Quick answer: The five defensive tools in this SEVN-X discussion are MFA, EDR, email filtering, NAC, and honeypots. Their value comes from how they are deployed and operated together.
Watch the original 2023 discussion
These 5 tools made our "We Love to Hate" list in 2023. Matt Barnett, CEO at SEVN-X explains why you should be implementing these tools in your environment.
Our list consists of:
- Multifactor Authentication (MFA)
- Endpoint Detection & Response (EDR)
- Email Filtering
- Network Access Control (NAC)
- Honeypots
What each control adds
- MFA: adds a verification factor beyond a password. Favor phishing-resistant methods where supported.
- EDR: provides endpoint visibility and response capabilities. Establish who investigates its alerts.
- Email filtering: reduces unwanted and malicious messages reaching users, while requiring a process for reporting what gets through.
- NAC: applies policies to which devices can join a network and what access they receive.
- Honeypots: create monitored decoys that can help surface suspicious interaction. Deploy them with clear ownership and isolation.
Validate the operating model
Ask three questions for every tool: Which assets are covered? Who responds to an alert? What evidence shows the control works? A product inventory alone cannot answer them.
Frequently asked questions
Which five tools are covered in the video?
The video covers multifactor authentication, endpoint detection and response, email filtering, network access control, and honeypots.
Do these tools guarantee that an attacker cannot get in?
No. Coverage, configuration, monitoring, and the response process determine how useful a control is. Validate the controls together through authorized testing.
