How to Evaluate Security Validation Solutions — EISS 2022 Enterprise Information Security Summit Shenzhen

On October 28th, the 15th EISS Enterprise Information Security Summit, hosted by Anshijia, was successfully held in Shenzhen! With the theme of "Facing Information Security Challenges, Creating Best Practices", this summit focused on the most cutting-edge hot topics in the current security circle. Several senior security experts and security heads shared and discussed their respective best security practices and experiences. Wang Jingpu, CTO of CyCraft Validation (SecOps Validation), was invited to share theoretical explanations and practical experiences on the topic of "How to Evaluate Security Validation Solutions".

Security validation technology has evolved from Breach and Attack Simulation (BAS) technology. According to Gartner's forecast, it will be widely adopted by markets globally across various fields within the next 2-5 years.

In the past three years, the Data Security Law, the Cryptography Law, the Personal Information Protection Law, and the Cybersecurity Law have jointly formed the top-level policy framework of the information security industry. Since 2016, China has begun planning "Cybersecurity Drills", which require practical, systematic, and regular offensive and defensive drills. Institutions' approach to cybersecurity needs has also upgraded from passive construction to an essential requirement for business security.

Security validation technology examines and improves the security defense system from the perspective of an attacker. CyCraft Validation has an attack library covering different attack stages across the complete cyber kill chain. The attack library also covers all techniques and tactics of ATT&CK, providing policy and technical support for enterprise security construction and industry compliance requirements, while continuously validating the effectiveness of the defense system.

Security validation technology can continuously validate the effectiveness of security construction across various industries currently targeted by cybercriminals, such as finance, high-tech, healthcare, critical infrastructure, education, manufacturing, and energy. CyCraft Validation will track internet hacker groups and vulnerabilities 24/7 to provide customers with the latest and most classic APT attack methods collected from the internet, allowing customers to use these real-world attack scenarios to validate the effectiveness of their defense systems.