Cloud

7/9/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Creating a Defensible Security Architecture

Take the time to learn about your assets. You'll be able to layer in multiple prevention and detection solutions and have a highly effective security architecture.

The Internet is constantly growing, giving birth to an age of network interconnection unlike anything we have ever known. Devices such as refrigerators, security cameras, and baby dolls have joined the ranks of Internet of Things (IOT) devices. These devices are made to be cheap and indispensable, resulting in insecure configurations and settings. The result: mass compromise and misuse for evil at a scale not been seen before.

To be specific, the attack surface is larger than ever due to the IoT. But this also is due to the lack of surface reduction within any given network. Routine patching, security hardening, and defensive network designs exist but are not in effect. Organizations flock to purchase the latest "next-generation" security technology but meanwhile ignore the basic tenants of security. A mature, secure architecture design does not require the most expensive best-of-breed solutions. However, it does involve taking time to think about one's environment and to design a secure architecture accordingly.

The concept of taking the time to do things right is much akin to the financial problems we face today. One large solution to a financial problem is taking the time to implement a budget and then sticking with it. And yet, many individuals have never taken the time to do this. Which feels more impactful — spending the last of your $200 in cash based on your grocery budget or swiping a credit card? The same holds true in network security. Security is not an accident. Similar to a credit or debit card, hoping money is in the bank is not enough; that is a failed approach. Security should be intentional and the result of careful planning.

Succeeding in Security
Modern attacks, the cloud, the IoT, and web applications have drastically changed the security landscape. They have created a world of deperimeterization where the old boundaries of "inside" and "outside" or "trusted" and "untrusted" no longer apply. To succeed in security in this new landscape requires a modern spin on security architecture. What may be surprising is that you likely own many of the technologies you need to win. However, these technologies need to be re-engineered to be effective.

Take, for example, a next-generation firewall (NGFW). The firewall comes with intrusion prevention, antivirus, application control, data loss prevention, denial-of-service protection, URL filtering, malware sandboxing, and more. Out of the box, this solution is highly ineffective. To be effective, it must be tuned according to your business needs. What usually happens is that the box is tuned by professional services or, in some cases, internal staff, but the end configuration is a generically tuned system that protects against Internet traffic.

Instead, the firewall should also be configured to implement internal layers of network segmentation. Controls should not only face the Internet but implemented to secure authorized access from internal assets to internal assets. Basic adjustments such as this allow for far superior prevention controls and, more importantly, detection controls. Think about this for a moment: If a computer on a subnet or zone A attempts to talk to any system found in zone B and the system from A is not allowed, then the connection will be denied, and you will be notified of that. Basic firewall rules aren't rocket science, but they are highly effective controls.

Modern challenges also must be overcome. For instance, consider an intrusion detection/prevention device, web proxy, data loss prevention sensor, network antivirus, or any other Layer 7 network inspection solution. These are all crippled by network encryption. Your brand-new shiny NGFW may not be configured to handle 70%+ of the traffic going through it. Basically, without understanding technologies like Secure Sockets Layer (SSL) inspection, SSL decrypt mirroring, HTTP Strict Transport Security (HSTS), certificate transparency, HTTP Public Key Pinning (HPKP), how can you handle modern encryption? A good architecture accounts for and handles network communication.

If you take the time to learn about your assets, you will be able to layer in multiple prevention and detection solutions and have a highly effective security architecture. Doing so will keep you prepared, even as your data traverses your network or the cloud. Understanding how to implement such an architecture by taking many of the security technologies you already own and implementing them with a fresh mindset and modern approach is essential in the creation of a defensible security architecture

Want to learn more? Check out the new SANS SEC530: Defensible Security Architecture course or research these concepts online.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Justin Henderson is a SANS Instructor and course author of SEC555: SIEM with Tactical Analytics, and CEO of H & A Security Solutions. He is a passionate security architect and researcher with over decade of experience working in the Healthcare industry. He has also had ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14084
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVE-2018-14085
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function swe...
CVE-2018-14086
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(...
CVE-2018-14087
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value of buyPrice to a large number in setPrices() then the "msg.value * buyPrice" will cause an integer overflow in the fallback functio...
CVE-2018-14088
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner sets the value of amount to a large number then the "amount * 1000000000000000" will cause an integer overflow in withdrawToFounde...