Skip to content

供應商存取監控與稽核指南

大多數組織對供應商存取的監控僅止於 VPN 日誌。它記錄了「誰」連線,卻無法解釋連線後的「行為」。缺乏行為數據會導致事故調查只能依靠假設而非事實。

網路可見性核心需求

  • 即時與回溯追蹤存取的系統與服務。
  • 對所有通訊進行協定級別的分。
  • 記錄數據傳輸量與方向。
  • 詳細記錄檔案複製與執行的指令。

VPN 與 ZTNA:原則的轉變

傳統 VPN

開啟整個網路區段。連線後,供應商可能觸及比工作需求更多的系統。

現代 ZTNA

僅授予對獲准使用的特定服務或應用程式的存取權,其餘網路皆不可觸及。

影子存取的風險 (4G/5G 路由器)

供應商為了方便常會安裝未經授權的 4G/5G 路由器。這些設備完全繞過了安全政策與稽核軌跡,在穩定的 OT (作業技術) 環境中構成嚴重風險。

如何偵測非法硬體

網路偵測與回應 (NDR) 解決方案透過以下方式識別非法硬體:

  • 設備發現: 自動分類網段上的每一個新設備。
  • 行為基準: 針對新的通訊模式或未知目的地發出警報。

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

AMI 異常檢測實戰手冊:IT 與 OT 的維運指南

在現代 AMI 環境中,智慧電表與閘道器的通訊模式極具規律性。任何偏離這些模式的行為都是配置錯誤、維運異常或資安威脅的重要早期指標。本手冊提供了一套結構化方法,協助 IT 與 OT 團隊偵測並驗證最常見的網路層級異常。

關鍵 AMI 異常類型與驗證步驟

1. 發現不明設備

AMI 子網路中出現新硬體,通常反映了未記錄的外勤工作、電表更換或未經授權的廠商存取。

Mendel 偵測: 自動識別新資產並根據角色(如 DLMS/COSEM 伺服器)進行分類。

驗證檢查清單:

  • 服務驗證: 確認該區域近期是否有維護記錄或電表更換。
  • 通訊分析: 審視該設備使用的協定、連接埠及其主要的通訊對象。
  • 模式比對: 與同一子網路中已知的電表類型行為進行比對。
外勤行動建議:若驗證後仍無法確認設備身分,應進行實地核查以確保資產記錄正確並防範入侵。

2. 首次出現的通訊模式

出現未曾見過的協定或連接埠,可能代表未經授權的韌體更新、診斷工具誤用或配置偏移。

驗證檢查清單:

  • 標準合規性: 驗證該協定是否屬於標準 AMI 營運範疇。
  • 維護背景: 檢查近期是否有韌體推送或廠商維護活動。
  • 地理位置審查: 確保通訊目的地國家不具備資安疑慮。
外勤行動建議:若通訊行為與核准服務不符,應對相關集中器進行配置審查。

3. 違反網路分段的禁止通訊

通訊超出核准邊界(例如流量流向網際網路),通常代表路由錯誤、防火牆或閘道器配置失效。

驗證檢查清單:

  • 架構對齊: 確認目的地是否屬於核准的 AMI 通訊設計(如 Head-End 平台)。
  • 變更審計: 檢查近期是否有路由或防火牆規則的變更記錄。
外勤行動建議:若違規通訊持續,需重新配置閘道器以限制流量僅能流向核准的目的地。

4. 未預期的 DLMS/COSEM 參數變更

應用程式層級出現未預期的 SET 操作,可能代表電表數值或設定遭到未經授權的篡改。

驗證檢查清單:

  • 基準比對: 將新參數值與預期的基準配置進行比對。
  • 來源歸因: 驗證發起變更的 IP 地址是否為受信任且獲授權的系統。
外勤行動建議:若變更無法解釋,應恢復基準配置,並在重新投入營運前審查變更來源。

結語

網路層級的可視性將異常偵測轉化為具體的維運控制。透過實施這些實戰手冊與一致的驗證步驟,團隊可以確保 AMI 環境的穩定與安全。

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

GREYCORTEX Mendel 4.6 Now Available

 

Streamlined Network Analysis: Mendel 4.6 introduces enriched network context and faster investigation tools, allowing security analysts to work more efficiently with complex data.

The 4.6 update focuses on optimizing how analysts validate security findings and interact with network telemetry. By providing a deeper level of visibility, the platform ensures that response teams can identify and address threats with higher precision.

New Features & System Improvements:

  • Hostname & Guest Identity Tracking: Enhanced history logs for hostnames and guest identity monitoring.
  • Application Layer Visibility: Deeper insights into device behavior and asset status using application layer data.
  • Unified PCAP Workflow: A centralized environment for the capture and playback of PCAP records.
  • Modern Authentication Support: Expanded identity management featuring SAML and Single Sign-On (SSO).
  • Napatech Bypass Mode: Implementation of a bypass mode that maintains consistent network flows for Napatech integrations.
  • Enhanced Zabbix Integration: Updated asset information exchange for better synchronization.
  • OpenAppID Framework Update: Refresh of the OpenAppID framework to the latest version.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Network Security Monitoring as a Service (NSMaaS): Enterprise Visibility Without the Overhead

Until recently, achieving full network visibility was a privilege reserved for large enterprises. Advanced monitoring required significant capital investment, specialized security teams, and lengthy deployment cycles. Today, IT teams, particularly those across Europe, face heightened complexity, limited staff, and growing regulatory pressures. The threat landscape is constant, but the ability to manage it varies widely.

Making Enterprise Visibility Accessible

Managed monitoring changes the operational equation for organizations that cannot afford a dedicated 24/7 Security Operations Center (SOC). It provides many benefits similar to SOC as a Service (SOCaaS) but avoids the complexity and infrastructure burden of building a full security function internally.

With technologies like GREYCORTEX Mendel (a Network Detection and Response, or NDR, solution), providers can offer the same depth of insight previously only accessible to major corporations.

The core value is simple: organizations finally gain clarity into what is happening inside their network. They can spot misconfigurations, detect unauthorized connections, and notice the early signs of malicious activity. For many, this is the first time they can verify whether their segmentation and firewall rules are effective against real-world traffic.

How Service-Based Monitoring Works in Practice

This model is exemplified by partners like SOC360 in Poland. They combine Mendel’s deep visibility with their own expert monitoring and response processes, providing predictable costs, quick deployment, and continuous expert oversight.

Key Components of a Managed NDR Service:

  • ✅ Continuous network and log monitoring, providing a constant pulse on system health.
  • ✅ Detection of hidden threats, unauthorized access attempts, and policy violations using behavioral analysis.
  • ✅ Investigation support using historical metadata and full-context analytics for rapid root cause analysis.
  • ✅ Monthly reporting and guidance with clear, actionable recommendations for IT teams.

For many organizations, this replaces reliance on assumptions and isolated alerts with insights supported by data and clear recommendations.

Scaling Up: Visibility for Mature Security Teams

For larger organizations that maintain their own SOC, the approach shifts. Instead of outsourcing, they integrate GREYCORTEX Mendel directly into their environment. In these setups, deep network visibility becomes a powerful analytical advantage.

In-house SOC teams gain a clear view of device communication, user behavior, and performance trends over time. Crucially, they access historical data that traditional log-centric tools often cannot provide. This depth speeds up investigations, reduces noise, and helps analysts understand not only that something happened, but also how and why it occurred.

Conclusion: Visibility That Fits Any Security Maturity

Network security monitoring proves that meaningful visibility is no longer limited by the size of your security team. Smaller companies gain critical clarity without building a SOC, while mature environments enhance their detection and investigation workflows through deeper network context.

GREYCORTEX Mendel supports both needs: it enables providers to deliver reliable monitoring as a service, and it gives enterprise SOCs the analytical depth required to manage complex infrastructures. The objective remains the same: reduce uncertainty, speed up response, and create a network environment where hidden activity is harder to ignore.

 

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

Women of GREYCORTEX: Different Paths, One Purpose in Cybersecurity

 

When people envision cybersecurity, they often default to a highly technical, male-dominated image. The reality, particularly at events like the recent Ženy v kyber (Women in Cyber) conference in the Czech Republic, paints a different picture—one focused on stories, curiosity, and the determination to enter a new field.

We were proud supporters of the event, as diversity is a core principle at GREYCORTEX. Approximately one-third of our team are women, playing vital roles across every department: development, product, marketing, sales, and technical support. Each of them followed a unique trajectory into cybersecurity. Let’s explore what brought them here.

Curiosity, Coincidence, and Determination

The journey into cybersecurity is rarely linear. Some arrive naturally, while others find their way almost by chance.

  • Minh, a developer, was drawn by the field’s broad scope—from mathematics and cryptography to programming and data analysis. “What drew me most,” she says, “was that the work has real impact, even on a national level. And, of course, I liked the idea of using my analytical mind to fight the bad guys.”

  • Aja, our marketing manager, started by coincidence after writing about tech companies during parental leave. “When they later opened a marketing role, I didn’t hesitate,” she laughs.

Regardless of their starting point, the consensus is that the field’s fast pace and energy keep them engaged. As Monika, our Country Manager for Poland, notes: “I like people, and I like when things happen, and in cybersecurity, things are always happening.”

Cybersecurity is not exclusively reserved for people with traditional technical degrees. What truly counts is persistence, curiosity, and a dedication to lifelong learning.

Irina from our marketing team shared, “The beginning was tough. I had to dive into the tools and really understand how cybersecurity works. I’m still learning every day, but that’s exactly what makes it exciting.”

Breaking Down Stereotypes

Though outdated stereotypes of cybersecurity being solely a “men’s field” are fading, many women still encounter them in professional and everyday situations.

  • Bára, a security analyst, recalled an instance when a shop assistant only accepted her complaint about a faulty router after she meticulously listed every technical test she had already performed on the device.

  • Saša from the product team experienced similar subtle bias at university, which, rather than discouraging her, served as a strong motivator: “Those moments motivated me to keep improving, to be consistent, and confident in my work.”

From the HR perspective, there is growing awareness of the value women bring. Ira from HR states, “I often hear that teams want more women because they bring a different way of thinking and communicating.”

At GREYCORTEX, success is measured by results and expertise, not background or gender. Women on our team lead major projects, design products, analyze network traffic, and run international business operations. They find respect, equal opportunities, and space to grow.

The Human Side of Cybersecurity

When asked what draws people to the field, conference participants cited remarkably similar answers: constant learning, variety, and the feeling that their work has a tangible, real-world impact.

What resonated most was the sense of community. Behind the complex systems are people who share knowledge and support each other, underscoring that security is fundamentally about collaboration and trust.

Ira from HR summarizes this well: “HR in IT is the ideal mix for me. You need to understand technology, but also know how to help teams grow and work together.”

Supporting Women in Cybersecurity

The message from the confident, curious, and inspiring women of GREYCORTEX to anyone considering the field is clear:

If cybersecurity interests you, go for it. And choose a company where the people inspire you and the environment feels right.

At GREYCORTEX, we prove every day that diverse perspectives make teams stronger, more creative, and ready for any challenge ahead.

About GREYCORTEX
GREYCORTEX uses advanced artificial intelligence, machine learning, and data mining methods to help organizations make their IT operations secure and reliable.

MENDEL, GREYCORTEX’s network traffic analysis solution, helps corporations, governments, and the critical infrastructure sector protect their futures by detecting cyber threats to sensitive data, networks, trade secrets, and reputations, which other network security products miss.

MENDEL is based on 10 years of extensive academic research and is designed using the same technology which was successful in four US-based NIST Challenges.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×