Cyber Security

I. Foundational Defensive Technologies

These are the essential, perimeter-based tools that have been the first line of defense for decades.

1. Firewalls

   • Function: Act as a gatekeeper between trusted internal networks and untrusted external networks (like the internet), filtering traffic based on predefined security rules.

   • Evolution: From simple stateless packet filters to stateful firewalls (tracking connections) and now Next-Generation Firewalls (NGFW) that incorporate deep packet inspection (DPI), intrusion prevention, and application awareness.

2. Antivirus/Anti-Malware

   • Function: Software designed to detect, prevent, and remove malicious software (malware) like viruses, worms, trojans, and ransomware.

   • Evolution: Originally based on signature detection (known malware patterns), now heavily supplemented with heuristic and behavioral analysis to identify zero-day and polymorphic threats.

3. Virtual Private Networks (VPNs)

   • Function: Creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network, ensuring data confidentiality.

4. Intrusion Detection & Prevention Systems (IDS/IPS)

   • Function: Monitors network or system activities for malicious activities or policy violations.

   • Types:

     • Network-based (NIDS/NIPS): Monitors entire network segments.

     • Host-based (HIDS/HIPS): Monitors a single endpoint.

     • Function: IDS alerts on suspicious activity; IPS actively blocks it.

II. Identity, Access, and Perimeter Security

Technologies focused on verifying “who you are” and controlling “what you can access.”

5. Multi-Factor Authentication (MFA) & Strong Authentication

   • Function: Requires users to provide two or more verification factors to gain access (something you know – password, something you have – phone/security key, something you are – biometrics). FIDO2/WebAuthn standards enable passwordless authentication using hardware security keys.

6. Identity and Access Management (IAM) & Privileged Access Management (PAM)

   • IAM: Framework for managing digital identities and their access rights across systems. Ensures the right people have the right access.

   • PAM: A subset focused on securing, monitoring, and managing access for highly privileged accounts (admins, service accounts).

7. Zero Trust Network Architecture (ZTNA)

   • Function: A security model that shifts from the old “trust but verify” (castle-and-moat) approach to “never trust, always verify.” It assumes no user or device, inside or outside the network, is trustworthy by default. Access is granted on a per-session, least-privilege basis.

III. Threat Intelligence, Detection & Response

Advanced technologies for proactive hunting, real-time analysis, and incident response.

8. Security Information and Event Management (SIEM)

   • Function: Aggregates and analyzes log data from various sources (network devices, servers, applications) in real-time to identify suspicious patterns and provide alerts. The central “brain” for security operations centers (SOCs).

9. Extended Detection and Response (XDR)

   • Function: An evolution of Endpoint Detection and Response (EDR). XDR automatically collects and correlates data from multiple security layers (email, endpoint, server, cloud, network) to improve threat detection, investigation, and response.

10. Security Orchestration, Automation, and Response (SOAR)

    • Function: Platforms that integrate various security tools and automate response playbooks. When a SIEM generates an alert, SOAR can automatically execute a predefined workflow (e.g., isolate a machine, block an IP, create a ticket).

11. Threat Intelligence Platforms (TIPs)

    • Function: Collect, aggregate, and analyze threat data (indicators of compromise, TTPs of threat actors) from open-source and commercial feeds to provide actionable intelligence for proactive defense.

IV. Encryption & Data Security

Technologies that protect data at rest, in transit, and in use.

12. Encryption

    • Types: Symmetric (AES for fast bulk encryption) and Asymmetric (RSA, Elliptic Curve for key exchange and digital signatures).

    • Application: Full Disk Encryption (FDE), SSL/TLS for web traffic, VPNs, and encrypted messaging.

13. Data Loss Prevention (DLP)

    • Function: Tools that monitor and control data transfer to prevent unauthorized exfiltration of sensitive information (PII, intellectual property, financial data).

14. Hardware Security Modules (HSMs)

    • Function: Physical, tamper-resistant devices that generate, store, and manage cryptographic keys, providing a high level of security for critical systems.

V. Application & Development Security

Technologies that “shift security left” into the software development lifecycle.

15. Static/Dynamic/Interactive Application Security Testing (SAST/DAST/IAST)

    • SAST: Analyzes source code for vulnerabilities before the application is run (white-box testing).

    • DAST: Tests a running application from the outside (black-box testing) for vulnerabilities like those in the OWASP Top 10.

    • IAST: Combines elements of both using agents within the application to analyze code during runtime.

16. Software Composition Analysis (SCA)

    • Function: Automatically identifies open-source and third-party components in a codebase, checking for known vulnerabilities (CVEs) and license compliance issues.

17. Web Application Firewalls (WAF)

    • Function: A specialized firewall that filters, monitors, and blocks HTTP/HTTPS traffic to and from a web application, protecting against attacks like SQL injection, XSS, and CSRF.

VI. Cloud & Infrastructure Security

18. Cloud Security Posture Management (CSPM) & Cloud Workload Protection Platforms (CWPP)

    • CSPM: Automatically detects and remediates misconfigurations and compliance risks in cloud infrastructure (e.g., an unsecured S3 bucket).

    • CWPP: Provides security for cloud workloads (VMs, containers, serverless) across their lifecycle.

19. Container & Kubernetes Security

    • Technologies: Image scanning, runtime security for containers, and configuration hardening for orchestration platforms like Kubernetes.

VII. Emerging & Frontier Technologies

20. Artificial Intelligence (AI) & Machine Learning (ML)

    • Application: Powers modern security tools for anomaly detection (spotting deviations from normal behavior), automating threat analysis, predicting attack vectors, and powering adaptive authentication.

21. Deception Technology

    • Function: Deploys decoys (honeypots, honeytokens) across the network to lure attackers, detect lateral movement, and study their tactics without risking real assets.

22. Quantum-Resistant Cryptography

    • Function: Developing and deploying new cryptographic algorithms (e.g., lattice-based cryptography) that are secure against potential future attacks from quantum computers, which could break current standards like RSA.

23. Secure Access Service Edge (SASE)

    • Function: A converged cloud-native architecture that combines comprehensive network security functions (FWaaS, CASB, ZTNA) with wide-area networking (SD-WAN), delivered as a single service.