Rethinking IT Security Architecture: Experts Question Wisdom Of Current 'Layered' Cyberdefense Strategies

As attacks become more sophisticated and breaches abound, it's time for enterprises to change their cybersecurity thinking from the ground up, experts say

Layered security. Security integration. Defense in depth. For years now, cybersecurity professionals and vendors have been preaching sermons on the merits of an enterprise security strategy that mixes a variety of tools and technologies to create a complex barrier that hackers can't penetrate. "Layered security" has become as much a part of industry parlance as authentication or encryption.

There's just one problem: It isn't working.

While enterprises and government agencies have invested unprecedented resources in cybersecurity over the past few years, the incidence of new data threats and breaches remains at record highs. The most recent Verizon Data Breach Investigations Report (PDF) indicates that breaches involving hacking and malware were both up considerably last year, with hacking involved in 81 percent of incidents and malware involved in 69 percent. According to the Cost of a Data Breach Report, malicious attacks on enterprise data rose last year, and the cost of a breach is at an all-time high ($222 per lost record). According to figures posted this month by Panda Labs, more than 6 million new malware samples were detected in the third quarter alone, and more than a third of machines across the globe are already infected.

Is it time to hit the "reset" button on cybersecurity strategy? Should organizations challenge current thinking around security architecture -- and, particularly, the effectiveness of layered defense? Many experts think so.

"Organizations are implementing incremental improvements to their information security capabilities to provide short-term solutions -- without tackling the issues associated with the overall information security threat," says research and consulting firm Ernst & Young in its Global Information Security Survey 2012, published in October. "The need to develop a robust security architecture framework has never been greater."

However, 63 percent of organizations have no such framework in place, the study says. "For years, companies have been approaching security as a technical problem, usually by buying products to solve specific problems," says Jose Granado, principal and practice leader for IT security services at Ernst & Young and one of the authors of the new report. "There hasn't been much thought put to how those technologies will work together, or to the people and process sides of the equation."

While many large organizations have systems architects or network architects who help create the framework for the evolution of hardware and communications technology across the enterprise, most of E&Y's large clients do not have security architects, Granado says.

"There is a huge [difference] between organizations that have a security architect and those that don't," he comments. "When there is an architecture that's tied to the company's business goals, then there's a realization that security problems can't be solved in a silo." A well-defined architecture helps dictate how the various single-function security technologies will work together -- and makes it easier to find the weak spots in enterprise defenses, he says.

Vinnie Liu, partner and co-founder of Stach & Liu, a consulting firm that works with large enterprises on security architecture and tests companies' defense strategies, agrees that enterprises' historical focus on point solutions has prevented many organizations from developing a broader security strategy.

"The industry has been approaching the cybersecurity problem like the TSA has been approaching the air-security problem," Liu says. "First the bad guys brought guns on board, so they put in metal detectors. Then somebody put a bomb in his shoe, and now we all have to take our shoes off. Then they found liquid explosives, so now we can't bring on any liquids. It's one problem, one solution, with no real thought to the big picture."

If enterprises do have a broader defense strategy, then it's usually focused on "layering," in which the organization buys a variety of different point products, essentially creating an obstacle course that the attacker must navigate to get to the sensitive data, Liu observes. By implementing a patchwork of firewalls, antivirus software, intrusion prevention systems, and the like, the enterprise hopes to detect a wide variety of attacks and mitigate them before they can do much damage.

"The problem is that most of these tools are still signature-based, which means you're taking a known threat and blacklisting it. So what you're doing is essentially layering one technology with another layer of the same type of technology," Liu says. "It's sort of like putting on a coat, and then putting on another coat that covers the exact same parts of your body, and then wondering why you're still cold."

Stach & Liu recommends that rather than buying more point technology, organizations should perform a risk assessment that identifies the most sensitive areas of the business, the most likely threats, and a holistic defense strategy -- an architecture of technology and processes -- designed specifically to protect the business. The risk assessment, along with the definition of the business' specific security requirements, helps identify top priorities and most likely threats, as well as key goals -- such as compliance -- in order to develop a comprehensive, practical defense strategy.

"You need to define your [security] requirements, just as you would with any architecture," Liu says. "Most companies don't take this step, so when it comes to building out the architecture, they have a hard time. They're trying to defend against everything without really knowing what problems they're trying to solve."

Next Page: The most important piece of developing a security architecture. Tim Wilson is Editor in Chief and co-founder of Dark, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 2 / 2
User Rank: Apprentice
12/27/2012 | 8:33:07 PM
re: Rethinking IT Security Architecture: Experts Question Wisdom Of Current 'Layered' Cyberdefense Strategies

The article title and the article itself don't seem to
match.- The quote from Steve Pao about
M&M security no longer being valid has been well known by the Information
Assurance community for over a decade.-
The M&M quote also conflicts with the article title; is layered
security old hat or isn't it?
While the article touches on everything from Risk
Assessments to cloud security, it misses one critical component most of these
articles miss - the human element.- All
of the security in the world isn't going to matter if people can be tricked
into giving out their password or executing the code at the other end of the
HTTP link.

<<   <   Page 2 / 2
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-01-22
A type confusion vulnerability exists when processing project files in CX-Supervisor (Versions 3.42 and prior). An attacker could use a specially crafted project file to exploit and execute code under the privileges of the application.
PUBLISHED: 2019-01-22
The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases where the BMC console u...
PUBLISHED: 2019-01-22
CX-Supervisor (Versions 3.42 and prior) can execute code that has been injected into a project file. An attacker could exploit this to execute code under the privileges of the application.
PUBLISHED: 2019-01-22
An attacker could inject commands to delete files and/or delete the contents of a file on CX-Supervisor (Versions 3.42 and prior) through a specially crafted project file.
PUBLISHED: 2019-01-22
Several use after free vulnerabilities have been identified in CX-Supervisor (Versions 3.42 and prior). When processing project files, the application fails to check if it is referencing freed memory. An attacker could use a specially crafted project file to exploit and execute code under the privil...