SIEM. Security Information and Event Management. It’s an essential part of any cybersecurity strategy, and yet oftentimes it is not that well known, and even those researching the topic are...
8/5/2020
Our increasingly networked world provides awesome opportunities for productivity and efficiency in organizations. Yet, those same systems are vulnerable to cybercriminals who try to steal data and disrupt organizations. These cybersecurity tools will help you stay secure and fight back.
Top 5 cybersecurity solutions to uncover hidden cyber threats
1) Firewall
Firewalls have been around forever. In fact, if there’s one cybersecurity tool you likely have; it’s this one.
The job of a firewall is simple: prevent unauthorized access to your system.
A firewall monitors network traffic and connection attempts through your network. Then, it determines whether or not to allow a packet to pass freely.
Firewalls do have limitations. First of all, they cannot catch malware that entered your system because of a phishing attack.
Newer firewalls, however, are more sophisticated. In addition to intrusion prevention, these new “Next-Generation Firewalls” (NGFW) offer deep packet and application-level inspection.
Still, the migration towards cloud-based applications and integrations is pushing more firewall solutions to the cloud. For example, Barracuda has discontinued it’s NGFW in favor of a cloud-based solution.
A variety of firewalls exist for mid-to-large sized organizations. Some of these include:
- Fortigate Next Generation Firewall – This firewall boasts high threat-protection with automated visibility that stops attacks before they happen.
- Cisco Adaptive Security Appliance (ASA) Software – Cisco is a leader in building security devices. Their firewall and security platform has more than 1 million deployments worldwide.
2) Antivirus
Like firewalls, antivirus tools are not new. These tools alert you to a virus or malware infection on any given machine. Antivirus tools scan incoming email attachments and links for infections. If a virus is detected, it is quarantined. If malware is discovered, it is removed.
Antivirus software options abound. Some of the most popular include:
- Avast Antivirus – Avast Antivirus is more than an antivirus. This software also acts as a firewall, web shield, anti-spam filter, and more.
- Bitdefender Endpoint Security – Bitdefender’s popular next-gen endpoint security protection platform features a suite of tools including anti-virus, ransomware protection, and more.
- Kaspersky’s Endpoint Security for Business Suite – Kaspersky’s suite provides next-gen protection, automatic rollback (in the event of an attack), and an easy-to-use management console.
3) Penetration Testing Tools
Some hackers are bad. Others are helpful.
The helpful hackers carry out penetration testing on a company’s IT infrastructure with a variety of tools. The goal of this test is to identify vulnerabilities before the bad hackers do.
You may choose to run penetration tests on:
- Specific applications: Are the applications vulnerable to cross-site scripting? Injection flaws? Weak session management? Something else?
- The network: Are the configuration files improperly configured? Are passwords weak?
- IoT/Device penetration testing: Are passwords weak? Do the APIs have vulnerabilities?
Every cybersecurity arsenal needs penetration testing.
Penetration Testing Steps
Planning & Recon
During this phase, test goals are identified. This includes which systems to test and how. For instance, if you’re testing an application, you might decide to target a particular facet.
Vulnerability Analysis
During this phase, you aim to understand how the target application will respond to various intrusion attempts. You’re looking to exploit flaws in the system. Often, this involves using a mix of off-the-shelf tools and custom code.
Exploitation
A simulated attack is carried out and access is used to steal data, change permissions, intercept traffic, etc. The goal is to understand what is at risk when an attack occurs.
Analysis
After the completed exploit, the value of the compromise is determined. The aim is to figure out the risk is to the organization.
Reporting
After the analysis and simulated attack, a report is compiled. This report details priorities for fixes and patches.
A variety of off-the-shelf and proprietary tools exist to carry out penetration tests. Some of the more popular tools for testing include:
- Metasploit – According to their website, Metasploit is the most used penetration testing framework. It is a collaboration of an open-source community and Rapid7. This tool also has a large database of exploits available to test your organization.
- Nmap – Nmap is a free, open-source tool designed for vulnerability scanning and network discovery. This tool is considered the defacto standard for port scanning and network mapping. Nmap sends packets to system ports, listens for responses, and then determines whether the ports are open, closed, or filtered (e.g., via a firewall).
- Wireshark – Wireshark is a free and open-source packet analyzer. This tool analyzes and troubleshoots the network. Their claim to fame is that it allows you to see what’s happening on your network at a deep level.
4) Public Key Infrastructure (PKI)
You’ve probably seen the little padlock in the top of a browser bar when surfing the net. That “lock” means the connection to the server is encrypted, adding a layer of security that exists through PKI technology.
PKI technology’s public-facing browser bar is familiar to many. However, the technology also encrypts connections on internal networks.
For instance, it can enable multi-factor authentication and access control, encrypt email communication (mitigating phishing attempts), authenticate endpoints in an IoT environment, and more.
5) Security Incident and Event Management (SIEM)
While preventative efforts such as user education and use of the tools mentioned above are helpful, they often aren’t enough.
A good SIEM aggregates information from every layer of the security stack. This includes firewalls and system logs to identify discrepancies that may indicate a breach.
A managed SIEM will eliminate false positives and create a game plan for discrepancies in log data.
Your SIEM and SOC team serve as the brain of your cybersecurity operation. They gather information from the system, parsing it, prioritizing it, and then directing action accordingly.
To learn how our SIEM and SOC team can protect your organization from cyber threats, contact us today.
