NGFWs are network security devices that allow, among other things:

• • • Protecting the Edge of the headquarters and data centers, whether on-premise or on the cloud.

    • Performing a correct segmentation of the network, improving security to prevent lateral propagation.

    • They offer complete visibility of what is happening on the network, and are capable of detecting and protecting users inside the network from certain threats thanks to features, such as antivirus, web filtering and application control. In addition, thanks to the IPS/IDS systems it is possible to prevent (IPS) and identify (IDS) any suspicious activity that attempts to exploit a known vulnerability.

A SD-WAN (Software Defined Wide Area Network) is a solution that transforms an organization’s WAN capabilities by providing centralized control mechanisms to determine and automatically route traffic over the WAN connection (MPLS, 3G/4G or broadband) that best suits the outgoing traffic at any given time. This solution allows you to stop relying on traditional architectures with MPLS connectivity, which is slower and more expensive. The traditional architectures do not offer any advantage over cloud-based applications (SaaS, IaaS, public cloud applications).

The use of this type of solution allows organizations to:

• • • Obtain high-performance network capabilities compatible with digital transformation initiatives.

    • Simplify complexity by unifying certain WAN features into a unified solution and management.

    • Improve the user experience with corporate applications by prioritizing them and providing direct access to cloud applications and the Internet from branch offices.

    • Cost savings compared to more traditional solutions such as MPLS.

It is a cloud native solution that allows organizations to protect both web traffic and cloud traffic, allowing them to differentiate and apply different security measures, depending on whether the instance to which the user connects is personal or corporate within a managed application.

Some of the features offered by the NG-SWGs are:

• • • Complete, online visibility into thousands of applications and cloud services.

    • Real-time granular control of web traffic and cloud applications accessed by users, applying CASB and DLP functions to them.

    • Protection against advanced threats, limiting the use of non-corporate and unauthorized instances, which can be used for the propagation of phishing and threats, performing an analysis prior to the execution of scripts or macros as well as using Machine Learning.

    • Data protection regardless of the location of the data.

    • Protection of users’ direct connections to the Internet, avoiding the need to redirect traffic and improving performance by offering a better user experience.

CASB is a service or application that allows organizations to set corporate security policies when accessing the organization’s cloud services. In this way, the application forces users to comply with the policies established by the service administrators.

Some of the features offered by CASB are:

• • • Visibility and control, allowing organizations to have said functions of cloud services, whether or not they are managed by the IT department, allowing them to profile not only the access to a service or not, but also the functions that can be performed on it depending on whether the instance is corporate or personal.

    • Data security, allowing IT departments to efficiently detect, thanks to the interaction with other modules such as DLP, possible data security violations, allowing you to identify and stop such activities. In addition, it provides the necessary tools for further analysis by the IT department.

    • Protection against advanced threats, limiting the use of non-corporate and unauthorized instances, which can be used for the propagation of phishing and threats, performing an analysis prior to the execution of scripts or macros as well as using Machine Learning.

DLP or Data Loss Prevention encompasses a set of practices and tools designed to detect and prevent data breaches, avoiding the exfiltration of sensitive data either by intentional or unintentional misuse.

DLP enables companies to detect data loss, as well as prevent the illicit transfer of data outside the organization and the unwanted destruction of confidential or personally identifiable data. It is also used to help organizations with data security and ensure that they comply with regulations, such as CCPA, GDPR, HIPAA or PCI-DSS.

DLP enables companies to:

• • • • Identify confidential information across multiple local and cloud-based systems.

      • Avoid accidental data exposure.

      • Monitor and protect data.

      • Ensure regulatory compliance.

ZTNA or Zero Trust Network Access is a set of products and services that enable access conditions to an application or set of applications based on identity and context.

Applications remain hidden from malicious discovery attempts and access to them is restricted, through a trusted broker, to authorized users. The trusted broker verifies the identity, context and policy compliance of specified users before allowing access and prohibits lateral movement elsewhere on the network. This eliminates the application of public visibility and significantly reduces the surface area for attacks.

ZTNA eliminates the excessive implicit trust that often accompanies other forms of application access, such as classic VPNs.

Remote work is becoming more and more common, forcing organizations to protect all their endpoints in an effective way by means of a new generation of Antivirus solutions, based on Artificial Intelligence providing the IT team with instant visibility and protection against advanced threats.

In one single solution and from one single agent, the new generation endpoint protection provides functions such as:

• • • Next Generation AntiVirus has evolved by taking advantage of big data and artificial intelligence to provide protection against advanced threats with minimal endpoint resource consumption by not relying on signatures and eliminating the need to perform traditional endpoint match scans.

    • Endpoint Detection and Response (EDR) is an endpoint security solution that continuously logs and stores endpoint system-level behaviors, using various data analysis techniques to detect suspicious system behaviors, providing contextual information, blocking malicious activity and providing remediation suggestions to restore affected systems.

    • Managed detection and response (MDR) is a cybersecurity service that combines technology and human expertise to search for, monitor and respond to advanced threats. The main benefit of MDR is that it helps to quickly identify and limit the impact of threats without the need for additional personnel from within the organization.

    • Extended detection and response (XDR) is a solution that is responsible for collecting threat data provided by different security tools, which were originally isolated within the large number of technologies used by the same, in order to perform investigations, search for threats and provide faster and more effective response. An XDR platform can collect security telemetry from endpoints, cloud workloads, email, and more. All of this enriched threat data filtered and correlated into a single console allows security teams to quickly and efficiently search for and eliminate security threats across multiple domains from a unified solution.

                

One of the attack vectors most used by cybercriminals continues to be email. Thus, the implementation of a solution to protect corporate users is essential, whether on-premise or via cloud.

Some of the features offered by e-mail security solutions are:

• • • Protection against fraudulent e-mails, allowing the IT department to dynamically block phishing e-mails, which attempt to gain access to critical company information or extract money by deceiving one of the organization’s employees.

    • Granular management of unwanted emails, allowing the IT department to sort and quarantine them in an automated way.

    • Add warning labels in the email subject line in an automated way so that the user can quickly and easily differentiate any suspicious email.

    • Business continuity, allowing email service to be maintained despite a downtime of the email servers.

The NAC is a corporate network access control solution that provides the IT department with extended visibility of all devices connecting to the corporate network. Thanks to this visibility, it is possible to perform different actions in an automated way, such as:

• • • Auto-configuration of network devices (switches, wireless access points, firewalls, etc.) based on the connected device and through device detection and profiling.

    • Micro segmentation, restricting network access of connected devices to only the necessary network assets, as a result of dynamic policy control.

    • Detection and identification of devices connected to the network. Thanks to the high network visibility it provides, the IT department can see all devices and users as they join the corporate network.

Traditionally, OT environments were not connected to the Internet and were therefore practically not exposed to external threats. This implied that cybersecurity in OT environments was “in the dark.”

However, the paradigm has shifted and OT environments need more and more connectivity with other services that can be found both inside and outside the organization, forcing companies to efficiently secure OT processes.

Some of the domains to consider for protecting processes in OT environments are:

• • • • Discovery and monitoring of assets, since in many cases the organization itself does not know 100% of the devices that are connected to the OT network and the relationships established between them.

      • Hardening of devices.

      • Vulnerability scanning, allowing organizations to know the exposure of all their OT assets and potential vulnerabilities.

      • Virtual patching, because vulnerable operating systems and other tools are common.

      • Access control and limitation of lateral movements, including remote and on-premise access management by manufacturers and third parties.

Vulnerability Scanning solutions allow organizations to know the exposure of all their assets, gaining visibility of the entire attack surface, thanks to vulnerability scanning of all applications, network devices, web applications, etc., found in the organization. These tools not only allow you to see what the vulnerabilities are, but they also allow the IT department to have a centralized view from which to analyze and measure risks. This enables them to assess, prioritize and correct vulnerabilities with less time and effort.

Breach and Attack Simulation (BAS) solutions allow the organization’s Cybersecurity team to operationally manage threat intelligence and the MITRE ATT&CK framework. This enables them to evaluate through simulating real attacks executed in an automated manner. Such an assessment allows the cybersecurity team to continuously optimize security controls throughout the cyber kill chain.

Data is an organization’s main asset. Attackers know this, which is why it is necessary to have a ransomware-proof backup solution that covers at least critical corporate data. An immutable backup will allow the organization to recover in the event of an attack, helping to adequately meet the RPOs and RTOs that have been set.