Cloud

7/9/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Creating a Defensible Security Architecture

Take the time to learn about your assets. You'll be able to layer in multiple prevention and detection solutions and have a highly effective security architecture.

The Internet is constantly growing, giving birth to an age of network interconnection unlike anything we have ever known. Devices such as refrigerators, security cameras, and baby dolls have joined the ranks of Internet of Things (IOT) devices. These devices are made to be cheap and indispensable, resulting in insecure configurations and settings. The result: mass compromise and misuse for evil at a scale not been seen before.

To be specific, the attack surface is larger than ever due to the IoT. But this also is due to the lack of surface reduction within any given network. Routine patching, security hardening, and defensive network designs exist but are not in effect. Organizations flock to purchase the latest "next-generation" security technology but meanwhile ignore the basic tenants of security. A mature, secure architecture design does not require the most expensive best-of-breed solutions. However, it does involve taking time to think about one's environment and to design a secure architecture accordingly.

The concept of taking the time to do things right is much akin to the financial problems we face today. One large solution to a financial problem is taking the time to implement a budget and then sticking with it. And yet, many individuals have never taken the time to do this. Which feels more impactful — spending the last of your $200 in cash based on your grocery budget or swiping a credit card? The same holds true in network security. Security is not an accident. Similar to a credit or debit card, hoping money is in the bank is not enough; that is a failed approach. Security should be intentional and the result of careful planning.

Succeeding in Security
Modern attacks, the cloud, the IoT, and web applications have drastically changed the security landscape. They have created a world of deperimeterization where the old boundaries of "inside" and "outside" or "trusted" and "untrusted" no longer apply. To succeed in security in this new landscape requires a modern spin on security architecture. What may be surprising is that you likely own many of the technologies you need to win. However, these technologies need to be re-engineered to be effective.

Take, for example, a next-generation firewall (NGFW). The firewall comes with intrusion prevention, antivirus, application control, data loss prevention, denial-of-service protection, URL filtering, malware sandboxing, and more. Out of the box, this solution is highly ineffective. To be effective, it must be tuned according to your business needs. What usually happens is that the box is tuned by professional services or, in some cases, internal staff, but the end configuration is a generically tuned system that protects against Internet traffic.

Instead, the firewall should also be configured to implement internal layers of network segmentation. Controls should not only face the Internet but implemented to secure authorized access from internal assets to internal assets. Basic adjustments such as this allow for far superior prevention controls and, more importantly, detection controls. Think about this for a moment: If a computer on a subnet or zone A attempts to talk to any system found in zone B and the system from A is not allowed, then the connection will be denied, and you will be notified of that. Basic firewall rules aren't rocket science, but they are highly effective controls.

Modern challenges also must be overcome. For instance, consider an intrusion detection/prevention device, web proxy, data loss prevention sensor, network antivirus, or any other Layer 7 network inspection solution. These are all crippled by network encryption. Your brand-new shiny NGFW may not be configured to handle 70%+ of the traffic going through it. Basically, without understanding technologies like Secure Sockets Layer (SSL) inspection, SSL decrypt mirroring, HTTP Strict Transport Security (HSTS), certificate transparency, HTTP Public Key Pinning (HPKP), how can you handle modern encryption? A good architecture accounts for and handles network communication.

If you take the time to learn about your assets, you will be able to layer in multiple prevention and detection solutions and have a highly effective security architecture. Doing so will keep you prepared, even as your data traverses your network or the cloud. Understanding how to implement such an architecture by taking many of the security technologies you already own and implementing them with a fresh mindset and modern approach is essential in the creation of a defensible security architecture

Want to learn more? Check out the new SANS SEC530: Defensible Security Architecture course or research these concepts online.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Justin Henderson is a SANS Instructor and course author of SEC555: SIEM with Tactical Analytics, and CEO of H & A Security Solutions. He is a passionate security architect and researcher with over decade of experience working in the Healthcare industry. He has also had ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2018-5067
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.