What should be expected from your threat intelligence?
Threat intelligence has been widely used right now, and it plays a crucial role in your security posture. If you are a cybersecurity professional, you must be familiar with the concept even though you might not fully understand how it works. It could be much more important to your various domains of cybersecurity, especially for those who are dealing with Security Information and Event Management tools or work within the incident response teams.
But, what you should be expecting when using a threat intelligence feed, especially when they need to collaborate with other security elements, such as NGFW, Email Services, WAF. Sprint Networks is partner with the leading security threat intelligence provider, Fortinet. What you should be expecting from the threat intelligence:
1. Antivirus:
Threat intelligence should deliver automated updates that protect against the latest viruses, spyware, and other content-level threats. It uses industry-leading advanced detection engines to prevent both new and evolving threats from gaining a foothold inside your network and accessing its invaluable content.
2. Intrusion Prevention (IPS):
Threat intelligence automated IPS updates provide latest defenses against network intrusions by detecting and blocking threats before they reach your network devices. You get the latest defenses against stealthy network-level threat, a comprehensive IPS Library with thousands of signatures, flexible policies that enable full control of attack detection methods to suit complex security applications, resistance to evasion techniques proved by NSS Labs and IPS signature lookup service.
3. Application Control:
Improve security and meet compliance with easy enforcement of your acceptable use policy through unmatched, real-time visibility into the applications your users are running. With FortiGuard Application Control, you can quickly create policies to allow, deny, or restrict access to applications or entire categories of applications. The sophisticated detection signatures identify Apps, DB applications, web applications and protocols; both blacklist and white list approaches can allow or deny traffic. Traffic shaping can be used to prioritize applications and flexible policies enable full control of attack detection methods.
4. Security Rating Service:
The Security Rating Service is helps guide customers to design, implement and continually maintain the target Security Fabric security posture suited for their organization. By running Security Rating Service audit checks, security teams will be able to identify critical vulnerabilities and configuration weaknesses in their Security Fabric setup, and implement best practice recommendations.
5. IoT Service:
The IoT service helps customers significantly reduce their attack surface by enabling the Fortinet Security Fabric to automatically discover and segment IoT devices based on FortiGuard intelligence, and enforce appropriate policies against them. With the service, FortiGates can query FortiGuard servers to obtain information about unknown devices and then act accordingly based on policy
6. Indicators of Compromise (IOC) :
The IOC service is an automated breach defense system that continuously monitors your network for attacks, vulnerabilities, and persistent threats. It provides protection against legitimate threats, guarding customer data and defending against fraudulent access, malware, and breaches. It also helps businesses detect and prevent fraud from compromised devices or accounts
7. Vulnerability Scan
Vulnerability scan network assets for security weaknesses, with on demand or scheduled scans. Comprehensive reports on the security to benefit from and access the intelligence, expertise, and protection delivered by FortiGuard Labs, customers simply need to add the desired security subscriptions to their Fortinet Security Fabric deployment. FortiGuard security services are designed to optimize performance and maximize protection across the Fortinet Security Fabric and are available as both individual and bundled subscriptions. Our subscriptions cover every aspect of the attack surface and includes IP reputation updates, intrusion prevention, web filtering, antivirus/anti-spyware, anti-spam, database security, virus outbreak protection service, content disarm & reconstruction, security rating services and network and web application control capabilities. Subscribe to FortiGuard to stay protected against the latest threat across all threat vectors and attack surfaces today! DATA SHEET | Fortinet Transceivers 3 FortiGuard Subscription Bundles posture of your critical assets and automated scanning of remote location FortiGates.
8. Web Application Firewall (WAF):
Automated WAF signature updates that protect against SQL injection, cross-site scripting, and various other attacks, hundreds of vulnerability scan signatures, data-type and web robot patterns, and suspicious URLs. Supports PCI DSS compliance by protecting against OWASP top 10 vulnerabilities and using WAF technology to block attacks.
9. Web Filtering:
Block and monitor web activities to assist customers with government regulations and enforcement of corporate internet usage policies. FortiGuard’s massive web content rating databases power one of the industry’s most accurate web filtering services. Granular blocking and filtering provide web categories to allow, log, or block. Comprehensive URL database provides rapid and comprehensive protection. And, Credential Stuffing Defense identifies login attempts using credentials that have been compromised using an always up-to-date feed of stolen credentials.
10. Industrial Control Systems Security:
The FortiGuard Industrial Security Service continuously updates signatures to identify and police most of the common ICS/SCADA (supervisory control and data acquisition) protocols for granular visibility and control. Additional vulnerability protection is provided for applications and devices from the major ICS manufacturers.
11. Antispam:
FortiGuard Antispam provides a comprehensive and multi-layered approach to detect and filter spam processed by organizations. Dualpass detection technology can dramatically reduce spam volume at the perimeter, giving you unmatched control of email attacks and infections. Advanced anti-spam detection capabilities provide greater protection than standard real-time blacklists.
12. Cloud Sandbox:
FortiCloud Sandbox Service is an advanced threat detection solution that performs dynamic analysis to identify previously unknown malware. Actionable intelligence generated by FortiCloud Sandbox is fed back into preventive controls within your network—disarming the threat. FortiSandbox is NSS Labs Recommended for breach detection and breach prevention, and ICSA Labs certified for advanced threat defense.
