Defense in depth

by | Aug 30, 2014 | IT Blueprint, Security, Technology

Defense in depth

Defense in depth is the only answer. The question is what are people and businesses to do about the growing security threats? Tekmar has been providing comprehensive Threat Protection since the late 1990s. Many in our industry are getting on the bandwagon. The alternative to taking action is expensive. We all rely on the Internet to help power our businesses.

Threats are not new. All internet, connected systems are in the cloud. In 2001, an audit of a prospective client’s systems showed that hackers had compromised their server. Their accounting server was after being a storage site for pornography. They have grown in number, target, scope and consequences. The best solutions are the ones that take a defense in depth approach.

defense-in-depth-bot

“The phrase simply means that plugging in one traditional defense — antivirus software, or a firewall, is no longer going to cut it. To stay ahead of a determined and sophisticated adversary, a security officer’s best hope is to layer on many different defenses — strong passwords, two-factor authentication, antivirus software, firewall protection, breach detection plans that can sift through vast amounts of employee data in search of anomalies — then pray they never make the headlines.” http://nyti.ms/1B4c98N

Step on the *Defense in Depth Stair Case

defense-in-depth-stairs-to-clouds

  • Realizing the problem includes you.
  • Taking action to mitigate threats by practicing safe computing.
  • Updating operating systems.
  • Using the latest firewall technologies.
  • Keeping antivirus and anti-malware current.
  • Using strong verifiable encryption.
  • Utilizing regular third party auditing.

As reported in the NY Times article referenced above, people in the network security business see more threats every day. The public and many executives are not blind. Too often they throw their hands too rather than focusing on what needs to be done. Vectra has a great business model. “Defense in depth” is the only answer.

The comprehensive approach is what it is going to take to stem the tide of threats. All levels of the communications and software industries need to be coordinated at heading off the bad guys at the pass like the white hats in the old westerns. Black hat and similar security events show that people can come together and make things happen.

More than action from those sectors people, workers and home internet users need to be educated to understand the threat and take defense in depth. People need to be pushing governments and business interest to make things happen. Even if the comprehensive strategy were to becomes the status quo it would not be enough. Businesses and individuals need new technologies like expiring tokens in transaction processing and stronger point-to-point encryption to stem the tide.

*Defense in depth is a military term. According to Wikipedia, Defense in depth is a military strategy that seeks to delay rather than prevent the advance of an attacker, buying time and causing additional casualties by yielding space https://en.wikipedia.org/wiki/Defence_in_depth. The network sense a defense in depth strategy emphasizes people, hard systems and processes in keeping attacks at bay https://www.nsa.gov/ia/_files/support/defenseindepth.pdf.