IT Security

Our partners: Fortinet, PaloAlto

When it comes to firewalls, we at Sidarion not only think of stateful inspection, but also of next-generation firewalls with application control, web filters, intrusion detection & prevention, antivirus, user and device identity and so on.

Modern firewalls allow services to be consolidated. Products that were once separate, such as web proxies, VPN concentrators and IPS systems, are now managed and monitored centrally. Depending on the size of the company and the desired architecture, this can be combined in a cluster or distributed over several devices. In any case, there is a cost saving, because you do not have to be familiar with numerous different systems, the number of support channels is reduced, and you gain more in-depth know-how by only needing to focus on one product.

Thanks to integrated, powerful hardware acceleration, we have a suitable solution for every company size.

Our Partner: Fortinet

Due to today’s conditions, employees are very mobile and working from home has become standard. The demand for speed, connectivity and availability remains. Since often sensitive documents are processed, security must also be guaranteed. A VPN infrastructure can meet all of these requirements. As an authenticated part of the company network, users can move around the intranet via the Internet as if they were in the office.

The two most common ways to set up a VPN network are SSL-VPN and IPsec. While SSL-VPN is mostly used to connect individual users to the company network for a limited time, IPsec tunnels are used to permanently connect two networks. This makes it possible to share internal resources in the head office with the subsidiaries. Different locations can work together as if they were connected in a single network.

Our Partners: Fortinet, OneSpan

A key factor in the success of the Internet and other networks is that people and devices around the world can participate in it in real time. Identity and access management products provide the services necessary to securely confirm the identity of users and devices when they enter the network.

Two-factor authentication is therefore widespread today. Together with our partners, we use various methods and, among other things, use centralized authentication services (including single sign-on services, certificate management and guest management) in combination with soft and hard tokens or a SMS service.

For user-friendly use of two-factor authentication, Single sign-on can be implemented in parallel. The user only logs on to a central instance once and is automatically given the rights that correspond to his approval on all connected systems. The flexibility in the integration of the solutions we offer is so great that not only existing infrastructures can be equipped with them, but also individual areas or very specific systems if required.

Our partners: Fortinet, Infoblox, PaloAlto, Cumulus Networks

The high degree of networking has resulted in systems whose failure can bring entire branches of the company, or even the whole operation to a standstill. The priorities have therefore shifted from resilience to high availability. For this reason, additional systems running in parallel are installed, which can take over the functionality in a fraction of a second if the primary device fails.

There are few spatial limits to such a cluster: Firewall clusters can be distributed over several data centers, so that availability is guaranteed even in the event of major problems such as power failures. The cluster can even span countries or continents and as the number of devices in the network increases, a system can be armed against even the most severe failures. Anyone who has already experienced major failures knows the resulting damage and supports the investment in redundant systems.

Our partners: Fortinet, MenloSecurity

There are still many dangers when surfing the Internet. Unfortunately, Web 2.0 and HTML 5 have not changed that. On the contrary, browsers are becoming more and more powerful and now offer many functions.

This is where the Unified Threat Management (UTM) of next-generation firewalls comes into play. In addition to undesirable content, the URL filter can also be used to block many malware and phishing sites. The anti-malware protection helps with known malware threats, while pattern-based attack detection can combat the weak points in the browser. The Application Control Profiles help to filter the content of a provider in the widely networked Web 2.0.

Of course, the most elegant solution would be if the user never came into contact with the Internet. And as absurd as the thought is nowadays, this is exactly possible with modern proxy products. Instead of the user accessing the website directly, these solutions only show the rendered image of the website. Nothing changes for the user, but a compromise via an infected website is made impossible. Don’t you believe us? Ask for a PoC, we will be happy to convince you.

Our partners: Fortinet, SEPPMail

In addition to the well-known anti-malware and anti-spam functions, secure e-mail solutions also offer the possibility of encrypted and signed communication with the whole world in a simple manner, without each user needing their own S/MIME certificate.

Checking for viruses and malware as well as the suppression of spam mails are still very much required. We offer you high-performance solutions that can process up to 2 million e-mails per hour on one appliance.

With SPF, DKIM and DMARC entries you can take effective action against forged senders. However, these additional security measures often fail due to implementation. Due to Sidarion’s expertise in the area of DNS, we can also support you in creating and editing these entries.

You can obtain all of our solutions as hardware appliances, virtual appliances or as a managed security service.

Our partners: Tufin, Redhat

Managing large firewall environments with over 100 firewalls is a challenge. With a suitable management system, however, this works well today and boundaries are managed. Independent of the manufacturer, you can manage entire firewall landscapes, generate reports, check compliance and consistently roll out changes to multiple systems at the same time.

An automated workflow is essential for managing the complete ruleset. The user should be able to submit their applications in a self-service portal. The automation can then make risk-based decisions and, if necessary, implement them automatically (zero-touch). Thanks to the high flexibility, the workflow that the customer wants can be implemented.

Reference projects of Sidarion:
insurance, automobile manufacturer

Our partner: Tufin

The rules on the firewalls are adjusted every day, new access lists are recorded on routers or temporary exceptions are configured for a test. Because new projects are coming in every day, there is often not enough time to clean up old and expired configurations.

Automation of the ruleset enables optimization and auditing in real time. In this way, even complex rulesets can be managed and documented on a project basis.

With an integrated change management process, other teams also have insight into which communication relationships their systems have and how these are configured on the firewalls. The whole change process becomes transparent, and many tasks only take minutes instead of hours or days. This makes it very easy to introduce new systems and dismantle old ones.

Our partners: Fortinet, Macmon

One reason the internet has risen so rapidly is that it is accessible to everyone. This cornerstone of the network permeates every protocol and architecture. As enormous as this benefit is, it represents a challenge to be solved for internal networks. How do we prevent users from connecting their devices to open network ports in an uncontrolled manner? How can we grant visitors access to projectors and televisions, but keep them away from internal company resources? And what do we do with employees’ personal devices?

The answer is 802.1x. With RADIUS-based logon mechanisms, the network can recognize company-internal devices and move them to the correct segment. Whether wired or wireless, Sidarion supports you in the selection and integration of this basic protection for your infrastructure.

Is your infrastructure not 802.1x compatible, or is the project over budget? Based on the information from a CMDB or IPAM, you can achieve quick results with minimal risk. Our consultants will help you find the right architecture for your environment.

Our partners: Nutanix, Rubrik

Sidarion offers a comprehensive range of solutions to protect your data and ensure the availability of your cloud applications. We offer suitable solutions for all cloud offerings, from SaaS to PaaS to IaaS installations.
Our experienced IT architects support you on your way to the cloud; in planning the migration, securing the services and in the central administration of a hybrid enterprise cloud infrastructure.

To do this, we use technologies such as:

• Cloud Firewalls
• Cloud Access Security Broker (CASB)
• Cloud Loadbalancer
• Cloud IPS Systems
• VPN connections from your network to your cloud provider
• Cloud appliances for secure email and web-server installations

Our partners: Fortinet, LogRhythm

Who isn’t familiar with vague error descriptions from end users: “The network is slow”, “The VoIP phone is not working properly”.

In such cases, it is important that the network team can find the cause quickly and efficiently, if only to determine that it cannot be the network infrastructure. Modern monitoring solutions cover many aspects of a network such as round trip time, jitter, packet loss and dropped packets. Response times of applications such as DNS can also be included in monitoring. This allows you to keep an eye on the state of the network at all times, and often you have the solution to a problem before the first call from a user.

Our monitoring solutions cover many aspects of a network, including:

• Link quality: round trip time, jitter, packet loss, discards
• Network utilisation
• Response times of network applications such as DNS
• Log distribution

As the speed of the network increases, so does the urgency of resolving issues.

Our goal is to optimize alerting so that only relevant events are reported. Thus, you save time and money.

Our partners: Illumio, Fortinet, Akamai Guardicore

Microsegmentation eliminates unnecessary network connections within your data center and cloud. It is different from network segmentation, which has been around for years and was originally developed to improve efficiency and reduce broadcast domains.

Your segmentation strategy should apply the right type of segmentation to provide the security you need:

• Environment-specific segmentation: separates environments within the data center and is the coarsest form of segmentation. It prevents intruders from entering multiple environments.
• Location-based segmentation: Cross-country or cross-data center segmentation. Manage or control access of devices from different data centers (e.g., due to data sensitivity or regulatory requirements).
• Application-aware segmentation: separates individual applications, preventing cross-application communication, even within the same environment. Critical applications are thus given an additional layer of security.
• Tier segmentation: is even more granular than application-based segmentation. It divides the tiers within an application (e.g., web, application, and DB tiers).
• Process and service related segmentation: also called nanosegmentation and is the most granular form of segmentation. It ensures that only enabled connections are allowed. Highly critical processes and services can be protected in this way.
• User-based segmentation: prevents “credential hopping” – a common tactic in which an intruder attempts to use acquired access rights to gain access to critical applications.

We have extensive experience in implementing data center firewall and IPS systems, and can help you make sense of segmentation based on security classes and protection needs.

Our partner: Fortinet

Many modern devices such as smartphones and tablets require a wireless connection. WLAN is also becoming increasingly important for mobile PCs, so almost all companies have a WLAN solution in place.

However, there are some important aspects to consider for a secure WLAN that are not supported by every product. We recommend that you take these points into account when using WLAN:

• Automatic management of BYOD (Bring Your Own Device) and guest access
• Distinguishing between managed and unmanaged (BYOD) devices
• Separate guest access (multi SSID)
• Integration into the company directory (e.g. AD)
• Device-based or user-based access rights
• Filtering of Internet access, especially for malware or abusive behavior
• Automatic WLAN roaming between different sites
• Adequate encryption

We are happy to support you in the design and implementation of your secure WLAN infrastructure and take care of the appropriate coverage of buildings or open spaces.

Our partner: Fortinet

Classic firewalls offer little protection for increasingly important web applications. Next-generation firewalls with IPS and Antivirus can offer a certain basic protection for vulnerabilities in the server software. But this usually does not help against a vulnerability in the programming of the page logic, because the content is created individually per customer and installation.

With Web Application Firewalls (WAF) we can protect your servers and improve data integrity as well as server availability. We also use them to minimize the risk of your website being used to spread malware. A WAF takes care of many web security issues such as:

• Code injection
• Cross-site scripting (XSS)
• Cross-site request forgery (CSRF)
• Unwanted data leakage
• URL whitelisting and blacklisting

You can learn about the top 10 risks in web programming at OWASP Top Ten Project.

Our Partner: Netskope

Generative AI has quickly become part of the modern workplace. Employees use applications such as ChatGPT, Microsoft Copilot, and Google Gemini, while autonomous AI agents are increasingly being deployed to perform tasks and make decisions. Without the right security controls, this introduces new risks—including data leakage, prompt injection, unauthorized AI use, and compliance violations.

At the same time, many organizations lack the visibility they need to manage these risks. According to the 2026 AI Risk and Readiness Report by Cybersecurity Insiders, commissioned by Netskope and based on a survey of 1,253 security professionals, 94% of organizations lack sufficient visibility into their AI usage. Only 23% enforce policies inline, 14% inspect API traffic, and just 9% can intervene before a risky agent action is completed.

Secure AI—From Applications to Autonomous Agents

Netskope enables organizations to discover, control, and secure AI across the entire AI ecosystem through a unified security and policy framework.

• AI Visibility & Discovery: Netskope One AI Command Center and Advanced Analytics provide visibility into GenAI applications, AI capabilities embedded in SaaS applications, and MCP servers used by autonomous agents. Organizations can centrally monitor usage trends and potential DLP violations while mapping discovered AI assets to the identities, data stores, and tools they are connected to—helping uncover hidden attack surfaces.
• Secure the AI Pipeline: Netskope One Agentic Broker provides visibility and access control for MCP implementations running locally, in containers, or on remote servers, complemented by an inventory of publicly available MCP servers. MCP servers are assessed for risk, while access can be controlled based on context—including blocking MCP traffic by default. Sensitive information such as intellectual property, passwords, and customer data can be detected within MCP traffic. Netskope One AI Red Teaming can also automatically test private LLMs for vulnerabilities before they are deployed into production.
• Protect Real-Time AI Interactions: Netskope One AI Guardrails inspects prompts and responses in real time to protect against prompt injection, jailbreaking, misuse, and data loss. Detections are mapped to MITRE ATLAS and the OWASP Top 10 for LLMs. Netskope One AI Gateway secures communication between applications and self-hosted LLMs with authentication, rate limiting, and content inspection. GenAI App Security extends protection across the entire GenAI environment—from personal and business applications to sanctioned AI tools and shadow AI.
• Optimize AI Performance: NewEdge AI Fast Path optimizes network connectivity to key AI services, reducing time to first token and accelerating multi-step agent workflows—without compromising security or the user experience.

Secure AI. Maintain Control.

AI Security provides the visibility organizations need to understand how AI is being used and the controls required to enforce security and compliance policies. It protects not only traditional GenAI applications, but also private LLMs and autonomous AI agents.

With the right controls in place, organizations can adopt AI with confidence while identifying and mitigating risks such as data loss, unauthorized access, and AI-specific attacks before they become business-critical issues.

Our Partner: Netskope

Secure Access Service Edge (SASE) brings networking and security together in a cloud-native, centrally managed architecture. Instead of backhauling traffic through a corporate data center, SASE provides direct, secure, high-performance access to applications—regardless of where users, devices, or applications are located.

Key Benefits of SASE

• Secure SD-WAN: Optimized routing and high-performance connectivity for branch offices, remote users, and endpoints.
• Security Service Edge (SSE): Comprehensive protection for network and data traffic with integrated SWG, CASB, and ZTNA, complemented by FWaaS, threat protection, and data loss prevention.
• Direct Access: Improve application performance and reduce latency by eliminating unnecessary traffic backhauling through central data centers.
• Security at the Edge: Apply consistent security policies wherever users, devices, and applications connect—regardless of location.
• Centralized Management: Manage network and security policies from a single platform, providing greater visibility, consistency, and control.

Networking and Security on a Single Platform

SASE gives organizations a modern approach to replacing fragmented networking and security solutions with an integrated, cloud-native architecture. The result is less complexity, centralized control, and consistent security across every location and connection.

Netskope One brings core SASE capabilities—including SWG, CASB, ZTNA, DLP, and SD-WAN—together on a single platform. It combines a unified management console, a single client, the Netskope Zero Trust Engine for consistent policy enforcement, and the global NewEdge network.

Together, these capabilities provide secure, consistent access to applications and data for users, devices, and workloads—anytime, anywhere.

Netskope is recognized in the Gartner Magic Quadrant for SASE Platforms.

Our Partner: Netskope

Traditional VPN solutions were designed for a world where applications and employees were primarily located within the corporate network. Today, users work from a wide variety of locations and devices and access applications in the cloud and in the data center. Traditional VPN access creates unnecessary complexity, can impair performance, and often grants broader network access than is actually required.

Added to this is a structural risk: The VPN concentrator is an appliance accessible from the Internet and is therefore a constant target for attacks—vulnerabilities in VPN gateways have been among the most frequently exploited entry points for years. Furthermore, a successful attack typically opens up the entire network, not just a single application.

Zero Trust Instead of Network Access

With Universal ZTNA—comprising Netskope One Private Access and Netskope Device Intelligence—remote access is implemented according to the least-privilege principle. Users no longer have access to the entire network, but rather to the specific applications for which they are authorized.

• Application-based access: Access is granted directly to the required application—not to the underlying network.
• Least privilege: Users are granted only the permissions that are actually necessary for their tasks.
• Reduced attack surface: Since there is no comprehensive network access, the risk of lateral movement within the infrastructure is reduced.
• Better performance: Direct connections to applications avoid unnecessary VPN overhead and enable faster access.
• Simplified remote access: A modern approach to secure access to private applications—regardless of where users and applications are located.

Remote Access Reimagined

Universal ZTNA replaces traditional network access with controlled, application-based access. This makes remote access both more secure and more efficient—without the drawbacks and additional overhead of traditional VPN connections.