IT Defense In Depth Part I

In the 1930s, France built a trench network called the Maginot Line to rebuff any invasion. Thephilosophy was simple: if you map out all the places an enemy can attack, and lay down a lot ofmen and fortifications at those places, you can rebuff any attack. The problem is, you can’t mapevery possible avenue for attack.

What does this have to do with IT security? Today many business owners install an antivirusprogram as their Maginot Line and call it a day. However there are many ways to get into anetwork that circumvent antivirus software.

Hackers are creating viruses faster than antivirus programs can recognise them (about 100,000new virus types are released daily), and professional cybercriminals will often test theircreations against all commercially available platforms before releasing them onto the net.

Even if you had a perfect anti­virus program that could detect and stop every single threat, thereare many attacks that circumvent anti­virus programs entirely. For example, if a hacker can getan employee to click on a compromised email or website, or “brute force guess” a weakpassword, all the antivirus software in the world won’t help you.

There several vulnerabilities a hacker can target: the physical layer, the human layer, thenetwork layer, and the mobile layer. You need a defense plan that will allow you to quicklynotice and respond to breaches at each level.

The physical layer refers to the computers and devices that you have in your office. This is theeasiest layer to defend, but is exploited surprisingly often.

Here are a few examples:

• Last year 60% of California businesses reported a stolen smartphone and 43% reported losing a tablet with sensitive information.
• The breaches perpetrated by Chelsea Manning and Edward Snowden occurred because they were able to access devices with sensitive information.
• For example, Comptia left 200 USB devices in front of various public spaces across the country to see if people would pick a strange device and insert into their work or personal computers. 17% fell for it.

For the physical layer, you need to:

• keep all computers and devices under the supervision of an employee or locked away at all times.
• Only let authorized employees use your devices
• Do not plug in any unknown USB devices.
• destroy obsolete hard drives before throwing them out

Next time in Part II, we will talk about the human and network layers of security.