Time to Update our “Defense in Depth” Definition – Part Three

In my spare time I love to cook; my specialty is soup. I’m currently building a new kitchen and taking the opportunity to update some of my kitchen gadgets. I was surprised to find out how many different devices you can buy to separate solids from liquids. You can start with colanders, and then move to strainers, skimmers, sieves, china caps, and finally, fine mesh cheesecloth. It all depends on how much solid material you want to catch and eliminate.

What does this have to do with defense in depth? Everything! Straining the solids out of a soup stock is exactly the same thing as filtering threats out of your network. I’m going to use different strainers if I’m cooking a chunky vegetable soup than I am if I’m making a clear consommé. Same thing with security: if I’m a hospital, then I’m going to protect my public website but deploy the strongest possible combination of security technologies available to defend my medical records database. But if I’m an on-line retailer, then my public website requires stronger protection than my email servers.

Not everything requires the same level of protection. An honest assessment of your environment is a prerequisite so that it’s clear to everyone what the critical components are, where they are located and what level of security is appropriate to deploy at every layer in the network.

Once you’ve identified your corporate crown jewels and designed a defense in depth strategy to protect them, your next worry is how to manage that security going forward. Make sure that the defense layers can talk to each other, that their logs are correlated, and that reports highlight prioritized, actionable information. Otherwise you’re going to end up with hundreds or even thousands of alerts that may or may not impact your critical systems. And, looking for that elusive needle in the proverbial haystack is NOT where you want to spend your time.