Simple explanation
A catalog of the specific tools and protocols organizations layer on top of basic infrastructure to actively defend it — firewalls, filtering, secure protocols, and behavior analytics.
Technical explanation
- Firewall rules / ACLs — the fundamental allow/deny logic controlling traffic.
- IDS/IPS trends and signatures — signature-based detection matches known attack patterns; trend/anomaly-based detection flags deviations from a baseline, catching novel attacks signatures would miss.
- Web filtering: agent-based (software on the endpoint) vs. centralized proxy (filtering happens at a network chokepoint), URL scanning, content categorization, block rules, and reputation-based filtering (blocking based on a domain/IP's known-bad history).
- Operating system security — hardening at the OS level; SELinux (Security-Enhanced Linux) is a specific example providing mandatory access control beyond standard Linux permissions.
- Implementation of secure protocols — protocol selection (choosing HTTPS over HTTP, SFTP over FTP), port selection, transport method — the principle of always preferring the encrypted/authenticated version of any protocol where one exists.
- DNS filtering — blocking resolution of known-malicious domains before a connection is even attempted.
- Email security: DMARC (tells receiving servers what to do with mail that fails authentication), DKIM (cryptographically signs outgoing mail to prove it wasn't altered), SPF (specifies which servers are authorized to send mail for a domain), and email security gateways (filtering at the mail server level).
- File Integrity Monitoring (FIM) — alerts when protected files change unexpectedly.
- DLP (Data Loss Prevention) — detects and blocks sensitive data from leaving the environment inappropriately.
- Network Access Control (NAC) — enforces policy (patch level, antivirus status, etc.) before allowing a device onto the network at all.
- EDR/XDR — Endpoint Detection and Response (endpoint-focused) / Extended Detection and Response (correlates across endpoint, network, cloud, and more for broader visibility).
- User behavior analytics (UBA) — baselines normal user behavior and flags deviations, useful for catching compromised accounts or insider threats that wouldn't trigger a signature-based alert.
Synonyms / related terms
| Term | Means | |---|---| | DMARC/DKIM/SPF | The three email authentication standards, always mentioned together | | NAC | Network Access Control | | UBA/UEBA | User (and Entity) Behavior Analytics |
Concept Check
"An organization wants to stop phishing emails that spoof its own domain from reaching recipients at OTHER companies." This isn't solved by an email security gateway alone (that protects inbound mail to your own users) — the organization needs SPF, DKIM, and DMARC properly configured on their own domain, so that other mail servers can verify and reject spoofed mail claiming to be from them.
Interview-style Q&A
Q: Why deploy XDR instead of just EDR? A: "EDR gives deep visibility into endpoint behavior, but an attacker's activity often spans endpoint, network, and cloud simultaneously. XDR correlates signals across all of those layers into a single view, which catches attack chains that would look like unrelated, low-priority alerts if you were only looking at endpoint data in isolation."
Memory trick
"Spam Doesn't Kick In" — SPF, DKIM — email authentication trio (add DMARC as the third, the "policy" layer that says what to do when SPF/DKIM fail).