Advanced considerations for defensive cyber products with regards to network security and enterprise integration capabilities

The developing complexity of cyberspace has provoked the need for increased security methods in order to protect users and their information. Information available online including a user's banking information, social media, and etc., makes individual users more susceptible to potential attacks. The risk is exponentially larger when you look at an enterprise or larger scale networks, as; a network's security is only as strong as its weakest link and incidents small scale incidents such as an undetected virus on your computer can compromise you and your information. It takes more than a firewall to protect a computer from malicious actors; a full end to end cybersecurity system should be used instead. Many organizations have already acknowledged this risk and have established practical Enterprise Security systems that consist of multi-part security measures. These measures include complex scanners and orchestrators that can fully protect a user and their information, as well as detect and prevent any threats that it may encounter, this includes; Endpoint Management Systems, Network Scanners, and SIEMs (Security Information and Event Managers). These components are responsible for quickly detecting and denying entry into a computer, or into a network from an unknown user. However, they must work in conjunction with all security measures and hardware in an enterprise system, as alone they cannot reach their full potential. Therefore, a layered security approach of multiple components is recommended to combat potential threats, rather than a simple firewall. Network Scanner's for instance, are tasked with conducting vulnerability scans, and network port scans on a computer network which aids in conducting security assessments and system maintenance. Endpoint Management Systems, like firewalls, are tasked with conducting a three-step process that verifies the integrity of IP devices before allowing them to connect to a network. This greatly reduces any potential threat of being hacked or having information stolen by an exterior actor, due to unfamiliar and suspicious users being denied access. Finally, SIEM systems act as the administrator for the entire network by consolidating logs for actions taken inside the network either by end users or by the defensive cybersecurity tools. This situational awareness gives SIEM the capability to alert other components of a network in order to conjoin and suspend network access or to suspend a computer's current action. In comparison to only a firewall, which only provides a single point of security, these components work in conjunction in order to secure all information and assets inside and outside of a network, while firewalls simply attempt to block any potential threats from gaining access, and do not when an adversary has already penetrated into a network. All in all, it is important to consider the multiple layers of security needed to fully protect a user and their sensitive information, seeing as firewalls lack the capabilities that a full-fledged enterprise system has to protect users. In the poster, we will carefully look at how exactly each component in a security enterprise plays a role in defending users.