| EDR/XDR (Endpoint Detection & Response) | Behavioral Detection, Investigation, Response บน Endpoint | CrowdStrike, SentinelOne, Microsoft Defender for Endpoint, Cortex XDR, Elastic |
| Antivirus / Anti-Malware (NGAV) | Signature + Heuristic + ML + Behavioral | Windows Defender, Bitdefender, Kaspersky, ESET, Malwarebytes |
| Application Control / Whitelisting | Allow Only Authorized Apps (AppLocker, WDAC, Carbon Black) | Microsoft WDAC, AppLocker, Airlock, Centrify |
| Vulnerability Management | Scan, Prioritize, Patch, Report | Tenable.io, Qualys, Rapid7 InsightVM, OpenVAS, Microsoft Defender Vulnerability Mgmt |
| System | Function | ตัวอย่าง |
|---|
| DLP (Data Loss Prevention) | Discover, Monitor, Protect Sensitive Data (PII, PCI, IP) | Forcepoint, Digital Guardian, Symantec, Microsoft Purview, Nightfall |
| Email Security Gateway | Anti-Spam, Anti-Phishing, Sandbox, DMARC, Encryption | Proofpoint, Mimecast, Cisco ESA, Microsoft Defender for Office 365 |
| CASB (Cloud Access Security Broker) | Visibility & Control SaaS Apps (Shadow IT, DLP, Threat Protection) | Netskope, McAfee MVISION, Microsoft Defender for Cloud Apps, Bitglass |
| API Security | Discover, Test, Protect APIs (OWASP API Top 10) | Salt Security, Noname, Traceable, 42Crunch, Wallarm |
6. Specialized / Emerging
- Deception Technology: Honeypots, Honeytokens, Decoys (Attivo, TrapX, Acalvio)
- Threat Intelligence Platform (TIP): Aggregate, Enrich, Share Intel (MISP, OpenCTI, Anomali, ThreatConnect)
- Breach & Attack Simulation (BAS): Automated Continuous Testing (AttackIQ, SafeBreach, Cymulate)
- SBOM / Software Supply Chain Security: Syft, Grype, Cosign, SLSA, Chainguard
Network Security Architecture Models
Traditional: Castle-and-Moat (Perimeter-based)
[Internet] → [Border FW] → [DMZ] → [Internal FW] → [LAN: Flat Network]
ปัญหา: Trust ทุกอย่างภายใน, Lateral Movement ง่าย, ไม่รองรับ Cloud/Remote Work
Modern: Zero Trust Architecture (Never Trust, Always Verify)
[User/Device] → [Identity Provider] → [Policy Engine (PDP/PEP)] → [Resource]
↑ ↑
[Device Posture] [Micro-segmentation]
[Continuous Auth] [Encryption (mTLS)]
[Least Privilege] [Logging/Analytics]
Components: ZTNA, Micro-segmentation, Continuous Verification, Encryption, Analytics
SASE / SSE (Secure Access Service Edge / Security Service Edge)
รวม Network + Security เป็น Cloud Service: SD-WAN + FWaaS + SWG + CASB + ZTNA + DLP
ตัวอย่าง Network Security Stack ตามขนาดองค์กร
| ขนาด | Core Stack | Advanced |
|---|
| SOHO / Small Business (<50 User) | NGFW/UTM (FortiGate/Sophos), Endpoint AV/EDR, Cloud DNS (1.1.1.1), Backup, MFA | VPN, Guest Wi-Fi, Vuln Scan (Nessus Essentials) |
| Mid-Market (50-2000 User) | NGFW HA, NAC (ISE/ClearPass), SIEM (Cloud), EDR, Email Security, Vuln Mgmt, Phishing Sim | NDR, SOAR (Light), ZTNA, Threat Intel Feed, Purple Team |
| Enterprise (>2000 User) | Multi-vendor NGFW, Global NAC, SIEM+SOAR, XDR, NDR, DLP, CASB, API Sec, Deception, BAS | Red Team, Threat Hunt, Custom Detection, Supply Chain Sec, Quantum-Ready Crypto |
เกณฑ์การเลือก Network Security Systems
- Risk Profile & Threat Model: คุกคามอะไร? ค่าข้อมูลเท่าไหร่? Compliance อะไร?
- Integration & Interoperability: API, Syslog, SNMP, STIX/TAXII, OpenTelemetry, Vendor Ecosystem
- Total Cost of Ownership (TCO): License, Hardware, Maintenance, Staff, Training, Renewal
- Scalability & Performance: Throughput, Latency, Concurrent Sessions, Cloud/Hybrid Ready
- Visibility & Analytics: Dashboard, Reporting, ML/AI, MITRE ATT&CK Mapping
- Vendor Viability & Support: Financial Health, Roadmap, Support SLA, Professional Services
- Proof of Concept (PoC): ทดสอบใน Lab/Production Subset ก่อนซื้อ
Open Source / Free Alternatives (Lab / Small Budget)
| Category | Open Source / Free Tools |
|---|
| Firewall | pfSense, OPNsense, IPFire, VyOS, nftables/iptables |
| IDS/IPS/NSM | Suricata, Zeek, Security Onion, Wazuh |
| SIEM | Wazuh, Elastic Stack (ELK), Graylog, OpenSearch |
| NAC | PacketFence, FreeRADIUS + daloRADIUS |
| Vuln Scanner | OpenVAS/Greenbone, Nuclei, Trivy, Grype |
| Endpoint | Windows Defender (Built-in), OSQuery, Velociraptor, LimaCharlie (Free Tier) |
| Threat Intel | MISP, OpenCTI, YARA, STIX/TAXII Libraries |
| Deception | Cowrie (SSH Honeypot), Dionaea, HoneyPy, Canarytokens |
สรุป
Network Security Systems ไม่ใช่ซอฟต์แวร์ตัวเดียว แตเป็น Ecosystem หลายชั้น (Defense in Depth) จาก Perimeter → Network → Endpoint → Data → Application → Cloud → Identity เลือกตาม Risk, Budget, Maturity เริ่มจากพื้นฐาน (FW, EDR, Patch, MFA, Backup) แล้วค่อยเพิ่ม Advanced (SIEM, NAC, ZTNA, NDR, SOAR) เป้าหมาย: Reduce Risk, Detect Fast, Respond Faster, Recover Quickly
