Cybersecurity software categories how to#
Cybersecurity software categories verification#
Cybersecurity software categories trial#

They securely install, configure, and operate systems and software-especially dedicated security products such as firewalls, intrusion detection, and even dedicated HSMs (Hardware Security Modules) to hold sensitive keys and certificates. This is the hands-on team that actually manages systems in the data center (or cloud). Because of that, they are often located off-site so they aren’t recognized.

They also perform “human engineering” tests by trying to convince users to give up sensitive information.

Cybersecurity software categories how to#

More importantly, they make recommendations on how to harden systems against future attack. Done correctly, they can expose weaknesses and vulnerabilities before the real attackers do. Often called the “Red Team,” they attack systems and processes exactly as a black hat attacker would. This team intentionally attacks systems to expose vulnerabilities and probe weaknesses. This is the most commonly outsourced specialization, but many organizations still perform some internally.

Cybersecurity software categories trial#

As a result, this team develops evidence to be used in trial when needed, following standard chain-of-evidence rules. They are also experts at forensic analysis, and can detect what an attacker did and how they did it. They detect and analyze security events and correctly respond by taking appropriate action, whether that means disconnecting a machine, or simply sand-boxing a piece of software to determine if it is malware.

This team runs the Security Operations Center (SOC) and does threat hunting and detection. Incident Response and Forensic AnalysisĮven the best defenses are breached from time to time. This function typically has less staff than the other specialties, but the most common attack is user credential compromise, so diligence is required.

More importantly, this team is most directly impacted by cloud architectures, which makes the job much more complex. They also track the latest in multi-factor identification and biometrics. This includes understanding roles and role-based access management for business processes. They also need to understand and enforce identification policies across the entire organization. Because of the proliferation of protocols and technologies (OAuth, SAML, etc.), they tend to be protocol experts across all platforms, from desktops and servers to smartphones and tablets. This team manages identification, authorization and permissions across all systems.

Cybersecurity software categories verification#

When there are findings of non-conformance, the GRC team provides tracking and verification until they are resolved. The GRC team typically acts as the “security auditor” and checks the work of the other seven specializations against compliance checklists such as PCI-DSS and frameworks such as the Risk Management Framework (RMF). Applications and programs critical to the business need more protection than others, and it’s up to these analysts to make sure the risk has been identified and mitigated properly. Risk analysis is becoming quite important because it must align with business risk. These analysts measure and quantify risk, performs internal audits against best practices and standards, and develop plans for business continuity and disaster recovery. Finally, they often engage in user privacy issues and work on GDPR compliance. DLP personnel also manage the security of data on servers and databases, often installing and maintaining special software for permissions and logging as well. These engineers make sure the system stays up to date and troubleshoot negative interactions with new applications (that sometimes interfere with virus checkers). Many modern anti-virus systems on PCs use an advanced client connected to services on the back-end to push out signature updates and the like. These engineers deploy and manage security applications such as malware detection on endpoints and servers. Architects use frameworks to organize the architecture into manageable structures. The policies developed by the architects are driven by the underlying architecture they have chosen to use. More importantly, they are comfortable defining secure interfaces between applications and systems. Architects are familiar with many products and protocols, and can develop functional diagrams of how applications actually work in the data center. In other words, they can typically think of several ways to tackle a particular problem, and then sort through those alternatives to find the best solution. In most organizations, this is an experienced engineer, typically with many years in IT, who can make complicated tradeoff decisions. The cybersecurity architect designs and implements secure architectures and translates standards, business processes, and frameworks into internal policies.