Pat Haley
The ability to identify anomalies within a computing environment is critical. Anomalies—events outside the norm—sometimes indicate security incidents, and usually prompt investigation. Whether they ultimately represent a security threat or not, anomalies are a leading indicator of something gone awry, which is why anomaly detection is a powerful tactic.
Endpoint visibility is crucial because most attacks begin on endpoints used by people—not the firewall or your servers. Typically, attackers gain control over these entry points to the network through techniques like phishing; from there, they can move laterally to access your servers. This type of activity currently accounts for over 80% of reported incidents, according to CSO.
Monitoring critical system files, configuration files, and content files for unusual or unauthorized activity is one of the core requirements of the PCI-DSS, the payment card industry’s security standard. As such, file integrity monitoring (FIM) is a necessary activity for companies that process or store credit card data. Security teams can choose from any number of endpoint security tools to handle FIM for PCI compliance, but some solutions do more than others.
Linux endpoint security is a more prevalent topic now than it was a decade ago. With the rapid growth of the SaaS industry, many significant applications in cloud environments now rely on Linux.
For a long time, Mac security threats weren’t a top of mind concern for security teams and vendors, who primarily focused on securing Windows where they had a much larger footprint. Now, many employees are using Macs to access production infrastructure, presenting new avenues for attackers to exploit.
Having the ability to aggregate and analyze data across multiple systems is a necessity for companies of all sizes, primarily for security and compliance reasons. For most businesses, SIEM (security information and event management) tools fulfill this function. But SIEM solutions as they are traditionally used can be costly, a problem that eventually leads most security professionals to make important decisions based on dollars and cents rather than actual security needs.