National Program of Depth

Cyber Attacks
Protecting National Infrastructure, 1st ed.

Chapter 6
Depth

Introduction

Anylayerofdefensecanfailatanytime,thusthe

introduction of defense in depth
Aseriesofprotectiveelementsisplacedbetweenan

asset and the adversary
Theintentistoenforcepolicyacrossallaccesspoints

Chapter 6 – Depth

Fig. 6.1 – General defense in depth schema

Chapter 6 – Depth

Effectiveness of Depth

Quantifyingtheeffectivenessofalayereddefenseis often difficult
Effectivenessisbestdeterminedbyeducatedguesses
Thefollowingarerelevantforestimating

effectiveness

– Practical experience

– Engineering analysis

– Use-case studies

– Testing and simulation

Chapter 6 – Depth

Fig. 6.2 – Moderately effective single layer of protection

Chapter 6 – Depth

Effectiveness of Depth

• Whenalayerfails,wecanconcludeitwaseither
flawed or unsuited to the target environment
• Nolayeris100%effective—thegoalofmakinglayers “highly” effective is more realistic

Chapter 6 – Depth

Fig. 6.3 – Highly effective single layer of protection

Chapter 6 – Depth

Fig. 6.4 – Multiple moderately effective layers of protection

Chapter 6 – Depth

Layered Authentication

Anationalauthenticationsystemforeverycitizen would remove the need for multiple passwords, passphrases, tokens, certificates, and biometrics that weaken security
Singlesign-on(SSO)wouldaccomplishthis authentication simplification objective
However,SSOaccessneedstobepartofa multilayered defense

Chapter 6 – Depth

Fig. 6.5 – Schema showing two layers of end-user authentication

Chapter 6 – Depth

Fig. 6.6 – Authentication options including direct mobile access

Chapter 6 – Depth

Layered E-Mail Virus and Spam Protection

Commercialenvironmentsareturningtovirtual,in- the-cloud solutions to filter e-mail viruses and spam
Tothatsecuritylayerisaddedfilteringsoftwareon individual computers
Antivirussoftwarehelpful,butuselessagainstcertain attacks (like botnet)

Chapter 6 – Depth

Fig. 6.7 – Typical architecture with layered e-mail filtering

Chapter 6 – Depth

Layered Access Controls
• Layeringaccesscontrolsincreasessecurity
• Addtothisthelimitingofphysicalaccesstoassets
• Fornationalinfrastructure,assetsshouldbecovered by as many layers possible
– Network-based firewalls – Internal firewalls

– Physical security

Chapter 6 – Depth

Fig. 6.8 – Three layers of protection using firewall and access controls

Chapter 6 – Depth

Layered Encryption
• Fiveencryptionmethodsfornationalinfrastructure protection
– Mobile device storage – Network transmission
– Secure commerce

– Application strengthening

– Server and mainframe data storage

Chapter 6 – Depth

Fig. 6.9 – Multple layers of encryption

Chapter 6 – Depth

Layered Intrusion Detection

Thepromiseoflayeredintrusiondetectionhasnot been fully realized, though it is useful
Theinclusionofintrusionresponsemakesthe layered approach more complex
Therearethreeopportunitiesfordifferentintrusion detection systems to provide layered protection

– In-band detection

– Out-of-band correlation – Signature sharing

Chapter 6 – Depth

Fig. 6.10 – Sharing intrusion detection information between systems

Chapter 6 – Depth

National Program of Depth
• Developingamultilayereddefensefornational infrastructure would require a careful architectural analysis of all assets and protection systems
– Identifying assets

– Subjective estimations

– Obtaining proprietary information – Identifying all possible access paths

Chapter 6 – Depth

National Program of Depth

Why work with us?

How the Platform Works

Recent Posts