Trustwave Government Solutions Attains StateRAMP Authorization. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave Government Solutions Attains StateRAMP Authorization. Learn More
One doesn’t have to be a magician to understand how to track the hundreds, if not thousands, of applications that are running on your network. To lighten the load and eliminate the need for having supernatural abilities, let’s go over some simple tasks a security defender can take to track, detect, and even block application threats.
Finding applications typically depends on the architecture platform and the software tracking tools available.
Some examples would be:
The methods for tracking these applications vary by vendor. Ideally, a query tool will be available that allows you to manipulate the search results as needed to produce useful reports and dashboards.
Some suggestions on what to track are:
Once the location and type of applications are identified, a strategy on how to detect malicious activity can be created. Some suggestions on what malicious activity to track are:
There are also ways to ‘block list’ applications. Some examples are WDAC – Windows Defender Application Control and Microsoft Defender for Cloud Apps.
For more suggestions on protecting cloud-based applications, see the ‘Well Architected Framework’ documentation for your cloud provider. You can also use a Zero Trust Network Access architecture (or SASE – Secure Access Service Edge) for protecting applications, but that’s outside the scope of this article.
Detecting and eliminating risky applications is a critical responsibility for cyber defenders. No one tool will likely be able to perform this task so an understanding of the variety of applications and how to protect each is necessary.
References
About This Blog Series
Follow the full series here: Building Defenses with Modern Security Solutions
This series discusses a list of key cybersecurity defense topics. The full collection of posts and labs can be used as an educational tool for implementing cybersecurity defenses.
Labs
For quick walkthrough labs on the topics in this blog series, check out the story of “ZPM Incorporated” and their steps to implementing all the solutions discussed here.
Compliance
All topics mentioned in this series have been mapped to several compliance controls here.
David Broggy is Senior Solutions Architect, Implementation Services at Trustwave with over 21 years of experience. He holds multiple security certifications and won Microsoft's Most Valuable Professional (MVP) Award for Azure Security. Follow David on LinkedIn.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.