Network SecurityAnd The Importance Of “Defense in Depth”

Network Defence:The Onion Model

Ever since the first viruses started infecting computers, IT departments have wrestled with whether it was more important to prioritize securing the network, or their endpoints. While every vendor will tell you they have the solution, the fact is that there are pros and cons to each, which is why security experts advocate adopting a “defense-in-depth” approach, and interweaving technologies to give them the best defense possible.

When looking at some of the recent US data breaches, many companies had invested heavily in the latest and greatest “next-generation” network detection-based security technologies. These work by trying to detect and block threats entering and leaving the network, and notifying security teams.

While this seems a fool-proof system on paper, the relentless noise generated by the literally thousands of daily alerts actually blinded IT to attacks. After all, trying to identify the one critical breach in a wave of thousands of security alerts is like trying to find a really sharp needle in a stack of regularly-sharp needles – not only difficult, but dangerous, too.

While there is an important place for network security – the simple fact that no system will ever be 100% secure shines light on the need for additional layers of security. Often network security solutions are trying to filter dangerous content from reaching vulnerable endpoints, but isn’t it better if we can make the endpoints less vulnerable? With this in mind, the best strategy is to build security from the endpoint out - reducing the attack surface and building defendable infrastructure.

While network-based security solutions can attempt to block threats before they hit the endpoint, the major problem with this approach is that companies that rely heavily on network security end up with an “eggshell” security stance – whereby a system is reliant on a single outer shell to protect all of the organization’s data. Without further securing the endpoints, even one small crack in the shell will leave the entire organization vulnerable, and this is without evening considering threats that don’t come via the corporate network.

Critical business data is accessed and stored on the endpoint, and as code – either good, bad or unknown – executes here, the endpoint effectively becomes the first line of defense for enterprise security against the latest APTs and cyber threats. The implementation of both network and endpoint detection into one inter-reliant defensive shell, or a “defense-in-depth” approach, removes the sole reliance on detection to block threats allowing organization to handle unknown and zero day attacks.

The main difficulty faced by detection solutions is the impossible trade-off between security and usability. Namely, all threats need to be deeply analyzed, but security teams simply cannot make employees wait while they address these issues, which would reduce productivity and staff morale.

Ultimately, this will often result in security features especially at a network level simply being disabled. Intel Security found that more than 30% of organizations disable network-based security features for this exact reason. Malware authors know this, and therefore will create attacks that simply lay dormant for a period of time to bypass the network sandbox. This has caused malware to evolve new methods of avoiding networks security products, including:

  •  Delayed onset
  •  Detecting virtualized environment
  •  Checking the number of CPU cores (network sandbox usually only presents one)
  •  Checking if user is real (monitor mouse movement, etc.)
  •  Exploiting the virtual environment to escape

With even the most effective network based defense facing the possibility of a breach, how can security admins ensure the same doesn’t happen to endpoints? The most effective way to complement a strong network defense is by reducing the attack surface of the endpoint.

This most commonly involves three key steps:

1. Removing administrator privileges – an extremely easy and cost-effective way to block malware from accessing the system and, and sensitive data.

2. Application whitelisting – allow only the known corporate approved applications to run preventing attackers from launching new malicious applications.

3. Sandboxing – isolate unknown or untrusted content such as websites, email attachments and downloaded documents away from sensitive corporate data to prevent attackers being able to access anything of value.

A bank doesn’t leave the vault door open just because they have a security guard on the door – they start from the vault and layer security outward. If the endpoint isn’t secure, and security admins do not ensure that both systems work in tandem, companies simply risk losing data, intellectual property, resources, money and invaluably, trust – in other words, everything.

Information-Management

 

 

« Close The Talent Gap - $10m Cisco Cybersecurity Scholarship Fund
Was The Internet Created In A Bar? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

BSI Group

BSI Group

BSI is the business standards company that equips businesses with the necessary solutions to turn standards of best practice into habits of excellence

Cambray Solutions

Cambray Solutions

Cambray Solutions LLC., is a leading technology consulting and software solutions company.

Senetas

Senetas

Senetas is a leading developer and manufacturer of certified high-assurance encryption solutions, dedicated to protecting network transmitted data without compromising performance.

Octopus Cybercrime Community

Octopus Cybercrime Community

The Octopus Community is a platform for information sharing and cooperation on cybercrime and electronic evidence.

International Association of Professional Security Consultants (IAPSC)

International Association of Professional Security Consultants (IAPSC)

Members of the IAPSC represent a unique group of respected, ethical and competent security consultants.

Datiphy

Datiphy

Datiphy's data-centric security platform uses behavioral analytics, and data-centric auditing and protection capabilities to mitigate risk.

Zertificon Solutions

Zertificon Solutions

Zertificon is a leader in professional email encryption and data security.

Korea Internet & Security Agency (KISA)

Korea Internet & Security Agency (KISA)

KISA is committed to improving the competitiveness, reliability and security of Internet information and knowledge in Korea.

The Open Group

The Open Group

The Open Group: Leading the development of open, vendor-neutral IT standards and certifications.

Exatel

Exatel

Exatel is Poland’s leading provider of ICT security services.

Gulf Information Security Expo & Conference (GISEC)

Gulf Information Security Expo & Conference (GISEC)

GISEC is the foremost cyber security conference in Asia, the Middle East and Africa.

ActZero

ActZero

ActZero’s security platform leverages proprietary AI-based systems and full-stack visibility to detect, analyze, contain, and disrupt threats.

Edgile

Edgile

Edgile is the trusted cyber risk and regulatory compliance partner to the world’s leading organizations, providing consulting, managed services, and harmonized regulatory content.

Rubrik

Rubrik

Rubrik helps enterprises achieve data control to drive business resiliency, cloud mobility, and regulatory compliance.

Auriga Consulting

Auriga Consulting

Auriga is a center of excellence in Cyber Security, Assurance and Monitoring Services, with a renowned track record of succeeding where others have failed.

Techsolidity

Techsolidity

Techsolidity is an emerging e-learning platform that offers a wide range of upskilling programs worldwide in areas including cybersecurity.