario of a deep understanding
of your attack surface, and reassurance that your risks
are controlled.
We propose this for the same reason that everyone
endorses regular health checks for cats and people: if
you go looking for problems, you will find some, and If you would like to know more about
you can quantify and understand your risks and make assessing your “ransomware readiness”
informed decisions about how to allocate your or performing a full security work-up on
resources to manage those risks most effectively – an application, don’t hesitate to contact
before the bad guys turn up and exploit them. us for a meeting.
Network Box Security Article Seeing Red... Network Box Red Team Services [Link]