-: Defense in depth. 2 2
In this lesson, we're going to discuss defense in depth 3 3
which includes network segmentation enforcement, 4 4
screen subnets and DMZs, 5 5
the separation of duties and honeypots. 6 6
So what is defense in depth? 7 7
Well, defense in depth is an approach to cybersecurity 8 8
in which a series of defensive mechanisms 9 9
are layered on top of each other 10 10
in order to protect valuable data and information. 11 11
Defense in depth is truly the foundation 12 12
of a good network security architecture. 13 13
With defense in-depth, 14 14
we're not going to rely on just a single defensive boundary 15 15
or measure of protection in place. 16 16
Instead, we're going to be able to layer them 17 17
on top of each other, because if we don't, 18 18
an attacker can find a vulnerability 19 19
and exploit a single boundary 20 20
and get access to our entire network. 21 21
So, instead, we're always going to be layering our defenses 22 22
and this way, we can ensure 23 23
that none of these vulnerabilities line up 24 24
across all the layers, 25 25
because if they do, then an attacker would still be able 26 26
to compromise our network. 27 27
Our goal is to make sure 28 28
that the vulnerabilities don't all line up 29 29
because we want to make sure we can stop attackers 30 30
from being successful. 31 31
To achieve this, we're going to use a mixture 32 32
of different physical, logical and administrative controls 33 33
to help secure our networks. 34 34
Let's consider an example and look at it from the inside 35 35
and work our way out. 36 36
When we talk about layer defense, 37 37
we're first going to start on the inside with our data. 38 38
We need to protect our data 39 39
by doing things like data integrity checks 40 40
or encrypting the data. 41 41
Next, we want to protect the applications 42 42
that manipulate our data. 43 43
This way, we can ensure that all of the security patches 44 44
are up to date for applications like Microsoft office, 45 45
Google Chrome or Adobe Acrobat. 46 46
By making sure these applications are protected, 47 47
we're going to make sure the data doesn't get modified 48 48
by mistake. 49 49
Then, we can look at how we secure our host itself. 50 50
So, we're going to add some end point security. 51 51
This can be things like antivirus, anti-malware, 52 52
host based intrusion detection systems, 53 53
windows security patching, 54 54
or implementing some other hardening measures 55 55
and configurations. 56 56
Next, we're going to go into the network 57 57
and we're going to start talking about things 58 58
like network intrusion detection systems, 59 59
and IP addresses and access control lists, 60 60
and VLANs and unified threat management systems 61 61
and things like that. 62 62
Next, we're going to move out to our perimeter 63 63
and here, we're going to consider our border routers, 64 64
our firewalls, our VPN connections 65 65
and any cloud-based connections we may have 66 66
going into or out of our network. 67 67
By considering each of these different layers, 68 68
we hopefully can ensure there's no straight line of attack 69 69
by lining up all the different vulnerabilities 70 70
and allowing an attacker to exploit our network 71 71
in our hosts. 72 72
So, now that we've talked about the concept 73 73
of layering our defenses 74 74
let's consider how we might apply these layers 75 75
as we move laterally across our network as well. 76 76
To help provide protections between different portions 77 77
of our network, we also want to create network segmentation. 78 78
By creating network segmentation, 79 79
we can separate a single larger network 80 80
into different levels of security or levels of protection 81 81
and we can keep data from moving between these areas 82 82
without first being inspected by our requirements. 83 83
Now to enforce network segmentation, 84 84
we can check data as it tries to enter or leave 85 85
a different part of the network. 86 86
We do this by creating choke points in our network, 87 87
by adding subnets or VLANs into our networks. 88 88
Each of these subnets or VLANs 89 89
would then require their data to be passed to a router 90 90
before entering a different subnet or VLAN. 91 91
As it passes through that router, 92 92
the network traffic can be inspected 93 93
and compared against the access control lists on that router 94 94
and its interfaces. 95 95
Based on those ACL rules, the traffic can be blocked 96 96
in order to isolate the subnet or VLAN. 97 97
It can be filtered to allow only specific traffic to enter 98 98
or leave that subnet or VLAN 99 99
or it can be allowed to freely pass 100 100
between the subnets or VLANs 101 101
if we're going from one trusted zone 102 102
to another trusted zone. 103 103
Most networks have at a minimum three security zones. 104 104
These three segments or zones are the intranet 105 105
or the internal network, 106 106
the screen subnet or DMZ, demilitarized zone 107 107
and the internet or your external network. 108 108
For example, here you can see the intranet, 109 109
the screen subnet or DMZ and the internet. 110 110
These are my three security zones, but I didn't stop there. 111 111
I also have a data center and it has its own segment 112 112
that is connected to the internet, the DMZ and the internet. 113 113
Now, as you can see, 114 114
how the segmentation is going to be used 115 115
to create a more complex network 116 116
while still providing these choke points 117 117
where we can screen or inspect the traffic 118 118
as it moves between different parts of this network. 119 119
This is one of the reasons that the name DMZ has changed 120 120
to a screen subnet 121 121
because DMZ is just one type of screen subnet, 122 122
but there are many others that we can implement 123 123
based on our particular business use cases. 124 124
For clarification, whenever you hear the term DMZ, 125 125
I want you to remember that refers to a perimeter network 126 126
that protects an organization's internal local area network 127 127
from untrusted traffic. 128 128
Normally, this is just going to be a subnet 129 129
where you're going to place all your public facing servers, 130 130
like your email servers, web servers 131 131
and file servers that you need to have access to 132 132
from the internet for particular use cases. 133 133
Since you don't want those users entering your intranet, 134 134
to directly touch your stuff for security reasons, 135 135
we placed them in this DMZ or screen subnet. 136 136
Now a screen subnet on the other hand, 137 137
is any subnet in the network architecture 138 138
that uses a single firewall with three interfaces 139 139
to connect three dissimilar networks, one public, 140 140
one private or internal 141 141
and one that is a semi-trusted zone between the two. 142 142
Yes, your DMZ is a screen subnet, 143 143
but it is just one particular type of screen subnet 144 144
there are many others out there. 145 145
Now, when we have a firewall in this type of configuration, 146 146
it creates this screen subnet, 147 147
and we call this a triple home firewall 148 148
because it's touching three different areas. 149 149
There are three homes to it. 150 150
Now another way to add defense in depth 151 151
is to be able to use administrative policies 152 152
like separation of duties. 153 153
Now, separation of duties 154 154
is a preventative type of administrative control 155 155
and it's one that should be considered 156 156
when you're drafting up your organizational authentication 157 157
and authorization policies. 158 158
Separation of duties is designed to prevent fraud and abuse 159 159
by distributing various tasks and approval authorities 160 160
across a number of different users. 161 161
For example, let's pretend 162 162
you work in the accounting department 163 163
and you have to be able to request checks 164 164
that are sent out to employees on payday. 165 165
Well, you might be able to request a check, 166 166
but you can't also approve that same request. 167 167
Instead, you would request it 168 168
and then a supervisor could approve it. 169 169
This creates a clear separation of duties 170 170
and prevents fraud, 171 171
because now you're going to have to have two users 172 172
who are working together 173 173
to steal money from the organization 174 174
in the case of my check approval example. 175 175
Now in the cybersecurity world, 176 176
a great example of this 177 177
is when one administrator is given the rights 178 178
to create the backups of the server, 179 179
but a different administrator is given the rights 180 180
to be able to do the restoration of those files 181 181
from the backup. 182 182
This separation of duties occurs 183 183
because the backup and the restore functions 184 184
are being performed by do different administrative users. 185 185
Anytime you have a function in your organization 186 186
that you consider to be high risk, 187 187
you should use a proper separation of duties. 188 188
For example, if you've ever watched a war movie 189 189
like Crimson Tide, and they want to launch a nuclear missile, 190 190
what do they do? 191 191
Well, they have two people 192 192
each take out a different physical key. 193 193
They then insert it into the machine 194 194
and they turn at the same time. 195 195
This is a separation of duties 196 196
because we don't want somebody to go off 197 197
and launch a nuclear missile on their own 198 198
just because they decided they wanted to. 199 199
Instead, we want to make sure we built that into the system. 200 200
So, the military, in the case of nuclear weapons 201 201
has built this into their system. 202 202
This is a technical control that requires two separate keys 203 203
and two different people have to turn them at the same time 204 204
because those key holes are too far apart 205 205
for a single person to be able to turn both keys 206 206
at the same time. 207 207
Now, this is a specific type of separation of duties, 208 208
which is known as dual control 209 209
because both people have to be present 210 210
at the same time to do it. 211 211
Another type of separation of duties 212 212
is known as split knowledge. 213 213
Now, split knowledge occurs 214 214
when two people each have half of the knowledge required 215 215
to do some function. 216 216
For example, let's imagine that I have a safe in my house 217 217
and it's going to hold my super secret family recipe 218 218
for the best macaroni and cheese that you've ever tasted. 219 219
Well, I want to make sure nobody gets this recipe. 220 220
So I'm going to lock it up in my safe, 221 221
and I'm going to use two different locks. 222 222
Now there's two locks on this. 223 223
One is a combination lock that I know the combination to 224 224
and the other is a physical lock 225 225
that my wife has the key to. 226 226
Now, she doesn't know the combination to the first lock 227 227
and I don't know where the key is for the second lock. 228 228
This way, neither of us can open the safe ourself 229 229
because each of us only has half of the knowledge. 230 230
This is split knowledge. 231 231
Since I know the combination 232 232
and she knows where the padlock key is, 233 233
we can only open the safe together 234 234
and we can take out the recipe 235 235
if we both are working together to do it. 236 236
This is why it is considered split knowledge. 237 237
Now in the cybersecurity world, 238 238
we can implement split knowledge by using data encryption 239 239
where a key can be broken up into two pieces 240 240
and one is given each of the different administrators. 241 241
Therefore, the data cannot be decrypted 242 242
without both administrators providing their half of the key. 243 243
Now our final defense in depth strategy I want to cover 244 244
is the use of honeypots. 245 245
Honeypots and their larger cousins known as honeynets 246 246
are used to attract and trap potential attackers 247 247
to counteract any attempts at unauthorized access 248 248
into your organization's network. 249 249
When we're dealing with a honeypot, 250 250
it's usually going to be a single computer or a server, 251 251
but it can also be a file, a group of files 252 252
or an area of unused IP address base 253 253
that could be considered attractive to a would be attacker. 254 254
A honeynet on the other hand is one or more computers, 255 255
servers or area of your network. 256 256
Often a honeynet is going to be used 257 257
when a single honeypot is not deemed sufficient enough 258 258
for your business needs. 259 259
Now, why would we use honeynets 260 260
and honeypots in our networks? 261 261
Well, this is usually going to be used as a form of research, 262 262
as well as in, you're trying to learn more about an attacker 263 263
and their techniques. 264 264
For example, the honeynet project@honeynet.org 265 265
is a well-known honeynet that's in use today. 266 266
It's used to learn the tools, tactics 267 267
and motivations that are involved in computer 268 268
and network attacks. 269 269
As they collect data on attackers 270 270
and their different methods, 271 271
the honeynet project then shares what they learn 272 272
with all the different groups 273 273
inside the cybersecurity industry. 274 274
Normally, your organization 275 275
isn't going to put up a honeypot on its own 276 276
unless you're part of a security operation center 277 277
for a large company, 278 278
who's trying to develop better countermeasures on their own. 279 279
For example, if you work as a security researcher 280 280
at a place like Microsoft, Google, Apple, CrowdStrike 281 281
or FireEye, you might run a honeypot or a honeynet 282 282
to try to better be prepared in the defense of those systems 283 283
and better understand the bad guys, their techniques 284 284
and their tactics. 285 285
If you're going to be putting up a honeypot or a honeynet, 286 286
it is usually going to be located in a screen subnet 287 287
to ensure an attacker cannot breach 288 288
the rest of your network 289 289
if and when they attack that honeypot or honeynet. 290 290
Remember, when it comes to defense in depth, 291 291
you need to think vertically through the layers 292 292
as well as horizontally or laterally across the network 293 293
when using those screen subnets to protect your network. 294 294
(soft music)