Operative Sicherheit im Unternehmen

SEGs can be an on-premise server, software running on another system, or provided as a cloud-native service. SEGs inspect emails that are leaving or entering the enterprise.  It filters messages that are unwanted such as span and intercepts malicious emails that contain phishing attacks, malware, viruses, or suspicious content.

The SEG can also perform DLP (Data Loss Protection), which intercepts outgoing emails containing sensitive information such as security credentials, credit card details, or controlled documents such as confidential engineering drawings.  If properly configured, they can also identify authorized emails that contain sensitive information and encrypt them before they are sent.

Secure Email Gateways, with built-in DMARC (Domain-based Message Authentication, Reporting & Conformance), uses SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to authenticate email messages to ensure the source is genuine.  Network administrators can also enable user preferences in accordance with compliance policies.  By using this feature, the SEG issues alerts and warnings to make users aware of potentially harmful activities.  Special reporting options provide insights into all filtering details per email.

CASBs can be on-premise or provided as a cloud-native service.  They reside in the communication path between users and cloud-based applications.  The main task of CASB is to monitor user activity and enforce cybersecurity policies.  If a threat, such as malware, is detected from either the user or application, the communication is halted.  To help ensure complete security, CASBs can inspect alerts and logs generated by other security devices such as firewalls, secure web gateways, and other proxy security devices.  If properly orchestrated, CASBs can instruct other devices to take action.

CASBs discover and monitor cloud application usage inside or outside the network and provide risk assessments and alerts of all suspicious activity.  The information can be helpful in enforcing global policies and monitoring the use of authorized and unauthorized cloud applications.  As an added precaution, they can also scan data on other connected clouds.  This added capability guards against data security violations and identifies threats that are hiding and spreading across other cloud services.

Mobile Entry Points (also known as access points) support the remote workforce regardless of where and when they work. They ensure users remain productive and have seamless and secure access to all their resources.

Mobile entry point networks are available from service providers.  Remote user traffic to an entry point is more manageable, higher performing, and more predictable than public internet connections.  Depending on the size of the service provider and business requirements, IT professionals can have hundreds to thousands of entry points all over the world.

Enforcing security policies is especially important for mobile users since they are exposed to more threats than on-premise users.  User cybersecurity and access control can be administered by the entry point.  It helps provide control and security closer to the user and the most likely point of cyber threat.  Additional technologies such as secure web gateways and cloud access security brokers can be integrated into entry points for added security.  Another benefit of using an entry point is that the user experience for security and application use don’t differ when connected remotely.  They have the same experience regardless of their location.

VPNs are connections that generally encrypt and protect remote user data.  Users and the networks remain secure even if users are working beyond the edge of the corporate enterprise.  Think of a VPN as an extension of the network, allowing it to stretch across uncontrolled networks without having to worry about security issues present with public connections.  The VPN connection is established using an encrypted and layered tunneling protocol.  Users may be required to pass various authentication methods to establish and gain access to the VPN.

Users, remote sites, and strategic business partners can send and receive data across shared or public networks.  The same is true for using applications located behind firewalls and secure web gateways.  VPNs provide remote users with the same functionality, security, and management that they would receive when connected directly to the local network.

Advanced Threat Protection leverages the combined real-time data of numerous threat libraries.  There are many cloud-native services that collect information about cybersecurity threats and attacks.  Data is collected, across the globe, from millions of devices and services being used by hundreds of thousands of businesses.  Sources such as applications, network appliances, security sensors, firewalls, proxy servers, domain name servers, secure email servers, and secure gateways send their security information to enrich these libraries. Because they are collected in real-time at a cloud-scale, the libraries are thorough, all-encompassing, and effective.  Data on all types of threats is collected including,

• Malware, Ransomware, Phishing, and Viruses
• Malicious websites/URLs, IP Session Hijacks, Replay Attacks, IP Spoofing, Eavesdropping Attacks
• Identity/ID Theft, Intrusion Techniques, Distributed Denial of Service Attacks

The amount of data ingested and parsed by these library services is petabytes per day, which leads to massive threat libraries and millions of attack profiles.  Providers can subscribe to these threat libraries and use the information to perform cybersecurity inspection, identification, screening, and blocking.  These libraries are used in near real-time by secure web gateways, secure email gateways, firewalls, domain name services, etc.   They provide invaluable information to ensure your cybersecurity posture is complete and using the most up-to-date threat information.

Businesses that migrate to an SD-WAN may have pre-existing contracts with ISPs and carriers for broadband and MLSP WAN services.  Leading SD-WAN providers offer programs that integrate and manage other services.  The management of the connection transfers from the user to the SD-WAN provider.  The available links are incorporated into the SD-WAN customer platform and managed along with other bandwidth resources.  Everything, including the existing third-party links, is controlled and monitored using the same single-pane-of-glass management SD-WAN console.