Operating and Maintaining Detective and Preventive Measures

In order to successfully detect intrusions in your network, you need to install and operate the infrastructure necessary to prevent incidents from happening and have the capability to detect incidents when they do occur.

This section will discuss some detection and prevention technologies, focusing on endpoint security, network security, whitelisting (or allowlisting), blacklisting (or denylisting), sandboxing, honeypots and honeynets, the role of machine learning, and the zero trust concept. This list is not complete, and there is a very large number of new security vendors with new tooling appearing every year. However, this list contains most of the tooling that is important.

Endpoint Security and Anti-Malware

The role of endpoint security is to ensure that malware and any malicious activity has a short lifespan on your endpoints, such as end user devices, servers, and mobile devices. Some of the conceptual and...