The ecosystem counts thousands of tools. The most useful approach is to organise them by use: protecting yourself, detecting, responding, legally testing your defences.
3.1For individuals and students
- Password managers: Bitwarden, 1Password, KeePass, Dashlane: one unique, strong password per service.
- MFA and passkeys: authenticator apps, physical keys, biometrics and FIDO standards.
- Hygiene: automatic updates, 3-2-1 backups, checking your leaks on Have I Been Pwned.
- Encrypted messaging: Signal; Olvid, French and certified by ANSSI.
- In France: cybermalveillance.gouv.fr, the public victim-assistance service.
3.2Protecting workstations and servers
From classic antivirus to EDR (Endpoint Detection and Response), which detects suspicious behaviour rather than signatures alone: CrowdStrike, SentinelOne, Microsoft Defender, and the French company HarfangLab, certified by ANSSI.
3.3Network, access and identity
- Firewalls and access: Fortinet, Palo Alto Networks, Zscaler, Cloudflare, Netskope.
- ZTNA / SASE: replacing the corporate VPN with zero trust access control.
- IAM: Okta, Microsoft Entra ID; identity becomes the new perimeter.
- PAM: CyberArk and equivalents protect privileged accounts.
3.4Monitoring: the SOC
The SOC (Security Operations Center) is the control tower. It relies on a SIEM (Splunk, Microsoft Sentinel, Sekoia.io) to collect and correlate logs, then on SOAR tools to automate part of the response.
The job of SOC analyst is one of the main junior entry points into the field.
3.5Legal offensive tools
- Pentest: Kali Linux, Nmap, Metasploit, Burp Suite, Wireshark.
- Bug bounty: YesWeHack (the European leader, French) and HackerOne connect companies with ethical hackers.
- Training: Root-Me, TryHackMe, Hack The Box, CTFs.
- Legal framework: testing a system without written authorisation is an offence; ethical hacking is done under contract.
3.6Threat intelligence, cloud and code
Threat intelligence maps attackers, their tools and their campaigns: OpenCTI (open-source software from the French company Filigran), MISP, Google Mandiant. For cloud and code: Wiz, Snyk, Tenable, Qualys and vulnerability management tools.
How to choose?
Three questions: what asset needs protecting? Where is the weak link? Build or delegate? A small organisation rarely benefits from setting up its own SOC: managed services exist for that.
Sources
ANSSI, guides and security certifications (cyber.gouv.fr); Cybermalveillance.gouv.fr; documentation of the vendors cited.
Finished this module?
Your progress is saved on this device.