Intro

In this lesson, we step through security layers needed to protect sensitive data and highly categorized resources. Implementing reasonable and appropriate security at each layer is implementation of defense in depth. You can download the script for this video from above or at the end of the video.

Overview

This graphic depicts what we usually think of when we discuss defense in depth. As we walk through each layer, remember that we need more than one safeguard at each layer. These are sub-layers within in-depth defense. Beginning with the outer layer, each layer is supported by the layers surrounding it and the layers within it. Security defense in depth is not building each layer in isolation. Instead, security professionals build a security infrastructure that reduces risk by managing each threat vector across multiple layers. The administrative layer includes policies, standards, guidelines, procedures, and awareness. These represent the outer circle of our defense in depth.

Administrative Layer

All security efforts begin with policies. Policies address resource risk issues beginning at the top of an enterprise network and stretching across all resources. Policies do not tell us how to protect resources. Rather, they state management's security expectations for networks and systems; they drive all the other layers. Standards and guidelines support policies by providing requirements and guidance about how to achieve management expectations. Standards are required steps that security teams must take to protect defined IT operations and resources. For example, a policy might state that all remote access by employee mobile devices must be encrypted. A standard would stipulate how to achieve that encryption. For example, it might require the use of SSL VPN for all remote access. A guideline is a recommendation; it is not a requirement. Guidelines provide more latitude in how security teams meet policy requirements. For example, an organization wants to ensure multi-factor authentication is used to access highly classified data. This is stated clearly in an access control policy. However, management does not want to dictate how to achieve this in all situations. Consequently, guidelines stipulate that security use two of three authentication factors something a user knows, something a user has, and something a user is. Procedures are step-by-step instructions for achieving security tasks that comply with standards and guidelines. They ensure consistent application of what is expected to manage risk. Policy, standards, guidelines, and procedures are ineffective if all affected users are either unaware of them or confused on how to apply the. Security training fills this gap. Included in security training are awareness activities to help fill the gaps left by technology safeguards. Awareness training helps users understand what is and is not considered safe use of the organization's information resources. Reliance on user behavior is a control of last resort, but it is required to help manage residual risk. Residual risk is a risk left after we apply all of our safeguards.

Physical Layer

The physical layer includes all barrier, detection, and response controls needed to manage physical intrusion by threat actors. The purpose of physical safeguards is to delay intruders until they can be detected and intercepted. In most cases, physical access by an intruder circumvents many if not most safeguards surrounding an information resource.

Network Layer

Network segments are placed in the physical structures that help protect them from unauthorized physical access. This includes securing the data center and wiring closets containing patch panels and access layer switches. Network security also includes the use of network layer intrusion prevention and detection systems. Network segmentation secured with segment access control lists, web filtering, data loss prevention filtering, secure switch and router configurations, firewalls at the perimeter and at ingress points leading to network segments, and traffic encryption as dictated by risk.

Endpoint Layer

Endpoint devices are placed within an environment secured by previous layers. In addition, organizations must use risk assessments to determine how to harden user devices and servers. For user devices, assessing attack vectors related to the Cyber Kill Chain is a good start. The Cyber Kill Chain developed by Lockheed Martin steps through the path generally taken by threat actors to compromise endpoint devices. We place safeguards to break the links in the chain.

Application Layer

Application security, as with all the layers in this defense-in-depth model, starts in the design phase. Applications must be securely coded, comprehensively tested, and audited over time. Application security considerations include using the OWASP Top 10 to assess web application attack surfaces for the presence of likely vulnerabilities often leveraged by threat actors; using code scanning tools to identify likely vulnerabilities; and including security misuse cases in design reviews as well as in unit, QA, and acceptance testing.

Data Layer

Our security efforts largely involve protecting the confidentiality and integrity of sensitive data, and the availability of the resources that enable the safe management and distribution of those data. Consequently, data is the core of our defense-in-depth model.

Testing, verification, and monitoring

No defense-in-depth efforts are perfect. There is always some residual risk. Penetration testing helps ensure that residual risk is at acceptable levels and should be performed before an application is implemented into production, after it is in production, and periodically during its life cycle. A penetration test should not just look at one or two layers; it should also look across all layers to determine the overall strength of the layered safeguards. Following a formal process, penetration testing can point out weaknesses at one or more layers or within one or more layers of the defense and depth design. In many cases, no new safeguards are needed. The organization just needs to reconfigure its existing safeguards and access the existing devices and applications. Finally, organizations should monitor for anomalous behavior noted in the logs collected from safeguards, network devices, and endpoints. This enables quick incident response to mitigate business impact from a potentially successful attack. Log management solutions like SIEM also help identify weak points in our defenses not found during penetration or other testing. That's it for this lesson. If you have questions, please ask. ...and until next time be careful what you click. you