> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Security tools and vulnerability management
> Explore the toolkit cybersecurity professionals use to find vulnerabilities and defend systems.
## The defender's toolkit
Cybersecurity professionals don't fight threats with guesswork - they use a range of specialized tools to find vulnerabilities, detect attacks, and respond to incidents. This page covers the most important tools in a defender's arsenal, how vulnerabilities are scored and tracked, and what security features are already built into the operating systems you use every day.
You don't need to memorize every tool on this page. Focus on understanding what each category of tool does and when you would use it. That's what matters in the real world.
## Security appliances and tools
### Vulnerability scanners
**What they do:** Automatically scan systems, networks, and applications for known weaknesses - missing patches, misconfigurations, default passwords, and known software flaws.
**When you use them:** Before attackers find the holes. Security teams run vulnerability scans regularly (weekly, monthly, or after every change) to identify problems before they're exploited.
**Example products:**
* **Greenbone (OpenVAS)** - Open-source network vulnerability scanner
* **Nessus** - Industry-standard vulnerability scanner by Tenable
* **Burp Suite** - Web application vulnerability scanner (finds SQL injection, XSS, etc.)
Think of a vulnerability scanner like a home inspector. They walk through your house and write a report of everything that needs fixing - leaky pipes, cracked foundations, unlocked windows. You still have to fix the problems, but at least you know where they are.
### Antivirus / anti-malware
**What they do:** Detect, quarantine, and remove malicious software (malware) from computers and servers. Modern antivirus tools use signature-based detection (matching known malware patterns) and behavioral analysis (watching for suspicious activity).
**When you use them:** Always. Antivirus runs continuously in the background on every endpoint - laptops, desktops, and servers.
**Example products:** Windows Defender, Malwarebytes, CrowdStrike Falcon, Sophos
### Firewalls
**What they do:** Filter network traffic based on predefined rules. Firewalls decide what traffic is allowed into and out of your network.
**Analogy:** A firewall is like a **bouncer at a club**. The bouncer checks IDs (source/destination IP, port, protocol) and only lets in people who are on the list. Everyone else gets turned away at the door.
**Types:**
| Type | Description |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Network firewall** | Sits at the network perimeter, filters traffic between networks |
| **Host-based firewall** | Runs on an individual computer, filters traffic for that specific device |
| **Next-generation firewall (NGFW)** | Adds application awareness, intrusion prevention, and deep packet inspection on top of traditional filtering |
**Example products:** Palo Alto Networks, Cisco ASA, pfSense, Windows Firewall
### IDS - Intrusion Detection System
**What it does:** Monitors network traffic and system activity for suspicious behavior, then **alerts** security teams. An IDS watches and reports - it does not block anything.
**Analogy:** An IDS is like a **security camera**. It records everything and notifies you when something looks wrong, but it can't physically stop an intruder.
**Types:**
* **NIDS (Network-based):** Monitors network traffic for suspicious patterns
* **HIDS (Host-based):** Monitors a single computer for suspicious file changes, processes, or log entries
**Example products:** Snort, Suricata, OSSEC
### IPS - Intrusion Prevention System
**What it does:** Monitors network traffic and system activity for suspicious behavior, then **blocks** the threat automatically. An IPS watches AND acts.
**Analogy:** An IPS is like a **security guard**. They don't just watch - they physically stop the intruder from entering.
The key difference between IDS and IPS is the response. IDS **detects and alerts**. IPS **detects, alerts, and blocks**. Many modern security appliances combine both functions.
### SIEM - Security Information and Event Management
**What it does:** Collects logs from every device, server, application, and security tool across the organization, stores them in one place, correlates events across sources, and generates alerts when suspicious patterns emerge.
**Why it matters:** Without a SIEM, security teams would have to manually check logs on hundreds of individual systems. A SIEM aggregates everything into a single dashboard, makes patterns visible, and can trigger automatic alerts.
**What it looks like in practice:**
1. The firewall logs a blocked connection from a suspicious IP
2. The email server logs a phishing email received by an employee
3. The antivirus logs a malware detection on that employee's laptop
4. The SIEM **correlates** all three events and generates a high-priority alert: "Possible phishing attack - malware delivered via email, attacker attempted network access"
**Example products:** Splunk, Elastic (ELK Stack), IBM QRadar, Microsoft Sentinel
Splunk is one of the most widely used SIEMs in the industry. You'll encounter it in Day 4 when discussing incident response and log analysis.
### SOAR - Security Orchestration, Automation and Response
**What it does:** Automates incident response workflows. When a SIEM detects a threat, SOAR can automatically execute a response - isolate a compromised machine, block an IP address, send alerts to the team, and create an incident ticket - all without human intervention.
**Why it matters:** Security teams are overwhelmed with alerts. SOAR handles repetitive, time-sensitive responses so analysts can focus on complex investigations.
**Example products:** Palo Alto XSOAR, Splunk SOAR, IBM Resilient
### DLP - Data Loss Prevention
**What it does:** Prevents sensitive data from leaving the organization. DLP monitors emails, file transfers, USB drives, and cloud uploads for sensitive content (credit card numbers, Social Security numbers, medical records, trade secrets) and blocks unauthorized transfers.
**Example scenario:** An employee tries to email a spreadsheet of customer credit card numbers to their personal Gmail account. DLP detects the credit card numbers in the file and blocks the email.
**Example products:** Symantec DLP, Microsoft Purview, Digital Guardian
### FIM - File Integrity Monitoring
**What it does:** Tracks changes to critical files and alerts you when something is modified. If an attacker alters a system configuration file, replaces a binary, or modifies a web page, FIM detects the change.
**Example scenario:** An attacker gains access to a web server and modifies the login page to capture passwords. FIM detects the change to the login page file and alerts the security team.
**Example products:** Tripwire, OSSEC, SolarWinds
### UBA - User Behavior Analytics
**What it does:** Establishes a baseline of normal behavior for each user, then detects anomalies. If a user who normally logs in from Virginia at 9 AM suddenly logs in from Russia at 3 AM and downloads 10 GB of files, UBA flags this as suspicious.
**Example scenario:** An employee's account is compromised via phishing. The attacker logs in after hours and accesses files the employee has never touched before. UBA detects the anomalous behavior and alerts the SOC (Security Operations Center).
**Example products:** Microsoft Sentinel UEBA, Exabeam, Securonix
## How the tools work together
In a real Security Operations Center (SOC), these tools don't work in isolation. They form a connected pipeline:
```
Vulnerability Scanner → finds weaknesses
Firewall → blocks known bad traffic
IDS/IPS → detects/blocks suspicious activity
Antivirus → catches malware on endpoints
FIM → detects unauthorized file changes
UBA → spots anomalous user behavior
↓ (all logs flow to)
SIEM → correlates events, generates alerts
↓
SOAR → automates response actions
↓
DLP → prevents data from leaving
```
## CVSS - Common Vulnerability Scoring System
When a vulnerability is discovered, security professionals need a way to measure how dangerous it is. **CVSS** provides a standardized severity score from 0.0 to 10.0.
### Score ranges
| Score | Severity | What it means |
| -------------- | -------- | -------------------------------------------------------------------- |
| **0.0** | None | Informational, no real risk |
| **0.1 - 3.9** | Low | Minor vulnerability, difficult to exploit or low impact |
| **4.0 - 6.9** | Medium | Moderate risk, should be patched during regular maintenance |
| **7.0 - 8.9** | High | Serious vulnerability, prioritize patching |
| **9.0 - 10.0** | Critical | Severe vulnerability, patch immediately - active exploitation likely |
### What the score considers
CVSS scores are calculated based on several factors:
**How does the attacker reach the vulnerability?**
* **Network:** Exploitable remotely over the internet (most dangerous)
* **Adjacent:** Requires access to the local network (e.g., same Wi-Fi)
* **Local:** Requires access to the device itself
* **Physical:** Requires physical contact with the hardware
**How difficult is the exploit to execute?**
* **Low:** Easy to exploit, no special conditions needed
* **High:** Requires specific conditions, timing, or knowledge
**Does the attacker need an account or special access?**
* **None:** No authentication needed (worst case)
* **Low:** Requires a basic user account
* **High:** Requires admin/root access
**Does the victim need to do something (like click a link)?**
* **None:** No user interaction needed (worst case)
* **Required:** Victim must perform an action (e.g., open a file, click a link)
**What happens if the vulnerability is exploited?** Measured across three dimensions:
* **Confidentiality:** Can the attacker read data they shouldn't?
* **Integrity:** Can the attacker modify data they shouldn't?
* **Availability:** Can the attacker disrupt the system?
## CVE - Common Vulnerabilities and Exposures
**CVE** is a standardized naming system for known vulnerabilities. Every publicly disclosed vulnerability gets a unique CVE ID so that security professionals worldwide can refer to the same vulnerability with the same name.
### CVE format
```
CVE-YEAR-NUMBER
```
**Example:** `CVE-2021-44228` - this is the famous **Log4Shell** vulnerability in the Apache Log4j logging library. It scored a 10.0 on CVSS (the maximum) and was one of the most critical vulnerabilities in internet history.
### Where to look up CVEs
| Resource | URL | What it provides |
| -------------- | -------------- | ---------------------------------------------------------------------------------- |
| **NIST NVD** | nvd.nist.gov | Full vulnerability database with CVSS scores, references, and remediation guidance |
| **MITRE CVE** | cve.mitre.org | The official CVE numbering authority - assigns CVE IDs |
| **Exploit-DB** | exploit-db.com | Database of published exploits for known CVEs |
When a new CVE is published, it's a race between defenders patching and attackers exploiting. Critical CVEs (9.0+) should be patched within hours, not days. The Log4Shell vulnerability was actively exploited within hours of public disclosure.
## Operating system built-in security
You don't always need to buy third-party tools. Every major operating system ships with built-in security features. Knowing what's already available helps you use it.
| Feature | What it does |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| **Windows Defender** | Built-in antivirus and anti-malware. Runs real-time scans and provides threat protection. |
| **BitLocker** | Full-disk encryption. If someone steals your laptop, they can't read the hard drive without your recovery key. |
| **Windows Firewall** | Host-based firewall. Filters incoming and outgoing network traffic on the device. |
| **User Account Control (UAC)** | Prompts you for permission before allowing programs to make system-level changes. Prevents malware from silently installing itself. |
| **Windows Hello** | Biometric authentication (fingerprint, facial recognition) for secure login. |
| Feature | What it does |
| ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Gatekeeper** | Blocks apps that haven't been signed by identified developers or approved by Apple. Prevents you from running untrusted software. |
| **FileVault** | Full-disk encryption. Encrypts your entire startup disk so data is unreadable without your password. |
| **XProtect** | Built-in anti-malware that runs silently in the background. Checks apps against a known malware signature database. |
| **System Integrity Protection (SIP)** | Prevents even the root user from modifying protected system files. Stops malware from tampering with the OS. |
| **Touch ID / Face ID** | Biometric authentication for secure login and Apple Pay. |
| Feature | What it does |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **SELinux** | Security-Enhanced Linux. Enforces mandatory access controls that limit what each process can access, even if it's running as root. |
| **AppArmor** | Application-level access control. Restricts individual programs to a limited set of resources. |
| **iptables / nftables** | Built-in firewall tools. Define rules for which network traffic is allowed or blocked. |
| **File permissions** | Linux uses owner/group/other read/write/execute permissions on every file and directory. Proper permissions are a foundational security control. |
| **LUKS** | Full-disk encryption for Linux. Encrypts partitions so data is unreadable without the passphrase. |
| Feature | What it does |
| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **App sandboxing** | Each app runs in its own isolated environment and can't access other apps' data without explicit permission. |
| **Biometric authentication** | Fingerprint and facial recognition for unlocking the device and authorizing payments. |
| **Encrypted storage** | Both Android and iOS encrypt all data on the device by default. If the phone is lost or stolen, data is unreadable without the PIN/biometric. |
| **App store review** | Both Google Play and the Apple App Store review apps before publishing to catch malicious software. |
| **Remote wipe** | If your phone is lost or stolen, you can remotely erase all data from it. |
## Daily security operations
Security isn't a one-time project - it's an ongoing operation. Here's what a typical day looks like in a Security Operations Center (SOC):
Collect logs from all systems - firewalls, servers, endpoints, applications, cloud services. Everything flows into the SIEM.
Review the alerts generated by the SIEM, IDS/IPS, and other tools. Determine which alerts are real threats and which are false positives.
Run scheduled scans against internal and external systems. Review new findings, compare against known CVEs, and prioritize remediation.
Apply security patches to operating systems, applications, and firmware. Critical patches are applied immediately; others follow a scheduled cycle.
Investigate and respond to any confirmed security incidents. Follow the incident response framework (you'll learn PICERL on Day 4).
Generate reports on security posture, incidents, and vulnerabilities. Archive logs for compliance and forensic analysis. Most regulations require logs to be retained for 1-7 years.
A SOC analyst's job is often described as "finding the needle in the haystack." With millions of log entries per day, the tools on this page are what make it possible to find the one event that matters.
## Key takeaways
* Security professionals rely on a layered toolkit - vulnerability scanners, firewalls, IDS/IPS, SIEM, SOAR, DLP, FIM, and UBA all work together.
* **CVSS** scores vulnerabilities from 0.0 to 10.0 based on how exploitable they are and how much damage they cause.
* **CVE** IDs give every known vulnerability a unique, standard name so the entire industry can communicate clearly.
* Every operating system has built-in security features - use them.
* Security is an ongoing operation, not a one-time setup. Daily log review, scanning, patching, and alerting are the heartbeat of any SOC.