Cybersecurity

Identity, endpoint protection and security operations.

A security product needs a clear account of what it protects and how a customer can use it. Devices, people and applications change; the controls and the team operating them have to keep up.

Sygate Technologies

Sygate developed enterprise endpoint security and network access control technology. Symantec acquired the company in 2005.

Explore Sygate

One access decision

In this access control example, identity and device context inform a policy decision. Enforcement applies that decision at the resource boundary, while a record makes the outcome available for review.

Identity and deviceContext for the request

Policy decisionEvaluate access

Access requestPerson, device or service

EnforcementApply the decision

Protected resourceAccess when allowed

Decision recordApproved and denied

Allow

DenyNo access to the resource

Policy controls access. Both outcomes are recorded, and access can be revoked when conditions change.

Define the scope of protection.

An evaluation needs to explain the situations a product handles and the cases outside its intended scope.

Assets and threats: Identify the systems, information and users being protected. Describe the adversary and failure modes the product is designed to address.
Conditions and dependencies: State the environment, configuration and permissions used in testing. Explain how the product behaves when connectivity, policy updates or other dependencies fail.
Results and limitations: Include missed events, false positives and performance costs. A successful demonstration provides evidence about the conditions tested.

Account for the operating work.

Installation and administration continue after the initial purchase. Security teams need to understand the workload a product adds and the decisions it helps them make.

Consider policy changes, alert review and response alongside detection quality. An alert needs investigation before it can be treated as a confirmed incident.

Useful records make it possible to understand what happened, which decision was taken and what action is required. The people running the product need the access, skills and time to carry out that work.

Evidence a customer can examine

Reproducible tests, clearly described limits and practical deployment requirements make a security claim easier to assess. An introduction should explain the threat, the evidence and how the customer would operate the product.

Preparing an introduction

How to read a security product evaluation

Threat coverage, test conditions and the work behind a purchasing decision.