Academy
TermDefence

Gateway security

Inspecting web and email traffic at the crossing point between the corporate network and the internet.

Flow

  1. 1Traffic is gathered
  2. 2Content is inspected
  3. 3Policy is applied
Related families
—
MITRE ATT&CK
—
Sources
4 sources
01

Overview

The gateway lets traffic leaving and entering the organisation be inspected at a single point: web filtering, email filtering, file inspection and intrusion prevention come together here. MITRE ATT&CK

Devices working remotely fall outside this inspection when they do not pass through the gateway; a significant share of infostealer infections happen on devices outside the corporate network. Google Cloud (Mandiant)

02

How it works

  1. 1

    Traffic is gathered

    Web and email traffic is routed through the gateway. MITRE ATT&CK

  2. 2

    Content is inspected

    Attachments and downloaded files are scanned or opened in a sandbox. MITRE ATT&CK

  3. 3

    Policy is applied

    Malicious content is blocked. MITRE ATT&CK

03

How to detect it

  • Compare files blocked at the gateway with endpoint records. MITRE ATT&CK
04

What to do

  • Bind devices outside the organisation to the same policy. MITRE ATT&CK
05

Related terms

06

Sources

  1. 1Filter Network Traffic (M1037) · MITRE ATT&CK
  2. 2Application Isolation and Sandboxing (M1048) · MITRE ATT&CK
  3. 3Restrict Web-Based Content (M1021) · MITRE ATT&CK
  4. 4UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024