1 1 00:00:00,580 --> 00:00:02,010 Defense in depth. 2 2 00:00:02,010 --> 00:00:04,700 In this lesson, we're going to discuss defense in depth 3 3 00:00:04,700 --> 00:00:06,750 which includes network segmentation enforcement, 4 4 00:00:06,750 --> 00:00:08,460 screen subnets and DMZs, 5 5 00:00:08,460 --> 00:00:10,790 the separation of duties and honeypots. 6 6 00:00:10,790 --> 00:00:12,960 So what is defense in depth? 7 7 00:00:12,960 --> 00:00:15,570 Well, defense in depth is an approach to cybersecurity 8 8 00:00:15,570 --> 00:00:17,610 in which a series of defensive mechanisms 9 9 00:00:17,610 --> 00:00:19,360 are layered on top of each other 10 10 00:00:19,360 --> 00:00:22,260 in order to protect valuable data and information. 11 11 00:00:22,260 --> 00:00:24,190 Defense in depth is truly the foundation 12 12 00:00:24,190 --> 00:00:26,430 of a good network security architecture. 13 13 00:00:26,430 --> 00:00:27,570 With defense in-depth, 14 14 00:00:27,570 --> 00:00:29,830 we're not going to rely on just a single defensive boundary 15 15 00:00:29,830 --> 00:00:31,530 or measure of protection in place. 16 16 00:00:31,530 --> 00:00:33,740 Instead, we're going to be able to layer them 17 17 00:00:33,740 --> 00:00:35,810 on top of each other, because if we don't, 18 18 00:00:35,810 --> 00:00:37,330 an attacker can find a vulnerability 19 19 00:00:37,330 --> 00:00:38,920 and exploit a single boundary 20 20 00:00:38,920 --> 00:00:41,120 and get access to our entire network. 21 21 00:00:41,120 --> 00:00:44,390 So, instead, we're always going to be layering our defenses 22 22 00:00:44,390 --> 00:00:45,590 and this way, we can ensure 23 23 00:00:45,590 --> 00:00:47,510 that none of these vulnerabilities line up 24 24 00:00:47,510 --> 00:00:48,830 across all the layers, 25 25 00:00:48,830 --> 00:00:51,570 because if they do, then an attacker would still be able 26 26 00:00:51,570 --> 00:00:53,370 to compromise our network. 27 27 00:00:53,370 --> 00:00:54,400 Our goal is to make sure 28 28 00:00:54,400 --> 00:00:56,450 that the vulnerabilities don't all line up 29 29 00:00:56,450 --> 00:00:58,510 because we want to make sure we can stop attackers 30 30 00:00:58,510 --> 00:00:59,970 from being successful. 31 31 00:00:59,970 --> 00:01:01,810 To achieve this, we're going to use a mixture 32 32 00:01:01,810 --> 00:01:04,790 of different physical, logical and administrative controls 33 33 00:01:04,790 --> 00:01:06,500 to help secure our networks. 34 34 00:01:06,500 --> 00:01:08,970 Let's consider an example and look at it from the inside 35 35 00:01:08,970 --> 00:01:10,300 and work our way out. 36 36 00:01:10,300 --> 00:01:11,880 When we talk about layer defense, 37 37 00:01:11,880 --> 00:01:14,510 we're first going to start on the inside with our data. 38 38 00:01:14,510 --> 00:01:15,720 We need to protect our data 39 39 00:01:15,720 --> 00:01:17,860 by doing things like data integrity checks 40 40 00:01:17,860 --> 00:01:19,320 or encrypting the data. 41 41 00:01:19,320 --> 00:01:21,300 Next, we want to protect the applications 42 42 00:01:21,300 --> 00:01:22,710 that manipulate our data. 43 43 00:01:22,710 --> 00:01:25,100 This way, we can ensure that all of the security patches 44 44 00:01:25,100 --> 00:01:27,990 are up to date for applications like Microsoft office, 45 45 00:01:27,990 --> 00:01:30,160 Google Chrome or Adobe Acrobat. 46 46 00:01:30,160 --> 00:01:32,330 By making sure these applications are protected, 47 47 00:01:32,330 --> 00:01:34,900 we're going to make sure the data doesn't get modified 48 48 00:01:34,900 --> 00:01:36,050 by mistake. 49 49 00:01:36,050 --> 00:01:38,880 Then, we can look at how we secure our host itself. 50 50 00:01:38,880 --> 00:01:41,120 So, we're going to add some end point security. 51 51 00:01:41,120 --> 00:01:43,720 This can be things like antivirus, anti-malware, 52 52 00:01:43,720 --> 00:01:45,820 host based intrusion detection systems, 53 53 00:01:45,820 --> 00:01:47,110 windows security patching, 54 54 00:01:47,110 --> 00:01:49,340 or implementing some other hardening measures 55 55 00:01:49,340 --> 00:01:50,740 and configurations. 56 56 00:01:50,740 --> 00:01:52,410 Next, we're going to go into the network 57 57 00:01:52,410 --> 00:01:53,540 and we're going to start talking about things 58 58 00:01:53,540 --> 00:01:55,600 like network intrusion detection systems, 59 59 00:01:55,600 --> 00:01:58,120 and IP addresses and access control lists, 60 60 00:01:58,120 --> 00:02:00,630 and VLANs and unified threat management systems 61 61 00:02:00,630 --> 00:02:02,050 and things like that. 62 62 00:02:02,050 --> 00:02:04,020 Next, we're going to move out to our perimeter 63 63 00:02:04,020 --> 00:02:06,260 and here, we're going to consider our border routers, 64 64 00:02:06,260 --> 00:02:08,780 our firewalls, our VPN connections 65 65 00:02:08,780 --> 00:02:10,730 and any cloud-based connections we may have 66 66 00:02:10,730 --> 00:02:12,690 going into or out of our network. 67 67 00:02:12,690 --> 00:02:14,700 By considering each of these different layers, 68 68 00:02:14,700 --> 00:02:17,380 we hopefully can ensure there's no straight line of attack 69 69 00:02:17,380 --> 00:02:19,320 by lining up all the different vulnerabilities 70 70 00:02:19,320 --> 00:02:21,470 and allowing an attacker to exploit our network 71 71 00:02:21,470 --> 00:02:22,680 in our hosts. 72 72 00:02:22,680 --> 00:02:24,480 So, now that we've talked about the concept 73 73 00:02:24,480 --> 00:02:25,930 of layering our defenses 74 74 00:02:25,930 --> 00:02:28,010 let's consider how we might apply these layers 75 75 00:02:28,010 --> 00:02:30,660 as we move laterally across our network as well. 76 76 00:02:30,660 --> 00:02:32,660 To help provide protections between different portions 77 77 00:02:32,660 --> 00:02:36,040 of our network, we also want to create network segmentation. 78 78 00:02:36,040 --> 00:02:37,630 By creating network segmentation, 79 79 00:02:37,630 --> 00:02:39,820 we can separate a single larger network 80 80 00:02:39,820 --> 00:02:42,730 into different levels of security or levels of protection 81 81 00:02:42,730 --> 00:02:45,410 and we can keep data from moving between these areas 82 82 00:02:45,410 --> 00:02:48,420 without first being inspected by our requirements. 83 83 00:02:48,420 --> 00:02:50,390 Now to enforce network segmentation, 84 84 00:02:50,390 --> 00:02:53,050 we can check data as it tries to enter or leave 85 85 00:02:53,050 --> 00:02:54,550 a different part of the network. 86 86 00:02:54,550 --> 00:02:56,900 We do this by creating choke points in our network, 87 87 00:02:56,900 --> 00:02:59,840 by adding subnets or VLANs into our networks. 88 88 00:02:59,840 --> 00:03:01,260 Each of these subnets or VLANs 89 89 00:03:01,260 --> 00:03:03,540 would then require their data to be passed to a router 90 90 00:03:03,540 --> 00:03:05,950 before entering a different subnet or VLAN. 91 91 00:03:05,950 --> 00:03:07,560 As it passes through that router, 92 92 00:03:07,560 --> 00:03:09,210 the network traffic can be inspected 93 93 00:03:09,210 --> 00:03:12,040 and compared against the access control lists on that router 94 94 00:03:12,040 --> 00:03:13,380 and its interfaces. 95 95 00:03:13,380 --> 00:03:16,180 Based on those ACL rules, the traffic can be blocked 96 96 00:03:16,180 --> 00:03:18,230 in order to isolate the subnet or VLAN. 97 97 00:03:18,230 --> 00:03:20,650 It can be filtered to allow only specific traffic to enter 98 98 00:03:20,650 --> 00:03:22,210 or leave that subnet or VLAN 99 99 00:03:22,210 --> 00:03:24,060 or it can be allowed to freely pass 100 100 00:03:24,060 --> 00:03:25,630 between the subnets or VLANs 101 101 00:03:25,630 --> 00:03:27,220 if we're going from one trusted zone 102 102 00:03:27,220 --> 00:03:28,730 to another trusted zone. 103 103 00:03:28,730 --> 00:03:32,020 Most networks have at a minimum three security zones. 104 104 00:03:32,020 --> 00:03:34,490 These three segments or zones are the intranet 105 105 00:03:34,490 --> 00:03:35,810 or the internal network, 106 106 00:03:35,810 --> 00:03:39,110 the screen subnet or DMZ, demilitarized zone 107 107 00:03:39,110 --> 00:03:41,690 and the internet or your external network. 108 108 00:03:41,690 --> 00:03:43,870 For example, here you can see the intranet, 109 109 00:03:43,870 --> 00:03:46,570 the screen subnet or DMZ and the internet. 110 110 00:03:46,570 --> 00:03:50,050 These are my three security zones, but I didn't stop there. 111 111 00:03:50,050 --> 00:03:52,550 I also have a data center and it has its own segment 112 112 00:03:52,550 --> 00:03:55,970 that is connected to the internet, the DMZ and the internet. 113 113 00:03:55,970 --> 00:03:57,000 Now, as you can see, 114 114 00:03:57,000 --> 00:03:58,520 how the segmentation is going to be used 115 115 00:03:58,520 --> 00:04:00,190 to create a more complex network 116 116 00:04:00,190 --> 00:04:01,970 while still providing these choke points 117 117 00:04:01,970 --> 00:04:03,920 where we can screen or inspect the traffic 118 118 00:04:03,920 --> 00:04:06,630 as it moves between different parts of this network. 119 119 00:04:06,630 --> 00:04:09,320 This is one of the reasons that the name DMZ has changed 120 120 00:04:09,320 --> 00:04:10,580 to a screen subnet 121 121 00:04:10,580 --> 00:04:13,560 because DMZ is just one type of screen subnet, 122 122 00:04:13,560 --> 00:04:15,540 but there are many others that we can implement 123 123 00:04:15,540 --> 00:04:17,830 based on our particular business use cases. 124 124 00:04:17,830 --> 00:04:20,590 For clarification, whenever you hear the term DMZ, 125 125 00:04:20,590 --> 00:04:23,190 I want you to remember that refers to a perimeter network 126 126 00:04:23,190 --> 00:04:25,840 that protects an organization's internal local area network 127 127 00:04:25,840 --> 00:04:27,460 from untrusted traffic. 128 128 00:04:27,460 --> 00:04:29,520 Normally, this is just going to be a subnet 129 129 00:04:29,520 --> 00:04:31,620 where you're going to place all your public facing servers, 130 130 00:04:31,620 --> 00:04:33,430 like your email servers, web servers 131 131 00:04:33,430 --> 00:04:35,930 and file servers that you need to have access to 132 132 00:04:35,930 --> 00:04:38,420 from the internet for particular use cases. 133 133 00:04:38,420 --> 00:04:40,680 Since you don't want those users entering your intranet, 134 134 00:04:40,680 --> 00:04:42,860 to directly touch your stuff for security reasons, 135 135 00:04:42,860 --> 00:04:45,770 we placed them in this DMZ or screen subnet. 136 136 00:04:45,770 --> 00:04:47,560 Now a screen subnet on the other hand, 137 137 00:04:47,560 --> 00:04:49,690 is any subnet in the network architecture 138 138 00:04:49,690 --> 00:04:52,390 that uses a single firewall with three interfaces 139 139 00:04:52,390 --> 00:04:55,160 to connect three dissimilar networks, one public, 140 140 00:04:55,160 --> 00:04:56,730 one private or internal 141 141 00:04:56,730 --> 00:04:59,660 and one that is a semi-trusted zone between the two. 142 142 00:04:59,660 --> 00:05:02,160 Yes, your DMZ is a screen subnet, 143 143 00:05:02,160 --> 00:05:05,040 but it is just one particular type of screen subnet 144 144 00:05:05,040 --> 00:05:06,760 there are many others out there. 145 145 00:05:06,760 --> 00:05:09,640 Now, when we have a firewall in this type of configuration, 146 146 00:05:09,640 --> 00:05:11,430 it creates this screen subnet, 147 147 00:05:11,430 --> 00:05:13,630 and we call this a triple home firewall 148 148 00:05:13,630 --> 00:05:15,810 because it's touching three different areas. 149 149 00:05:15,810 --> 00:05:17,500 There are three homes to it. 150 150 00:05:17,500 --> 00:05:19,340 Now another way to add defense in depth 151 151 00:05:19,340 --> 00:05:21,640 is to be able to use administrative policies 152 152 00:05:21,640 --> 00:05:23,460 like separation of duties. 153 153 00:05:23,460 --> 00:05:24,700 Now, separation of duties 154 154 00:05:24,700 --> 00:05:26,840 is a preventative type of administrative control 155 155 00:05:26,840 --> 00:05:28,180 and it's one that should be considered 156 156 00:05:28,180 --> 00:05:30,810 when you're drafting up your organizational authentication 157 157 00:05:30,810 --> 00:05:32,590 and authorization policies. 158 158 00:05:32,590 --> 00:05:35,650 Separation of duties is designed to prevent fraud and abuse 159 159 00:05:35,650 --> 00:05:38,070 by distributing various tasks and approval authorities 160 160 00:05:38,070 --> 00:05:40,100 across a number of different users. 161 161 00:05:40,100 --> 00:05:41,510 For example, let's pretend 162 162 00:05:41,510 --> 00:05:42,890 you work in the accounting department 163 163 00:05:42,890 --> 00:05:44,760 and you have to be able to request checks 164 164 00:05:44,760 --> 00:05:46,720 that are sent out to employees on payday. 165 165 00:05:46,720 --> 00:05:48,780 Well, you might be able to request a check, 166 166 00:05:48,780 --> 00:05:51,580 but you can't also approve that same request. 167 167 00:05:51,580 --> 00:05:53,160 Instead, you would request it 168 168 00:05:53,160 --> 00:05:55,200 and then a supervisor could approve it. 169 169 00:05:55,200 --> 00:05:57,100 This creates a clear separation of duties 170 170 00:05:57,100 --> 00:05:58,110 and prevents fraud, 171 171 00:05:58,110 --> 00:06:00,250 because now you're going to have to have two users 172 172 00:06:00,250 --> 00:06:01,330 who are working together 173 173 00:06:01,330 --> 00:06:02,900 to steal money from the organization 174 174 00:06:02,900 --> 00:06:05,130 in the case of my check approval example. 175 175 00:06:05,130 --> 00:06:06,570 Now in the cybersecurity world, 176 176 00:06:06,570 --> 00:06:07,630 a great example of this 177 177 00:06:07,630 --> 00:06:09,590 is when one administrator is given the rights 178 178 00:06:09,590 --> 00:06:11,340 to create the backups of the server, 179 179 00:06:11,340 --> 00:06:13,840 but a different administrator is given the rights 180 180 00:06:13,840 --> 00:06:15,830 to be able to do the restoration of those files 181 181 00:06:15,830 --> 00:06:17,010 from the backup. 182 182 00:06:17,010 --> 00:06:18,690 This separation of duties occurs 183 183 00:06:18,690 --> 00:06:20,700 because the backup and the restore functions 184 184 00:06:20,700 --> 00:06:23,760 are being performed by do different administrative users. 185 185 00:06:23,760 --> 00:06:25,510 Anytime you have a function in your organization 186 186 00:06:25,510 --> 00:06:27,150 that you consider to be high risk, 187 187 00:06:27,150 --> 00:06:29,700 you should use a proper separation of duties. 188 188 00:06:29,700 --> 00:06:31,790 For example, if you've ever watched a war movie 189 189 00:06:31,790 --> 00:06:34,440 like Crimson Tide, and they want to launch a nuclear missile, 190 190 00:06:34,440 --> 00:06:35,420 what do they do? 191 191 00:06:35,420 --> 00:06:36,710 Well, they have two people 192 192 00:06:36,710 --> 00:06:38,710 each take out a different physical key. 193 193 00:06:38,710 --> 00:06:40,050 They then insert it into the machine 194 194 00:06:40,050 --> 00:06:41,760 and they turn at the same time. 195 195 00:06:41,760 --> 00:06:43,350 This is a separation of duties 196 196 00:06:43,350 --> 00:06:45,020 because we don't want somebody to go off 197 197 00:06:45,020 --> 00:06:46,840 and launch a nuclear missile on their own 198 198 00:06:46,840 --> 00:06:48,650 just because they decided they wanted to. 199 199 00:06:48,650 --> 00:06:51,490 Instead, we want to make sure we built that into the system. 200 200 00:06:51,490 --> 00:06:54,050 So, the military, in the case of nuclear weapons 201 201 00:06:54,050 --> 00:06:55,530 has built this into their system. 202 202 00:06:55,530 --> 00:06:58,550 This is a technical control that requires two separate keys 203 203 00:06:58,550 --> 00:07:01,310 and two different people have to turn them at the same time 204 204 00:07:01,310 --> 00:07:03,430 because those key holes are too far apart 205 205 00:07:03,430 --> 00:07:05,440 for a single person to be able to turn both keys 206 206 00:07:05,440 --> 00:07:06,700 at the same time. 207 207 00:07:06,700 --> 00:07:09,340 Now, this is a specific type of separation of duties, 208 208 00:07:09,340 --> 00:07:11,010 which is known as dual control 209 209 00:07:11,010 --> 00:07:12,720 because both people have to be present 210 210 00:07:12,720 --> 00:07:14,460 at the same time to do it. 211 211 00:07:14,460 --> 00:07:16,020 Another type of separation of duties 212 212 00:07:16,020 --> 00:07:17,560 is known as split knowledge. 213 213 00:07:17,560 --> 00:07:18,720 Now, split knowledge occurs 214 214 00:07:18,720 --> 00:07:21,040 when two people each have half of the knowledge required 215 215 00:07:21,040 --> 00:07:22,570 to do some function. 216 216 00:07:22,570 --> 00:07:25,270 For example, let's imagine that I have a safe in my house 217 217 00:07:25,270 --> 00:07:27,700 and it's going to hold my super secret family recipe 218 218 00:07:27,700 --> 00:07:30,340 for the best macaroni and cheese that you've ever tasted. 219 219 00:07:30,340 --> 00:07:32,260 Well, I want to make sure nobody gets this recipe. 220 220 00:07:32,260 --> 00:07:33,970 So I'm going to lock it up in my safe, 221 221 00:07:33,970 --> 00:07:35,720 and I'm going to use two different locks. 222 222 00:07:35,720 --> 00:07:36,950 Now there's two locks on this. 223 223 00:07:36,950 --> 00:07:39,630 One is a combination lock that I know the combination to 224 224 00:07:39,630 --> 00:07:41,250 and the other is a physical lock 225 225 00:07:41,250 --> 00:07:42,800 that my wife has the key to. 226 226 00:07:42,800 --> 00:07:45,100 Now, she doesn't know the combination to the first lock 227 227 00:07:45,100 --> 00:07:47,490 and I don't know where the key is for the second lock. 228 228 00:07:47,490 --> 00:07:50,130 This way, neither of us can open the safe ourself 229 229 00:07:50,130 --> 00:07:52,650 because each of us only has half of the knowledge. 230 230 00:07:52,650 --> 00:07:54,180 This is split knowledge. 231 231 00:07:54,180 --> 00:07:55,470 Since I know the combination 232 232 00:07:55,470 --> 00:07:57,270 and she knows where the padlock key is, 233 233 00:07:57,270 --> 00:07:59,320 we can only open the safe together 234 234 00:07:59,320 --> 00:08:00,630 and we can take out the recipe 235 235 00:08:00,630 --> 00:08:02,720 if we both are working together to do it. 236 236 00:08:02,720 --> 00:08:05,360 This is why it is considered split knowledge. 237 237 00:08:05,360 --> 00:08:06,800 Now in the cybersecurity world, 238 238 00:08:06,800 --> 00:08:09,740 we can implement split knowledge by using data encryption 239 239 00:08:09,740 --> 00:08:11,940 where a key can be broken up into two pieces 240 240 00:08:11,940 --> 00:08:14,610 and one is given each of the different administrators. 241 241 00:08:14,610 --> 00:08:16,640 Therefore, the data cannot be decrypted 242 242 00:08:16,640 --> 00:08:19,990 without both administrators providing their half of the key. 243 243 00:08:19,990 --> 00:08:22,250 Now our final defense in depth strategy I want to cover 244 244 00:08:22,250 --> 00:08:23,920 is the use of honeypots. 245 245 00:08:23,920 --> 00:08:26,530 Honeypots and their larger cousins known as honeynets 246 246 00:08:26,530 --> 00:08:29,000 are used to attract and trap potential attackers 247 247 00:08:29,000 --> 00:08:31,550 to counteract any attempts at unauthorized access 248 248 00:08:31,550 --> 00:08:33,450 into your organization's network. 249 249 00:08:33,450 --> 00:08:34,760 When we're dealing with a honeypot, 250 250 00:08:34,760 --> 00:08:37,320 it's usually going to be a single computer or a server, 251 251 00:08:37,320 --> 00:08:39,730 but it can also be a file, a group of files 252 252 00:08:39,730 --> 00:08:41,960 or an area of unused IP address base 253 253 00:08:41,960 --> 00:08:44,630 that could be considered attractive to a would be attacker. 254 254 00:08:44,630 --> 00:08:47,220 A honeynet on the other hand is one or more computers, 255 255 00:08:47,220 --> 00:08:49,430 servers or area of your network. 256 256 00:08:49,430 --> 00:08:51,360 Often a honeynet is going to be used 257 257 00:08:51,360 --> 00:08:53,930 when a single honeypot is not deemed sufficient enough 258 258 00:08:53,930 --> 00:08:55,340 for your business needs. 259 259 00:08:55,340 --> 00:08:57,157 Now, why would we use honeynets 260 260 00:08:57,157 --> 00:08:58,780 and honeypots in our networks? 261 261 00:08:58,780 --> 00:09:01,540 Well, this is usually going to be used as a form of research, 262 262 00:09:01,540 --> 00:09:03,740 as well as in, you're trying to learn more about an attacker 263 263 00:09:03,740 --> 00:09:04,930 and their techniques. 264 264 00:09:04,930 --> 00:09:07,930 For example, the honeynet project@honeynet.org 265 265 00:09:07,930 --> 00:09:10,620 is a well-known honeynet that's in use today. 266 266 00:09:10,620 --> 00:09:12,540 It's used to learn the tools, tactics 267 267 00:09:12,540 --> 00:09:14,740 and motivations that are involved in computer 268 268 00:09:14,740 --> 00:09:16,150 and network attacks. 269 269 00:09:16,150 --> 00:09:17,710 As they collect data on attackers 270 270 00:09:17,710 --> 00:09:18,920 and their different methods, 271 271 00:09:18,920 --> 00:09:20,990 the honeynet project then shares what they learn 272 272 00:09:20,990 --> 00:09:22,100 with all the different groups 273 273 00:09:22,100 --> 00:09:24,280 inside the cybersecurity industry. 274 274 00:09:24,280 --> 00:09:25,680 Normally, your organization 275 275 00:09:25,680 --> 00:09:27,670 isn't going to put up a honeypot on its own 276 276 00:09:27,670 --> 00:09:29,520 unless you're part of a security operation center 277 277 00:09:29,520 --> 00:09:30,510 for a large company, 278 278 00:09:30,510 --> 00:09:33,110 who's trying to develop better countermeasures on their own. 279 279 00:09:33,110 --> 00:09:35,550 For example, if you work as a security researcher 280 280 00:09:35,550 --> 00:09:38,690 at a place like Microsoft, Google, Apple, CrowdStrike 281 281 00:09:38,690 --> 00:09:41,620 or FireEye, you might run a honeypot or a honeynet 282 282 00:09:41,620 --> 00:09:44,600 to try to better be prepared in the defense of those systems 283 283 00:09:44,600 --> 00:09:46,970 and better understand the bad guys, their techniques 284 284 00:09:46,970 --> 00:09:48,270 and their tactics. 285 285 00:09:48,270 --> 00:09:50,370 If you're going to be putting up a honeypot or a honeynet, 286 286 00:09:50,370 --> 00:09:52,710 it is usually going to be located in a screen subnet 287 287 00:09:52,710 --> 00:09:54,270 to ensure an attacker cannot breach 288 288 00:09:54,270 --> 00:09:55,560 the rest of your network 289 289 00:09:55,560 --> 00:09:58,180 if and when they attack that honeypot or honeynet. 290 290 00:09:58,180 --> 00:10:00,110 Remember, when it comes to defense in depth, 291 291 00:10:00,110 --> 00:10:02,250 you need to think vertically through the layers 292 292 00:10:02,250 --> 00:10:04,980 as well as horizontally or laterally across the network 293 293 00:10:04,980 --> 00:10:07,780 when using those screen subnets to protect your network. 294 294 00:10:08,808 --> 00:10:10,991 (soft music)