9 Essential Cyber Security Tools and Techniques

Packet filter: This is the original and most basic type of firewall that cyber security professionals deploy. It inspects packets transferred between computers and permits or denies access based on an access control list. This list tells the firewall what packets need to be investigated and what information should result in a file rejection or deletion. These firewalls are older and cannot fully secure a network on their own, but they are still useful for filtering out low effort cyberattacks.

Connection tracking: Connection tracking firewalls, also known as second generation firewalls, perform work in a way that is similar to first generation packet filters. They perform a similar type of packet inspection, but also record the port number each IP address is using to send and receive information. This allows the exchange of data to be examined in addition to the packet content.

Application/layer 7: Application firewalls are significantly more powerful than connection tracking or packet filter firewalls. They are capable of understanding various applications such as file transfer protocol (FTP), hypertext transfer protocol (HTTP) and domain name system (DNS). This enables them to recognize non-standard ports or unwanted applications. These are also useful on the internet thanks to their ability to perform web filtering.

Behavior-based detection: This is a powerful type of software that implements technology like machine learning algorithms to identify malware through an active approach. Instead of examining how the malware looks, it focuses on how it behaves in order to stamp it out more quickly.

Sandboxing: Sandboxing is a feature that places dangerous software in an isolated location. It can filter files out before they can cause damage to the system at large. Once isolated, the anti-malware can delete the dangerous software.

Signature-based detection: Signature-based detection is most useful for eliminating common malware such as adware and keyloggers. It uses signature detection to identify common malware and delete it. Once it has eliminated a piece of malware, it will remove all types of malware bearing that same signature automatically.

John the Ripper is a tool used to test the strength of passwords quickly and efficiently, to minimize the likelihood of a weak password putting a network at risk.

Hashcat is a password-cracking tool used by penetration testers and system administrators. Password hashing is a method of protecting passwords by converting them into a series of random characters, known as a hash (this process is different from encryption, which is used to conceal information). The software essentially guesses a password, hashes it and compares the hash to the one it’s trying to crack.

Wireshark is a console-based cyber security tool (previously known as Ethereal) used to study network protocols and analyze network security in real time.

Tcpdump is a network data packet-sniffing program used by cyber security pros to monitor and log TCP (Transmission Control Protocol) and IP (Internet Protocol) traffic that passes across a computer network.

Snort is an open-source intrusion protection system that can be used as a packet sniffer (like tcpdump), as a packet logger, or as a fully deployed network intrusion prevention system. This program can be downloaded and configured for either business or personal use.

SNMP: The Simple Network Management Protocol uses a call and response system to check the status of devices such as switches and printers, and can be used to monitor system status and configuration.

ICMP: Routers, servers and other network devices use the Internet Control Message Protocol to send IP operations information and generate messages when devices fail.

Cisco Discover Protocol: This protocol facilitates management of Cisco devices by discovering them, determining how they are configured and allowing systems using different network-layer protocols to learn about one another.

ThousandEyes Synthetics: An internet-aware synthetic monitoring system that detects modern networked application performance issues.

Acunetix: This web vulnerability scanner features advanced crawling technology that enables it to uncover vulnerabilities to search every type of web page, even pages that are password protected.

Nessus: Downloaded more than 2 million times worldwide, Nessus provides thorough coverage and scans for more than 59,000 common vulnerabilities and exposures (CVEs).

Burp Suite: With multiple scanning, integration and reporting features, Burp Suite is a vulnerability scanner that integrates with bug tracking systems like Jira and is frequently updated.

GFI Languard:  A vulnerability scanner for network and web applications that can automatically deploy patches across operating systems, web browsers and third-party applications.

Tripwire IP360: A scalable vulnerability scanning tool that can scan an organization’s total environment, including previously-undetected assets.

Network-based: These IDPS technologies monitor network traffic for particular network segments or devices and analyze the network and application protocol activity to identify suspicious activities.

Wireless: Wireless IDPS technologies monitor and analyze traffic on wireless networks to identify suspicious activity involving wireless networking protocols.

Network behavior analysis (NBA): NBA examines network traffic to identify threats generating unusual traffic flows, such as distributed denial of service (DDoS) attacks or certain forms of malware.

Host-based: Host-based IDPS technologies monitor the characteristics of a single host (a PC or server, for example) and the events occurring within that host for suspicious activity.

Triple DES: Strengthening the original DES (Data Encryption Standard), which was established in 1977 and is now considered too weak to protect sensitive data, Triple DES runs encryption 3 times – encrypting, decrypting and encrypting again.

RSA: Taking its name from the initials of its 3 computer scientist inventors (Rivest, Shamir and Adleman), RSA uses a strong and widely used algorithm for encryption. It is popular because of its key length and commonly used for secure data transmission.

Advanced Encryption Standard (AES): Used worldwide, AES has been the U.S. government standard since 2002.

TwoFish: This free encryption software is used in hardware and software. It is considered to be one of the fastest encryption algorithms.