1. Firewalls
The first line of defense, firewalls act as a barrier between your trusted internal network and untrusted external networks (like the internet).
-
Function: Monitors incoming and outgoing traffic based on predetermined security rules.
-
Modern Context: Includes Next-Generation Firewalls (NGFW) which can inspect packet payloads, not just headers.
2. Access Control
Not everyone needs access to everything. This pillar ensures that users and devices are identified and authorized before entering the network.
-
Function: Enforces policies like “Least Privilege” (giving users only the access they strictly need).
-
Key Tech: NAC (Network Access Control).
3. Anti-Malware Software
Malware (viruses, worms, Trojans, ransomware) remains a constant threat. This software prevents initial infection and roots out malicious code that breaches the perimeter.
-
Function: Scans for known signatures and, increasingly, heuristic anomalies (suspicious behavior) to catch zero-day threats.
4. Application Security
Any software used to run your business is a potential entry point. This pillar focuses on closing “holes” or vulnerabilities within the applications themselves.
-
Function: Involves patching, updates, and coding standards to prevent exploits like SQL injection or Cross-Site Scripting (XSS).
5. Behavioral Analytics
To catch a thief, you must know what “normal” looks like. This pillar focuses on establishing a baseline of normal network behavior to spot anomalies.
-
Function: specialized tools analyze traffic patterns; if a user who normally downloads 10MB suddenly downloads 10GB at 3 AM, the system flags it.
6. Data Loss Prevention (DLP)
The goal of DLP is to ensure sensitive data (customer info, IP, financial records) does not leave the corporate network unauthorized.
-
Function: Blocks users from uploading, forwarding, or printing critical information in unsafe manners.
7. Email Security
Email is the #1 threat vector for breaches (via phishing). This pillar secures the gateway where most attacks originate.
-
Function: Blocks incoming phishing attacks/spam and controls outbound messages to prevent data leaks.
8. Intrusion Prevention Systems (IPS)
While a firewall blocks traffic based on rules, an IPS actively scans network traffic to block attacks in real-time.
-
Function: Scans for known attack patterns and exploits to stop them before they execute.
9. Mobile Device Security
With BYOD (Bring Your Own Device), personal phones and tablets are now part of the network.
-
Function: Ensures that any mobile device connecting to the network is compliant, encrypted, and free of malicious apps.
10. Network Segmentation
Instead of one flat network, segmentation divides the network into smaller parts (subnets).
-
Function: If a hacker breaches one segment, they are “contained” there and cannot easily move laterally to steal data from other segments.
11. Security Information and Event Management (SIEM)
This is the “brain” that connects the other pillars. SIEM tools collect logs and data from all other security hardware/software to provide a holistic view.
-
Function: correlative analysis—seeing that a firewall block on one server and a failed login on another are actually part of the same coordinated attack.
12. VPN (Virtual Private Network)
Essential for remote work, a VPN extends the secure internal network across public networks like the internet.
-
Function: Encrypts the connection between an endpoint (remote employee) and the corporate network, keeping data safe from prying eyes on public Wi-Fi.