API protection products protect APIs from exploits, abuse and access violations, and assist in remediating API exposures. These products perform API discovery and posture management and provide runtime protection. API protection products may be delivered as cloud-based or on-premises solutions. API protection products serve to provide capabilities to organizations that need to protect their data assets primarily from attacks against the first-party APIs they expose publicly. They also need to provide coverage for the internal APIs and the third-party APIs that they may consume. API products deliver a catalog of inventoried APIs, a prioritized list of remediations of API exposures and alerts on suspicious or malicious activity on APIs.
Cloud security posture management tools help in the identification and remediation of risks across cloud infrastructures, including Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS). These tools continuously assess the security posture across multi-cloud environments by maintaining a current inventory of the cloud assets for proactive analysis and risk assessment to detect any misconfigurations. Once these misconfigurations are identified, security controls are developed and implemented. CSPM solutions also integrate with DevOps tools, streamlining the incident response process and ensuring continuous compliance with regulatory requirements and security frameworks by providing visibility of the cloud environment’s security posture.
Gartner defines cloud WAAP as a category of security solutions designed to protect web applications irrespective of their hosted locations. Typically delivered as a service, cloud WAAP is offered as a series of security modules that provide protection from a broad range of runtime attacks. It offers protection from the Top 10 web application security risks defined by the Open Web Application Security Project (OWASP) and automated threats, provides API security, and can detect and protect against multiple sophisticated Layer 7 attacks targeted at web applications. Cloud WAAP’s core features include web application firewall (WAF), bot management, distributed denial of service (DDoS) mitigation and API protection.
Cloud-native application protection platforms (CNAPPs) are a unified and tightly integrated set of security and compliance capabilities, designed to protect cloud-native infrastructure and applications. CNAPPs incorporate an integrated set of proactive and reactive security capabilities, including artifact scanning, security guardrails, configuration and compliance management, risk detection and prioritization, and behavioral analytics, providing visibility, governance and control from code creation to production runtime. CNAPP solutions use a combination of API integrations with leading cloud platform providers, continuous integration/continuous development (CI/CD) pipeline integrations, and agent and agentless workload integration to offer combined development and runtime security coverage.
Digital forensics and incident response (DFIR) services help organizations identify the extent of, and deal with security incident investigations, forensic response and triage, and security breaches. They generally offer a combination of digital forensics (DF), incident response (IR) and related proactive and reactive security services. DFIR is mostly delivered as a retainer-based service, and is intended to work with the end user’s in-house DFIR processes and procedures.
Email security refers collectively to the prediction, prevention, detection and response framework used to provide attack protection and access protection for email. Email security spans gateways, email systems, user behavior, content security, and various supporting processes, services and adjacent security architecture. Effective email security requires not only the selection of the correct products, with the required capabilities and configurations, but also having the right operational procedures in place.
The Endpoint Detection and Response Solutions (EDR) market is defined as solutions that record and store endpoint-system-level behaviors, use various data analytics techniques to detect suspicious system behavior, provide contextual information, block malicious activity, and provide remediation suggestions to restore affected systems. EDR solutions must provide the following four primary capabilities: • Detect security incidents • Contain the incident at the endpoint • Investigate security incidents • Provide remediation guidance
Gartner defines an endpoint protection platform (EPP) as security software designed to protect managed endpoints — including desktop PCs, laptop PCs, mobile devices and, in some cases, server endpoints — against known and unknown malicious attacks. EPPs provide capabilities for security teams to investigate and remediate incidents that evade prevention controls. EPP products are delivered as software agents, deployed to endpoints, and connected to centralized security analytics and management consoles. EPPs provide a defensive security control to protect end-user endpoints against known and unknown malware infections using a combination of security techniques (such as static and behavioral analysis) and system controls (such as device control and host firewall management). EPP prevention and protection capabilities are deployed as a part of a defense-in-depth strategy to help reduce the attack surface and minimize the risk of endpoint compromise. EPP detection and response capabilities are used to uncover, investigate, and respond to endpoint threats that evade security prevention, often as a part of broader security operations platforms.
An enterprise browser is a specialized web browser designed for corporate use, featuring advanced security, centralized management, and seamless integration with enterprise systems. It ensures compliance with corporate policies, protects against cyber threats, and optimizes productivity by managing web access and securing sensitive data. The key features include comprehensive protection against malware and phishing, IT management tools for remote control of settings and policies, and secure data handling through encryption. The typical users include IT administrators, security professionals, and business leaders, and more.
MSSs provide organizations with a variety of management and operational services specific to security technologies and business outcomes for security. Capabilities include security monitoring, detection and response, exposure assessment and management as well as security consulting and security technology implementation. MSSs are delivered in a variety of modes, in the providers’ cloud infrastructure, as consultative engagements or through staff augmentation and on-premises. MSS providers offer a variety of different engagement models. These include heavily customized and consultancy-led models and commoditized technology management-driven experiences.
Gartner defines mobile data protection (MDP) products and services as software security methods that enforce confidentiality policies by encrypting data, and then defending access to that encrypted data on the mass storage systems of end-user workstations. These storage systems include the primary boot drive of a workstation, additional system drives and removable devices used for portability. Storage technologies affected by MDP include magnetic hard-disk drives (HDDs), solid-state drives (SSDs), self-encrypting drives (SEDs), flash drives and optical media. Several methods allow MDP products to delegate all or part of the encryption process to be accomplished by hardware elements, including the CPU and drive controller, and to native capabilities in the OS. Some vendors also have protection capabilities for network storage, and a few also support cloud-based storage environments as an extension to the desktop.
Mobile threat defense (MTD) products protect organizations from malicious threats on iOS and Android devices, at the device, network and application levels. To successfully attack a mobile device, mobile malware must circumvent the controls built into mobile OSs, such as those for app store curation and native mobile OS hardening. MTD products tend to focus on preventing and detecting anomalous behavior by collecting and analyzing indicators of compromise, as well as expected behavior. MTD products gather threat intelligence from the devices they support, as well as from external sources, and use an analysis engine that resides in the cloud, on-premises or on an MTD app installed on devices.
Gartner defines the network firewall market as the market for firewalls that use bidirectional stateful traffic inspection (for both egress and ingress) to secure networks. Network firewalls are enforced through hardware, virtual appliances and cloud-native controls. Network firewalls are used to secure networks. These can be on-premises, hybrid (on-premises and cloud), public cloud or private cloud networks. Network firewall products support different deployment use cases, such as for perimeters, midsize enterprises, data centers, clouds, cloud-native and distributed offices.
Network management tools are software applications used to monitor, maintain, and administer computer networks. They help in ensuring the network's efficient operation, detecting and resolving problems, and optimizing performance. Key functions include monitoring network traffic, managing network devices, ensuring security, and troubleshooting issues. Network Administrators, IT Managers, and Security Professionals utilize these tools to monitor and manage network hardware effectively. They track the performance of network devices such as routers and switches, ensuring these devices operate optimally. Additionally, they maintain and update the configuration of these network components to ensure robust security and efficient network functionality.
Network-based sandboxing is a proven technique for detecting malware and targeted attacks. Network sandboxes monitor network traffic for suspicious objects and automatically submit them to the sandbox environment, where they are analyzed and assigned malware probability scores and severity ratings. Sandboxing technology has been used for years by malware researchers at security companies and even in some large enterprises that are highly security conscious. Traditionally, using a sandbox has been an intensive effort requiring advanced skills. The malware researcher manually submits a suspicious object into the sandbox and analyzes it before flagging it as malware or not. By adding automated features to sandboxing technology (automatically submitting suspicious objects and automatically generating alerts).
Gartner defines operational technology (OT) as “hardware and software that detects or causes a change, through direct monitoring and/or control of industrial equipment, assets, processes and events”. OT security includes practices and technologies used to protect them, but these practices and technologies are now evolving into distinct categories to address the growing threats, security practices and vendor dynamics.
Penetration Testing tools and services are designed to test vulnerabilities and weaknesses within computer systems and applications by simulating a cyber attack on a computer system, network, or web application. Companies conduct penetration tests to uncover new defects and test the security of communication channels and integrations. These tools and services either use vulnerability scanners or conduct manual/automated tests that scan networks and systems for open ports, and services and conduct vulnerability assessments to find any software lapse that may prove a route of attack on the system later. Further, the identified vulnerabilities are exploited to gain unauthorized access to systems or data and they try to escalate or pivot to key assets to have a better understanding about the impact of a specific attack. The process ends with generating a detailed and comprehensive testing report that describes, gives evidence for, assesses the risk, and recommends the solution to any vulnerability found. Typically these are used by security professionals and ethical hackers to identify vulnerabilities, understand how cyber attacks work, and test the effectiveness of security measures.
Gartner defines SD-WAN as functionality primarily used to connect branch locations to other enterprise and cloud locations. SD-WAN products provide dynamic path selection based on business or application policy, routing, centralized orchestration of policy and management of appliances, virtual private network (VPN), and zero-touch configuration. SD-WAN products are WAN transport/carrier-agnostic and create secure paths across physical WAN connections. SD-WAN products replace traditional branch routers and enable connectivity between enterprise branch locations as well as the cloud. They facilitate WAN connectivity’s evolution from Multiprotocol Label Switching (MPLS)-centric to public internet-centric in support of enterprise traffic shifts from private data centers to public cloud and SaaS.
Gartner defines security service edge (SSE) as a solution that secures access to the web, cloud services and private applications regardless of the location of the user or the device they are using or where that application is hosted. SSE protects users from malicious and inappropriate content on the web and provides enhanced security and visibility for the SaaS and private applications accessed by end users. Security service edge provides a primarily cloud-delivered solution to control access from end users and edge devices to applications (private or delivered via SaaS) as well as websites (and to a lesser extent general internet traffic). It enables a hybrid workforce more efficiently than traditional on-premises solutions. Capabilities integrated across multiple traffic types and destinations allow a more seamless experience for both users and admins while maintaining a consistent security stance.
Reviews for 'Security Solutions - Others'
Gartner defines single-vendor secure access service edge (SASE) offerings as those that deliver multiple converged-network and security-as-a-service capabilities, such as software-defined wide-area network (SD-WAN), secure web gateway (SWG), cloud access security broker (CASB), network firewalling and zero trust network access (ZTNA). These offerings use a cloud-centric architecture and are delivered by one vendor. SASE securely connects users and devices with applications. It supports branch office, remote worker and on-premises general internet security, private application access and cloud service consumption use cases.
Gartner defines zero trust network access (ZTNA) as products and services that create an identity and context-based, logical-access boundary that encompasses an enterprise user and an internally hosted application or set of applications. The applications are hidden from discovery, and access is restricted via a trust broker to a collection of named entities, which limits lateral movement within a network.