Gartner defines adversarial exposure validation (AEV) as technologies that deliver consistent, continuous and automated evidence of the feasibility of an attack. These technologies confirm how potential attack techniques would successfully exploit an organization and circumvent prevention and detection security controls. They achieve this by performing attack scenarios and modeling or measuring the outcome to prove the existence and exploitability of exposures. AEV is generally delivered as a SaaS solution with or without on-premises agents. AEV technologies provide automated execution of both simplified and/or extensible attack scenarios. Results data from an executed attack scenario is used for various outcomes, such as: validating a theoretical exposure as real, automating frequent controls testing, improving preventive security posture or improving detection and response capabilities.
Reviews for 'Application Development, Integration and Management - Others'
Brand Protection software guards against suspicious listings and brand abuse networks that infringe on your intellectual property, sell counterfeit products and commit other online scams against your brand . This software continuously monitors and detects infringements including fake domains , third party sites, unauthorized apps and search engine results,thus helping in overcoming brand impersonation, minimizing monetary and reputational damage. Also, the analytics generated by brand protection software can be used to determine a brand's vulnerability and provide practical guidance on how to improve the brand's online presence, by providing holistic workflows and interactive report tracking to improve content management. Brand managers, marketing teams, and security teams addressing external threats to their social media accounts, reputation, online brand, and follower engagement are the predominant users.
Gartner defines data loss prevention (DLP) as a technical control designed to prevent data loss in order to comply with personal data regulations, prevent unintended disclosure, minimize insider risk and ensure that sensitive data is not overly accessible. DLP controls are typically applied to reduce the data risk for two states of unstructured data: data at rest and data in motion. Depending on the state of the data, DLP applies detective, preventive or corrective controls, including alerting, quarantining, blocking, redaction or access restriction.
Gartner defines an email security platform as a product that secures email infrastructure. Its primary purpose is the removal of malicious (phishing, social engineering, viruses) or unsolicited messages (spam, marketing). Other functions include email data protection, domain-based message authentication, reporting and conformance (DMARC), investigation, and remediation through a dedicated console. These solutions may integrate as a secure email gateway (SEG) for predelivery protection or as an integrated cloud email security (ICES) solution for postdelivery protection. Email security platforms protect an organization’s email infrastructure from social engineering, phishing, business email compromise, spam, malware attacks and data theft. These platforms are deployed independently but integrated with other network and endpoint security controls to improve the overall risk posture of the organization. They offer cybersecurity teams visibility into email-related security incidents for investigation and remediation.
Gartner defines an endpoint protection platform (EPP) as security software designed to protect managed endpoints — including desktop PCs, laptop PCs, mobile devices and, in some cases, server endpoints — against known and unknown malicious attacks. EPPs provide capabilities for security teams to investigate and remediate incidents that evade prevention controls. EPP products are delivered as software agents, deployed to endpoints, and connected to centralized security analytics and management consoles. EPPs provide a defensive security control to protect end-user endpoints against known and unknown malware infections using a combination of security techniques (such as static and behavioral analysis) and system controls (such as device control and host firewall management). EPP prevention and protection capabilities are deployed as a part of a defense-in-depth strategy to help reduce the attack surface and minimize the risk of endpoint compromise. EPP detection and response capabilities are used to uncover, investigate, and respond to endpoint threats that evade security prevention, often as a part of broader security operations platforms.
File analysis (FA) products analyze, index, search, track and report on file metadata and file content, enabling organizations to take action on files according to what was identified. FA provides detailed metadata and contextual information to enable better information governance and organizational efficiency for unstructured data management. FA is an emerging solution, made of disparate technologies, that assists organizations in understanding the ever-growing volume of unstructured data, including file shares, email databases, enterprise file sync and share, records management, enterprise content management, Microsoft SharePoint and data archives.
Gartner defines identity governance and administration (IGA) as the solution to manage the identity life cycle and govern access across on-premises and cloud environments. To accomplish this, IGA tools aggregate and correlate disparate identity and access rights data, and provide full capability controls over accounts and associated access. IGA solutions also fulfill the purpose of unifying and correlating identity data for organizations with multiple person and machine identity authoritative sources. This is done to provide a single view of identity (system of record) for their dependent processes and systems
Infrastructure monitoring tools capture the health and resource utilization of IT infrastructure components, no matter where they reside (e.g., in a data center, at the edge, infrastructure as a service [IaaS] or platform as a service [PaaS] in the cloud). This enables I&O leaders to monitor and collate the availability and resource utilization data of physical and virtual entities — including servers, containers, network devices, database instances, hypervisors and storage. These tools collect data in real time and perform historical data analysis or trending of the elements they monitor.
The network intrusion detection and prevention system (IDPS) appliance market is composed of stand-alone physical and virtual appliances that inspect defined network traffic either on-premises or in the cloud. They are often located in the network to inspect traffic that has passed through perimeter security devices, such as firewalls, secure Web gateways and secure email gateways. IDPS devices are deployed in-line and perform full-stream reassembly of network traffic. They provide detection via several methods — for example, signatures, protocol anomaly detection, behavioral monitoring or heuristics, advanced threat defense (ATD) integration, and threat intelligence (TI). When deployed in-line, IDPSs can also use various techniques to detect and block attacks that are identified with high confidence; this is one of the primary benefits of this technology. Next-generation IDPSs have evolved in response to advanced targeted threats that can evade first-generation IDPSs.
Gartner defines managed detection and response (MDR) services as those that provide customers with remotely delivered security operations center (SOC) functions. These functions allow organizations to perform rapid detection, analysis, investigation and response through threat disruption and containment. They offer a turnkey experience, using a predefined technology stack that commonly covers endpoints, networks, logs and cloud. Telemetry is analyzed within a provider’s platform using a range of techniques. The MDR provider’s analyst team then performs threat hunting and incident management to deliver recommended actions to their clients. MDR offers outcome-driven security incident management that is predicated on the detection, analysis and investigation of potentially impactful security events and the delivery of active threat disruption and containment actions to respond to and mitigate the impact of cyber breaches.
MSSs provide organizations with a variety of management and operational services specific to security technologies and business outcomes for security. Capabilities include security monitoring, detection and response, exposure assessment and management as well as security consulting and security technology implementation. MSSs are delivered in a variety of modes, in the providers’ cloud infrastructure, as consultative engagements or through staff augmentation and on-premises. MSS providers offer a variety of different engagement models. These include heavily customized and consultancy-led models and commoditized technology management-driven experiences.
Gartner defines mobile data protection (MDP) products and services as software security methods that enforce confidentiality policies by encrypting data, and then defending access to that encrypted data on the mass storage systems of end-user workstations. These storage systems include the primary boot drive of a workstation, additional system drives and removable devices used for portability. Storage technologies affected by MDP include magnetic hard-disk drives (HDDs), solid-state drives (SSDs), self-encrypting drives (SEDs), flash drives and optical media. Several methods allow MDP products to delegate all or part of the encryption process to be accomplished by hardware elements, including the CPU and drive controller, and to native capabilities in the OS. Some vendors also have protection capabilities for network storage, and a few also support cloud-based storage environments as an extension to the desktop.
Gartner defines operational technology (OT) as “hardware and software that detects or causes a change, through direct monitoring and/or control of industrial equipment, assets, processes and events”. OT security includes practices and technologies used to protect them, but these practices and technologies are now evolving into distinct categories to address the growing threats, security practices and vendor dynamics.
Gartner defines privileged access management (PAM) as tools that provide an elevated level of technical access through the management and protection of accounts, credentials and commands, which are used to administer or configure systems and applications. PAM tools — available as software, SaaS or hardware appliances — manage privileged access for both people (system administrators and others) and machines (systems or applications). Gartner defines four distinct tool categories for PAM tools: privileged account and session management (PASM), privilege elevation and delegation management (PEDM), secrets management, and cloud infrastructure entitlement management (CIEM).
Gartner defines robotic process automation (RPA) as software that automates tasks within business and IT processes using software scripts that emulate human interaction with the application UI. RPA enables a manual task to be recorded or programmed into a software script, which users can develop through programming or by using the RPA platform’s low-code and no-code GUIs. This script can then be deployed and executed into different runtimes. The runtime executable of the deployed script is referred to as a bot or robot.
The SACBT market is characterized by vendor offerings that include one or more of the following capabilities: Ready-to-use training and educational content; Employee testing and knowledge checks; Availability in multiple languages, natively or through subtitling or partial translation (in many cases, language support is diverse and localized); Phishing and other social engineering attack simulations; Platform and awareness analytics to help measure the efficacy of the awareness program. Training modules are available as cloud-hosted SaaS applications or on-premises deployments via client-managed learning management systems (LMSs), and also support the Sharable Content Object Reference Model (SCORM) standard, enabling integration with corporate LMSs.
SIEM is a configurable security system of record that aggregates and analyzes security event data from on-premises and cloud environments. SIEM assists with response actions to mitigate issues that cause harm to the organization and satisfy compliance and reporting requirements. The security information and event management (SIEM) system must assist with: 1. Aggregating and normalizing data from various IT and operational technology (OT) environments 2. Identifying and investigating security events of interest 3. Supporting manual and automated response actions 4. Maintaining and reporting on current and historical security events
Gartner defines security service edge (SSE) as an offering that secures access to the web, cloud services and private applications regardless of the location of the user, the device they are using or where that application is hosted. SSE protects users from malicious and inappropriate content on the web and provides enhanced security and visibility for the SaaS and private applications accessed by end users. Security service edge provides a primarily cloud-delivered solution to control access from end users and devices to applications, as well as websites and the internet. It provides a range of security capabilities, including adaptive access based on identity and context, malware protection, data security and threat prevention, as well as the associated analytics and visibility. It enables more direct connectivity for hybrid users by reducing latency and providing the potential for improved user experience. Capabilities that are integrated across multiple traffic types and destinations allow a more seamless experience for both users and administrators while maintaining a consistent security stance.
Reviews for 'Security Solutions - Others'
The security threat intelligence products and services market refers to the combination of products and services that deliver knowledge (context, mechanisms, indicators, implications and action-oriented advice), information and data about cybersecurity threats, threat actors and other cybersecurity-related issues. The output of these products and services aims to provide or assist in the curation of information about the identities, motivations, characteristics and methods of threats, commonly referred to as tactics, techniques and procedures (TTPs). The intent is to enable better decision making and improve security technology capabilities to reduce the likelihood and impact of a potential compromise. Threat intelligence (TI) products and services support the different stages of a TI process life cycle. In particular, this involves defining the aims and objectives, collecting and processing intelligence originating from various sources, analyzing and disseminating it to different stakeholders within the organization, and regularly providing feedback on the entire process. These products and services support ongoing security investigations and assist in preventing future breaches by prioritizing infrastructure hardening. TI tools and services are most commonly cloud-based products and services, but can also be delivered “as a service.”
Gartner defines the service orchestration and automation platform (SOAP) market as encompassing solution suites that deliver capabilities enabling organizations to manage workloads, workflows, resource provisioning and data pipelines across their technology landscapes. SOAPs enable infrastructure and operations (I&O) leaders to design and implement business services. These platforms combine workflow orchestration, workload automation and resource provisioning across an organization’s hybrid digital infrastructure. Increasingly, they are central to an organization’s ability to deploy workloads and to optimize deployments as a part of cost and availability initiatives. SOAPs expand the role of traditional workload automation by adapting to use cases that deliver and extend into data pipelines, cloud-native infrastructures and application architectures. These tools complement and integrate with DevOps toolchains to provide customer-focused agility, cost savings, operational efficiency and process standardization.
VA solutions identify, categorize and prioritize vulnerabilities as well as orchestrate their remediation or mitigation. Their primary focus is vulnerability and security configuration assessments for enterprise risk identification and reduction, and reporting against various compliance standards. VA can be delivered via on-premises, hosted and cloud-based solutions, and it may use appliances and agents. Core capabilities include: - Discovery, identification and reporting on device, OS, software vulnerabilities and configuration against security-related criteria - Establishing a baseline for systems, applications and databases to identify and track changes in state - Reporting options for compliance, control frameworks and multiple roles Standard capabilities include: - Pragmatic remediation prioritization with the ability to correlate vulnerability severity, asset context and threat context that then presents a better picture of true risk for your specific environment - Guidance for remediating and configuring compensating controls - Management of scanner instances, agents and gateways - Direct integration with, or API access to, asset management tools, workflow management tools and patch management tools