Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

7/9/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Creating a Defensible Security Architecture

Take the time to learn about your assets. You'll be able to layer in multiple prevention and detection solutions and have a highly effective security architecture.

The Internet is constantly growing, giving birth to an age of network interconnection unlike anything we have ever known. Devices such as refrigerators, security cameras, and baby dolls have joined the ranks of Internet of Things (IOT) devices. These devices are made to be cheap and indispensable, resulting in insecure configurations and settings. The result: mass compromise and misuse for evil at a scale not been seen before.

To be specific, the attack surface is larger than ever due to the IoT. But this also is due to the lack of surface reduction within any given network. Routine patching, security hardening, and defensive network designs exist but are not in effect. Organizations flock to purchase the latest "next-generation" security technology but meanwhile ignore the basic tenants of security. A mature, secure architecture design does not require the most expensive best-of-breed solutions. However, it does involve taking time to think about one's environment and to design a secure architecture accordingly.

The concept of taking the time to do things right is much akin to the financial problems we face today. One large solution to a financial problem is taking the time to implement a budget and then sticking with it. And yet, many individuals have never taken the time to do this. Which feels more impactful — spending the last of your $200 in cash based on your grocery budget or swiping a credit card? The same holds true in network security. Security is not an accident. Similar to a credit or debit card, hoping money is in the bank is not enough; that is a failed approach. Security should be intentional and the result of careful planning.

Succeeding in Security
Modern attacks, the cloud, the IoT, and web applications have drastically changed the security landscape. They have created a world of deperimeterization where the old boundaries of "inside" and "outside" or "trusted" and "untrusted" no longer apply. To succeed in security in this new landscape requires a modern spin on security architecture. What may be surprising is that you likely own many of the technologies you need to win. However, these technologies need to be re-engineered to be effective.

Take, for example, a next-generation firewall (NGFW). The firewall comes with intrusion prevention, antivirus, application control, data loss prevention, denial-of-service protection, URL filtering, malware sandboxing, and more. Out of the box, this solution is highly ineffective. To be effective, it must be tuned according to your business needs. What usually happens is that the box is tuned by professional services or, in some cases, internal staff, but the end configuration is a generically tuned system that protects against Internet traffic.

Instead, the firewall should also be configured to implement internal layers of network segmentation. Controls should not only face the Internet but implemented to secure authorized access from internal assets to internal assets. Basic adjustments such as this allow for far superior prevention controls and, more importantly, detection controls. Think about this for a moment: If a computer on a subnet or zone A attempts to talk to any system found in zone B and the system from A is not allowed, then the connection will be denied, and you will be notified of that. Basic firewall rules aren't rocket science, but they are highly effective controls.

Modern challenges also must be overcome. For instance, consider an intrusion detection/prevention device, web proxy, data loss prevention sensor, network antivirus, or any other Layer 7 network inspection solution. These are all crippled by network encryption. Your brand-new shiny NGFW may not be configured to handle 70%+ of the traffic going through it. Basically, without understanding technologies like Secure Sockets Layer (SSL) inspection, SSL decrypt mirroring, HTTP Strict Transport Security (HSTS), certificate transparency, HTTP Public Key Pinning (HPKP), how can you handle modern encryption? A good architecture accounts for and handles network communication.

If you take the time to learn about your assets, you will be able to layer in multiple prevention and detection solutions and have a highly effective security architecture. Doing so will keep you prepared, even as your data traverses your network or the cloud. Understanding how to implement such an architecture by taking many of the security technologies you already own and implementing them with a fresh mindset and modern approach is essential in the creation of a defensible security architecture

Want to learn more? Check out the new SANS SEC530: Defensible Security Architecture course or research these concepts online.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info

Justin Henderson is a SANS Instructor and course author of SEC555: SIEM with Tactical Analytics, and CEO of H & A Security Solutions. He is a passionate security architect and researcher with over decade of experience working in the Healthcare industry. He has also had ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19551
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not b...
CVE-2019-19552
PUBLISHED: 2019-12-06
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the user management screen of the Administrator web site, i.e., the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user...
CVE-2019-19620
PUBLISHED: 2019-12-06
In SecureWorks Red Cloak Windows Agent before 2.0.7.9, a local user can bypass the generation of telemetry alerts by removing NT AUTHORITY\SYSTEM permissions from a malicious file.
CVE-2019-19625
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (which provides the tools that generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2) leaks node information due to a leaky default configuration as indicated in the policy/defaults/dds/governance.xml document.
CVE-2019-19627
PUBLISHED: 2019-12-06
SROS 2 0.8.1 (after CVE-2019-19625 is mitigated) leaks ROS 2 node-related information regardless of the rtps_protection_kind configuration. (SROS2 provides the tools to generate and distribute keys for Robot Operating System 2 and uses the underlying security plugins of DDS from ROS 2.)