Lesson 9: Explain the Purpose of Mitigation Techniques Used to Secure the Enterprise

Secure Design Engineering

The goal of secure design engineering is to develop trustworthy and survivable systems.

- Survivability is a system property (i.e., the system's ability to prevent, mitigate, and recover from cyber events).
- Three sets of secure design principles:
- Secure Design Planning Principles
- Secure Design Configuration Principles
- Secure Design Relationship Principles

Secure Design Planning Principles

• Threat Modeling: Use threat modeling to anticipate threats. Focus on undesirable consequences.
  - Keep it Simple: Security mechanisms should be as simple as possible. Simplicity means fewer possibilities exist for error, and the assessment process is less complex.
  - Default Deny Posture: Base access decisions on permission rather than exclusion. This means that, by default, access is denied, and the protection scheme identifies conditions under which access is permitted.
  - Fail-Secure: In the event of failure, access is denied.
  - Open Design: The security mechanism should not depend upon the secrecy of the design or implementation. Argument against "security through obscurity".

Secure Design Configuration Principles

• Secure the Weakest Link: Identify and strengthen weak links until an acceptable level of risk is achieved.
  - Defense-in-Depth: Utilize multiple layers of diverse controls including endpoint protection such as host-based firewall.
  - Least Functionality: Systems and devices should be configured to provide only essential capabilities, and specifically prohibit or restrict the use of unnecessary functions, ports, protocols, and services.
  - Appropriate Disclosure: Error and system messages should not include unnecessary information that may lead to a compromise of security.
  - Sanitize Data Sent to Other Systems: Sanitize all data passed to complex subsystems such as command shells, relational databases, and commercial off-the-shelf (COTS) components.

Secure Design Relationship Principles

• Zero Trust: No default trust or privilege. Verification (authentication) is required for access.
  - Trust but Verify: Dependencies are not trusted until proven trustworthy.
  - Separation of Duties: Breaking a task into segments so that no one subject is in complete control or has complete decision-making power.
  - Least Privilege: Giving a subject or process only the rights and permissions needed to complete assigned tasks.
  - Psychological Acceptance: Human interface should be designed for ease of use, so that users routinely and automatically apply the protection mechanisms correctly.

Segmentation

Segmenting an enterprise into security zones is useful for creating and enforcing security policies, controlling information flow, and securing network access.

- Security zones are divisions of the network based on functional, performance, and/or security requirements.
- Security zones are enforced by firewall ingress and egress access control lists (ACL) - rules.

Security Zones

Untrusted
Screened Subnet
Trusted
Enclave
Air Gapped
Physically Isolated
Wireless
Virtual Private Network (VPN)

Untrusted (Security Zone)

An untrusted network is one which the organization has no control over.

Screened Subnet (Security Zone)

A screened subnet has connections to both trusted and untrusted networks.

Trusted (Security Zone)

A trusted network is one which the organization has complete control over.

Enclave (Security Zone)

An enclave is a restricted network within a trusted network.

Air Gapped (Security Zone)

An air gapped network does not connect to any untrusted network.

Physically Isolated (Security Zone)

A physically isolated network does not connect to any other network.

Wireless (Security Zone)

A wireless network supports wireless transmissions.

Virtual Private Network (VPN)

A VPN is designed to facilitate secure communications over a public circuit.

Micro-segmentation

Micro-Segmentation is a method of creating zones within data centers and cloud environments to isolate workloads from one another and secure them individually.

North-South

North-South refers to the traffic that flows into and out of a data center or cloud.

East-West

East-West refers to traffic within a data center or cloud.

Protect Surface

The protect surface is made up of the network's most critical and valuable data, assets, applications, and services (DAAS). It is always knowable.

Zero Trust (Micro-segmentation)

Micro-segmentation allows for the implementation of zero trust protect surface environments. Authentication is always required and enforces least privilege access.

Isolation

Isolation is when zones, devices, sessions, or even components need to be segregated, so as not to cause harm or to be harmed.

Virtualization

Virtualization technology creates multiple environments from a single physical hardware system.

- Virtual machines (VMs) provide fault and security isolation at the hardware level including memory and CPU access.

Virtual Local Area Network (VLAN)

A virtual local area network (VLAN) divides a single existing network into multiple logical network segments which can be restricted.

- Broadcast domains are portioned and isolated at the data link layer.