Defensible Security Architectures: Implementing the Strategy for Your Organization

Name: Defensible Security Architectures: Implementing the Strategy for Your Organization
Author: James Youngblood

Learn how to prepare your company for new security policies

Preview the first lesson free — get full access to all 3 lessons.

Request a demo Sign in

Course: On-Demand

Hello, my name is James Youngblood and in this module, Defensible Security Architecture, we'll be talking about implementing the strategy for your organization. And in this lesson, we're gonna talk about defense in depth strategy. With every network, there are three things that matter most. And that's the availability of the network, the integrity of the network, and the confidentiality of the network's content. So availability is defined as the state of being able to be used. And integrity is defined as the state of being honest or trustworthy. Confidentiality is the state of being kept a secret. Now defense in depth ensures that the processes and controls of a network are going to guarantee that a network is available, that it's trustworthy, and that it keeps the information stored on it a secret. So how do we accomplish this? Let's talk about this. It's actually what's known as the layered approach. So defense in depth is a strategy that's used in IT security that uses multiple methods, and our methods are gonna be zero trust and data-centric, but it uses multiple methods, and systems, and policies to ensure the security of the network. Now these methods are layered such that if one layer fails, the others will still remain and continue to protect the network. And rather than relying on a single appliance to provide security, such as, say we had a perimeter firewall, a perimeter firewall is going to protect us from any kind of outside threat. But the question is, what happens if a hacker gets past that perimeter firewall? If that's the only defense that we have, now the hacker can do whatever he wants to inside of our network. It's gonna involve multiple appliances instead of just a single appliance to protect our network. There's gonna be many components of the zero-trust method and the data-centric method that gets incorporated into the defense-in-depth strategy. So let's talk about some of the components first. Some of the components we're gonna be looking at will be firewalls. And firewalls may include perimeter firewalls, like what we were just talking about, but it may also include application firewalls, things like a web application firewall. It may include host-based firewalls, so like the firewall that comes on any copy of Windows, that's a host-based firewall. And even next-generation firewalls like a unified threat management appliance. Firewalls are our first line of defense in pretty much every network. Another appliance that we're gonna be dealing with will be an intrusion detection system and an intrusion prevention systems. This next one, it's not that it's an appliance but it's something we're going to do to an appliance, and that is network segmentation. On our switches, we're gonna be creating multiple subnets and private VLANs. And the reason why we're doing that is because we want to limit an attacker's ability to move from one system to another inside our network. Even if they get past our firewalls, they're not gonna be able to see any other device on our network except for the system that they actually hacked into. They're not gonna be able to go any further because in a private VLAN, each computer can only see itself and its connection, it can't see anything else. So the hacker's stuck there. We do want to provide endpoint security. And endpoints are things like PCs, and servers, and mobile devices. So we wanna make sure we've got antivirus software on there, anti-malware, anti-spyware, host-based firewalls, anything like that. But we also wanna make sure that we're verifying access control. So using things like active directory to verify usernames and passwords. That's how we're gonna secure our endpoints. We do need some pretty strong policies and procedures if we're gonna implement defense in depth. It's not just the security hardware that we need. When we're dealing with defense in depth, there's a bigger focus on users and their access to the network. So keep that in mind. We're gonna need to have strong passwords. And passwords should have complexity in length. It's recommended that a password be at least eight characters long and it needs to contain letters, numbers, and special characters. An alternate way of doing a password is to provide what's known as a passphrase. A passphrase can be a sentence, such as, "A passphrase is better than a username period." An even bigger improvement on our password policies and procedures is if we require something known as multifactor authentication. It's going to have three main conditions. It has to be something that you know, so like a username and password, that's something that you would know. But it's also something you have, now that may be like a security badge or a key fob with a code on it. Something that you are, so like my fingerprints or a retina scan, that would be something that I am. And multifactor authentication requires you to have at least two of these three. Another policy that we want to implement is the policy of least privilege. This is where users are granted access to what they need to do their jobs but they're not granted any other access. Finally, we also wanna do it with patch management. We need to make sure that we're keeping our endpoint devices updated and secured. So a patch management tool can significantly improve the security on our network by ensuring that all endpoint devices have received the latest updates. Thank you for watching this lesson on defensible security architectures and dealing with the defense-in-depth strategy. Join me in my next lesson as I talk about presenting information to senior management.

Intermediate Provider : James Youngblood 3 Lessons · 12m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

How can an IT professional explain to senior managers and decision makers the need to change a security policy or method? We recognize that a simple username and password are no longer sufficient for providing security for our company. But what is the best way to present the need for improved security, not only to management, but also to the end users? This is one of the most challenging aspects of an IT professional’s job. It’s difficult to explain the need for further investment in something that does not directly bring a profit to a company’s bottom line. We will explore and discuss the types of defenses that can be implemented on a small budget while also maximizing the security of the business.

In these lessons, you will learn how to present the information to decision makers within the company, as well as the individuals who will be affected by security policy changes. We will discuss the terms and phrases to use or avoid to help explain security needs effectively. Finally, you will learn how defense in depth can provide extra security to a network and help protect critical assets.

What You'll Learn

Describe the benefits of a defense in depth strategy for protecting a network and critical assets
Identify the steps for presenting security data and proposals to senior management and decision makers
Recognize the importance of including end users in security policies and educating them on changes
Explain the need for improved security beyond a simple username and password to both management and end users
Choose the terms and phrases to use or avoid when communicating security needs effectively
Evaluate defenses that can be implemented on a small budget while maximizing business security

Key Takeaways

A simple username and password is no longer sufficient to provide security for a company.
Explaining the need for further security investment, which does not directly add to profit, is one of the most challenging aspects of an IT professional's job.
Effective security defenses can be implemented on a small budget while still maximizing the security of the business.
Defense in depth can provide extra security to a network and help protect critical assets.
Communicating security needs requires presenting information to both decision makers and the individuals affected by policy changes, using the right terms and phrases.

Frequently Asked Questions

Who is this course for?

It is aimed at IT professionals who need to explain the need to change a security policy or method to senior managers, decision makers, and the end users affected by those changes.

What does this course cover?

It covers defense in depth strategy, presenting information to senior management, and educating end users, including which terms and phrases to use or avoid when explaining security needs.

What will I learn to do?

You will learn to describe the benefits of defense in depth, identify the steps for presenting data to senior management, and recognize the importance of including end users in security policies.

Does the course address security on a limited budget?

Yes. It explores and discusses the types of defenses that can be implemented on a small budget while also maximizing the security of the business.

What skills does this course build?

It builds skills in cyber security strategy, IT security architecture, security implementation, security patterns, security strategies, and information systems security architecture.