The Power of Defense in Depth in Cybersecurity

Source: VicCamacho

Key Layers of Defense in Depth

Let’s break down each of the core layers that make up a defense in depth strategy, and why each is necessary.

1. The Human Factor: Policies, Procedures, and Awareness

While technology plays a crucial role in cybersecurity, one of the most essential layers in defense in depth is the human factor, or sometimes known as the human firewall. The reality is that no matter how many sophisticated security tools you deploy, they will always be vulnerable to human error, negligence, or malicious insider activity. This is why comprehensive policies, procedures, and employee awareness programs are vital to building a robust cybersecurity posture.  Cybersecurity policies define how individuals within your organization should interact with technology, access data, and behave in various cybersecurity scenarios.

• Acceptable Use Policies (AUP): Establish guidelines on how employees can use company devices, networks, and resources. This includes restrictions on accessing unapproved applications or visiting suspicious websites.
• Password Management and MFA Policies: Enforce strong password practices and mandate the use of multi-factor authentication (MFA) where possible.
• Data Handling and Classification Policies: Define how sensitive data should be handled, stored, and transmitted. This also includes encryption requirements for sensitive data at rest and in transit.
• Incident Response Procedures: Define specific actions that employees and security teams should take in response to a security breach or incident. These procedures should include how to report incidents, who to notify, and what the escalation process looks like.
• Cybersecurity Awareness Training: This is one of the most important defenses against cyber threats.  Keeping employees aware of potential phishing emails that attacker users targeting their credentials, their machine or moving laterally to other targets is the biggest risk to a good defense strategy. Having regular cybersecurity awareness training, along with understanding evolving threats is paramount to success.

2. Perimeter Security: The First Technical Line of Defense

Although the human firewall came first, perimeter security layer is your organization’s first technological line of defense against external threats. While it’s not enough to rely solely on perimeter security, it’s essential to have the following technologies in place to filter out malicious traffic before it enters your network:

• Firewalls: Firewalls act as a barrier between your internal network and the outside world, blocking unauthorized traffic and filtering potential threats. Vendors include: Cisco, Palo Alto, Check Point, Sophos, Sonic Wall, Fortinet and more.
• Intrusion Detection/Prevention Systems (IDS/IPS): IDS monitors traffic to detect malicious activity, while IPS goes a step further by actively blocking or mitigating attacks. These are often integrated within a firewall vendor’s offerings.
• Email Security: With phishing attacks accounting for a significant percentage of breaches, email security tools like Proofpoint, Microsoft or Mimecast help filter malicious attachments, links, and suspicious email traffic.
• Demilitarized Zone (DMZ): This isolated subnetwork allows you to place exposed services web server outside the internal network, reducing the risk of direct attacks on your core systems.

3. Endpoint Security: Defending the Devices in Your Network

Endpoints are often the most vulnerable entry points for attackers. From desktops to mobile devices, if attackers can compromise an endpoint, they can often pivot into the rest of your network. Here’s what you need to protect endpoints effectively:

• Endpoint Detection and Response (EDR): EDR tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne or others provide real-time monitoring, threat hunting, and automated response to malicious activity on endpoints.
• Host-based IPS/IDS: These systems monitor traffic and activity on individual endpoints, detecting signs of compromise and are often included as features within EDR software.
• Patch Management: Vulnerabilities are often exploited due to unpatched software. Tools like Ivanti or ManageEngine automate patching to ensure your endpoints stay up to date.
• Browser Security: Modern browsers are highly targeted by attackers. Besides user vigilance, employing browser isolation environments, preventing users from installing extensions, discourage storing passwords in browsers and utilizing web content filtering are all good strategies to employ.
• Endpoint Privilege Management (EPM): Managing user privileges at the endpoint level is critical. Solutions like Delinea, CyberArk or BeyondTrust can enforce least privilege access to minimize the impact of compromised machines or accounts.

4. Application Security: Protecting Your Critical Applications

Applications, particularly company websites or web-based applications, are a prime target for attackers. Securing them is essential, as vulnerabilities in application code can provide a backdoor for attackers to gain access to sensitive data. Key tools for application security include:

• Web Application Firewalls (WAF): A WAF, such as Imperva, Akamai, or Cloudflare WAF, protects web applications from common attacks like SQL injection, cross-site scripting (XSS), and other application-layer vulnerabilities.
• Secure Development Practices: It’s crucial to integrate security throughout the software development lifecycle (SDLC).
• Runtime Application Self-Protection (RASP): Tools like Arxan or Signal Sciences protect applications during runtime by identifying and mitigating threats in real time.

5. Data Security: Protecting Your Most Valuable Assets

Data is often the primary target in many cyberattacks. If attackers can access sensitive data, they can exploit it for financial gain, espionage, or other malicious purposes. Protecting data requires a combination of preventive controls and constant monitoring.  Using data security tools can help to prevent a ransomware attack and deter insider threats.

• Data Loss Prevention (DLP): DLP tools like Digital Guardian or Symantec DLP prevent the unauthorized sharing or leakage of sensitive data across endpoints, networks, and cloud environments.
• Identity and Access Management (IAM): Tools like Okta, Microsoft Azure AD, or Ping Identity ensure that only authorized individuals have access to critical resources, enforcing role-based access control (RBAC) and multifactor authentication (MFA).
• Privileged Access Management (PAM): Solutions like CyberArk or BeyondTrust help protect privileged accounts and monitor their usage to prevent abuse, especially in high-risk environments where administrative access is required.

Prevention vs. Monitoring and Response

One key distinction to make when building a defense in depth strategy is the difference between prevention and monitoring/response and why it’s important to have both:

• Prevention technologies focus on stopping attacks before they can do harm. These include firewalls, EDR, human vigilance, and WAFs and what we covered above.
• Monitoring and Response tools help detect attacks in progress and mitigate their impact. Technologies like EDR, IDS/IPS, and SIEM (Security Information and Event Management) systems enable rapid detection and response to an ongoing attack.  Although we haven’t covered SIEM’s much in this post, having a SIEM to monitor, digest and correlate information is paramount to a successful security strategy.

A robust defense in depth strategy requires a balance between both. While prevention is vital to stop known threats, detection and response play an equally crucial role in identifying attacks that are geared towards bypassing one type of technology such as EDR, but will go detected by other technologies, such as a NGFW.

We can look forwards popular frameworks such as NIST for organizations to understand and improve their cybersecurity risk and posture.