The appropriateness of using certain tools

[rakhirhif8963]

Such protection tools include a security event management system (SIEM), firewalls with the ability to analyze data packets, intrusion prevention systems (IPS/IDS), etc. Among the listed classes of solutions, there are both commercial and free products based on open source software.

Active protection tools will help prevent such common types of attacks as brute force, password spraying, etc., where the attacker tries to actively interact with your services over the network. On the one hand, for small companies, implementing complex tools like SIEM or IPS/IDS is not always economically justified. On the other hand, installing a utility like fail2ban to prevent brute force attacks will not add costs, but can easily cope with the task of blocking the attacker's IP.

If you have a steady hand and time, you can build a good defense on the open source basis. If you don't have enough time and a normal budget is allocated, you can buy commercial products with full integration right away.

is determined by the set of tasks and capabilities of the company. It is necessary to determine the attack surface, reduce it to a reasonable minimum, and then install optimal protection tools on those services that are still "sticking out".

Mistake #2: Weak or missing event bahamas mobile database rules
In the previous point, we focused on active means of protection. For good reason: they need to respond to incidents independently or with the help of third-party software, without waiting for permission to act from anyone. This requires rules, that is, a fixed sequence of operation of the entire complex of information security tools.

Software from the category of active information security tools offers a number of pre-installed rules. This is the necessary minimum needed for the software to work "out of the box" and at least somehow perform its tasks at the very beginning. By and large, the basic set of rules for processing events must be formulated and added as weak points in your infrastructure are identified and "dark spots" are discovered - events that are characteristic of various attacks, but are currently not described in the SIEM rules.