Important features

IMPEX can be used on-premise without any need for cloud services or other internet dependencies. A station can be completely offline or connected to a local ICC server for central management and unattended updates.

The support of different types of external devices is always growing with support for new technologies and older legacy devices.

IMPEX is built with many functions used by end-users who need to scan devices and files. Administrative functions exist in the background to give manager and system owners the possibility to do follow-ups and visualize the usage of devices and files in the organization.

The possibility to integrate with SIEM solutions will give SOC personnel more visibility into movable devices used in isolated environments. LDAP or Active Directory integrations can enforce central accounts and password policies.

The ICC server provides audit trails, statistics and central configuration possibilities.

Designed for everyone

By using an intuitive user interface we remove the need for training before using the IMPEX USB. The interface uses a modern design with a touch interface and removes the need of a keyboard or mouse.

IMPEX USB has support for 14 different languages with the possibility to add even more languages.

For traceability the scan result can also be printed on a physical receipt that can be used together with for example work orders. The receipt can also be configured to be sent via email to the user.

When a user inserts a device, all files are viewed, including hidden files before an operation is started. The steps to start an operation is done by selecting prefered action on the touchscreen. When the selected operation has been started will a progress view show all the details in the progress. A receipt view will show the result from the operation.

IMPEX USB

IMPEX USB is the kiosk used by users to scan devices or to scan and transfer files to a trusted device. IMPEX USB can be connected to the ICC server and work as a standalone solution without network connection.

All available technologies are used to harden the station, this is done by using minimal installations and by disabling functions not needed. This basic hardening is following CIS-standard together with internal knowledge for even stronger hardening by using SELinux, seccomp etc. The user interface and exposed USB-ports(IMPEX USB) are locked down to disallow everything besides the possibility to scan files in a restricted environment.

Software updates are automatically done. All software is digitally signed.

IMPEX USB will log every action and it is possible to view all operations on the ICC with all included metadata. Source code audit is done both internally and by customers.

IMPEX Data Lock

IMPEX Data Lock is a network based solution to scan files in data communications. IMPEX Data Lock can be connected to the ICC server

Software updates are automatically done. All software is digitally signed.

IMPEX Data Lock will log every action and it is possible to view all operations on the ICC with all included metadata. Source code audit is done both internally and by customers.

ICC

The ICC (IMPEX control center) is the heart of the evergreen solution and is used for distribution of updates and configuration of the station's behavior.

The server uses the same type of hardening and software handling as the Station together with traceability.

The ICC server has one HTTPS service exposed on the network compared to the station which does not listen on any port. The webservice is API-based with all hardening techniques applied and follows OWASP recommendations as well as Hardenize and SSLLabs.

By removing unused cipher suites enforcing TLS with HSTS together with web security technologies like CSRF-protection and Content Security Policies makes the attack surface more limited compared to default installations.

The application itself runs under a limited user together with strict input validation. The source code used is continuously analyzed to look for potential vulnerabilities.

Files

The core function is to scan files in a sandboxed environment for malicious content together with information gathering of metadata.

File filters can be created based on checksums to handle false positives or to actually allow transfer of files even if they are malicious.

If any file is detected as malicious it can be uploaded to the quarantine area in the ICC server. From the server is it possible to download quarantined files for further analyses.

Identity

Authentication and authorization to the ICC server is either done with local accounts or by using an external identity solution like Active Directory.

Stations with NFC support can use physical tokens or mobile phones to authenticate users before they are allowed to use the Station.

Configurations

The ICC server can control the stations. Configuration cards for the stations will set the different stations behavior.

The ICC server will also get the results from the Stations which is accessible in the graphical application and from the API

The station can be forced to only allow Transfer mode which requires scans to have a source and destination device. This can ensure that only trusted devices is used in higher trusted systems