At the core of any organization is a certain amount of data, or information, used to conduct business or meet mission objectives. That information needs to be protected through the use of multiple security mechanisms. The key concept here is that if an attacker compromises one security mechanism that was in place during the attack, other mechanisms should step up to deny further access, alert the organiza- tion of the intrusion, or both. This is known as a layered defense.
As an example of this concept, consider Figure 3-1. At the center, you can see the critical information the organization is trying to protect. Each security mechanism you implement around the information pro- vides another level of protection through which an attacker must pass to compromise that information. The more layers you have, the better protected your information is, in theory.
Bear in mind that a layer is only as useful as the quality of its implementation. For instance, if you were to use a poorly configured firewall to protect the network perimeter around your information, that fire- wall would provide a much weaker boundary through which the attacker must pass. A more securely configured firewall has a better chance of stopping an intruder. This concept is true with all security mechanisms or products you implement. But as you consider these layers, please remember that even security products have vulnerabilities associated with them.
The outermost ring around the information in Figure 3-1 is the router. Since the router was first intro- duced, professionals have viewed it as a vital component to the networking function. Over the last 10 years, however, the role of the router has expanded dramatically and now provides the first line of defense. The access control lists (ACLs) implemented on routers can provide approval or denial of net- work traffic traversing into or out of a network.
Firewalls provide the second outermost ring. Firewalls can be hardware or software based, but the basic premise is the same: control traffic at a more granular level. These devices allow you to control not only network address filters but also protocol filters. Organizations can now allow certain computers in or out of the network based on what protocol or host they are attempting to reach.
Figure 3-1
Intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) are the next layer, providing a mechanism for administrators and security professionals to monitor attempts to bypass the defenses they have put into place. A huge number of these products are cropping up on the market, but the key is that an IDS passively monitors traffic and simply alerts, and logs, when it detects nefarious traffic. An IPS, on the other hand, provides this same capability, along with the added bonus of actively stop- ping the offending traffic.
We’ve included virus protection as the next layer because it operates on both a network level and host level. Border firewalls and other security devices now have the ability to scan for viruses in incoming and outgoing e-mails and file exchanges. Host-based virus detection provides this same protection on the various computers in the organization. With the huge numbers of servers and workstations that have been plagued by virus attacks over the last 10 years, this layer is considered a normal cost of doing busi- ness at most companies.
The secure configuration of the hosts and servers on the network provides the next layer of defense in our example. Disabling services that aren’t required and ensuring that applications are patched appro- priately are big pieces of this layer. This layer could also include local host-based firewalls or intrusion- detection mechanisms.
Policies are the second innermost ring in our defense example. In contrast to the previous layers we’ve discussed, this one is not technical in nature. Instead, security policies define what the security goals and objectives of the organization are at the current time. These goals mostly relate directly to the mis- sion of the organization and how it conducts its business. These documents include such items as
Router Firewall IDS/IPS Virus Hosts Policies Users
Critical
Information
documents, just to name a few. The documents in question should be endorsed and supported by the upper management within the organization; otherwise, they aren’t worth the paper they’re printed on. Users are the innermost layer because they provide the absolute last layer of defense within your organi- zation. In case all other layers fail, an organization needs to depend on knowledgeable and ethical users to protect the critical information. To do this, the users must be informed and trained concerning the security policies and how the loss of critical information could impact the organization. Education is key here. This layer also relies quite heavily on hiring the correct personnel through the use of background checks.
Remember that the defense processes you put into place within your organization should be based on your needs. Some organizations may need fewer layers, whereas others may require many more layers. Use what you need based on the value of the information and the threats to that information.