Network Security

What is network security?

Network security includes physical, virtual, agent-based, and agentless solutions such as:

• Device profiling and visibility: Agent-based and agentless solutions providing visibility into type and behavior of edge devices connecting to the network. These visibility insights act as the first step in securing the network and help security teams in device discovery, device profiling, and custom fingerprinting.
• Authentication: Agent-based and agentless solutions providing role-based authentication for edge devices trying to connect to the network. A NAC (network access control) solution authenticates user or device identity against a wide variety of identity sources, to support robust network security.
• Role-based access security or authorization: Enforcing least privilege access to the edge devices and providing authorization to access only relevant part of the network by segmenting traffic based on identity or role and associated access permissions.
• Conditional monitoring: Continuous monitoring requires solutions that provide real-time threat telemetry by constantly monitoring edge devices. Different products work individually and together to track edge-device behaviour and flag any potentially malicious activity to network access control (NAC) systems for further action. Continuous monitoring solutions include:
  • Unified threat management/IDS/IPS: Intrusion detection provides threat intelligence on malicious activities including command and control, ransomware, phishing, malware, spyware, trojans, and exploit kits. Intrusion prevention detects malicious activities and performs actions like blocking the traffic to protect against malicious activity.
  • Web content classification, IP reputation and geolocation filtering: Content filtering blocks specific websites that are potentially harmful. Web content filtering helps identify websites that propagate malware, spam, spyware and phishing attacks, as well as websites with sensitive content such as adult or gambling content. IP Reputation services provide a real-time feed of known malicious IP addresses in 10 categories so IT security administrators can easily identify threats by type. Geolocation filtering services associate source/destination IP addresses with location. It allows organizations to apply policies to permit or drop inbound or outbound communications with countries of concern.
  • SIEM or interoperable products: SIEMs help security teams detect, analyze, and respond to security threats.
  • Secure SD-WAN: SD-WAN solutions are used to efficiently connect users and applications. A secure SD-WAN solution has built-in security capabilities and works with other elements within the security ecosystem to enforce strong network and application security from edge-to-cloud. 
• Enforcement and Response: When malicious activity is suspected of or observed participating in an attack, the NAC (network access control) solution can take either guided or automated attack response to preserve network security. Security teams also deploy different types of firewalls for robust network security enforcement.
  • Firewall: A network firewall is hardware or software that restricts and permits the flow of traffic between networks. Network firewalls help prevent cyberattacks by enforcing policies that block unauthorized traffic from accessing a secure network.
  • Next gen firewall: Next generation firewalls add advanced capabilities like application-level packet inspection and intrusion prevention to traditional packet-filtering network firewall capabilities. 

In today’s world workers access corporate networks from home, cafés, airports, etc. They also consume a lot of SaaS apps that are not hosted in corporate data centers or private clouds. Besides securing the network, security teams need a robust Security Service Edge (SSE) solution to reduce potential attack surface and improve application security for SaaS and web services.