Phân loại công cụ bảo mật mạng theo chức năng
1. Kiểm soát truy cập & Perimeter Security
| Loại công cụ | Công cụ đại diện | Chức năng chính |
|---|---|---|
| Next-Gen Firewall (NGFW) | Palo Alto, FortiGate, Check Point, Cisco Firepower, Sophos XGS | App-ID, User-ID, IPS, SSL Decrypt, Sandbox, SD-WAN |
| Cloud/Host Firewall | AWS SG/NACL, Azure NSG, GCP Firewall, iptables/nftables, Windows Defender FW, ufw/firewalld | Micro-segmentation, workload protection |
| Zero Trust Network Access (ZTNA) | Zscaler ZPA, Cloudflare Access, Twingate, Tailscale, AWS Verified Access, Google BeyondCorp | Identity-based access, thay thế VPN |
| Network Access Control (NAC) | Cisco ISE, Aruba ClearPass, FortiNAC, Portnox, PacketFence | 802.1X, MAB, posture assessment, dynamic VLAN |
2. Phát hiện & Phản ứng (Detection & Response)
| Loại | Công cụ | Mô tả |
|---|---|---|
| NDR (Network Detection & Response) | ExtraHop, Vectra AI, Corelight (Zeek-based), Darktrace, Awake Security | ML-based anomaly detection trên traffic mirror/span port |
| IDS/IPS | Suricata (open source), Snort, Zeek (Bro), Cisco Secure IPS, Palo Alto IPS | Signature + Anomaly based, inline (IPS) hoặc tap (IDS) |
| SIEM | Splunk, Elastic (ELK), Microsoft Sentinel, IBM QRadar, LogRhythm, Sumo Logic | Log aggregation, correlation, UEBA, dashboard, alerting |
| SOAR | Palo Alto Cortex XSOAR, Splunk SOAR, FortiSOAR, Siemplify (Google), Shuffle (open source) | Playbook automation, case management, threat intel enrichment |
| XDR/EDR | CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint, Cortex XDR, Trend Vision One | Endpoint + Network + Cloud + Identity correlation |
3. Bảo vệ dữ liệu & Ứng dụng
| Loại | Công cụ | Chức năng |
|---|---|---|
| DLP (Data Loss Prevention) | Forcepoint, Digital Guardian, Microsoft Purview, Nightfall, Cyberhaven | Network/Endpoint/Cloud DLP, exact match, regex, fingerprinting, OCR |
| WAF (Web App Firewall) | Cloudflare, AWS WAF, Azure WAF, F5 ASM, Imperva, ModSecurity (open source), Wallarm | OWASP Top 10, API protection, Bot management, Rate limiting |
| API Security | Salt Security, Noname, Traceable, 42Crunch, Wallarm, Postman | API discovery, schema validation, abuse detection, sensitive data |
| Email Security | Proofpoint, Mimecast, Microsoft Defender for Office 365, Cisco ESA, Avanan | Anti-phishing, sandbox, DMARC/DKIM/SPF, BEC protection |
4. Quản lý lỗ hổng & Cấu hình (Vulnerability & Configuration Management)
- Vulnerability Scanner: Tenable Nessus, Qualys VMDR, Rapid7 InsightVM, OpenVAS (open source), Nuclei (template-based)
- CSPM (Cloud Security Posture Management): Wiz, Orca, Palo Alto Prisma Cloud, Check Point CloudGuard, Microsoft Defender for Cloud
- CWPP (Cloud Workload Protection Platform): Sysdig, Aqua, Falco (runtime), Datadog Cloud Security
- SAST/DAST/SCA/Container Scan: SonarQube, Checkmarx, Veracode, Snyk, Trivy, Grype, Syft (SBOM)
5. Threat Intelligence & Hunting
- TIP (Threat Intelligence Platform): MISP (open source), Anomali, ThreatConnect, EclecticIQ, OpenCTI
- Threat Intel Feeds: AlienVault OTX, Abuse.ch, Spamhaus, MITRE ATT&CK, CISA KEV, VirusTotal, URLhaus
- Threat Hunting Tools: Velociraptor, KAPE, Hayabusa (Windows Event Log), Osquery, Elastic Endpoint
6. Mã hóa & Quản lý khóa (Encryption & Key Management)
- HSM/Key Management: AWS KMS/CloudHSM, Azure Key Vault, Google Cloud KMS, HashiCorp Vault, Thales Luna, Utimaco
- Certificate Management: Let's Encrypt (ACME), cert-manager (K8s), Venafi, Smallstep, AWS Private CA
- Secrets Management: HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, 1Password, Bitwarden, Doppler
7. Phân tích gói tin & Forensics (Packet Analysis & Forensics)
- Packet Capture/Analysis: Wireshark, tcpdump, tshark, ntopng, Arkime (Moloch), Zeek
- Network Forensics: NetworkMiner, Xplico, Brim (Zeek+Suricata UI), Security Onion (distro)
8. Kiểm thử & Đánh giá (Testing & Assessment)
- Penetration Testing Framework: Metasploit, Cobalt Strike, Brute Ratel, Sliver, Havoc
- Red Team Tools: BloodHound (AD), SharpHound, Rubeus, Impacket, CrackMapExec, Evilginx2
- Breach & Attack Simulation (BAS): AttackIQ, SafeBreach, Cymulate, Validato, SCYTHE
- Cloud Security Audit: ScoutSuite, Prowler, CloudSploit, CloudCustodian
Framework & Chuẩn mực tham khảo
- NIST CSF 2.0: Govern, Identify, Protect, Detect, Respond, Recover
- MITRE ATT&CK: Enterprise, Mobile, ICS matrices - mapping detection/mitigation
- CIS Controls v8: 18 Critical Security Controls (IG1/IG2/IG3)
- ISO 27001/27002: ISMS framework, Annex A controls
- Zero Trust Architecture: NIST SP 800-207, CISA ZTMM
- PCI DSS 4.0, GDPR, NIS2, DORA
Xu hướng công cụ hiện đại (2024)
- Platformization: Consolidation vendors (Palo Alto Cortex, CrowdStrike Falcon, Microsoft Security, SentinelOne Singularity) - single agent, single console
- AI/ML Native: Behavioral analytics, LLM-assisted investigation, auto-triage, natural language query (Splunk AI, Microsoft Security Copilot, Google Sec-PaLM)
- Data Fabric / Security Lake: Amazon Security Lake, Open Cybersecurity Schema Framework (OCSF) - unified data layer
- DevSecOps Integration: Policy as Code (OPA/Rego), GitOps security, Shift-left trong CI/CD (GitHub Advanced Security, GitLab SAST/DAST/Dependency Scanning)
- Identity-First Security: ITDR (Identity Threat Detection & Response), CIEM, ISPM (Identity Security Posture Management)
Lựa chọn công cụ: Tiêu chí quyết định
- Coverage: Đáp ứng surface area (on-prem, cloud, hybrid, SaaS, OT/IoT)
- Integration: API, webhook, syslog, OCSF, native integration với stack hiện có
- Total Cost of Ownership: License, infra, people, training, maintenance
- Team Maturity: Tool phức tạp cần team mature; SMB ưu tiên managed/SaaS
- Compliance: Hỗ trợ báo cáo tự động cho chuẩn áp dụng
- Vendor Viability: Roadmap, financial health, community, support SLA