4.3Security products

There are many types of security products, and memorizing names alone is not useful in practice. What matters is understanding what each product detects or protects, whether it targets known or unknown threats, whether it operates at the endpoint, the network, or cloud usage, and at what granularity it protects. This section builds the judgment to select the right product for a given detection requirement.

4.3.1Network-boundary products: firewall, IDS/IPS, UTM

• A firewall allows or blocks traffic based on header information such as IP addresses and port numbers—the basic building block of boundary defense. It does not inspect the payload contents, so an attack that uses an allowed port passes straight through.
• IDS (Intrusion Detection System) monitors traffic and detects and alerts on signs of an attack (without blocking). IPS (Intrusion Prevention System) adds automatic blocking on top of detection. Detection methods include signature-based matching against known attack patterns (strong against known attacks but blind to unknown ones) and anomaly-based detection of deviation from normal traffic (can catch unknown attacks but tends to raise more false alarms).
• UTM (Unified Threat Management) integrates multiple functions—firewall, IDS/IPS, antivirus, web filtering—into a single appliance. It is chosen when a small-to-midsize site wants layered defense while keeping operational load and cost down.