Impex can be used on-premise without any need for cloud services or other internet dependencies. A station can be completely offline or connected to a local ICC server for central management and unattended updates.
The support of different types of external devices is always growing with support for new technologies and older legacy devices.
Impex is built with many functions used by end-users who need to scan devices and files. Administrative functions exist in the background to give managers and system owners the possibility to do follow-ups and visualise the usage of devices and files in the organisation.
The possibility to integrate with SIEM solutions will give SOC personnel more visibility into movable devices used in isolated environments. LDAP or Active Directory integrations can enforce central accounts and password policies.
The ICC server provides audit trails, statistics and central configuration possibilities.
By using an intuitive user interface we remove the need for training before using the Impex USB Protect. The interface uses a modern design with a touch interface and removes the need for a keyboard or mouse.
Impex USB Protect has support for 14 different languages with the possibility to add even more languages.
For traceability the scan result can also be printed on a physical receipt that can be used together with for example work orders. The receipt can also be configured to be sent via email to the user.
When a user inserts a device, all files are viewed, including hidden files before an operation is started. The steps to start an operation are done by selecting the preferred action on the touchscreen. Once the selected operation has started, a progress view will show all the details of the progress. A receipt view will show the result of the operation.
Impex USB Protect is the kiosk used by users to scan devices or to scan and transfer files to a trusted device. Impex USB Protect can be connected to the ICC server and work as a standalone solution without network connection.
All available technologies are used to harden the station. This is done by using minimal installations and by disabling functions not needed. This basic hardening follows the CIS standard, together with internal knowledge, for even stronger hardening by using SELinux, seccomp, Landlock, etc. The user interface and exposed USB ports (Impex USB Protect) are locked down to disallow everything besides the possibility to scan files in a restricted environment.
Software updates are automatically done. All software is digitally signed.
Impex USB Protect will log every action and it is possible to view all operations on the ICC with all included metadata. Source code audit is done both internally and by customers.
Impex DataLock is a network-based solution to scan files in data communications. Impex DataLock can be connected to the ICC server.
Software updates are automatically done. All software is digitally signed.
Impex DataLock will log every action and it is possible to view all operations on the ICC with all included metadata. Source code audit is done both internally and by customers.
The ICC (Impex Control Center) is the heart of the evergreen solution and is used for distribution of updates and configuration of the station's behaviour.
The server uses the same type of hardening and software handling as the Station together with traceability.
The ICC server has one HTTPS service exposed on the network compared to the station which does not listen on any port. The web service is API-based with all hardening techniques applied and follows recommendations from OWASP, Hardenize, and SSL Labs.
By removing unused cipher suites, enforcing TLS with HSTS, and using web security technologies like CSRF protection and Content Security Policies, the attack surface is more limited compared to default installations.
The application itself runs under a limited user together with strict input validation. The source code used is continuously analysed to look for potential vulnerabilities.
The core function is to scan files in a sandboxed environment for malicious content together with information gathering of metadata.
File filters can be created based on checksums to handle false positives or to actually allow transfer of files even if they are malicious.
If any file is detected as malicious it can be uploaded to the quarantine area in the ICC server. From the server it is possible to download quarantined files for further analysis.
Authentication and authorisation to the ICC server is either done with local accounts or by using an external identity solution like Active Directory.
Stations with NFC support can use physical tokens or mobile phones to authenticate users before they are allowed to use the Station.
The ICC server can control the stations. Configuration cards for the stations will set the different stations' behaviour.
The ICC server will also get the results from the Stations, which are accessible in the graphical application and from the API.
The station can be forced to only allow Transfer mode, which requires scans to have a source and destination device. This can ensure that only trusted devices are used in more highly trusted systems.
The ICC is using a well documented API to allow integrations with other products and is by itself using standard technologies to integrate with other products.
Stations use state-of-the-art technology to isolate the kiosk solution which removes the possibility to access the underlying system.
By following all the best practices regarding hardening and well-trusted software, the risk for any potential vulnerability is minimised. If a software bug exists anywhere in the solution, the next layer of defence protects the system.