Cyber Security
Tools
Embedded Files
5 Day(s)
🎯 LEARNING OBJECTIVES
By the end of this lecture, you will be able to:
Understand the purpose and role of cybersecurity tools in protecting systems, networks, and applications.
Classify security tools by their capabilities, including network analysis, vulnerability scanning, penetration testing, and security monitoring.
Select appropriate tools for identifying vulnerabilities, analyzing traffic, and assessing application security.
Understand how tools such as Wireshark, Nmap, OWASP ZAP, and SIEM platforms support security operations.
Interpret tool outputs and use findings to recommend practical security improvements.
Apply cybersecurity tools responsibly in authorized environments and controlled labs.
🧠 PREREQUISITES
Learners should have:
Basic knowledge of software engineering and the Software Development Life Cycle (SDLC).
Fundamental programming skills and familiarity with at least one programming language.
Basic understanding of databases and application development.
Familiarity with software requirements and system design concepts.
Basic awareness of project management, teamwork, and version control tools such as Git.
A general understanding of how software applications solve business or user problems.
Lecture 14: Security Tools
1.Firewall Tools:
1.Firewall Tools:
Palo Alto Networks NGFW
Fortinet FortiGate
Cisco ASA/Firepower
2.IPS Tools: Intrusion prevention system
2.IPS Tools: Intrusion prevention system
Palo Alto Networks Threat Prevention
Cisco Firepower IPS
Check Point IPS
3.IDS Tools: Intrusion detection system
3.IDS Tools: Intrusion detection system
Snort
Suricata
Trend Micro IDS
4.SAST Tools:
4.SAST Tools:
SonarQube
Fortify Static Code Analyzer (by OpenText)
GitHub Advanced Security (CodeQL):
Reshift: Focus on JavaScript & TypeScript, CI-first SAST for modern web apps
5.DAST Tools:
5.DAST Tools:
Burp Suite Pro: Most used, strong for manual + semi-auto DAST, ⭐ 1–3
Acunetix: Highly automated, user-friendly, fast scanning, good for devs, ⭐ 1–3
Netsparker (by Invicti): Same vendor as Acunetix, better for enterprise use
OWASP ZAP: Open-source, strong community, good for small teams, Top 5
AppScan (HCL): Strong in regulated sectors, enterprise-level, Top 5
Qualys WAS: Scales well, part of Qualys suite
6.Simulation Sites:
6.Simulation Sites:
7.EDR:
7.EDR:
What is EDR?
What is EDR?
EDR stands for Endpoint Detection and Response: tools that manage enterprise assets, detect abnormal behavior, and can enforce actions and policies to maintain a secure environment, so it's not only about antivirus; it's fully managed services for the environment.
Key Benefits:
Key Benefits:
Endpoints data collection
Data analysis
Automated response
Threat investigation
Integration with security infrastructure
EDR governance rules:
EDR governance rules:
In order to have successful and smooth implementation of the EDR platform, you need to establish the following practices to mitigate risks and eliminate management overheads:
Install the agent on all machines before delivery to employees
Enable Tamper protection: Prevent setting modification
Restrict local admin
Define risk-based policies
Monitor powershell activities
Monitor Registry modifications
Control USB usage
Integrate with SEIM
Auto-agent update
Auto-Anti virus update
Auto-OS Update
Reports review
Define KPIs
Conduct Monthly EDR health and coverage
EDR Tools
EDR Tools
Sophose Intercept X
Microsoft Defender
CrowdStrike Falcon Pro/Enterprise
EDR KPIs
EDR KPIs
Endpoint Coverage: > 98%
Agent Health Status: > 99%
Mean Time to Detect (MTTD): < 15 min
Mean Time to Respond (MTTR): < 1 hour
False Positive Rate: < 10%
Endpoints with Latest Agent Version: > 95%
Ransomware Detection Rate: 100%
Threat Containment Success Rate: > 95%
Policy Compliance Rate > 98%
Critical Alerts Investigated: 100%
Dr. Ghoniem Lawaty
Tech Evangelist @TechHuB Egypt
Page updated
Google Sites
Report abuse