THREAT DETECTION AND PROTECTION

Handling the unknown enemy

Once upon a time, threat protection was about known threats, and antivirus was enough. Those days are long gone. It is essential to understand that if we only look for known threats, we lose the battle…
Today, it’s about protecting individual devices and their users in a very different threat landscape, full of dangers that are unknown, unpredictable and uncontrollable.

Things to consider

Know your users – and how they act

The key to threat detection and protection is behavior: User behavior and system behavior. The tell-tale that something is wrong is abnormal behavior – unusual access patterns and locations, uncharacteristic activities, etc.
But to spot abnormal behavior, you must first know what “normal” looks like.

Take advantage of the fact that modern endpoint security platforms:

are data-driven, and can both prevent and warn about potential issues.
analyze user behavior, and detect and warn against abnormal behavior.

If you use these platforms the way they were intended, and have the policies and processes in place to recognize the warning signs, you’ve come a long way.

And then, you “just” need to listen. And respond efficiently.

User training and technology

Threat detection and protection is all about knowing your users, and understanding how to utilize your technologies. The insights of your internal IT teams into how your specific users behave, is what enables you to set up technologies, to spot when something is not right.

You can get help from external technology experts to ensure you utilize the functionalities of your tools of choice, and adhere to best practices.

But what it’s all about is:

knowing your organization and its users;
training your organization and its users;
raising security awareness among your users and at C-level;
and building awareness and a corporate culture that supports, and is supported by, your security processes.

Security is based on insight.

Configuration, analysis and visualization

There are good and strong technologies on the market which can take your threat detection and protection efforts far.

When CTGlobal helps you set up and run your threat detection and protection, we typically apply three methods:

CTGlobal’s methods:

Configuration – we make sure everything is hooked up and functioning, according to best practices.
Analysis – we assess your infrastructure, your business needs and your compliance requirements, to identify the best approach for your organization.
Visualization – every step of the way we monitor progress and effect, to ensure that your goals are met, and your efforts documented.

CTGlobal uses Microsoft technologies.

For threat protection and detection we use Defender and Sentinel.