Cybersecurity Fundamentals

You’ve got questions. We’ve got answers. Browse through a comprehensive overview of popular security technologies, processes, and solutions. Stay up-to-date on the latest industry standards and best practices.

All Topics

Filter by Category

Search Topics

XDR vs. MDR: What are the Differences?The enterprise cybersecurity market has a great variety of solutions for detecting and responding to advanced threats. Many of these solutions share similar names, making it difficult to pinpoint their capabilities and use cases. Managed Detection and Response (MDR) and Extended Detection and Response (XDR) are a good example. These two distinct solutions are not […]

What is User Entity and Behavioral Analytics (UEBA)?User Entity and Behavioral Analytics In 2015, Gartner defined the User Entity and Behavioral Analytics (UEBA) category of security technologies. UEBA has gone on to become a critical element of the modern security tech stack, providing organizations with the ability to detect unknown threats and insider attacks. Before UEBA, security teams used User Behavior Analytics […]

What is Trojan Horse Malware?Trojans are a specific type of malware that infects the target device by disguising itself as a legitimate application. Like the mythical Trojan Horse described in Homer’s Odyssey, it infiltrates the system by pretending to be something it is not. In the original story, the Greeks hid inside a giant wooden horse after failing to […]

What is the Gartner Magic Quadrant for MDR?The Gartner Magic Quadrant is a market research report that divides technology providers into four categories: Leaders, Challengers, Visionaries, and Niche Players. This report helps IT leaders compare different vendors according to their core values. As of 2024, Gartner publishes a Market Guide for MDR services, but it does not have a dedicated Magic Quadrant […]

What is SQL Injection?SQL injection is a cyberattack that exploits vulnerabilities in SQL databases. Hackers use SQL injection to expose and modify sensitive data without authorization. In some cases, attackers can use this tactic to steal login credentials and gain general access to protected systems. As one of the most popular programming languages in the world, SQL is […]

What is Spyware? Spyware is a type of malware designed to gather data on users, devices, and networks. It then sends this data to a third party without the victim’s knowledge or consent. There are many different types of spyware. Some collect relatively low-value data to send to advertisers and data brokers. Others focus on highly sensitive information […]

What is SOAR in Cybersecurity?Security Orchestration, Automation, and Response (SOAR) is a technology that helps security teams coordinate incident response actions. It eliminates many of the repetitive, time-consuming manual tasks involved in investigating security events, and enables automation between different security tools. Without SOAR, security professionals must manually investigate suspicious events. That means using multiple tools—often more than 40—to […]

What is SIEM?Security information and event management (SIEM) is a technological approach to monitoring and analyzing security event data. SIEM platforms enable continuous, real-time monitoring of security events while tracking and logging security data in a centralized location. Modern SIEM platforms form the foundation of successful Security Operations Centers (SOCs). The ability to gather security event logs […]

What is SIEM in Cybersecurity?Cybersecurity involves three different components. Prevention, detection, and response processes each have a role to play keeping sensitive assets safe from threat actors. Security Information and Event Management (SIEM) is a detection technology that also informs prevention and response workflows. SIEM (often pronounced “sim”) platforms collect logs and network data from across your IT environment. […]

What is Ransomware? What is ransomware? Ransomware is a type of malware designed to give cybercriminals leverage over victims by holding their data hostage. Most forms of ransomware do this by encrypting sensitive or mission-critical data. This renders the data unusable until the victim obtains a decryptor tool from the cybercriminal group responsible. In a typical ransomware attack […]

What is Privilege Escalation?Privilege escalation is an attack technique that gives threat actors unauthorized access to higher-level permissions within a network or system. Granting malicious insiders higher permissions enables them to launch attacks, disable security policies, and cover their tracks more successfully. How privilege escalation works Most privilege escalation attacks rely on exploiting a vulnerability that allows a […]

What is Network Detection and Response?Discover how security teams leverage network traffic data to identify threats that other tools can’t see Network detection and response enables security teams to monitor network traffic for signs of unauthorized behavior. When threat actors conduct sophisticated systemwide attacks or engage in lateral movement between subnetworks, they leave traces that network traffic monitoring can detect. […]

What is Mean Time-to-Respond (MTTR)?Mean time-to-respond (MTTR) is the average time it takes to achieve system recovery after a failure or cyberattack. It is calculated from the moment the issue is first detected to the moment normal operations can resume. MTTR doesn’t take into account the period of time that a problem remains undetected on the network. A different […]

What is Mean Time-to-Detect?Mean time-to-detect (MTTD) measures the amount of time it takes for an organization to discover a security incident. The lower this metric is, the faster and more reliable its detection systems are. Early detection makes a significant difference in the overall cost of incident response. Introduction to Mean Time-to-Detect (MTTD) As a strategic key performance […]

What is Managed Detection & Response (MDR)?In today's digital landscape, where cyber threats are becoming increasingly sophisticated and prevalent, organizations need robust cybersecurity measures to protect their assets and data. Managed Detection and Response (MDR) is a crucial component of any comprehensive cybersecurity strategy. This webpage aims to provide an overview of MDR, its importance, key features, and benefits. What is […]

What is malware?What is malware? Any software designed with malicious intent is malware. It’s a broad category that includes ransomware, spyware, computer viruses, and more. Malware is intentionally created to harm computer systems, making malware attacks distinct from cyberattacks that exploit vulnerabilities in legitimate software. The vast majority of modern cyberattacks involve malware to some degree. Intentionally […]

What is Log Management?Log management is the process of continuously collecting, storing, and analyzing log data from across the organization’s tech stack. Organizations with excellent log management capabilities are more efficient and secure than those without. What are logs? Logs are computer-generated files that describe system or application activity. Most software tools can generate logs, providing IT teams […]

What is Lateral Movement?Lateral movement is a threat actor attack technique that expands their access to multiple hosts and applications in an organization. After attackers compromise an endpoint, they may use lateral movement to maintain persistence in the network and gain access to higher-value assets and data. Instead of launching a cyberattack the moment they gain initial access […]

What is Endpoint Detection and Response (EDR)?Find out how secure organizations protect their endpoints from sophisticated threats. Every organization uses endpoints as an interface between users and network assets. Endpoint Detection and Response (EDR) platforms continuously monitor these end-user devices to detect threats and launch coordinated responses to them. Endpoint devices include everything from mobile phones, tablets, desktop computers, virtual machines, […]

What is Double Extortion?Double extortion is a type of ransomware attack. In this scenario, threat actors hold an organization’s data hostage and demand payment. The ransom amount can vary widely, and threat actors are more likely to demand very high sums—millions of dollars and up—if they believe their victim has no other choice but to comply. Typically, a […]

What is Data Exfiltration?Data exfiltration is the unauthorized transmission of data from an IT asset to an external destination. This includes removing data from endpoints, cloud applications, or even physical on-premises media. Hackers can use this data to gain leverage over their victims and conduct extortion attacks. Data exfiltration is a critical security risk because data breaches can […]

What is an Insider Threat?Insider threats are a type of cybersecurity risk caused by users with authorized access to the organization’s network, applications, or infrastructure. These threats can be incredibly difficult to detect and address because they already have the appropriate credentials. Security teams monitoring insider risk can’t rely on traditional security tools. These tools rely on assumptions that […]

What is a Zero-Day Exploit?Security professionals use the word “zero-day” to refer to unknown security weaknesses. Since these weaknesses are unknown, security researchers have had zero days to prepare a response. When security teams encounter a known threat, they can rely on the collected experience of a worldwide network of security researchers when responding to it. They may already […]

What Is a Phishing Attack?Phishing attacks are a common cyber threat that abuses digital communication platforms to deceive victims. Attackers impersonate trusted authority figures through email, SMS messages, phone calls, and other media to convince their victims to give up financial information, login credentials, or some other kind of sensitive data. Phishing attacks are closely related to social engineering, […]

What is a Managed Service Provider (MSP)?Managed service providers (MSPs) help organizations extend their IT and information security capabilities. By working with an MSP, organizations bypass the need to pursue costly in-house technology implementations. They gain access to specialist expertise they might not otherwise be able to find, allowing the company to focus on its core value. Several different types of […]

What is a Man-in-the-Middle Attack?Man-in-the-middle attacks are a type of cyberattack where threat actors secretly intercept communications between two parties. The threat actor can read, modify, or withhold information traveling between the two, and use the information they learn for malicious purposes. Cybercriminals use man-in-the-middle attacks to obtain sensitive data and to abuse the authority of the services they […]

What is a Denial of Service Attack (DoS)?Denial of Service (DoS) attacks overwhelm systems and networks with fraudulent requests. Threat actors launch these attacks to prevent users from performing routine tasks, like accessing their email or interacting with web-hosted content. In most cases, DoS attacks do not directly result in data loss. Usually, the goal of the attack is simply to disrupt […]

What is a Dark Web Leak Site?Dark web leak sites are specialized websites and e-commerce marketplaces that cybercriminals use to illegally share sensitive data. These websites allow threat actors to publish stolen data while preventing law enforcement agencies from easily identifying them. Some allow cybercriminals to buy and sell data, often using cryptocurrency. What is the Dark Web? The Dark Web […]

What is a Brute Force Attack?Brute force attacks use trial-and-error to infiltrate secure accounts and IT assets. They are most commonly used to breach passwords and login credentials, though they can also be used against encryption keys. Although the concept is simple, threat actors have developed sophisticated strategies for carrying out brute force attacks effectively. How do brute force attacks […]

What are Indicators of Compromise (IOCs)?What are Indicators of Compromise (IOCs?) Every action that a user, asset, or application makes on your network leaves a trace of some kind. Security practitioners use digital forensics to piece together evidence and understand how threat actors work. Each individual piece of evidence connected to a particular security incident is called an indicator of […]

The Modern Security Operations Center (SOC) Explained Your organization's security operations team performs a vital role protecting users, applications, and assets from cyberattack. It uses a variety of highly specialized tools to monitor for signs of unauthorized activity and investigate security events when they occur. Specialist security tools require specialist expertise. Centralizing security workflows in a single facility makes it easier and […]

The Benefits of SOAR for your Business Security Orchestration, Automation, and Response (SOAR) technology helps organizations coordinate security activities across complex environments. It connects people and security tools together through a consolidated platform designed for incident response. Without SOAR, security teams must navigate multiple security tools and dashboards to execute incident response actions. They must take many of these actions manually, and […]

The Benefits of MDR for your Business Business leaders are increasingly under pressure to protect sensitive data from opportunistic cybercriminals. The average cost of a data breach continues to increase every year—nearly $10 million in the US as of 2024. Organizations need a comprehensive multi-layered security posture supported by best-of-breed technologies. There are two broad ways to achieve that. Either you build […]

The 5 Most Important Incident Response Metrics Avoiding preventable downtime is one of the main goals every security team shares. In scenarios where a single minute of downtime can cost thousands of dollars, keeping systems running smoothly is a core business value. Incident response plays a significant role in contributing to that goal. The more consistent and reliable your organization’s incident management […]

SOAR vs SIEM: Which Security Technology is the Better Choice?Cross-platform security operations are a vital element of enterprise cybersecurity. Your organization has many different tools and data sources as its disposal. Reliably detecting and responding to threats means using all of them in concert. Both Security Orchestration, Automation, and Response (SOAR) and Security Information and Event Management (SIEM) tools help achieve this broad goal, […]

SOAR Solution Evaluation Criteria Security Orchestration, Automation, and Response (SOAR) platforms help security teams act quickly when cybercriminals threaten critical assets and data. By aggregating data and enabling automated incident response, SOAR reduces key performance metrics like Mean Time-to-Respond (MTTR). However, security leaders have many choices when it comes to implementing SOAR technology. Some SOAR platforms are standalone solutions […]

SIEM vs Log Management: How to Use Event Logs in the SOC Event logs play a vital role enabling security monitoring, detection, and investigation. The ability to collect and analyze logs efficiently is a cornerstone of the modern Security Operations Center (SOC). Many SOCs deploy Security Information and Event Management (SIEM) solutions to gather log data and analyze it for security operations. Log management tools also collect […]

SIEM Solution Evaluation Criteria Security Information and Event Management (SIEM) platforms play a central role in modern enterprise cybersecurity. These platforms collect log data from across the organization and correlate activities to detect threats in real-time. SIEM implementation is among the most complex undertakings an organization can attempt. As a security leader, you’re under a great deal of pressure […]

Obtaining Buy-in: How to Explain the Benefits of SIEM To Business Leaders Security Information and Event Management (SIEM) platforms continuously track and correlate log data in your IT environment. This gives them a role of central importance in risk management, compliance reporting, and incident response. Without SIEM, detecting and investigating threat activity is a difficult process. Your first warning of unauthorized activity will come from a single […]

MDR vs. MSSP: Two Different Approaches to Managed Security In-house cybersecurity operations don’t scale as readily as IT leaders need them to. Building and staffing your own Security Operations Center (SOC) is a complex, expensive, and time-consuming project. For small businesses, such a major investment is out of the question—but even the largest enterprises also find value in delegating security operations to managed service […]

MDR vs EDR: Two Cybersecurity Fundamentals Explained Detecting and responding to threat activity is a cornerstone of a successful cybersecurity strategy. Your approach to detection and response can have a large impact on your overall security posture. Both Managed Detection and Response (MDR) and Endpoint Detection and Response (EDR) address this need, but in different ways. What is Managed Detection and Response […]

Introduction to Incident Response: The Definitive Guide Preventing cyberattacks and data breaches is a major part of every organization’s information security strategy. However, even the best prevention-based approach won’t work 100% of the time. Security leaders must be prepared to detect and respond to security incidents at any moment. What is incident response? Incident response is the coordinated process by which security […]

Incident Response Frameworks Explained The incident response process is necessarily a reactive one. You can only respond to an incident once it has been detected. This makes it difficult to predict or optimize incident response outcomes. If an organization has never experienced a ransomware attack, how will it know when it’s ready to face one? Incident response frameworks enable […]

How to Develop a Future-proof Incident Response Plan Your organization's incident response plan describes exactly how it will restore normal operations after a security incident. It provides a flexible plan for detecting and responding to multiple types of incidents, clearing infected devices of malware, and mitigating cyber attack risks. Effective incident response plans minimize the amount of ad hoc improvisation that goes into […]

Comparative Analysis of Leading SIEM Tools in the Market Implementing a Security Information and Event Management (SIEM) solution can dramatically improve your ability to detect, investigate, and respond to threat activity. But not every SIEM offers the same features and capabilities to users. The right SIEM for your organization must fit the capabilities and expertise provided by your Security Operations Center (SOC). It must […]

10 Essential Features of a SIEM Solution Your Security Information and Event Management (SIEM) solution forms the foundation of your detection and response workflow. A full-featured SIEM helps security analysts detect potential threats, investigate suspicious events, and coordinate incident response effectively. Legacy SIEM solutions enable security teams to gather log data from across the organization and correlate events according to pre-configured detection […]

Solutions

Use Cases

Industries

Security Operations Center

Knowledge Center

Our Partners

Company

Certification

SOC 2 Type 2

Cybersecurity Fundamentals

All Topics

Filter by Category

Search Topics

📣 Announcing:

Lumifi Acquires Critical Insight

Solutions

Use cases

PARTNERS

KNowledge Center

COMPANY