Cloud

7/9/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Creating a Defensible Security Architecture

Take the time to learn about your assets. You'll be able to layer in multiple prevention and detection solutions and have a highly effective security architecture.

The Internet is constantly growing, giving birth to an age of network interconnection unlike anything we have ever known. Devices such as refrigerators, security cameras, and baby dolls have joined the ranks of Internet of Things (IOT) devices. These devices are made to be cheap and indispensable, resulting in insecure configurations and settings. The result: mass compromise and misuse for evil at a scale not been seen before.

To be specific, the attack surface is larger than ever due to the IoT. But this also is due to the lack of surface reduction within any given network. Routine patching, security hardening, and defensive network designs exist but are not in effect. Organizations flock to purchase the latest "next-generation" security technology but meanwhile ignore the basic tenants of security. A mature, secure architecture design does not require the most expensive best-of-breed solutions. However, it does involve taking time to think about one's environment and to design a secure architecture accordingly.

The concept of taking the time to do things right is much akin to the financial problems we face today. One large solution to a financial problem is taking the time to implement a budget and then sticking with it. And yet, many individuals have never taken the time to do this. Which feels more impactful — spending the last of your $200 in cash based on your grocery budget or swiping a credit card? The same holds true in network security. Security is not an accident. Similar to a credit or debit card, hoping money is in the bank is not enough; that is a failed approach. Security should be intentional and the result of careful planning.

Succeeding in Security
Modern attacks, the cloud, the IoT, and web applications have drastically changed the security landscape. They have created a world of deperimeterization where the old boundaries of "inside" and "outside" or "trusted" and "untrusted" no longer apply. To succeed in security in this new landscape requires a modern spin on security architecture. What may be surprising is that you likely own many of the technologies you need to win. However, these technologies need to be re-engineered to be effective.

Take, for example, a next-generation firewall (NGFW). The firewall comes with intrusion prevention, antivirus, application control, data loss prevention, denial-of-service protection, URL filtering, malware sandboxing, and more. Out of the box, this solution is highly ineffective. To be effective, it must be tuned according to your business needs. What usually happens is that the box is tuned by professional services or, in some cases, internal staff, but the end configuration is a generically tuned system that protects against Internet traffic.

Instead, the firewall should also be configured to implement internal layers of network segmentation. Controls should not only face the Internet but implemented to secure authorized access from internal assets to internal assets. Basic adjustments such as this allow for far superior prevention controls and, more importantly, detection controls. Think about this for a moment: If a computer on a subnet or zone A attempts to talk to any system found in zone B and the system from A is not allowed, then the connection will be denied, and you will be notified of that. Basic firewall rules aren't rocket science, but they are highly effective controls.

Modern challenges also must be overcome. For instance, consider an intrusion detection/prevention device, web proxy, data loss prevention sensor, network antivirus, or any other Layer 7 network inspection solution. These are all crippled by network encryption. Your brand-new shiny NGFW may not be configured to handle 70%+ of the traffic going through it. Basically, without understanding technologies like Secure Sockets Layer (SSL) inspection, SSL decrypt mirroring, HTTP Strict Transport Security (HSTS), certificate transparency, HTTP Public Key Pinning (HPKP), how can you handle modern encryption? A good architecture accounts for and handles network communication.

If you take the time to learn about your assets, you will be able to layer in multiple prevention and detection solutions and have a highly effective security architecture. Doing so will keep you prepared, even as your data traverses your network or the cloud. Understanding how to implement such an architecture by taking many of the security technologies you already own and implementing them with a fresh mindset and modern approach is essential in the creation of a defensible security architecture

Want to learn more? Check out the new SANS SEC530: Defensible Security Architecture course or research these concepts online.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Justin Henderson is a SANS Instructor and course author of SEC555: SIEM with Tactical Analytics, and CEO of H & A Security Solutions. He is a passionate security architect and researcher with over decade of experience working in the Healthcare industry. He has also had ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8354
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.
CVE-2019-8355
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
CVE-2019-8356
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
CVE-2019-8357
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.
CVE-2013-2516
PUBLISHED: 2019-02-15
Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.