Cybersecurity

Defensive security services

MB Aldarna is an independent Lithuanian consultancy for cybersecurity and IT. We work on the defensive side only, helping organisations protect their networks, servers, software and everything attached to them, and we hold our own cloud platform to the same standard. Below is what we do, how we work and how to report a vulnerability.

What we do

Security audit and risk assessment

We map the network, its services, access rights and data flows, rank the risks and arrange them into a plan that can be carried out in stages.

Vulnerability assessment and validation

Scanner results are always checked by hand, because many are false positives. For each real finding we explain the impact and what to do.

Infrastructure hardening

Linux servers, Docker containers, internet-facing services, network equipment. Firewalls, segmentation, VPN, Zero Trust, two-factor authentication, update management.

Monitoring and incident investigation

Log collection, anomaly alerts and incident plans. When something happens we find the cause, assess the impact and help with recovery, then write it up so nobody starts from zero next time.

Authorised security testing

Only on systems the client controls, only with written permission stating scope and time frame. We go through the results together.

IoT and building automation security

Controllers, cameras and sensor networks are usually the weakest link. Take one over and you can reach the whole internal network, including the computers used for banking. At one client we found an IoT device connecting to servers in Russia, although it had been bought from a European online shop. Cheap Chinese thermostats, thermometers, sensors and gate controllers are everywhere, and in themselves they are fine. The problem is that they talk to servers nobody knows anything about, and nothing guarantees they will still be harmless tomorrow. So we isolate such devices and control them locally, in a closed environment that nothing gets into or out of.

Backups and recovery

The 3-2-1 rule, regular restore tests, a plan for data loss or ransomware.

Training and processes

Teaching staff to recognise fraud and handle access carefully, and helping write rules that are then applied, not just filed.

Systems we build and protect

Besides consulting we develop and run ALDARNA Cloud, a platform for managing building automation controllers. We are responsible for its security ourselves, so whatever we recommend to clients is tried in our own environment first:

  • hardened Linux hosts and containerised services with minimal privileges
  • access only through Zero Trust tunnels with two-factor authentication, and no administrative interfaces open to the internet
  • centralised logs and alerts
  • regular updates and vulnerability review
  • backups that we periodically test by restoring them
  • an incident management procedure and a separate channel for reporting vulnerabilities

How we work

  • Only with permission and a clear scope

    Only on systems the client controls, only with written permission. No "just have a quick look".

  • Legality

    We comply with Lithuanian and EU law, including the Criminal Code and the GDPR, and do not work with anyone whose identity we cannot confirm.

  • Confidentiality and data protection

    Client data is used only for the task and deleted afterwards. NDAs on request.

  • The findings belong to the client

    The findings go to the client only. A bug in a third-party product goes to the manufacturer first, with time to fix it.

  • Defensive purpose

    Everything we do is for protection. No malicious tools, and no work whose purpose is not defensive.

  • Who we work for

    Companies, private individuals and public sector organisations in Lithuania and the EU, on site or remotely.

Vulnerability disclosure

If you have found a security flaw on aldarna.lt, in the ALDARNA Cloud platform or in any other system we run, please e-mail us. Machine-readable contact details are at /.well-known/security.txt (RFC 9116).

  • We will review your report and reply within 3 working days.
  • Do not use the flaw beyond what is needed to prove it exists. No browsing, changing or deleting other people's data, no DoS, no social engineering.
  • Please do not publish until we have fixed it. We will agree a timeline with you.
  • Researchers acting in good faith and following these rules will not face legal action from us. Public credit if you want it.

Company identity

Legal nameAldarna, MB (MB Aldarna)
Legal formMažoji bendrija – small partnership (Republic of Lithuania)
Head of companyDarius Aleškaitis
Company code305039889
RegistrationRegister of Legal Entities of the Republic of Lithuania, 20 February 2019
Registered officeDobilų g. 6, Garliava, LT-53250 Kaunas district, Lithuania
Activity (NACE)62.10 – computer programming activities; IT and security consulting
Websitewww.aldarna.lt
Security contactby e-mail (see contact) · /.well-known/security.txt

Need a security audit?

Write to us and we will tell you where to start.

Get in touch