NETI

http://www.neti.com/

Official Coordinates

NETI IT Consulting Ltd.

Munkacsy Mihaly street 16.

H-1063 Budapest

Hungary

T: +36-1-3012030

F: +36-1-3532320

E: neti@neti.hu

Company Profile

NETI is a pioneer in the development of systems based on custom designed applications supporting analytic security solutions. – These systems provide our customers with robust and efficient tools for the handling of massive dataflow monitoring in various areas.

Ownership background

The company’s sole proprietor is the Theodore Puskás Foundation (PTA), a non-profit public benefit entity supervised by the e-Governmental Centre of the Prime Minister’s Office. Its objective is the advancement of modern technologies through transfer, consulting and technology audit. PTA’s main focus of activities are directed at the security-related aspects of Information and Communication Technologies. PTA is host to CERT-Hungary, the Network-, and Cyber-security Centre of the Government.

Products / Services

Portfolio

Responding to the demands of the market the company’s portfolio includes the following product lines:

1. Monitoring systems for law enforcement

Our systems are capable of supporting the national security services, ICT service providers and the vendors of ICT systems. Starting from the various monitoring subsystems through the tactical interceptors our solutions cover the whole spectrum of the information intercepting, decoding and processing systems.

2. Log processing, intelligent security event management

Our pertinent applications support the analysis of the trouble-free operation and IT security of enterprise IT systems, supplemented with supervisory and management services. Our systems are capable of handling and tuning of alerts issued by operating systems, hardware related solutions (such as IOS, firmware etc.) and specifically developed applications, complemented with associated statistical functions.

3. Workflow support

The processing of information intercepted by monitoring or the realization of business processes in different areas all need a massive database background and workflow management, which we are ready to implement in our custom-tailored applications.

Clientele

The clientele of NETI can be most easily found in two market segments:

The players in telecommunications monitoring (national security organizations, ICT service providers and the international vendors of ICT equipment), on one hand

The providers of electronic government services and their suppliers (relevant administrative institutions, large IT companies and system integrators) on the other hand.

It is our ambition to have an up-to-date knowledge of the needs of our clients and to assist their procedures with our solutions.

Human Resources

NETI has an in-house professional staff over 30 employees including IT engineers, application developers, and the management. In order to meet various challenges approximately 20 independent experts contribute to our teamwork from time to time. The industry in which we are active has special requirements regarding human resources besides high professional qualifications and the knowledge of foreign languages. Personal integrity and a clean and transparent carrier are indispensable. For this reason it’s a basic requirement of the employment for our collaborators to successfully undergo a national security screening.

Economic indicators and qualifications

NETI IT Consulting Ltd. has been established in 1993 by the Theodore Puskás Foundation with an initial primary capital of EUR 66.000. The company is pursuing IT development as its core activity and by now its equity has exceeded EUR 3 million.

As a result of our good performance our revenue has achieved EUR 3 million and managed to maintain it for years now. Our ISO 9001:2009 certification guarantees that our projects are perfectly organized and documented. For this reason we keep it up-to-date and renew the quality assurance audit annually.

Bongo

Monitoring Solution for Everyday Security

BONGO is an integrated solution supporting the intelligent monitoring activities of National Security and Law Enforcement Agencies. The system inherited its name from the Bongo antelope, the elusive king of the Equatorial Rain Forest, who finds his way easily and undetected in the thickest of jungles, while can see and hear everything. Today’s monitoring tasks are no less challenging. The systems have to be capable of fast and reliable navigation, selection, storage and presentation of the valuable pieces of information out of the massive and ever-growing jungle of networks and data masses of the Twenty-first Century. BONGO Monitoring System:

• Can intercept huge amount of data from a wide array of telecom and IP networks and other information sources.
• Carries out comprehensive logical data management and workflow starting with capturing and collecting through decoding and transferring the data to the operators of one or several Monitoring Centres.
• BONGO is basically a framework, a set of proven technologies utilizing all the experiences gained from the operation of former systems.
• BONGO can be configured, tailored and extended to fit the various needs of all customers in order to create their own systems.
• The structure of BONGO can be realized on a single workstation, but it can unleash its great power as a large, or even national system with hundreds of servers and operators.
• The system is ready to handle massive amount of data intercepted from telecom and IP systems. The effective handling of great masses of data is assured by the complex set of background processes with strong support provided to the operators’ processing tasks.
• The data processing is based on the workflow defined together with the customer, supported by a multi level authorization scheme, in accordance with the relevant legal regulations.

High speed of background processes:

• Performance optimised design and development of software modules
• Using state of the art and highly reliable hardware
• Using high performance enabling system-software

Efficient operators’ work processes:

• Optimised workflow based on years of experience
• User-friendly interfaces for effective oversight and handling of complex data structures
• User interfaces built on uniform principles for all types of data.
• Special emphasis on mass-processing

BONGO Inputs:

Capturing and filtering data intercepted from IP networks

• Direct data capture by line tapping
• Mirroring the data at appropriately chosen nodes
• Controlling intelligent active network tools, reception of filtered data
• Intelligent monitoring using built-in monitoring sub-systems
• Handling data intercepted in monitored premises

Data filtering in Telecom networks

• Fixed line telephone networks (PSTN, Voip)
• Ground mobile telephone networks (PLMN) including audio, video and data (GPRS, EDGE) traffic
• Audio and data traffic of TETRA networks
• IP based telecom networks
• Attachment of external devices, peripheries, (audio, video, other specific, or even processing tools, third party interfaces)
• Attachment of other tools on standard interfaces based on the requirements of the customer

Filtering according to: phone number, IMEI, IMSI, radius identification, IP address, e-mail address, MAC address, etc. BONGO Outputs:

• Reports and ready-to-archive documentation created by the operators using special and universal interfaces
• Copies on CD or DVD including viewer applications
• Interfaces allowing controlled direct access for external organizations
• Direct and automated transfer of part of the monitored data for authorized organizations
• The system supports several language versions.

Compact Bongo

Monitoring Solution for Everyday Security

COMPACT BONGO is an integrated solution supporting the intelligent monitoring activities of National Security and Law Enforcement Agencies. The system inherited its name from the BONGO antelope, the elusive king of the Equatorial Rain Forest, who finds his way easily and undetected in the thickest of jungles, while can see and hear everything. Today’s monitoring tasks are no less challenging. The systems have to be capable of fast and reliable navigation, selection, storage and presentation of the valuable pieces of information out of the massive and ever-growing jungle of networks and data masses of the Twenty-first Century. COMPACT BONGO Monitoring System:

• Can intercept huge amount of data from a wide array of Telecom and IP networks or other information sources.
• Carries out comprehensive logical data management and workflow starting with capturing and collecting through decoding and playing back to archiving and transferring.
• COMPACT BONGO is based on a set of proven technologies utilizing all the experiences gained from the operation of former systems.
• COMPACT BONGO can be configured, tailored and extended to fit the various needs of all customers in order to create their own system.
• COMPACT BONGO is realized on a single workstation.
• The system is ready to handle massive amount of data intercepted from telecom and IP systems, depending on the storage capacity of the workstation. The effective handling of great masses of data is assured by the complex set of background processes with strong support provided to the operators’ processing tasks.
• The data processing is based on the workflow defined together with the customer, supported by an adequate authorization scheme, in accordance with the relevant legal regulations.
• Interoperable with the BONGO system

High speed of background processes:

• Performance optimised design and development of software modules
• Using high performance enabling system-software

Efficient operators’ work processes:

• Optimised workflow based on years of experience
• User-friendly interfaces for effective oversight and handling of complex data structures
• User interfaces built on uniform principles for all types of data.
• Special emphasis on mass-processing

COMPACT BONGO Inputs:

Capturing and filtering data intercepted from IP networks

• Direct data capture by line tapping
• Mirroring the data at appropriately chosen nodes
• Controlling intelligent active network tools, reception of filtered data
• Intelligent monitoring using built-in monitoring sub-systems
• Handling data intercepted in monitored premises

Data filtering in Telecom networks

• Fixed line telephone networks (PSTN, Voip)
• Ground mobile telephone networks (PLMN), including audio, video and data (GPRS, EDGE) traffic
• Audio and data traffic of TETRA networks
• IP based telecom networks
• Attachment of external devices, peripheries, (audio, video, other specific, or even processing tools, third party interfaces)
• Attachment of other tools on standard interfaces based on the requirements of the customer

Filtering according to: phone number, IMEI, IMSI, radius identification, IP address, e-mail address, MAC address, etc. COMPACT BONGO Outputs:

• Reports and ready-to-archive documentation created by the operators using special and universal interfaces
• Copies on CD or DVD including viewer applications
• Direct and automated transfer of part of the monitored data for authorized organizations
• The system supports several language versions.

NETIMON

NETIMON is a Mediation Device assuring the connection between the network components of ICT service providers and the LEMF (Law Enforcement Monitoring Facility) of the LEA (Law Enforcement Agency). It is capable of the audio and data surveillance of PSTN and PLMN networks (CS – Circuit Switched and PS – Packet Switched network).

The principal features of NETIMON Mediation Device:

• Conceals the service provider’s network from the LEA.
• Provides a single channel access to the service provider’s subsystem.
• It is capable of simultaneously handling several LEAs. Supports rights management between LEAs. Super LEA function. (An appointed LEA can be granted access to the data of the others.)
• Multi level rights management.
• Advanced logging system.
• Continuous adaptive network component and intelligent load supervision in the background.
• The users can assign unique identifiers to the monitored data.
• Support of both FILE (FTP, SCP, SFTP), and STREAM (TCP, UDP) based communication.
• Standard HI interface.
• Easily replaceable X interface.

The operation of the system:

NETIMON Mediation Device is connected to the service provider’s network components through an X interface and through an HI interface to the monitoring centre. These connections are established through encrypted channels. Both the X and the HI interface can be divided into three levels:

1. Administration and management communicatin
2. Interception Related Information (IRI)
3. Content of Communication (CC)

After having accepted the provisioning commands through the LEA interface, the system performs the provisioning in the service provider’s network through the X interface, then the intercepted traffic is converted into HI format and conveyed to the relevant LEA. Data conversion between the interfaces is implemented by the system without losses.

The HI↔X conversion is provided by the NETIMON system. Mapping is unambiguous only in the case of conversions between X2→HI2 and X3→HI3, it is up to the NETIMON subsystem to decide whether X1→HI1 and/or a HI1→X1 mapping is necessary or not.

Besides HI1 interface providing automatic management, NETIMON also has a command line interface (CLI) for manual management of the system. In order to assure confidential data handling NETIMON stores the handled data only in the memory, and does not save it to HDD. Unique competitive advantages:

• Single identifiers can be assigned to the captured data by the LEA.
• Asynchronous operation. (The HI and the X interface operate independently.)
• Inter-LEA authorization management, Super LEA function.
• Advanced adaptive network component supervision, intelligent load supervision.

System support:

Full service and maintenance support is provided for the product, including support over phone, on-the-site error recovery and version update.

NETIPHONE

According to our observations there is an emerging demand both from the sides of governmental institutes and companies operating in the commercial sector for the encrypted communication, using public networks. The main goal is the secure transmission of classified information, no matter if it is verbally spoken, multimedia, or data communication. Furthermore the headquarter needs to have the ability to monitor and intercept the secure communication. Above the communication features the secure access to corporate applications and mailing is also a basic requirement. During these types of transmissions, the information must not get outside the trusted environment or be saved on the client terminals. There are existing products on the market that are partly able to handle some of the above-mentioned needs but NETIPHONE™ is directly designed to deliver all these required functions. On top of that NETIPHONE™ is a user friendly, easy-to-use application with plenty of useful tools that makes communicating through secure channels as simple as the everyday mobile telephony. System overview

NETIPHONE™ provides trusted communication through the encrypted data channel between the mobile client and the central NETIPHONE™ server, using public mobile data network. The central VoIP server provides the secure verbal communication between the connected terminals. Secure mailing and usage of central services – e.g. file transfer – are also available by the NETIPHONE™ system. Intercepting the secure communication and monitoring the usage of the system according to system logs is also a basic feature of NETIPHONE™.

Services of the system

The design and creation of NETIPHONE™ was according to real and actual business needs so besides the secure vocal communication and data transmission the system has several related services, which are as follows: Functionality:

• Reaching central applications through remote desktop
• Encrypted verbal communication
• Automatic text message notification to the called but currently not connected user
• Centrally stored Phonebook
• Centrally stored Log of missed, received and dialled calls
• System notifications about missed calls and newly received e-mails

Security:

• Centrally stored sensitive information. Password protected identifiers on the client.
• AES256 encryption
• Separated inner and outer audio communication – blocked secure network audio communication functions during the usage of public network
• Password protected key and set-up information on the mobile client
• Cloud applications, central data storage

Management and monitoring:

• Event logs
• Incident logs
• Data retention
• Central configuration and manageability

Advantages of the system

Bearer independent encrypted channel – voice, media, data

NETIPHONE™ is able to provide encrypted voice, media and data communication as well as access to central applications at the same time. Furthermore the system is able to operate on any data communication channel that fits the minimal system requirements (e.g. channel quality). Central functions

Since the system communicates through a central server it is possible to manage and monitor the communication centrally and also to apply server based applications. Due to centralized functions, the sensitive data that is crucial for the operation of the system is stored on secure storage

User-friendly interface

The remote desktop application of NETIPHONE™ has a simple user interface that provides basic functions. It is optimised for the display of mobile phones. Separated public and closed telephone functions, common resources

NETIPHONE™ can be installed on normal commercial mobile phones it does not require any special appliance. The encrypted voice communication will immediately be suspended in case of an incoming open network call. After the dismissal or termination of the open network call the system returns to the encrypted communication automatically.

ONEWAYER

Secure one-way street

Onewayer is an IT protection tool, which offers a strictly single-way data communication from a lower to a higher security level IT environment. The Onewayer maintains the physical separation of the higher security level environment and, at the same time, can satisfy the information demand of the higher security level IT environment in real time, in a controlled way without the need to apply any resources. Its usage is strongly advised in cases where the members of an organization are to send information frequently into a high security internal IT environment from an external source of low or unknown security level. The use of the system ensures the information transmission into the internal environment so that it physically prevents any data theft or leakage on the established connection.. Onewayer is the secure, one-way street of IT data transmission.

OneWayer has been evaluated and certified at high security level according to MIBÉTS methodology (complying with CC EAL4)" Certificate

The system consists of the following units:

• Onewayer one-way data transmission tool
• Low Security Level Server (LSLS)
• High Security Level Server (HSLS)

The system copies the selected directories from LSLS side to HSLS side.

Functionality

The information stored on LSLS module of Onewayer is streamed to Onewayer which receives and „one-ways” it for the HSLS module. The transmitted file system or directory will be restored from the stream by HSLS module. Usability

Standard interfaces support the communication of the system. GUI helps the user at LSLS side to select files to be transmitted and to compose the stream. The opto-electronic coupler installed in Onewayer transmits the received dataflow. GUI helps the user at HSLS side as well to manage the received files and arrange them into directories. Reliability

The opto-electronic coupler provides the galvanic separation of the LSLS and HSLS side by its nature . The system excludes the illegal electromagnetic data leakage by its design. Hardware based network noise filter is installed at network connection. The HW units of the system are tamper-protected. In case of opening a unit it will become temporarily disabled and can be activated by the system administrator only. Error correcting code is used during the file transmission. The transmitted information remain stored on both the sender and receiver servers until pre-determined time only. After the expiration of the storage time the files are deleted automatically. In case of irreparable errors the receiver side may send notification to the sender one on external channels (e.g. e-mail). In order to guarantee the hardware, software, physical security of the system a Wathcdog service is operated. Performance

The system handles gigabit level traffic. The size and amount of the files practically have no effect on the performance. Supportability

The system supports setting up several user levels (administrator, user and auditor) by an authorization management function. The servers can be managed by local console and/or remote access (SSH). The application can be configured via web based management GUI. The system logs its activity and stores it in a local database or a syslog server.

Articles / Events / Situations

Date	Source	Title	Tags
20130904	wikileaks.org	BONGO monitoring system	NETI
20130904	wikileaks.org	NETI IT Consulting profile	NETI
01.10.2008	wikileaks.org	Data in a Haystack - Monitoring System with advanced workflow management (Presentation)	NETI Monitoring