Enterprise cybersecurity is the work of protecting one company's people, accounts, devices, networks, websites, cloud systems, code and data from attackers, together with the software that companies buy to do it. It is also called corporate security or information security. The buyers of this software are the IT and security teams of other companies.
Consider a pharmaceutical company in Vadodara with 2,000 employees, three factories and a website on which pharmacies place their orders. An attacker who wants money or data from this company can start in many places. So the company needs a defence at each of them. The industry sells these defences in eight areas.
The first area is email security. Many attacks begin with an email. A phishing email is a fake message built to trick a person into typing a password or paying money. A secure email gateway checks every incoming email before it reaches an employee.
The second area is identity and access management (IAM). It decides who may log in, and to which system. Single sign-on (SSO) gives each employee one login for every app. Multi-factor authentication (MFA) asks for a second proof, such as a code on the phone. Privileged access management (PAM) guards the administrator accounts that can change anything.
The third area is endpoint security. An endpoint is a laptop, phone or server. Endpoint detection and response (EDR) software runs on each one and stops attacks such as ransomware, which locks a company's files and demands money to unlock them.
The fourth area is network security. It covers the firewall and the cloud services that check every connection between the company and the internet, and the networks that run the factory machines. The fifth is web and API security, which protects the ordering website from floods of traffic and automated attacks. The sixth is cloud security, for the servers that the company rents from cloud providers and the online apps it uses. The seventh is application security, which checks the company's own software for flaws while it is being written. The eighth is data security, which finds where the company's records are kept and stops them from leaving.
The products in every area raise alerts, which are messages saying that something looks wrong. The alerts go to one team, the security operations centre (SOC), which watches them around the clock.
Two ideas run through all eight areas. The first is zero trust: no login, device or connection is trusted just because it comes from inside the office, so each one is checked every time. The second is least privilege: each person and each program gets only the access that its job needs. In India, the rules of CERT-In, the government's cyber security agency, also require companies to report many kinds of cyber incident, such as data breaches and unauthorised access to their systems, within six hours of noticing them.