A Guide to Threat Detection
What is threat detection?
Threat detection is the process of inspecting and analyzing your entire technology ecosystem to identify vulnerable conditions and other risks that could lead to a compromise of your technology operating environment.
When vulnerable conditions, or threats, are detected, specific activities must be initiated to either remediate the vulnerable condition (like patching or updating out-of-date software) or additional controls must be put in place to ensure that the identified condition does not otherwise lead to a compromise or breach.
As it relates to your organization’s IT security program, or focused efforts around IT risk management, the concepts associated with identifying vulnerable conditions and threats are multi-dimensional. Information security and IT risk management programs must plan for a variety of worst-case scenarios, ensuring that if a condition or other risk leads to some level of compromise that resilience measures and processes are considered and in place to mitigate the potential for loss or disruption.
Recommended solutions and controls for threat detection and response:
- Antivirus Software
- NextGen Firewall
- Endpoint Detection and Response (EDR) or Managed Detection and Response (MDR)
- Managed Security Services Provider (MSSP)
- Screening New Employees
- Least Privilege Model
