Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


10:30 AM
Jon Kim
Jon Kim
Connect Directly
E-Mail vvv

Network Security: An Ounce Of Prevention Is Worth A Pound Of Reaction

For humans ailments, prevention might begin with an allergist. In security, it's the network engineer.

Imagine you're at a seafood restaurant. One look at the menu, and you know exactly what you want: lobster. Your food arrives, you clean your plate, and then proceed to pull out your EpiPen because you also happen to have a life-threatening shellfish allergy.

Sound improbable? Let's hope so. Chances are, you'd bypass the lobster in favor of the significantly less lethal cod. Preventing damage, after all, is almost always better than reacting to it. Sure, you still need the EpiPen. After all, no matter how diligently you avoid it, sometimes shellfish happens. Just don't invite it to the table.

Now, think of your network — including how you protect it.

Much like an EpiPen for food allergies, you need security capabilities in remediating attacks. But once a breach occurs, your ability to mitigate damage is limited by how quickly you detect and respond to it. Just ask Sony, which experienced one of the most massive breaches of the 21st century, costing an estimated $35 million.  

Truly securing our networks requires practicing preventive medicine. That means diagnosing potential vulnerabilities and integrating pre-emptive measures into our IT infrastructure. Reactive measures alone won't suffice.

For humans, prevention might begin with an allergist. In security, it's the network engineer. No one is better positioned to assess network health risks or to determine the best configurations to prevent attacks. But first, we need to shift our perceptions about engineers' roles in security from the start.

Prevention as a Cyberthreat Cure
While network engineers do care about security, it's not their primary focus. Their perception of security originates from colleagues who focus specifically on security, and thus might be unaware of how network designs and configurations themselves affect security. 

A network engineer's work is judged by the network's functionality, performance, and reliability. Consequently, security measures are often implemented after deployment — with firewalls or VPNs, for instance — instead of earlier, when prevention matters most.

Education Is Critical
I recently interviewed multiple enterprise networking candidates, some of them Cisco Certified Internetwork Expert certified. Unsurprisingly, their concept of security was limited to intrusion detection or event logs. I've yet to hear a candidate mention making actual infrastructure enhancements to secure a router or switch environment. 

If we want to create networks with intrinsic self-protections, we should begin with how we educate network engineers. At many universities, network engineering programs focus on logic, infrastructure, architecture, and visualization. When addressing security, however, curricula are often vague or focused on topics such as intrusion detection and firewalls. And, of course, traditional technologies still matter. But let's also teach how even the simplest capabilities, such as network segmentation (or micro-segmentation), can address threats.

At the same time, we can't simply wait on a new generation of security-minded network engineers to graduate. Those of us already in the field need to change our own perceptions of and approaches to security as well.  

For network engineers, the traditional focus on designing, building, and maintaining networks creates a silo — one unoccupied by security. Unfortunately, this disempowers engineers from playing meaningful roles in their organizations' security strategies. 

It's time for network engineers to abandon convention and believe that network security begins with them — particularly their network designs. 

Think about segmentation technology. It's not a traditional security tool; it's a network tool — one that, used properly, has significant security impact. Without segmentation, for instance, an attacker could easily breach a pharmaceutical company's payroll department and subsequently access the lucrative research and development department. In a well-segmented network, however, the same attacker couldn't access R&D from payroll, because those two traffic streams are isolated from one another.

Most IT leaders want to avoid introducing too much new technology at once. Eventually the organization tires of it — even solutions designed to protect your system. 

But improving your security posture doesn't always mean large investments of money, time, or resources. Instead of buying new technology to fix old problems, we should utilize our existing capabilities. 

Often, better security is achievable through comparatively simple network tweaks and changes, such as refreshing switches and routers. If your system runs on Oracle, for example, invite networking team members to discuss what they can do to improve basic security hardening — no shiny new security tools needed.

Doing this effectively requires bringing your networking team into security discussions from the start. Early participation allows network engineers to understand their contributions to your security strategy, and to play an active role in its success.

Sustainable, Preemptive Security
Sometimes, no matter how aggressively you respond to a breach, the damage is done. Perhaps Bill Gates said it best: "Treatment without prevention is simply unsustainable."

Ideally, your network should offer its own best defense — a goal that begins with prevention and made possible by your network engineers. They not only know your network better than anyone, but with the right support, education, and planning, they can play a first-line role in securely configuring it. Ultimately your engineers should play a crucial role in your organization's overall security posture by heading off threats from the start.  

Related Content:

Jon Kim is the Director of NextGen Networking at Force 3. In this role, Jon is responsible for providing unique expertise to help clients build effective, long-term IT strategies around software-defined networking (SDN) platforms and emerging technologies. He has more than ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
1/6/2017 | 10:15:51 AM
Detection is a must
Yes, please do take every measure possible to prevent an event but, rest assured, if someone wants you they will have you. Having consulted at Fortune 50 companies and government agencies I can assure you that the attackers have more ways in than you have safegaurds.

Prevention is important but detection is a MUST. Stop thinking you can be 100% safe 100% of the time and start planning for how you will recover. Spend time, money and brainpower on how you will find an attack as quickly as possible,
User Rank: Strategist
12/26/2016 | 3:45:49 PM
Thanks. This is nice post regarding the Network Security. It one of the most importnat thing to keep our data safe from hacker.


US Formally Attributes SolarWinds Attack to Russian Intelligence Agency
Jai Vijayan, Contributing Writer,  4/15/2021
Dependency Problems Increase for Open Source Components
Robert Lemos, Contributing Writer,  4/14/2021
FBI Operation Remotely Removes Web Shells From Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unprivileged users through the iteration of crafted AbuseFilter rules.
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked could bypass AbuseFilter and have their edits completed.
PUBLISHED: 2021-04-22
An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppressed MediaWiki usernames to unprivileged users.
PUBLISHED: 2021-04-22
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.
PUBLISHED: 2021-04-22
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.