Network SecurityAnd The Importance Of “Defense in Depth”

Network Defence:The Onion Model

Ever since the first viruses started infecting computers, IT departments have wrestled with whether it was more important to prioritize securing the network, or their endpoints. While every vendor will tell you they have the solution, the fact is that there are pros and cons to each, which is why security experts advocate adopting a “defense-in-depth” approach, and interweaving technologies to give them the best defense possible.

When looking at some of the recent US data breaches, many companies had invested heavily in the latest and greatest “next-generation” network detection-based security technologies. These work by trying to detect and block threats entering and leaving the network, and notifying security teams.

While this seems a fool-proof system on paper, the relentless noise generated by the literally thousands of daily alerts actually blinded IT to attacks. After all, trying to identify the one critical breach in a wave of thousands of security alerts is like trying to find a really sharp needle in a stack of regularly-sharp needles – not only difficult, but dangerous, too.

While there is an important place for network security – the simple fact that no system will ever be 100% secure shines light on the need for additional layers of security. Often network security solutions are trying to filter dangerous content from reaching vulnerable endpoints, but isn’t it better if we can make the endpoints less vulnerable? With this in mind, the best strategy is to build security from the endpoint out - reducing the attack surface and building defendable infrastructure.

While network-based security solutions can attempt to block threats before they hit the endpoint, the major problem with this approach is that companies that rely heavily on network security end up with an “eggshell” security stance – whereby a system is reliant on a single outer shell to protect all of the organization’s data. Without further securing the endpoints, even one small crack in the shell will leave the entire organization vulnerable, and this is without evening considering threats that don’t come via the corporate network.

Critical business data is accessed and stored on the endpoint, and as code – either good, bad or unknown – executes here, the endpoint effectively becomes the first line of defense for enterprise security against the latest APTs and cyber threats. The implementation of both network and endpoint detection into one inter-reliant defensive shell, or a “defense-in-depth” approach, removes the sole reliance on detection to block threats allowing organization to handle unknown and zero day attacks.

The main difficulty faced by detection solutions is the impossible trade-off between security and usability. Namely, all threats need to be deeply analyzed, but security teams simply cannot make employees wait while they address these issues, which would reduce productivity and staff morale.

Ultimately, this will often result in security features especially at a network level simply being disabled. Intel Security found that more than 30% of organizations disable network-based security features for this exact reason. Malware authors know this, and therefore will create attacks that simply lay dormant for a period of time to bypass the network sandbox. This has caused malware to evolve new methods of avoiding networks security products, including:

  •  Delayed onset
  •  Detecting virtualized environment
  •  Checking the number of CPU cores (network sandbox usually only presents one)
  •  Checking if user is real (monitor mouse movement, etc.)
  •  Exploiting the virtual environment to escape

With even the most effective network based defense facing the possibility of a breach, how can security admins ensure the same doesn’t happen to endpoints? The most effective way to complement a strong network defense is by reducing the attack surface of the endpoint.

This most commonly involves three key steps:

1. Removing administrator privileges – an extremely easy and cost-effective way to block malware from accessing the system and, and sensitive data.

2. Application whitelisting – allow only the known corporate approved applications to run preventing attackers from launching new malicious applications.

3. Sandboxing – isolate unknown or untrusted content such as websites, email attachments and downloaded documents away from sensitive corporate data to prevent attackers being able to access anything of value.

A bank doesn’t leave the vault door open just because they have a security guard on the door – they start from the vault and layer security outward. If the endpoint isn’t secure, and security admins do not ensure that both systems work in tandem, companies simply risk losing data, intellectual property, resources, money and invaluably, trust – in other words, everything.

Information-Management

 

 

« Close The Talent Gap - $10m Cisco Cybersecurity Scholarship Fund
Was The Internet Created In A Bar? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Perimeter 81 / Zero Trust Network Access Guide

Perimeter 81 / Zero Trust Network Access Guide

Curious how you can Implement a Zero Trust roadmap with insights from Gartner? Download this free report for a limited time only.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Activereach

Activereach

Activereach provides a complete range of Internet, networking, voice & security solutions to businesses across the UK and Europe.

SOTI

SOTI

SOTI is an industry leader in Enterprise Mobility Management (EMM).

Phoenix Contact Cyber Security

Phoenix Contact Cyber Security

Phoenix Contact Cyber Security is a leading manufacturer of network security appliances for use in industrial environments.

Silverfort

Silverfort

Silverfort introduces the first security platform enabling adaptive authentication and identity theft prevention for sensitive user, device and resource throughout the entire organization.

Securitybulls

Securitybulls

Securitybulls is an information security firm offering an encyclopedic penetration testing & IT security assessment service for your organization.

Smart Protection

Smart Protection

Smart Protection are experts in brand and trademark protection - we fight against counterfeits and unauthorized usages of brands with machine learning technology.

UnderDefense

UnderDefense

UnderDefense provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats.

Quantropi

Quantropi

Quantropi is bound to be the standard for quantum-secure data communications – forever unbreakable, no matter what.