10:30 AM
Jon Kim
Jon Kim
Connect Directly
E-Mail vvv

Network Security: An Ounce Of Prevention Is Worth A Pound Of Reaction

For humans ailments, prevention might begin with an allergist. In security, it's the network engineer.

Imagine you're at a seafood restaurant. One look at the menu, and you know exactly what you want: lobster. Your food arrives, you clean your plate, and then proceed to pull out your EpiPen because you also happen to have a life-threatening shellfish allergy.

Sound improbable? Let's hope so. Chances are, you'd bypass the lobster in favor of the significantly less lethal cod. Preventing damage, after all, is almost always better than reacting to it. Sure, you still need the EpiPen. After all, no matter how diligently you avoid it, sometimes shellfish happens. Just don't invite it to the table.

Now, think of your network — including how you protect it.

Much like an EpiPen for food allergies, you need security capabilities in remediating attacks. But once a breach occurs, your ability to mitigate damage is limited by how quickly you detect and respond to it. Just ask Sony, which experienced one of the most massive breaches of the 21st century, costing an estimated $35 million.  

Truly securing our networks requires practicing preventive medicine. That means diagnosing potential vulnerabilities and integrating pre-emptive measures into our IT infrastructure. Reactive measures alone won't suffice.

For humans, prevention might begin with an allergist. In security, it's the network engineer. No one is better positioned to assess network health risks or to determine the best configurations to prevent attacks. But first, we need to shift our perceptions about engineers' roles in security from the start.

Prevention as a Cyberthreat Cure
While network engineers do care about security, it's not their primary focus. Their perception of security originates from colleagues who focus specifically on security, and thus might be unaware of how network designs and configurations themselves affect security. 

A network engineer's work is judged by the network's functionality, performance, and reliability. Consequently, security measures are often implemented after deployment — with firewalls or VPNs, for instance — instead of earlier, when prevention matters most.

Education Is Critical
I recently interviewed multiple enterprise networking candidates, some of them Cisco Certified Internetwork Expert certified. Unsurprisingly, their concept of security was limited to intrusion detection or event logs. I've yet to hear a candidate mention making actual infrastructure enhancements to secure a router or switch environment. 

If we want to create networks with intrinsic self-protections, we should begin with how we educate network engineers. At many universities, network engineering programs focus on logic, infrastructure, architecture, and visualization. When addressing security, however, curricula are often vague or focused on topics such as intrusion detection and firewalls. And, of course, traditional technologies still matter. But let's also teach how even the simplest capabilities, such as network segmentation (or micro-segmentation), can address threats.

At the same time, we can't simply wait on a new generation of security-minded network engineers to graduate. Those of us already in the field need to change our own perceptions of and approaches to security as well.  

For network engineers, the traditional focus on designing, building, and maintaining networks creates a silo — one unoccupied by security. Unfortunately, this disempowers engineers from playing meaningful roles in their organizations' security strategies. 

It's time for network engineers to abandon convention and believe that network security begins with them — particularly their network designs. 

Think about segmentation technology. It's not a traditional security tool; it's a network tool — one that, used properly, has significant security impact. Without segmentation, for instance, an attacker could easily breach a pharmaceutical company's payroll department and subsequently access the lucrative research and development department. In a well-segmented network, however, the same attacker couldn't access R&D from payroll, because those two traffic streams are isolated from one another.

Most IT leaders want to avoid introducing too much new technology at once. Eventually the organization tires of it — even solutions designed to protect your system. 

But improving your security posture doesn't always mean large investments of money, time, or resources. Instead of buying new technology to fix old problems, we should utilize our existing capabilities. 

Often, better security is achievable through comparatively simple network tweaks and changes, such as refreshing switches and routers. If your system runs on Oracle, for example, invite networking team members to discuss what they can do to improve basic security hardening — no shiny new security tools needed.

Doing this effectively requires bringing your networking team into security discussions from the start. Early participation allows network engineers to understand their contributions to your security strategy, and to play an active role in its success.

Sustainable, Preemptive Security
Sometimes, no matter how aggressively you respond to a breach, the damage is done. Perhaps Bill Gates said it best: "Treatment without prevention is simply unsustainable."

Ideally, your network should offer its own best defense — a goal that begins with prevention and made possible by your network engineers. They not only know your network better than anyone, but with the right support, education, and planning, they can play a first-line role in securely configuring it. Ultimately your engineers should play a crucial role in your organization's overall security posture by heading off threats from the start.  

Related Content:

Jon Kim is the Director of NextGen Networking at Force 3. In this role, Jon is responsible for providing unique expertise to help clients build effective, long-term IT strategies around software-defined networking (SDN) platforms and emerging technologies. He has more than ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
1/6/2017 | 10:15:51 AM
Detection is a must
Yes, please do take every measure possible to prevent an event but, rest assured, if someone wants you they will have you. Having consulted at Fortune 50 companies and government agencies I can assure you that the attackers have more ways in than you have safegaurds.

Prevention is important but detection is a MUST. Stop thinking you can be 100% safe 100% of the time and start planning for how you will recover. Spend time, money and brainpower on how you will find an attack as quickly as possible,
User Rank: Apprentice
12/26/2016 | 3:45:49 PM
Thanks. This is nice post regarding the Network Security. It one of the most importnat thing to keep our data safe from hacker.


'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
Flash Poll
The State of IT and Cybersecurity
The State of IT and Cybersecurity
IT and security are often viewed as different disciplines - and different departments. Find out what our survey data revealed, read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2018-06-25
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its l...
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.
PUBLISHED: 2018-06-24
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial o...
PUBLISHED: 2018-06-24
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was ...