All right, then switching gears a little bit.
User behavior analytics.
This goes back to the anomaly based detection.
Again, it's the process of tracking user
behavior to detect malicious attacks, potential threats, financial fraud.
It provides advanced threat detection
and it's used to identify variations in traffic patterns caused by user behaviors
which can be either disgruntled employees or malicious attackers.
Network access control.
Network access control, also known as the network admission control, appliances that
control or protect the network by restricting the connection of an end user
to the network on the basis of a security policy.
So you have a pre installed software agent that examines the system to be sure that
it actually meets the security requirements.
So it does give you authentication of
users connected to network resources, identification of devices, platforms, and
operating systems, defining a connection point between
network devices, and development and application of
security policies. All right, Web content filters.
These have been around an awful long time.
Their whole purpose is to prevent
undesirable content, whatever that may be defined as, on the Worldwide Web, harmful
websites, undesirable, inappropriate content.
It protects the network from malware, phishing and pharming attacks.
It filters content based on keywords, URLs, and contextual analysis.
It provides additional protection other
than traditional network firewalls and antivirus software.
A lot of that is content inspection,
whitelisting or blacklisting different websites, that thing.
A lot of that can actually be deployed through your web proxy.
Unified threat management wraps everything into one solution.
Allows an administrator to monitor and
manage the organization's network through a centralized management console, wraps
everything into one product, or wraps multiple functionalities into one product.
Provides firewall
intrusion detection, and a power spam filter, load balancing, content filtering,
data loss prevention, and VPN capabilities using a single ATM appliance.
You always want to exercise a healthy skepticism for
any single device's capability to handle this type of workload.
Of course, the vendors are going to tell you, Oh, absolutely.
The history is dictated that you might
want to separate out things a little bit and do some prefiltering.
But regardless, a single UTM appliance is one stop shopping for everything.
Security incidents and event management systems.
Siems
are a consolidation point on the network or central location, perform real time
security operation center functions, identifying, monitoring, recording,
auditing, and analyzing security incidents, provides security by tracking
suspicious end user behavior activities within a real time environment,
and manages security, combining information and security event management.
You see S IEM, SIM, SEM, or combinations there in between, but it's centralization.
The whole thing started off with SIS logging, centralized logging
locations, and that evolved into SIM systems, where again, we consolidate
everything in the central location for examination.
Security orchestration, automation, and
response is a suite or stack of technologies
that assist in accumulating, investigating, and responding to adversary
events, employing a standardized automation workflow.
It deals with the detection, the triage, the prioritization, and the response.
Little bit out of order there.
No, we're actually starting flowing.
Prioritization in the response as well.
But this whole circle is the core of incident response.
Detect, verify, respond based on priority, based on severity events.
But a source system automates the whole
thing, enhances the defensive efficiency of a security operation center.