James Wan Blog

With the evolution of TCP/IP internetworking, Enterprise infrastructure has been connected to the Internet cloud more than ever, which enables tremendous business opportunities and data communication for the enterprise, but in the same time also exposes enterprise to the various threats and attacks. To protect enterprise infrastructure from known and zero-day attack, design and implement a defense in depth strategy is very important.

To defend in depth, enterprise infrastructure can be subjectively segregated into two zones: perimeter zone and internal networks/systems. Enterprise typically deploys DMZ Internet web servers, external routers, firewall, proxy, Internet DNS servers in the perimeter zone, and perimeter zone is typically the attacking point for the external threat and attacks. The defense of the critical perimeter should include routing security, which includes well-designed ACL, routing redundancy, and routing design. Firewall/proxy/DNS servers need to be hardened with system security principals to prevent attacks like DDOS and DNS poisoning.

To most enterprise large or small, web application security is probably the most critical aspect, as web applications are the most convenient and easiest attack target. Http is open through the firewall and there are many known vulnerabilities for pretty much all web servers. The most common attacks include the SQL injection, cross-site scripting (XSS), buffer overflow. OWASP (http://www.owasp.org) is a good resource for web application security.

As equally important perimeter security, VPN security and wireless perimeter is often overlooked. In today’s mobile world, companies deploy more and more VPN solution and wireless networks. If not properly secured, enterprise infrastructure could be easily attacked through VPN client and VPN tunnel, or through wireless hotspots. Because of the distributed and mobile nature of the VPN and wireless devices, protecting VPN and wireless perimeter from attacks makes it even more important to have defense strategy in place before deploying them.

Even with perimeter defense in place, internal networks and systems still need to be properly secured so that penetration of perimeter won’t leave enterprise’s critical internal infrastructure wide open to attacker. This requires implement system security, application security, and database security to all internal infrastructure components. Inside threat is one particular vector to consider for the internal security, especially upon impending lay off, firing, or spin off. Appropriate access control, authorization, and auditing logging are necessity as part of the defense.

Defense in depth depends not only physically segregation of the infrastructure as above zones for protection, but also logically depends on integrating security in the networks design, application design and secure coding, database design, and continuous system hardening. Besides defense through technology, employee security awareness training and bulletproof operation procedure should be included as part of defense in depth, along with process for security monitoring and breach detection.

Tags: application security, attack vector, enterprise infrastructure, inside threat, network security, perimeter protection, security monitoring, system security, web application security

This entry was posted on Saturday, April 17th, 2010 at 10:54 am and is filed under Technology. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.