4.3Security products

There are many types of security products, and memorizing names alone is not useful in practice. What matters is understanding what each product detects or protects, whether it targets known or unknown threats, whether it operates at the endpoint, the network, or cloud usage, and at what granularity it protects. This section builds the judgment to select the right product for a given detection requirement.

4.3.1Network-boundary products: firewall, IDS/IPS, UTM

• A firewall allows or blocks traffic based on header information such as IP addresses and port numbers—the basic building block of boundary defense. It does not inspect the payload contents, so an attack that uses an allowed port passes straight through.
• IDS (Intrusion Detection System) monitors traffic and detects and alerts on signs of an attack (without blocking). IPS (Intrusion Prevention System) adds automatic blocking on top of detection. Detection methods include signature-based matching against known attack patterns (strong against known attacks but blind to unknown ones) and anomaly-based detection of deviation from normal traffic (can catch unknown attacks but tends to raise more false alarms).
• UTM (Unified Threat Management) integrates multiple functions—firewall, IDS/IPS, antivirus, web filtering—into a single appliance. It is chosen when a small-to-midsize site wants layered defense while keeping operational load and cost down.

4.3.2Application-layer products: WAF, RASP

• A WAF (Web Application Firewall) inspects the content (parameters, etc.) of HTTP requests to detect and block application-layer attacks such as SQL injection and XSS. It targets application-specific attacks that a network-layer firewall cannot stop.
• RASP (Runtime Application Self-Protection) is embedded inside the application's runtime environment, monitoring the actual behavior of executing code to detect and block attacks. While a WAF inspects traffic on the external network path, RASP observes behavior from inside the application, making it better suited to handling encrypted traffic contents or sophisticated attacks that might slip past a WAF.

4.3.3Detection, visibility, and endpoint products: SIEM, EDR, DLP

• SIEM (Security Information and Event Management) aggregates and correlates logs from multiple devices—firewalls, IDS/IPS, servers, endpoints—to surface attack indicators that no single device could notice alone (e.g., a combination of low-frequency access across multiple sites). Its main focus is organization-wide situational visibility, and it does not itself block individual threats.
• EDR (Endpoint Detection and Response) monitors behavior on endpoints such as PCs and servers, detecting signs of suspicious process execution or lateral movement after an intrusion, and supporting isolation and forensic investigation. It focuses on detection and response after intrusion, complementing antivirus (which prevents known malware from getting in).
• DLP (Data Loss Prevention) detects confidential information (patterns such as personal data or card numbers) and detects/blocks unintended or unauthorized exfiltration via email, USB transfer, cloud upload, and similar channels. Its focus on the leakage of the information itself, rather than malware, is what distinguishes it from EDR.

Suppose a global company's CSIRT is reviewing its security products in response to expanding cloud usage and the normalization of remote work. First, for the requirement of visualizing and controlling the fact that the sales department is uploading confidential materials to an unapproved cloud storage service (shadow IT), a CASB (Cloud Access Security Broker), which visualizes cloud service usage and provides access control and DLP functionality, is appropriate. Next, for the requirement of moving away from reliance on perimeter defense toward verifying every access, for employees connecting from outside via various networks, SASE (Secure Access Service Edge), which integrates SD-WAN and security functions in the cloud, is a candidate. For the requirement of remotely locking or wiping employees' smartphones and laptops when lost or stolen, MDM (Mobile Device Management) is the relevant domain, and for the requirement of letting employees single sign-on once across multiple cloud services and SaaS apps, an IdP (Identity Provider) that centrally issues authentication is the relevant domain. Now, if the existing IDS (signature-based) had been missing unknown variants of a targeted attack, the team would consider switching to anomaly-based IDS/IPS or adding EDR to monitor endpoint behavior—but anomaly-based detection is prone to misclassifying legitimate changes in business traffic (e.g., a temporary access surge during a busy period) as false positives, risking alert fatigue for the operations team, a trade-off that must be weighed when tuning the threshold. Conversely, loosening the threshold too far increases false negatives, missing real attacks—so the core practical judgment is to select and tune both the product and the threshold according to the detection requirement (what to protect, and at what granularity).

4.3.4Section summary

• IDS only detects, IPS also blocks. Signature-based is strong on known threats; anomaly-based handles unknown ones but raises more false alarms
• WAF inspects HTTP content on the path; RASP monitors runtime behavior from inside the app. SIEM correlates and visualizes logs across devices
• Choose by scope: CASB for cloud usage, SASE for all access paths, MDM for mobile devices, IdP for the authentication foundation