Blue Lights Digital

Blue Lights Discovery knowledge platform

The next-generation training and resource solution delivering concept to delivery around the evolving challenges of digital investigation. This platform delivers interactive, immersive multimedia led training courses, continual professional development and resources optimised for smartphones, tablets and the web enabling access to professional knowledge, Procedure, Policy and Intelligence anytime, anywhere.

Features

  • Real time reporting
  • Synchronised mobile access
  • Identity Access Managed
  • Off line local app content available in active mode
  • Full interactive immersive visualised workflows
  • Self managed content or a managed service
  • Current legislation
  • Current Search & Seizure guidance
  • Pay per module or on a subscriber usage
  • Full Continual Professional Development automation

Benefits

  • Streamlined analysis saving manual configuration & processing
  • Big data scalability - automating workflow
  • Access updated easy to understand Cyber Threats
  • Access updated 'Safer Mobile Device Settings'
  • Identity Access Management is built in for increased security posture
  • Connect via HTTPS using SSL/TLS or mobile App
  • Access latest digital forensics procedures
  • Enterprise subscription reducing cost per user
  • Mobile 24/7 Digital Investigation Coordination
  • Manage training, CPD, IP & digital culture in one portal.

Pricing

£0.00 per person

  • Education pricing available
  • Free trial available

Service documents

G-Cloud 9

747483573556240

Blue Lights Digital

Matt Service

01223919607

matt@bluelightsdigital.com

Service scope

Service scope
Software add-on or extension No
Cloud deployment model Hybrid cloud
Service constraints Available from the Apple App Store, Google Play Store App. Windows mobile is in development. Enterprise edition is issued through MDM policy and local procedures for organisations security compliance. Professional services are available for integration at our standard day rates.
System requirements
  • Enterprise edition requires subscription
  • IOS device
  • Android device
  • Desktop browser for Web Services

User support

User support
Email or online ticketing support Email or online ticketing
Support response times Mon - Fri 08:00 - 19:00 4 hour response
Sat - Sun 08:00 - 19:00 Next day response
19:00 - 00:00 Bank Holidays Next day response
User can manage status and priority of support tickets No
Phone support Yes
Phone support availability 9 to 5 (UK time), Monday to Friday
Web chat support No
Onsite support Yes, at extra cost
Support levels Support is on a reasonable endeavour basis and is included in our pricing.
Dedicated 'operational' support can be provided under our standard day rates for an investigating officer.

Technical developers can be provided to assist with data modelling, Data integration, Data Parsing, Data migration, API build, software integration, Network integration and automation under our standard day rates.
Support available to third parties No

Onboarding and offboarding

Onboarding and offboarding
Getting started Training is provided by the app itself. The UI and UX are designed for self provisioning. Content is navigated by breadcrumbs and visual pointers. The app has been UX tested for systems usability. With all versions of Discovery the 'About Discovery' module will demonstrate how to use the system.

Training can be provided for Administration purposes where administrators are required to manage cohorts, manage reporting metrics, report on currency and compliance and award credentials.

Training can be provided in design, build and operation of discover modules.
Service documentation Yes
Documentation formats
  • HTML
  • ODF
  • PDF
End-of-contract data extraction Data is deleted by Blue Lights Digital only. Note that any data downloaded to a container on a mobile device will remain at rest on that device. Therefore clients are recommended to use MDM to manage access to the enterprise edition of the Discover App.
End-of-contract process A subscription will lapse and no further updates will be provided to that user. Access to the web service will also be denied. The app, its content and workflow will remain at rest until deleted by the user or via an MDM function.

Using the service

Using the service
Web browser interface Yes
Supported browsers
  • Internet Explorer 7
  • Internet Explorer 8
  • Internet Explorer 9
  • Internet Explorer 10+
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
  • Opera
Application to install No
Designed for use on mobile devices No
Accessibility standards WCAG 2.0 A
Accessibility testing Discovery can use the full accessibility options available on IOS and Android devices. Testing has been completed for both apps. Windows mobile is in development
API No
Customisation available Yes
Description of customisation Modules can be updated through admin access portal by Web Services only. Access is via HTTPS with Identity Access Management applied.

Customer managed content can be updated and published to web and mobile users.

Scaling

Scaling
Independence of resources Load balancing, Clients can be allocated reserved instances for on demand scaling.

Analytics

Analytics
Service usage metrics Yes
Metrics types Transaction by user, client to domain.
Reporting types Reports on request

Resellers

Resellers
Supplier type Not a reseller

Staff security

Staff security
Staff security clearance Conforms to BS7858:2012
Government security clearance Up to Developed Vetting (DV)

Asset protection

Asset protection
Knowledge of data storage and processing locations Yes
Data storage and processing locations United Kingdom
User control over data storage and processing locations Yes
Datacentre security standards Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency At least once a year
Penetration testing approach In-house
Protecting data at rest Scale, obfuscating techniques, or data storage sharding
Data sanitisation process Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data importing and exporting
Data export approach Any data that is managed on behalf of the client can be extracted and sent to the client in a format of there choosing.
Data export formats
  • CSV
  • ODF
  • Other
Data import formats
  • CSV
  • ODF
  • Other

Data-in-transit protection

Data-in-transit protection
Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Availability and resilience
Guaranteed availability Availability of less than 99.95% but equal to or greater than 99.0% is guaranteed by a 10% service credit for failure to meet SLA.

Availability less than 99.0% is guaranteed by a 30% service credit for failure to meet SLA.
Approach to resilience We utilise elastic load balancing, computing clusters, autoscaling and cloud flaring (DNS obfuscation) to add resilience to our cloud environments.
Outage reporting Email alerts to users.

Identity and authentication

Identity and authentication
User authentication needed Yes
User authentication
  • 2-factor authentication
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
Access restrictions in management interfaces and support channels Access to the Decypher system is limited by identity Access Management to known and vetted users only. Three factor authentication is required via a RSA key, Password and Username.
Access restriction testing frequency At least every 6 months
Management access authentication
  • 2-factor authentication
  • Username or password

Audit information for users

Audit information for users
Access to user activity audit information You control when users can access audit information
How long user audit data is stored for User-defined
Access to supplier activity audit information You control when users can access audit information
How long supplier audit data is stored for User-defined
How long system logs are stored for User-defined

Standards and certifications

Standards and certifications
ISO/IEC 27001 certification No
ISO 28000:2007 certification No
CSA STAR certification No
PCI certification No
Other security accreditations Yes
Any other security accreditations Cyber Essentials

Security governance

Security governance
Named board-level person responsible for service security Yes
Security governance accreditation No
Security governance approach Through Cyber Essentials and NCSC cloud principles.
Information security policies and processes We use a shared responsibility model between customers and Blue Lights Digital. We operate, manage, and control the components at the operating system layer down to the physical security of the servers in which the services are provided (including updates and security patches), other associated application software, as well as the configuration of firewalls. ,

It is possible to enhance security and/or meet more stringent compliance requirements by leveraging technology such as host-based firewalls, host-based intrusion detection/ prevention, and encryption which can be requested by our clients at additional charges.

Operational security

Operational security
Configuration and change management standard Supplier-defined controls
Configuration and change management approach Any changes to our systems are first managed by impact and risk assessment. Any changes to architecture, software or network access is tested within a development environment before release to production. A production snapshot is available for roll back.

Security assessment is managed through in house pentesting an testing procedures. External pen testing is subject to additional charges.
Vulnerability management type Supplier-defined controls
Vulnerability management approach As part of our Cyber Essentials programme we practice identifying, classifying, remediating, and mitigating vulnerabilities.

We use vulnerability scanners to identify known vulnerabilities, such as open ports, insecure software configuration, and susceptibility to malware. For unknown vulnerabilities, such as a zero-day attacks we relay on updates to our vulnerability scanners such as OWASP ZAP. Vulnerability testing is also part of our test automation processes.

Correcting vulnerabilities involves the installation of a patch, a change in network security policy, reconfiguration of software, or educating users about social engineering.

We are active members of OWASP, CISP and Black Hat communities.
Protective monitoring type Supplier-defined controls
Protective monitoring approach We license SiteLock TrueCode Static Application Security Testing (SAST) for source code analysis. Also known as "white-box" testing, TrueCode finds common vulnerabilities by analysing 100% of the source code in our applications without actually executing them, and adds critical layer of security by protecting our web applications.

Our SAST is automated to send alerts if a breach or malware is detected.
Incident management type Supplier-defined controls
Incident management approach The activities within our incident management process include:
Incident detection and recording
Classification and initial support based upon known errors and new events
Investigation and analysis
Resolution and record
Incident ownership, monitoring, tracking and communication

We report on incidents with a full disclosure policy to ensure any impact can be contained and a resolution is satisfactory to the end user.

Incident reports are provided by e-mail to the end user.

Secure development

Secure development
Approach to secure software development best practice Conforms to a recognised standard, but self-assessed

Public sector networks

Public sector networks
Connection to public sector networks Yes
Connected networks
  • Public Services Network (PSN)
  • Police National Network (PNN)

Pricing

Pricing
Price £0.00 per person
Discount for educational organisations Yes
Free trial available Yes
Description of free trial The Discovery App is free from the Apple and Google App Store.
Blue Lights Digital will provide a 30 day fee trial to selected content modules. The modules available are:

Cell Site Analysis
Cellular Networks
Cyber Threats
Glossary for Digital Investigations
Online Investigations (OSINT)
Safe Social Media
Search & Seizure

Documents

Documents
Pricing document View uploaded document
Terms and conditions document View uploaded document
Return to top ↑