01 / 04Firewall rules
What we deliverLayer 3 and Layer 7 rules by address, port and application.
Why it matters
Only the traffic each system needs gets through, and every rule change is logged and backed up.
- Home
- Cybersecurity Services
Cybersecurity Services in NYC
- Firewalls and segmentation
- Hardened cameras and readers
- Secure remote access
Security for your business network and every camera, reader and intercom on it.
- 1,000+
installations over 10+ years
- 24/7
support for managed-service clients
- Excellent
Rated 4.9/5 by 110+ NYC corporations
- 7 Active Teams
Operating throughout New York
Are you facing?
Our cybersecurity services in NYC start with cameras, readers and intercoms: computers nobody treats as computers.
Your situation01Cameras and readers sit on our business network
What we doGive each class of device its own segment, with traffic between them denied by default.What to expect
On a flat network, one weak device reaches everything. After segmentation, a compromised camera reaches only its recorder, which helps stop a breach spreading. Staff, guest, video, access control, intercom and management traffic each get their own network.
Your situation02Our recorder is open to the internet
What we doClose the port forward; cloud platforms connect outbound, and staff use client VPN.What to expect
Remote viewing keeps working without exposing the recorder. Each user reaches only the system they need: a facility manager reaches the video platform and nothing else. Outside vendors get named, time-limited accounts, so no shared logins are left behind.
Your situation03Our IT team doesn't manage the security devices
What we doSecure the devices and the firewall they sit behind, working alongside your IT.What to expect
Usually IT and the security vendor each assume the other owns the cameras' firmware and passwords. We own both the device and the firewall, so the gap has an owner. We build to your policies, record every change and hand over full documentation.
Your situation04We need records for NYDFS Part 500 or the SHIELD Act
What we doSegmentation diagrams, access reviews and change logs your compliance team can work from.What to expect
For cybersecurity in New York under NYDFS Part 500 or the NY SHIELD Act, our network security services support your program. Your compliance team owns it, and we do not certify compliance.
Managed firewall services and secure remote access
Managed firewall services keep edge policy correct over time, on next-generation firewalls such as the Cisco Meraki MX.
01 / 0402 / 04Threat protection
What we deliverContent filtering, intrusion prevention and Advanced Malware Protection.
Why it matters
These run on the Meraki MX with Advanced Security licensing, and Meraki Auto VPN links your locations site to site.
03 / 04Identity-based remote access
What we deliverCisco Secure Client (formerly AnyConnect) on the MX, authenticated against your directory.
Why it matters
Multi-factor authentication runs through your identity provider, following zero-trust principles: every user is verified before they reach anything.
04 / 04Alerts to your team
What we deliverOffline devices and configuration changes flagged from the cloud dashboard.
Why it matters
Your team sees problems as they happen. Existing managed-service clients also get 24/7 support, with a 4-hour response on critical failures.
Networks and security systems we have delivered
Pacha NYC shows the network and security delivered together; Lexington School shows NDAA-compliant access control.
Hospitality and nightlife01 / 02
Pacha NYC
Two venues' network and security systems delivered by one team.
What we did
IT infrastructure programming, structured cabling and fiber, integrated access control and over 200 AI-powered cameras across Brooklyn Hall and Pacha, with 25+ technicians working simultaneously and ongoing support.
Education02 / 02
Lexington School for the Deaf, Queens
Compliant, on-premises access control with accessible entry.
What we did
Electrified retrofit hardware, NDAA-compliant on-premises access control and two ADA-compliant swinging doors.
What do your security systems expose?
We will review what runs on your network and show you the gaps.
Hardening cameras, access control and intercoms
Hardening closes the gaps firewalls cannot see, with one baseline on every device we install or take over.
01 / 04Unique credentials
What we deliverIts own administrator password on every device, with UPnP, Telnet and FTP turned off.
Why it matters
A leaked password exposes one device, not every camera, and fewer running services means fewer ways in.
02 / 04Firmware tested first
What we deliverUpdates on a schedule, tested on one unit before the rest.
Why it matters
Known flaws are closed without breaking the systems that depend on the device.
03 / 04Encrypted connections
What we deliverHTTPS for management, and OSDP Secure Channel instead of Wiegand.
Why it matters
Traffic between readers and controllers, and to management screens, is encrypted in transit.
04 / 04NDAA-compliant hardware
What we deliverNDAA-compliant cameras only, from Axis and Genetec.
Why it matters
Section 889 of the 2019 NDAA bars federal agencies and grant recipients from buying covered equipment, including Hikvision, Dahua and Hytera video surveillance and Huawei and ZTE telecom equipment.
Network segmentation for cameras, access control and IoT
Each class of device gets its own network, and this is what each one may reach.
| Network | What is on it | What it may talk to |
|---|---|---|
| Staff | Laptops, phones, printers | Business systems and filtered internet |
| Video | Cameras and recorders | The recorder only |
| Access control | Door controllers, readers | Its server or cloud service only |
| Intercom and IoT | Intercoms, sensors, AV | Their own platform and named integrations |
| Guest | Visitor devices | Internet only, clients isolated |
| Management | Switch and firewall management | Authorized administrators only |
Why it matters
Staff wireless uses WPA3 and 802.1X, so network access ends the day someone leaves.
How the work runs
Four steps, from what is on your network today to records your team keeps.
- 01
Review
Every device on the network listed, with its credentials, firmware and exposure.
- 02
Segment
Each class of device moved to its own network, denied by default.
- 03
Harden
Unique credentials, tested firmware, encrypted connections and unused services off.
- 04
Document
Segmentation diagrams, rule descriptions and change logs handed to your team.
FAQs
Cybersecurity services FAQs
What cybersecurity services do you provide in NYC?
The cybersecurity services we provide in NYC cover the network and the security systems on it. That means managed firewalls, segmentation, secure remote access, device hardening and monitoring.
Are you one of the cybersecurity companies in NYC, or a security integrator?
We are a security integrator that secures the networks we build. We also install the cameras and access control on them.
Do you offer managed firewall services?
Yes, we offer managed firewall services on next-generation firewalls such as the Cisco Meraki MX. That covers rules, content filtering, intrusion prevention, VPN and change control.
Why does physical security cybersecurity matter?
Physical security cybersecurity matters because cameras, door controllers and intercoms are network devices with credentials and firmware. Each one stays on the network for years.
Can you help us meet NYDFS Part 500 or other New York requirements?
We can help with the network and security-system controls behind NYDFS Part 500 or other New York requirements. Our documentation supports your program; your compliance team owns it.
Do you replace our IT team or provider?
No, we do not replace your IT team or provider. We secure the network infrastructure and security systems, and hand over full as-built documentation.
Request a cybersecurity site assessment
Tell us which systems you run. We'll give you a prioritized list of fixes.