Defensible Security Architectures: Determining the Defense for Your Organization

Name: Defensible Security Architectures: Determining the Defense for Your Organization
Author: James Youngblood

Learn about different security methods and how to determine which method is best for you

Preview the first lesson free — get full access to all 3 lessons.

Course: On-Demand

Hello, my name is James Youngblood, and in this module of Defensible Security Architectures, we're gonna be talking about determining the defense for your organization. And in this lesson, I wanna talk about what method is best for my company. Depending upon what your company actually does, is gonna determine what kind of defense you actually need to implement. So some of the methods that we're gonna be covering will be the zero trust method, the data-centric method, and the defense in-depth method. When we're talking about production, due to its nature, production networks or industry are going to focus on protecting their trade secrets. And it's very common for companies to have their trade secrets stolen due to lack security policies. So for this type of an environment, a data-centric method of defense is ideal. This type of defense puts the focus on securing that critical data and the systems that house that data. Now, when we're talking about banking, this is where we're going to really see a lot of security implemented. And due to federal guidelines, banking systems must follow the zero trust method. Remember that the zero trust method means that all requests on the network must be authenticated, authorized, and accounted for before access is actually given. And zero trust means verify everything, trust no one. By doing that, we are providing the best security we can for our banking network. When dealing with utilities, the thing about it is, there's really no federal guidelines for utilities that require them to use a specific security method. Although depending upon what country you're in, some of them do, but it is recommended for utilities to use either a zero trust method or a defense-in depth method. Defense in-depth is a little bit different with zero trust. Defense in-depth means the use of multiple security measures to protect a company's data and infrastructure. This includes addressing vulnerabilities in hardware and software as well as also with the people that work in it. When we're talking about retail, this is where we're dealing with stores that sell products and things of that nature. Because retail outlets are given customer information, including names and addresses and credit card information, their security should focus on data protection. So a data-centric method defense should be used for all retail locations. Education is kind of a unique thing here when we're talking about security. And education systems have student information, including names, addresses and government identification, such as Social Security numbers. Now this is critical information, and due to its nature, it should be treated the same as banking information. Given this fact, education systems should be using the zero trust method of security. Remember, once again, trust no one. Now, unfortunately, there are a lot of education systems that they don't use the zero trust method. And in fact, what we have found through the industry is that a lot of times where some of our weakest security measures are put in place is actually in the education system. This is simply not acceptable. If you work in the education industry, you need to make sure that your educational system, whatever school you're teaching at, they need to be using a zero trust method for securing that data. Government and healthcare agencies in the United States have federal mandates that require them to implement a zero trust method of security by the year 2030. Depending upon what country you live in, this is something that most countries, their governments, are actually gonna be moving towards if they're not already there. And once again, zero trust is just simply, we do not trust anything. Every single message that goes across the network, every single bit of data or every single request has to be authenticated and authorized and accounted for. We need to make sure that it is verified, that the person that it says sent that message is actually the one who did. Now, there are other industries as well, and remember that the goal of any security policy is to make the network as secure as possible, but minimizing the effect on the end user's activity. So I'm gonna say that if your industry was not listed, this is what you want to make sure that you're doing. If it's possible for your company to implement a zero trust method, that's probably what you should do because it includes all the principles of the other security methods in addition to additional policies as well. Now, this is why the zero trust method is referred to as the gold standard for network security. Thank you for watching this lesson on Defensible Security architecture. Join me in my next lesson as I talk about identifying your most critical weaknesses.

Intermediate Provider : James Youngblood 3 Lessons · 20m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

If the zero-trust method is the gold standard of security, why are some companies reluctant to implement it into their networks? Using a zero-trust network is the most secure choice, but it often provides more intense security measures than most companies really need. The type of defense a business uses should be determined by the needs of the company. For example, if protecting trade secrets is the biggest concern, then a data-centric method would be the best option. We’ll explore three different security options– zero-trust security, data-centric security, and defense in depth– and which needs they suit best.

In these lessons, you will learn which defense strategy is best for your network security, based on the type of industry in which you operate. We will discuss the ways that Red Team testing can help identify security weaknesses within your network and how to fix them. Finally, we will discuss the importance of employees being knowledgeable about IT security, particularly in recognizing social engineering tactics.

What You'll Learn

Describe the zero-trust, data-centric, and defense in depth security methods
Recognize the benefits of data-centric security for protecting concerns such as trade secrets
Recognize the benefits of defense in depth security
Recognize the benefits of zero-trust security
Explain the benefits of Red Team testing for identifying network security weaknesses
Determine which defense strategy best suits your network based on your industry

Key Takeaways

The type of defense a business uses should be determined by the needs of the company rather than defaulting to the most intense option.
Zero-trust networks are the most secure choice but often provide more intense security measures than most companies really need.
If protecting trade secrets is the biggest concern, a data-centric method is the best option.
Red Team testing helps identify security weaknesses within a network and supports fixing them.
Employees being knowledgeable about IT security, particularly in recognizing social engineering tactics, is important to network defense.

Frequently Asked Questions

What security methods does this course cover?

The course explores three security options: zero-trust security, data-centric security, and defense in depth, and explains which needs each one best suits.

How does this course help me choose the right defense for my organization?

It teaches which defense strategy is best for your network security based on the type of industry in which you operate, since the type of defense should be determined by the needs of the company.

Does the course address Red Team testing?

Yes. It discusses the ways Red Team testing can help identify security weaknesses within your network and how to fix them.

What role do employees play in the security topics covered?

The course discusses the importance of employees being knowledgeable about IT security, particularly in recognizing social engineering tactics.

What lessons are included in this course?

The course includes three lessons: What Method Is Best for My Company?, Identifying Your Most Critical Weakness, and The Need for Red Team Testing.