One of the most fundamental security principles that a lot of organizations miss.
Is reducing or restricting the attack surface.
This includes changing the default configurations and the lack of system hardening some of the ways
in which system hardening can be implemented include disabling the default services, restricting default
permissions that start up with a power on default usernames and passwords, open ports and so on.
Concerning passwords and credentials, a policy must be developed that enforces the usage of complex
passwords with more than an eight character limit, with a mandated usage of numeric values, capital
letters and special characters.
A password change policy must also be in place.
Network Segmentation.
Network segmentation refers to segregating a network into subnetworks with the aim of improving performance
and security.
So a reduced attack surface and grouping systems with a similar security needs.
This can be achieved by implementing firewalls, a virtual local area, network, LAN and software defined
networking Sd-wan to name a few.
Proper network segmentation will allow the organization to segregate low priority and low trust network
areas from the rest of the infrastructure or critical network segments.
Use preventing widespread impact on the event of a cyber attack.
This also helps with the utilizing security monitoring platforms and access controls for the most business
circular segments of the organization.
Network Choke Points.
One of the major differentiating aspects between a fragile and resilient cybersecurity program is the
strategy and approach toward building a comprehensive foundation.
This foundation can be built only by having a clear visualization of the logical and technological layout
of the environment.
For example, identifying and adequately monitoring bottlenecks and choke points can often help us discover
larger and deeper problems in the Networks Foundation.
In military terms, a choke point is a location on land or sea, a valley or a strait where the military
is forced to pass through a narrow column, which makes it easier for an opposing force to take them
out with ease.
Technically this is a shooting fish in a barrel kind of situation in networking terms.
A similar situation is faced when the data flow of a network is restricted due to bandwidth or application
constraints from a network security standpoint.
Common examples include implementing a firewall for an internet facing site or a load balancer that
reroutes traffic based on a bandwidth consumption.
In the case of distributed denial of service, DDoS or denial of service DDoS attack, this can add
to a cyber resiliency.
So today we can build such scalable and highly available load balancers over the cloud by using services
such as Google Cloud.
The Defense in Depth.
This is an implementation approach where multiple layers of security or defensive controls through the
environment or landscape have redundancy in case of security incident.
This is also known as the castle approach.
So the reason why this approach is important is that it takes the weight of a single cybersecurity,
defensive control and supplements or complements the security strategy by having a multiple independent
controls in place at different layers.
Originally, this was a military strategy, also known as Deep in Defense that sought to hinder the
movement of enemy forces.
The focus is not on stopping them entirely via frontal assault, but by buying the time and slowing
down the attacks progression.
This is an effective measure as it often results in the attacker losing momentum over a period of time
due to no or less progress.
This vital time can be used to mount an attack on the assault forces or reinforce the defenses of the
defending team.