The Security Depth Chart

It's October, which means its Cyber Security Awareness Month! Last year, I celebrated by writing a blog where I compared the songs on Taylor Swift's newest album to different cyber security concepts. It was so fun to hear that my coworkers shared it with their Swiftie family members, and they got to learn about cyber in a new and relatable way. 

So, of course, we're continuing the excitement, but this time, we're bringing it to the other side of the family. We're going to be comparing cyber security tool categories to football positions!

My credentials for this topic? My brother played SEC football, I was a cheerleader for his pee wee football team, and I was QB1 in powderpuff but had to sit out of the big game due to a season ending injury. So, yeah. 

If you disagree with any of these comparisons, or have a better one, please let me know in the comments, I'd love to hear it.

Before we dive in, just as a reminder, security is not purely a defensive effort. A successful security program consists of offensive security personnel using products that test defenses, code and infrastructure. Just like in football, offense wins games, but defense wins championships.

Offense

Quarterback – SIEM 

We're starting with the leader of the offense: the quarterback. He touches the ball on almost every play. In simple terms, he takes the snap, then either hands off to the running back, looks for a receiver or tight end, or finds a hole and runs it himself. He never does this alone, though. The center makes first contact, then the quarterback, then one of his ball carriers. Even when he runs it himself, the offensive line is still blocking and clearing the lane.

That same theme shows up in security: it's never a one person job, not for your engineers, and not for your tools. Since we're focusing on tools here, we'll start with security information and event management, SIEM, which usually sits at the core of what a SOC runs on. Like the quarterback and his team, SIEM gets fed data, makes a decision, and generates an alert to pass along.

As written by our security operations experts, a SIEM runs through four stages: collection, normalization, correlation, and alerting. It collects data from sources like networks, endpoints, authentication, email, and applications, normalizes it into a consistent format, correlates events using its own rules or machine learning to connect things that look unrelated, and generates an alert for the SOC to investigate.

The quarterback does something similar. He reads the field, personnel, formation, matchups, where the pressure's coming from, who's open, then checks that against what he already knows, film, tendencies, what his guys do well. Once it clicks, he pulls the trigger, handing the ball to whoever's in the best spot to go.

Either way, it comes down to the same thing: seeing the whole picture, knowing what you're looking at, and having a real process for deciding what to do with it.

Wide receiver – Vulnerability scanner

The wide receiver is one of your offense's pass catchers. His main job is to get open downfield so the quarterback has someone to throw to. He's running a planned route, but it's on him to create separation from the defender covering him and get open.

Vulnerability scanners do something similar. They scan your full environment looking for weaknesses that could be exploited, and they run on a regular schedule, just like a receiver running his route on every passing play. They won't always find something, but they're always looking.

In both situations, they're looking for an opening. For the wide receiver, that opening is separation, enough space to catch the ball and get moving toward the end zone. For the scanner, that opening is a weak spot somewhere in your environment, one an attacker could use to work toward your crown jewels.

Tight end – CNAPP 

Our tight end is a man of multitudes. He has two main roles, part offensive lineman, part receiver, and could be one or both depending on the play. He'll line up outside the left or right tackle and either stay in to block the pass rushers, or release downfield to run a route and catch a pass.

It's a position that has been getting a lot of attention recently, mainly because it happens to be the position Mrs. Swift's husband plays. A security tool that's been getting a lot of attention recently? Cloud native application protection platforms, or CNAPP. And the similarities don't stop there, this is also a tool of multitudes. CNAPP has always packed in a lot of capabilities, but lately we've seen even broader cloud security coverage built into it.

On one hand, CNAPP is like your wide receiver, constantly scanning cloud environments for vulnerabilities, misconfigurations, identity risks and more. On the other hand, CNAPP is like your offensive line. Agent-based runtime security and detection and response have become more common in cloud security for many reasons, one of which I cover in my recent blog. The bottom line is you need something actively watching what's happening in your cloud workloads, with the ability to block a malicious actor in real time, the same way a lineman blocks a pass rusher to keep him off your quarterback. 

Running back – Penetration test

Next is the running back. He lines up behind the line of scrimmage, and his job is to take the handoff, find an opening, and run through the defense to gain yards. He's one of the most physical offensive positions, since on nearly every play he carries the ball, he's taking contact from one or more defenders along the way.

In security, this translates well to the active nature of penetration testing. Pen testers actively exploit whatever vulnerabilities they find to push past the initial defenses and into the system, the same direct, run it through the line approach as the running back. 

Just like the quarterback, the running back is never in it alone. On a running play, the offensive line and even the other receivers are blocking too, clearing a path, since there's no way he's getting through the big guys on power alone. Strong pen testing isn't just one tool either, it usually takes a team of engineers running multiples tools together. 

Offensive line – Firewall 

The final piece on this side of the ball is the offensive line. These are your big guys standing in the front with one main goal: protect the quarterback. Every lineman is there to form a wall between the defense and the quarterback, blocking anything trying to get through before it ever reaches him. 

A firewall does the same thing for your network. It sits at the perimeter and filters traffic based on a set of rules, blocking anything that isn't allowed through before it ever reaches whatever's behind it. Neither the offensive line nor the firewall is attacking anything, they're just standing in the way, play after play, packet after packet, making sure nothing unauthorized gets past them.

Defense

Defensive line – email security

To kick off the defense, we're starting directly opposite of where we just left off: the defensive line. This is the first line of defense on the other side of the ball, and its first job is simple, don't let the runner through.

This next pairing might seem like an unexpected one at first. But think about how cruicial email is to business processes around the world. It is consistently one of the largest attack vectors, specifically through an initial access tactic, phishing. And now that AI has entered the picture, threats are coming into our inboxes from every direction, faster and harder to catch than before, a trend our email security and DLP expert breaks down well.

So what do you do about it? The same thing the defensive line is built to do, stop it before it gets through. Email security's job is to strip the risk out of a message before it's ever delivered, catching it at that first point of contact rather than reacting after it's already inside. There are layers of defense behind the defensive line and behind the inbox, but I think anyone would agree that it is best to stop the threat at the first point of contact. 

Linebacker – IDS/IPS

Defensive formations split players across three general areas: the front, the middle, and the secondary. Linemen sit at the front, along the line of scrimmage, while the middle is where you'll find the linebackers. The linebacker's job is to watch the middle of the field, the quarterback's eyes, receiver routes, and what the running back and tight end are doing. They cover their own zone and help out in others when needed, with the goal of keeping anyone from getting past the middle.

On the security side, intrusion detection and intrusion prevention systems, IDS/IPS, work similarly. Both watch network traffic for signs of malicious activity. IDS is passive, it sits off to the side and generates an alert for someone to investigate. The IPS is active, it sits inline with the traffic and can immediately block the threat.

Linebackers work the same way, watching traffic through the middle and acting when needed. The weakside linebacker, for example, might be more like the IDS, less likely to charge straight at the ball carrier and more focused on reading the other offensive players trying to clear a path. Less in the center of the action, but still helping.

Cornerback - EDR

Our last two positions, cornerback and safety, start in the secondary, lining up behind the linebackers. The cornerback can be man to man the whole time, but he's commonly assigned to a zone, and once a receiver enters it, he's right there with him, either preventing the catch or bringing him down immediately after, before he can gain more ground.

Endpoint detection and response, EDR, works in a similar way. An agent is installed directly on the endpoint, monitoring activity, file changes, and network connections, basically everything happening on that device, and watching for behavior that's unusual or already known to be malicious. In that sense, EDR is essentially always playing man to man coverage. The response half is what lets the agent actually kill a malicious process right on the spot, the same way a cornerback would bat the ball down or tackle the receiver once the catch is made.

Safety – CTEM

Last but not least, our safeties. As the last line of defense, the safety lines up at the back of the secondary and watches for any chance to step in and help. Because he's so far back, he needs strong field vision, taking in the whole picture to read the offense's strategy, and often communicates what he's seeing to the rest of the team.

Continuous threat exposure management, CTEM, is an evolution of vulnerability management, focused on continuously identifying risks, showing what's actually exploitable, and prioritizing what to fix first. It's a five-step process, and the safety actually runs through roughly the same five steps on every play:

Scoping

• CTEM: Map your boundaries, what needs monitoring, what's business critical, what's part of the attack surface.
• Safety: Internalize the call, his zone, who's on the field, and what the play is designed to look like.

Discovery

• CTEM: Identify the assets, vulnerabilities, misconfigurations, and exposures within that scope.
• Safety: Scan the offense's formation, skill players, and alignment.

Prioritization

• CTEM: Rank risks by exploitability and business impact, what's most likely to be hit, and what would hurt the most if it is.
• Safety: Pull from tendencies to judge the biggest threat, who's most likely to touch the ball, and where they tend to win.

Validation

• CTEM: Test whether controls hold up and the asset's actually exploitable, confirming the risk is real.
• Safety: The ball's snapped, the play starts, who has it, and where he's going.

Mobilization

• CTEM: Get the findings to the right people with the right evidence, and start remediating.
• Safety: Go get him. Or tell someone else to.

Honorable mentions 

Punter – Cyber recovery

Long snapper – Data backups 

Coaching staff – Threat intelligence

Referees – Network protocols

Mascot – Didas  

Post game thoughts

At the end of the day, we're all just trying to navigate a world that's moving faster than most of us can keep up with, and with AI in the mix, security matters more than it ever has. This blog doesn't really mean anything in the grand scheme of things, but it's a good reminder that life doesn't always need to be so serious. Taking something as familiar as football and using it to make sense of strategy, decision making, even security, is just one more way to make complicated things feel a little more human. If it makes a topic like security more consumable and relatable along the way, even better.

Go Bills!