Bối cảnh năm 2019: Chuyển dịch quan trọng
Năm 2019 đánh dấu sự chuyển biến mạnh mẽ từ perimeter-based security sang identity/zero-trust based, sự trỗi dậy của Cloud-Native Security, SASE/SSE (chưa có thuật ngữ SASE nhưng đã có nguyên nhân), và AI/ML trong detection. Gartner Magic Quadrant 2019 cho Network Firewall, Endpoint Protection, SIEM phản ánh xu hướng này.
Top Network Security Management Software 2019
1. Next-Gen Firewall (NGFW) - Gartner MQ 2019 Leaders
| Vendor | Sản phẩm chính | Điểm mạnh 2019 |
|---|
| Palo Alto Networks | PA-7000/5200/3200 Series, VM-Series, Prisma Access (SASE sớm) | App-ID tốt nhất, WildFire sandbox, User-ID, Decryption, Panorama central mgmt |
| Fortinet | FortiGate (SoC SPU), FortiManager, FortiAnalyzer, FortiClient | Hiệu năng/giá tốt nhất (ASIC), Security Fabric tích hợp sâu (Switch, AP, Endpoint) |
| Check Point | Quantum Security Gateway, R80.10/R80.20, Infinity Architecture | Kernel-level inspection, SmartConsole quản trị tập trung mạnh, SandBlast |
| Cisco | Firepower 4100/9300 (FTD), Meraki MX (Cloud-managed), ASA (End-of-sale) | Tích hợp Cisco ecosystem (ISE, Stealthwatch, Umbrella, Talos Intel) |
| Sophos | XG Firewall (SFOS 17.5), Synchronized Security với Intercept X | Xstream SSL decrypt, Heartbeat liên kết FW-Endpoint, MSP-friendly |
2. SIEM & Security Analytics 2019
| Vendor | Sản phẩm | Xu hướng 2019 |
|---|
| Splunk | Splunk Enterprise, Splunk Cloud, Splunk UBA, Phantom (SOAR - mua 2019) | Market leader, SPL query, ML Toolkit, ITSI, chuyển sang Cloud/SaaS |
| IBM QRadar | QRadar SIEM 7.3/7.4, QRadar on Cloud | Reference set, offense, Watson integration, Cloud Pak for Security (2019) |
| LogRhythm | LogRhythm NextGen SIEM, CloudAI | Embedded SOAR (SmartResponse), UserXDR (UEBA), MITRE ATT&CK mapping |
| Elastic (ELK) | Elastic Stack 7.x, Elastic SIEM (Beta 2019), Elastic Security (GA 2020) | Open source, scale-out, security free features, MITRE ATT&CK dashboards |
| Microsoft | Azure Sentinel (Public Preview 2019 → GA 2020) | Cloud-native SIEM + SOAR, built-in connectors, pay-as-you-go, KQL |
3. Endpoint Protection (EPP/EDR) - Gartner MQ 2019
| Vendor | Sản phẩm | Điểm nhấn 2019 |
|---|
| CrowdStrike | Falcon Platform (EDR, NGAV, ITDR, Threat Graph) | Leader. Cloud-native, single lightweight agent, Threat Graph real-time, MITRE ATT&CK alignment, Falcon X (threat intel) |
| Microsoft | Windows Defender ATP (renamed Defender for Endpoint 2020) | Built-in Win 10, EDR, ATP, ASR rules, tích hợp M365 Security, giá cạnh tranh |
| SentinelOne | Singularity Platform (EDR, NGAV, Ranger, Vigilance) | Autonomous AI, Storyline™ auto-correlation, rollback ransomware, offline protection |
| Carbon Black (VMware sau 2019) | Cb Defense (EDR), Cb Protection (App Control), Cb Response | Cloud-native, streaming prevention, MITRE ATT&CK |
| Cylance (BlackBerry sau 2019) | CylancePROTECT (AI AV), CylanceOPTICS (EDR) | AI/ML static analysis, no signature, lightweight |
4. Công nghệ mới nổi 2019 (Trở thành Mainstream 2020+)
- SASE (Secure Access Service Edge): Gartner định nghĩa 2019. Kết hợp: SD-WAN + FWaaS + SWG + CASB + ZTNA. Vendor sớm: Cato Networks, Zscaler, Palo Alto Prisma Access, Netskope, Versa Networks
- XDR (Extended Detection & Response): Mở rộng EDR sang Network, Cloud, Identity. Palo Alto Cortex XDR (2019), Microsoft Defender XDR, Trend Micro Vision One
- CNAPP (Cloud-Native Application Protection Platform): CSPM + CWPP + CIEM + DSPM. Palo Alto Prisma Cloud, Wiz (2020), Orca (2019), Aqua, Sysdig
- Deception Technology: Attivo Networks, Illusive Networks, TrapX, Acalvio - Decoy/deception at scale
- Breach & Attack Simulation (BAS): AttackIQ, SafeBreach, Cymulate - Continuous security validation
- Zero Trust Network Access (ZTNA): Zscaler ZPA (2018), Appgate SDP, Pulse Secure ZTNA, Akamai EAA - Thay thế VPN
5. Network Detection & Response (NDR) 2019
- ExtraHop Reveal(x): Wire data analytics, ML-based detection, TLS 1.3 decryption
- Corelight (Zeek-based): Network protocol parsing, evidence generation, open core
- Vectra AI (Cognito): AI-driven network threat detection, Privileged Access Analytics
- Darktrace: Enterprise Immune System, Self-learning AI, Antigena (autonomous response)
- Awake Security: Network traffic analysis, encrypted traffic analysis (ETA)
6. Vulnerability Management & Compliance 2019
- Tenable.io / Nessus: Cloud-based VM, Predictive Prioritization (VPR)
- Qualys VMDR: Cloud platform, Continuous monitoring, Patch integration
- Rapid7 InsightVM: Risk-based prioritization, InsightConnect (SOAR), Project Sonar
- Kenna Security: Risk-based vuln management (Data science approach) - Cisco mua 2021
Xu hướng quản trị bảo mật mạng 2019 (Vẫn áp dụng 2024+)
- Consolidation (Hợp nhất): Giảm vendor sprawl (trung bình 45-76 tools → mục tiêu < 10 platform)
- Automation (Tự động hóa): SOAR, Playbook, API-first, Infrastructure as Code (Terraform, Ansible)
- Cloud-Native: Born in cloud, container/K8s security, Serverless security
- Identity-Centric: Zero Trust, ZTNA, CIEM, ITDR
- Data-Driven: Security Lake, OCSF, Open Telemetry, MITRE ATT&CK mapping
- Outcome-Based: Đánh giá bằng risk reduction, MTTD/MTTR, không phải số lượng alert
Lời khuyên cho tổ chức năm 2019 (và vẫn đúng hôm nay)
- Đầu tư Visibility trước Protection: Không bảo vệ được thứ không thấy (Flow logs, Packet capture, CloudTrail, EDR telemetry)
- Xây dựng Detection Engineering team: Rule development, testing, tuning, MITRE ATT&CK coverage
- Triển khai Zero Trust từng bước: Identity → Device → Network → Application → Data
- Upskill team: Cloud security, Automation (Python/Go), Threat Hunting, Cloud-Native tools
- Chọn Platform vendor có ecosystem mở (API, Webhook, Marketplace) tránh vendor lock-in
