Information Security - Layered Security Model

Bruce Schneier, the renowned security technologist and author, believed that the mantra for any good security engineer is “Security is not merely a product, but a process. It's more than designing strong cryptography into a system; it's designing the fail-safe system such that, all security measures, including cryptography, work together." 

Steps in Security:

1. Comprehend your network configuration, network traffic and communication systems

2. Prepare a comprehensive Information Security policy, procedure and its implementation plan

3. Obtain an approval for policy and procedure from the management

4. Maintain up to date documentation for entire IT Infrastructure

5. Periodically test & audit your IT infrastructure. Maintain audit trails of all changes

6. Create Security awareness among all users via training, crash courses, quiz, posters, banners etc.

7. Focus to 'Preventive Measures' than 'Corrective Measures'

Layered Security Model:

'Defense is in depth' it is said and it should be followed while designing any security solution.

The layered security model consists of 4 layers

1. Perimeter Defense

2. Operating Systems & Servers  protection

3. Workstation Security

4. Information Protection

1. Perimeter Defense

This is like your fence, walls & roofs of the house. The perimeter security solutions include Firewalls, Proxy Servers, Content Filters, Routers etc. A survey has showed that majority of the attacks (70-80%) are internal attacks (i.e. somebody within your organization) and hence the security solution should also consider this fact in the designing stage.

The common attacks at the perimeter security are Denial of Service 'DOS' attacks and Man in the Middle attacks.

2. Operating Systems & Servers Protection

This layer is the protection of Application, Web, Database Servers and all other infrastructure servers such as Mail, DNS, Proxy etc.

While traffic is regulated at the perimeter depending on the needs of the organization, the applications utilizing the traffic run on different application/webservers which in turn run on operating systems. An abuse of operating system privileges can potentially compromise network security. Users with access to the underlying operating system can jeopardize the availability and integrity of the firewall and expose critical network resources to both internal and external security threats. Hardening this layer will protect the network from number of internal threats.
Vulnerabilities exist in operating systems, web servers, proxy servers, mail servers and application servers that need patches / service packs / hotfixes to fill those holes.
An organization may have multiple operating systems in its network. It is the responsibility of the OS vendors to make their products secure. In addition the user organization also has the responsibility of applying the available security features. 
Common solutions for OS protection
1. OS Hardening
2. Periodic security patch implementation
3. Logging
4. File Integrity Monitoring
5, Review of superuser rights on a periodic basis

3. Workstation Security

We need to have workstation security for two reasons:

• to protect against someone trying to attack from within the network
• to protect the data stored on workstation from someone coming in through the firewall

Common solutions for Workstation Security:

1. Anti-Virus

2. Anti-Malware

3. End Point protection

4. Information Protection

This layer focuses on protecting the actual business critical data. Businesses should identify critical data and security teams should design an optimum cost effective solution on protecting the actual information.
Common solutions for Information Protection:
1. Database encryption
2. Data Masking
3. Data Loss Prevention



CONCLUSION
Security is not just perimeter security as most of us think. There are a lot of APT's (Advanced Persistent Threats) that can penetrate the defense of perimeter security and either gain access of your environment or stop you from having access to your own environments. All four layers of security should be looked at while designing a robust security solution.
Also Security cant just be achieved by implementing robust security solutions,you have to set up right processes and you have to have right set of people to identify & mitigate the threats. 
The idea behind multi-layered defense security is to manage the security risk with multiple defensive strategies, so that if one layer of defense turns out to be inadequate, another layer of defense will, ideally, prevent a full breach.