Understanding Defense

Before defending a network an analyst must identify three things: the assets, the vulnerabilities in the system and the threats to the assets.

Asset

Anything of value to the organisation that must be protected: servers, infrastructure devices, end devices and, the greatest asset, data.

Vulnerability

A weakness in a system or its design that a threat actor could exploit.

Threat

Any potential danger to an asset.

Attack surface

All the devices and information the organisation owns or manages, which threat actors could target.

Asset management is inventorying every asset, then building and applying policies and procedures to protect them. The organisation also has to locate its critical information assets and know how access to them is gained. Different assets attract different threat actors: a retail business stores card data, an engineering firm stores competition-sensitive designs, a bank stores customer and account data.

Asset classification groups resources by common characteristics so the most critical receive the highest protection and, if needed, special handling. A labelling system shows how valuable, sensitive and critical information is. It takes four steps.

Asset standards name the specific hardware and software products an organisation uses. After a failure, staff do not scramble for a replacement part. Non-standard environments need more expertise and raise the cost of maintenance contracts and inventory.

Cybersecurity specialists manage an information asset and its systems through five stages.

Threat identification gives the organisation a list of likely threats for its environment. It asks three questions.

1. 1.What are the possible vulnerabilities of the system?
2. 2.Who may want to exploit them to reach specific information assets?
3. 3.What are the consequences if they are exploited and assets are lost?

Finding vulnerabilities means understanding the important applications in use and the weaknesses of each application and its hardware. The module's example is an e-banking system with seven threats.

Defense-in-depth uses multiple layers of security at the network edge, inside the network and on endpoints. The layers work together so that the failure of one safeguard does not affect the effectiveness of the others. It does not remove the need for firewalls or mitigate every vulnerability.

Other devices in the design: IPS (intrusion prevention systems), AMP (advanced malware protection), web and email content security, identity services and network access controls.

With only one measure in place, a criminal needs to beat only that one. The five strategies build in more.

Configuration management is identifying, controlling and auditing the implementation of, and any changes to, a system's established baseline. The baseline configuration is the settings configured for a system that form the template for all similar systems. For example, the required applications and system settings for every Windows workstation the organisation deploys.

A log records all events as they occur, and each log entry holds the details of one event. Logs show how an attack occurred and which defences worked.

Log management sets the procedures for generating, transmitting, storing, analysing and disposing of log data.

A protocol analyser (packet analyser, packet sniffer) intercepts and logs network traffic on wired and wireless networks. It captures each packet, reads its fields and analyses its content. Its functions are traffic logging, network problem analysis, detection of network misuse, detection of intrusion attempts and isolation of exploited systems.

Business policies govern an organisation's actions and define correct behaviour. On a network they define the allowed activities and so set a baseline of acceptable use. Behaviour that breaks policy may mean a security breach.

A comprehensive security policy demonstrates commitment to security, sets expected behaviour, ensures consistency in operations, acquisition and maintenance, defines the legal consequences of violations and gives security staff the backing of management.

The AUP (also called an appropriate use policy) is one of the most common components. It defines what users may and may not do, including the type of traffic allowed. Make it as explicit as possible, for example by listing prohibited websites, newsgroups or bandwidth-heavy applications. Every employee signs it and signed copies are kept for the length of employment.

BYOD (bring your own device) lets employees use personal mobile devices to reach company systems, software, networks or information. Benefits: higher productivity, lower IT and operating costs, better mobility, greater appeal for hiring and retention. Risk: data breaches and greater liability for the organisation.

A BYOD security policy states the goals of the program, which employees may bring devices, which devices are supported, the access level granted, the rights and permitted activities of security staff on the device, which regulations apply and the safeguards if a device is compromised.

Compliance regulations are external rules that define what an organisation must provide and its liability if it fails to comply. Which ones apply depends on the type of organisation and the data it handles. INFOSEC (Information Systems Security) professionals must know the laws and codes of ethics that bind them.