I. Preparation & Prediction: Asset/Vulnerability/Policy Effectiveness

NGAF can automatically identify risks such as open ports, vulnerabilities, and weak passwords on internal servers in advance, and can judge whether the identified assets have corresponding security protection policies and whether the policies are effective.

II. Real-Time Defense: Complete Defense System + Security Correlation + Threat Intelligence

NGAF integrates a number of security technologies for effective defense during an event. It provides a complete security defense system (L2-L7) to ensure that there are no weaknesses in security protection. At the same time, NGAF can also improve the timeliness and effectiveness of the defense system through security integration, including the integration of cloud and endpoint security solutions, and the coordination of different modules. In addition, NGAF also cooperates with third-party security agencies, and utilizes threat intelligence from multiple sources, such as the Chinese National Vulnerability Database, VirusTotal, and malicious URL databases to help users prepare for defense before security events occur.

III. Post-event Detection & Response: Continuous Detection of Threatening Behaviors and Rapid Response

Traditional security work mainly focuses on border security defense, and lacks the ability to detect and respond when attackers bypass security defense measures. If there are mature post-event detection and response measures, the impact of security events can be greatly reduced. NGAF integrates post-event detection and rapid response technologies, which help users timely discover malicious behaviors even after hacking, such as detecting malicious behaviors initiated by zombie computers, webpage tampering, website backlink embedment, and Webshell backdoor, and quickly push alarm events to assist users in responding and handling.