7 terms
DDoS mitigation is the set of techniques that detect and absorb distributed denial-of-service traffic so services stay available during an attack.
EDR (endpoint detection and response) records activity on laptops and servers, detects malicious behavior and lets defenders isolate and fix hosts.
A firewall is a network security control that allows or blocks traffic between zones according to a rule set, forming the core of infrastructure defense.
An IDS, intrusion detection system, monitors network traffic or host activity for signs of attacks and policy violations and raises alerts for investigation.
An IPS (intrusion prevention system) inspects network traffic inline and blocks packets or sessions that match attacks before they reach targets.
SIEM is the security platform that collects, normalizes and correlates logs across an organization to detect threats, aid investigations and meet audit needs.
A WAF, or web application firewall, inspects HTTP traffic to block attacks such as SQL injection and XSS before they reach a web application.