Telefonica UK Limited

Secure Mobility – SandBlast Mobile from O2

SandBlast Mobile (previously MTP/Capsule) provides powerful and continuous levels of security across organisations’ mobile device real-estate. The solution provides an always-on, always up-to-date protection for your smartphone and tablet users against known and unknown threats before any damage can be caused.

Features

  • Cloud protection for data including Anti-Bot protection
  • On-device network protection
  • URL Filtering
  • Conditional access - restrict access to corporate resources
  • Cloud based management portal with detailed reporting
  • Clear user alerts with remediation recommendations

Benefits

  • Stay ahead of new and emerging Gen V threats
  • Constant real-time protection against the latest threats
  • Device protection regardless of how the device is connected
  • Network security policies can be replicated on mobile devices
  • Works across a wide range of mobile devices
  • No additional hardware or software installation required
  • Proactive device lock down when threats are detected

Pricing

£23.40 a device a year

  • Free trial available

Service documents

Framework

G-Cloud 12

Service ID

3 1 5 0 5 4 4 3 9 5 7 6 7 5 6

Contact

Telefonica UK Limited Neil Cruden
Telephone: 07872015506
Email: g-cloud_framework@o2.com

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
SandBlast Mobile can be integrated with UEM and data governance solutions to create the basis for a digital workplace
Cloud deployment model
  • Community cloud
  • Hybrid cloud
Service constraints
None
System requirements
No special requirements defined

User support

Email or online ticketing support
Email or online ticketing
Support response times
24 hours
User can manage status and priority of support tickets
Yes
Online ticketing support accessibility
WCAG 2.1 AAA
Phone support
Yes
Phone support availability
24 hours, 7 days a week
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
SandBlast Mobile from O2 includes Helpdesk-to-Helpdesk support at a "Break/Fix" level. Initial issue triage is to be conducted by the customer helpdesk prior to escalation to O2, who in turn will escalate to Check Point as required depending on the severity of the issue.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
SandBlast Mobile has a simple on-boarding process that can be managed either via a UEM solution or direct download and email enrolment of the "protect" app. Once the end-user has the "protect" app installed and correctly registered, no other action is required by the end-user
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
No user data is stored in this SaaS solution. Only binary code from the app is shared with the cloud risk engines.
End-of-contract process
Delete device list from database in SaaS solution and remove app from device. The instance will then be disposed of with no data persistence.
There is no automatic renewal for SandBlast licences. At the end of the contract, unless renewed, the device list is deleted and the ""protect"" app is deactivated and removed.

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
Application to install
Yes
Compatible operating systems
  • Android
  • IOS
  • MacOS
  • Windows
  • Windows Phone
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
SandBlast Mobile has two distinct elements;
1) On device application
Which monitors device and App performance for threats.
2) Desktop admin portal
Which provide a reporting mechanism for administrators to monitor devices and threats.
Service interface
Yes
Description of service interface
The end-user requires the "protect" app on their device and the device to be registered within the admin portal.
Once registered, the end-users device behaviour and performance s being monitored against potential threats.
Accessibility standards
None or don’t know
Description of accessibility
The end-user requires the "protect" app on their device and the device to be registered within the admin portal.
Once registered, the end-users device behaviour and performance s being monitored against potential threats."
Accessibility testing
Not applicable to the service.
API
Yes
What users can and can't do using the API
REST API allows the customer to create integration and automate actions by collecting or injecting data classes and attribute values to/from the cloud service.
API documentation
Yes
API documentation formats
PDF
API sandbox or test environment
No
Customisation available
Yes
Description of customisation
"Service requests from customers are typically supplied for alteration of risk levels associated with specific detection events.
e.g. an organisation wishes to detect network packet capture apps on android phones as high risk rather than medium risk."

Scaling

Independence of resources
The SandBlast service is delivered via the European AWS infrastructure, a leading technology that provides assurances that scalability is readily available to ensure that customer requirements are met through comprehensive load-balancing protocols.

Analytics

Service usage metrics
No

Resellers

Supplier type
Reseller providing extra features and support
Organisation whose services are being resold
Check Point Technologies (UK) Ltd

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Developed Vetting (DV)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
User control over data storage and processing locations
Yes
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least every 6 months
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Physical access control, complying with CSA CCM v3.0
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Not applicable, no user data is stored by this solution.
Data export formats
Other
Other data export formats
No application data can be extracted
Data import formats
Other
Other data import formats
No application data can be extracted

Data-in-transit protection

Data protection between buyer and supplier networks
Other
Other protection between networks
SandBlast Mobile is hosted on AWS in either London or Dublin on a separate network to Checkpoint and O2. Your unique SandBlast Mobile instance is hosted on AWS infrastructure to which no other individual has access.
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
99.99%
Approach to resilience
AWS HA measures.

Customers will be notified of any planned service outages via the Admin portal, any unplanned outages will be managed within the standard AWS policies and processes.
Outage reporting
AWS HA measures.

Customers will be notified of any planned service outages via the Admin portal, any unplanned outages will be managed within the standard AWS policies and processes

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Username or password
Access restrictions in management interfaces and support channels
Role and scope based access

User access is based upon the individual role assigned by the Primary Admin.
Access restriction testing frequency
At least every 6 months
Management access authentication
2-factor authentication

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
Between 6 months and 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
Between 6 months and 12 months
How long system logs are stored for
Between 6 months and 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
https://aws.amazon.com/compliance/iso-27001-faqs/
ISO/IEC 27001 accreditation date
03/12/2018
What the ISO/IEC 27001 doesn’t cover
All relevant areas covered
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Other security certifications
Yes
Any other security certifications
  • SOC1
  • SOC2

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
Checkpoint is an organisation that complies with a wide variety of internationally recognized security standards, approval processes and independent security industry tests.
Information security policies and processes
We strive to replicate the standard of ISO/IEC 27001.

our goal is to hold ourselves to the highest levels of security and as such we follow the processes and standards set out within ISO/IEC27001.

Checkpoint is a company founded on key security principals and they constantly monitor security governance.

Operational security

Configuration and change management standard
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Configuration and change management approach
SOC2: http://www.ssae16.org/important-elements-ssae16/what-is-a-service-organization.html

Our aim is to ensure that we follow the latest standards and best practice within all of our processes, to this end we follow SOC2 standards More information can be found here: http://www.ssae16.org/important-elements-ssae16/what-is-a-service-organization.html
Vulnerability management type
Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
Vulnerability management approach
SOC1 pen testing audits.

We adhere to guidelines set out within SOC1 for penetration testing audits
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
As a leading supplier of internet security products, Check Point uses many of its own products, such as the latest firewalls and IPS solutions to protect all their systems against unauthorized access, these include endpoint gateways and mobile devices protection; software blades to manage access to applications; anti-malware; encryption technology; user authentication via password and certificates; access control to corporate resources; data labeling, document control and logging. Check Point also employs physical security procedures such as security guards, electronic access devices, video cameras and restricted access areas.
Incident management type
Conforms to a recognised standard, for example, CSA CCM v3.0 or ISO/IEC 27035:2011 or SSAE-16 / ISAE 3402
Incident management approach
For incident management the support desk operates within standard ITIL processes. Support is offered on a helpdesk-to-helpdesk basis ONLY.

Secure development

Approach to secure software development best practice
Conforms to a recognised standard, but self-assessed

Public sector networks

Connection to public sector networks
No

Pricing

Price
£23.40 a device a year
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
Up to 50 users can get up to a 30 day trial, to test operational scope of the service.
Link to free trial
Please contact O2 directly to arrange a trial

Service documents