-: Defense in Depth.
So, when we talk about defense in depth
this is the foundation of good security architecture.
This means that we're not gonna rely on a single
defensive measure for control or protection
because the problem is if you have just one hole
it's real easy to break into a system.
But, even with Defense in Depth it's not fool proof.
You need to try to make sure that the holes don't line up.
So, as you can see in this image I have four different
layers of defense pictured here and you can see
that all three, all four of those had lined up
so that the attacker could still get in.
Our job is to make those holes not line up
so that they're all in different places
so that we can stop the attacker.
We do that using our physical, our logical
and our administrative controls.
Now, when we talk about layered defense we start
from the inside out.
We wanna protect the data, that's the inside part.
That might be things like doing data integrity checks
or encrypting the data.
Then, we wanna protect the application itself
and that could be using security patches for things
like Microsoft Word, Internet Explorer or Google Chrome.
Then we talk about endpoint security.
We put on things like anti-virus or malware detection.
Then we go into the network.
We start talkin' about intrusion detection systems
and intrusion detection systems and firewalls.
And then we get out to the perimeter and we start
talking about our border routers and our firewalls.
All of this stuff creates a nice layered approach
that hopefully one of those layers will stop
the attacker from getting in.
Now, it is difficult to design and implement
a good layered defense, but it is important.
You have to consider the business needs and the usability
in the design of your layered foundations
because otherwise, you can actually stop
business function by putting something on the network.
For example, if I went and encrypted every single
data file I had on the network and then post them
on my website, but didn't give the key to my customers,
well yeah the data's secure, but the customer
still can't see it.
So, that layered defense would stop business operations.
So we have to consider that as we go through
and do our layered security.
So there are four different ways that we can design
our architecture when we start talking about
layered security defense.
We can do uniform protection, protected enclaves,
risk or threat based and information
or classification based.
Let's go ahead into each one of those in detail.
Uniform protection is gonna give you the same protection
across all data, all systems and all networks.
Now, the problem with this is if you have
a large network this gets really expensive.
If you have a small network it may be okay to do this.
So, in this example I have one trusted internal zone
and I'm gonna provide all the work stations
and all the servers the same patches, anti-virus,
host intrusion detection systems, all the same protection.
So, my focus is everywhere.
I wanna protect everything and everywhere inside my network.
That's the problem with uniform protection.
Instead, in the real world, we often have to start
breaking it up and making hard choices of what we're
gonna protect more and what we're gonna protect less.
So, we start talking about things like protected enclaves.
And this is where we take an enclave that houses
more sensitive data and gives it additional protections.
So on the screen here you can see that the data,
there's a firewall between our inner and outer routers
there and then we have two additional firewalls placed,
one in front of the credit card operations network
and one in front of our data center because we want
those protected even more than the normal company network
because our data center has all of our servers in it
and our credit cards have additional compliance
requirements based on PCIDSS.
So, by doing that protected enclave it allows us
to break those pieces out and give them additional
protection that they need like maybe an intrusion
protection system, an extra firewall, maybe additional
monitoring capabilities, whatever those things are.
Now, when we start looking at risk or threat based,
we are gonna talk about addressing specific risks or threats
in the design.
So, for instance, if you're concerned with phishing
as one of the threat vectors, you may wanna employ
additional controls that will scan and filter
your incoming emails and you may do that for your
company based network like we saw on the last slide,
as opposed to our data center because the company based
network is where our users are.
And so, based on whatever threat or risk we're looking at
we're gonna apply additional protections and measures
and controls to try to reduce that threat
to an acceptable level.
The last one we're gonna talk about is information
or classification based and this is gonna map
our data protection to different classes of information.
This is what you'll see in governments and military
and even in some companies.
You'll classify all of your information
based on what level it is.
So, if we're dealing with a military construct
you might be looking at unclassified and secret
and top secret information.
If you're dealing with a company you may be looking
at classified versus official use, right.
Higher classification levels are gonna get
additional protections.
So, in this case, I have broken up my network
into two pieces.
I have my unclassified network on the left
and then I have my secondary network, which have
my confidential data and I put a data loss program
in place in front of it and that gave it
additional protection based on its classification level.
Very similar to risk or threat based, but in this case
we're looking at the risk of higher classification data
being leaked out.
Now, what do you really do when you look at these models?
Do you use just one of them?
Well, no.
Often we're gonna combine these four models
into pieces and parts as opposed to picking
a singular model because again, layered defense
is a tricky concept.
You're gonna be taking some threat
and risk information in there.
You're going to be taking some information
and classification information in there.
You're gonna be taking multi enclaves in there.
All of those things get combined
except on the very smallest of networks
where people will use universal protection.