{"id":4942,"date":"2024-02-13T11:03:55","date_gmt":"2024-02-13T09:03:55","guid":{"rendered":"https:\/\/it-integrator.ua\/platforms\/tier-4-adaptive\/"},"modified":"2024-03-12T11:17:14","modified_gmt":"2024-03-12T09:17:14","slug":"tier-4-adaptive","status":"publish","type":"platforms","link":"https:\/\/it-integrator.ua\/en\/platforms\/tier-4-adaptive\/","title":{"rendered":"Tier 4: Adaptive"},"content":{"rendered":"
1. eXtended Detection & Response, XDR<\/strong><\/span><\/h6>\n

Purpose:<\/strong><\/span> An integrated set of solutions (CDS+EDR+NTA) that allows, based on network traffic analysis, signatureless detection of suspicious events and in-depth control of PCs and servers, to provide an unprecedented level of IT infrastructure observability and incident response efficiency<\/p>\n

2. Attack Surface Management, ASM<\/strong><\/span><\/h6>\n

Purpose:<\/span><\/strong> Control of own “surface attack”:<\/p>\n

    \n
  • obtaining unbiased data on how the organization “looks” to a potential attacker<\/li>\n
  • rapid automated identification (using OSINT) of publicly available assets<\/li>\n
  • detection of hidden connections between the organization’s resources and public cloud resources and code repositories (eg Github)<\/li>\n
  • building a real model of threats to public resources of the organization and their constant proactive monitoring<\/li>\n<\/ul>\n
    3. Policy & Compliance Management, PMC<\/strong><\/span><\/h6>\n

    Purpose:<\/span><\/strong> Control of network security policies, automation of Change Management processes, Compliance:<\/p>\n

      \n
    • collection, centralized storage and analysis of configurations of firewalls and other network equipment<\/li>\n
    • detection of dangerous, unused, duplicate rules<\/li>\n
    • automatic construction of the network map “as it really is” at the current moment<\/li>\n
    • simulation of risks and vectors of implementation of network attacks<\/li>\n
    • simulation of the consequences of changes in the configuration of network devices before real use
      \noptimization and control of the work of network administrators, building an effective change management process<\/li>\n
    • identification and control of corporate applications<\/li>\n<\/ul>\n
      4. User Entity Behaviour Analysis, UEBA<\/strong><\/span><\/h6>\n

      Purpose:<\/span><\/strong> Continuous monitoring, logging and analysis of user activity and processes:<\/p>\n

        \n
      • profiling the work of users and processes<\/li>\n
      • detection of anomalies in user behavior and processes and services, including with the help of AI\/ML<\/li>\n
      • keeping statistics and monitoring the use of working time<\/li>\n<\/ul>\n
        5. Identity and Access Manager, IDM \/ IAM<\/strong><\/span><\/h6>\n

        Purpose:<\/span><\/strong> Centralized management of accounts and rights in IS:<\/p>\n

          \n
        • provision, termination, change of access rights to information resources<\/li>\n
        • audit of available accesses – “putting things in order” in accounts (everything unnecessary is deleted, what is needed is uniquely identified and personified)<\/li>\n
        • integration with most modern application software platforms (Microsoft, Oracle, SAP, etc.)<\/li>\n
        • built-in toolkit for development of connectors to non-standard (self-written) software<\/li>\n<\/ul>\n
          6. Cloud Access Security Broker, CASB<\/strong><\/span><\/h6>\n

          Purpose:<\/span><\/strong> Continuous monitoring, control and management of cloud services:<\/p>\n

            \n
          • implementation of Zero Trust architecture for clouds<\/li>\n
          • granting users access rights to cloud resources in compliance with the principle of minimum authority<\/li>\n
          • protection of data in the cloud from distortion, deletion, leakage (both built-in functions and due to integration with DLP)<\/li>\n
          • detection of abnormal behavior of users and processes when accessing cloud resources and prevention of incidents (both built-in functions and due to integration with UEBA)<\/li>\n
          • protection against malicious programs and their spread in the organization’s IT infrastructure through clouds<\/li>\n<\/ul>\n
            7. Security Orchestration Automation & Response, SOAR<\/strong><\/span><\/h6>\n

            Purpose:<\/span><\/strong> Centralization and automation of the Incident Management process (the main tool of the corporate Security Operation Center):<\/p>\n

              \n
            • orchestration of all existing cyber security systems to build a complete interconnected system<\/li>\n
            • automation of routine security event processing operations based on customizable playbooks<\/li>\n
            • creating a unified operating environment for proactively tracking and handling cyber security incidents<\/li>\n
            • maintaining a single knowledge base for the implementation of the process of continuous improvement of the Incident Management process<\/li>\n<\/ul>\n","protected":false},"featured_media":0,"template":"","class_list":["post-4942","platforms","type-platforms","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/platforms\/4942","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/platforms"}],"about":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/types\/platforms"}],"wp:attachment":[{"href":"https:\/\/it-integrator.ua\/en\/wp-json\/wp\/v2\/media?parent=4942"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}