Tools

1. Endpoint Protection

  • Priority: Critical

  • Function: Protects endpoints from malware, ransomware, and other malicious activities, ensuring devices are secure and monitored for threats.

  • Examples: Symantec Endpoint Protection, McAfee Endpoint Security

2. Identity and Access Management (IAM)

  • Priority: Critical

  • Function: Manages and controls access to resources, preventing unauthorized access and ensuring appropriate access levels for employees.

  • Examples: Okta, Microsoft Azure Active Directory

3. SIEM (Security Information and Event Management)

  • Priority: Critical

  • Function: Provides centralized visibility, detects threats, and helps in responding to incidents in real-time by analyzing security event data from across the network.

  • Examples: Splunk Enterprise Security, IBM QRadar

4. Network Security

  • Priority: Critical

  • Function: Defends the network perimeter against external threats and ensures availability and performance. It includes firewall policy management and anti-DDoS protection.

    • Firewall Policy Management: Configures and manages firewall policies to control traffic and protect the network.

      • Examples: Palo Alto Networks Panorama, Cisco Firepower Management Center

    • Anti-DDoS (Distributed Denial of Service): Protects against DDoS attacks to maintain network availability.

      • Examples: Cloudflare, Radware

5. EUBA (Enterprise User Behavioral Analytics)

  • Priority: High

  • Function: Detects and mitigates insider threats and compromised accounts by analyzing deviations from normal user behavior.

  • Examples: Exabeam, Splunk User Behavior Analytics

6. Vulnerability Scanning (Internal and External)

  • Priority: High

  • Function: Identifies and addresses vulnerabilities to prevent exploitation by attackers. Regular scanning helps in maintaining a secure posture by proactively identifying weaknesses.

  • Examples: Nessus, Qualys

7. CASB (Cloud Access Security Broker)

  • Priority: High

  • Function: Provides visibility and control over cloud applications, ensuring compliance and security policies are enforced.

  • Examples: McAfee MVISION Cloud, Palo Alto Networks Prisma Access

8. DLP (Data Loss Prevention)

  • Priority: High

  • Function: Protects sensitive data from being exposed or stolen by monitoring and controlling data transfers across the network, endpoints, and cloud.

  • Examples: Symantec Data Loss Prevention, McAfee DLP

9. Application Security

  • Priority: High

  • Function: Ensures the security of applications through comprehensive testing and monitoring, preventing vulnerabilities and exploits. This includes various types of testing and protection measures.

    • IAST (Interactive Application Security Testing)

      • Examples: Contrast Security, Synopsys

    • DAST (Dynamic Application Security Testing)

      • Examples: OWASP ZAP, Acunetix

    • Component Scan

      • Examples: Black Duck, Sonatype Nexus

    • Pentesting

      • Examples: Metasploit, Kali Linux

    • SAST (Static Application Security Testing)

      • Examples: Fortify, Checkmarx

    • RASP (Runtime Application Self-Protection)

      • Examples: Imperva, Waratek

    • Application Shielding

      • Examples: Arxan, Jscrambler

10. Secret Management

  • Priority: High

  • Function: Securely manages secrets, such as API keys, passwords, and certificates, to protect sensitive information and ensure access control.

  • Examples: Thales CipherTrust Manager, AWS Secrets Manager

11. Internal Certificate Management

  • Priority: High

  • Function: Manages internal certificates to ensure secure communication and authentication within the organization.

  • Examples: Venafi, DigiCert CertCentral

12. SOAR (Security Orchestration, Automation, and Response)

  • Priority: Medium

  • Function: Automates response to security incidents, reducing response time and improving efficiency in dealing with threats.

  • Examples: Splunk Phantom, Palo Alto Networks Cortex XSOAR

13. Threat Intelligence

  • Priority: Medium

  • Function: Provides insights into emerging threats and helps in proactive defense by leveraging threat data from various sources.

  • Examples: Recorded Future, ThreatConnect

14. AD Security Monitoring

  • Priority: Medium

  • Function: Ensures the integrity and security of Active Directory by monitoring changes and activities to detect potential security issues.

  • Examples: ManageEngine ADAudit Plus, SolarWinds Server & Application Monitor

15. ASM (Application Security Management)

  • Priority: Medium

  • Function: Secures applications by identifying vulnerabilities in code and configurations, preventing exploits at the application level.

  • Examples: Veracode, Checkmarx

16. Network Traffic Analysis

  • Priority: Medium

  • Function: Monitors and analyzes network traffic to detect anomalies, intrusions, and other security threats.

  • Examples: Darktrace, Cisco Stealthwatch

17. Offensive Security

  • Priority: High

  • Function: Simulates real-world attacks to test the effectiveness of security controls and the preparedness of the defensive teams.

  • Examples: Cobalt Strike, Red Canary

PreviousKey Function & RoleNextPeople

Last updated