Defensive Depths

02/01/2010 13:17

With the new year, it's time to get back to basics and review some key concepts in the security field. One term we often bandy about is "defense in depth" as a means to secure your information and it has nothing to do with deep sea warfare.

The term is taken from military parlance and can be traced back to ancient times as a way to increase the survival of whatever it is you're protecting. By placing your king, or gold, or big rock, or sensitive information within multiple layers of defense, you can significantly increase the difficulty of others getting to it.

Think of a medieval castle: for a marauding dragon to get at your king he must go through the town walls, then swim across the moat, and then get through the castle walls. Once inside the castle, there is the main keep or central tower to get into and climb. At each layer, defensive countermeasures can be taken to repel or at least delay the vicious beasty until help can arrive.

Properly designed networks incorporate the same strategy. Your connection to the outside world (the internet) should have strong walls and gates to your network (the town) such as a true firewall that looks at all of your traffic for signs of any mischief. Any services you provide to the internet at large, such as web sites, ftp sites, etc. should be isolated outside your network in what is known as a DMZ (Demilitarized Zone).

Once traffic enters your network, it should be verified and screened by your servers and computers (the castle). These servers and computers should have modern and updated anti-malware software as well as software firewall protection against anything that manages to get inside the network.

Finally, the information itself (the king) should be secured through permissions and perhaps file encryption (the tower) to only allow access from authorized people, not just authorized computers.

All of these components work together to help make sure our information is only accessible to those we want. Other layers can be added or removed, based on the sensitivity of the information, the risk of exposure, and the risk tolerance of the information holder.