020
The Control Layer is the core of the SDP architecture. Its role is to generate software-
defined protections and to deploy them for execution at the appropriate Enforcement Layer
enforcement points, whether implemented using high-performance dedicated hardware or
as host-based software in the network, on mobile devices or in the cloud.
Protection categories include threat prevention, access control and data protection. These
strategies differ in the underlying knowledge domain fromwhich security policy rules are drawn:
Threat Prevention
draws on an understanding of threats and threat behavior. It
is fed by collaborative real-time threat intelligence received from the community
Access Control
enforces a security policy model of authorized interactions
between users and assets in the enterprise, as configured by the
Management Layer
Data
Protection
focuses on data classification rather than on behavior and
interactions. The Management Layer determines the data flow policies in the
organization
Software-defined protections provide the level of flexibility needed to cope with new and
dynamic threats and changing enterprise network configurations. The Enforcement Layer
provides a robust platform that can execute protections at enforcement points throughout
the enterprise. Because protections are controlled by software, the underlying hardware
deployed at these enforcement points does not need to be replaced when a new threat or
attack method is discovered, or when new technologies are introduced into the organization.
Protections should automatically adapt to the threat landscape without requiring manual
follow-up on review of thousands of advisories and recommendations. This is achieved
using automated threat prevention controls that interact with the Management Layer only
as needed to employ human decision-making (e.g., when threat indicators provide only low
confidence as to the identification of a threat or attack).
02
Cont rol
Layer
