0:00 Welcome engineers. My name is Travis IQ and today we're discussing defense and depth, a critical cyber security principle that did not originally exist when we thought about cyber security. Let's get started. Join me in the void as we begin this discussion. Let's first start off and talk about why. Why do we have defense in depth? Number one, defense in depth is a mechanism to secure our entire infrastructure. It is a holistic view of the infrastructure with an understanding that there may or may not be security events occurring within that infrastructure at any given time. What does this mean? This is a concept that we actually talk about. It's called assumed breach. Basically, what you're saying is I'm assuming that there is going to be or is currently a breach in my environment. Why are we assuming breach like this? The reason that we are
0:45 assuming breach is because back in the day we had a castle model of defense. we had a castle. What that means is we had this outer layer of defenses and then we had our network in here. You'll notice that we don't have that in this in this model that I'm describing to you here. The physical facility, data and infrastructure, internal network. We are looking at the network as a holistic infrastructure. We're saying, hey, these are the layers at which we could investigate or we could secure the network. We did not do that previously. And now this is a long time ago. You're talking 20, 25, 30 years ago where you said we're going to implement firewalls and then we're going to utilize unsecure protocols within the internal infrastructure. Things like FTP, HTTP, SMB. These protocols, some of them still
1:31 in use today, not as frequently as you would think, but they are still in use. They don't utilize authentication. They don't utilize encryption. they don't utilize these internal security tools that we would that we traditionally think of when we discuss security and security plus for example if this were to be part of a course infrastructure and so that that's how it used to be. It used to be this castle model where we would filter all the traffic and we would keep the bad guys out. We don't do that anymore and you know this because you've heard me discuss things like cloud infrastructure security tools, network infra infrastructure security tools, other security tools. Now let's discuss them in a little bit more rigorous fashion here. So with our defense in-depth model, the first thing that we want to look at is our data infrastructure. And the data infrastructure can be secured a number of ways. We've talked about the CIA
2:16 triad confidentiality integrity and availability as it applies to data. I'll link that video in the description below. But we can apply a number of security concepts specifically to the data. We can encrypt the data. We can back the data up. We can maintain confidentiality, availability, right? We can hash the data and maintain integrity checks. So there's a lot of things that we can do with the data. But we are we are talking about securing the data at one at one layer. The next layer is the applications. We can use secure applications. We can use the secure alternatives to FT FTP like FTPS. We can use secure alternatives to DNS if we're using DNS in our internal environments with DNS over HTTPS or DO. We can secure HTTP with HTTPS. We can secure SMB with SMB version two and additional SMB overlays of security tools. So we can
3:03 secure the application. So you notice we're going basically we're going up the stack in our infrastructure and it's not just the network stack. We'll talk about the network stack here as I'm going up the stack but we can also talk about physical facility and some other things and you'll notice that users and organization that come out even above the network stack and then this data data and applications these really exist on the hosts and so you notice there was a little there was a little little dark spot here where I wanted to summarize this and say data applications passwords we can apply these all as host security tools. We can also apply overlays on top of what the hosts are utilizing to secure their own infrastructure. We can utilize things like endpoint detection and response. Those might be a component of things like intrusion prevention systems or intrusion detection systems.
3:49 And then you're like, Travis, do detection systems really constitute security concepts? I mean, they're not actively preventing anything. Yes, active detection is a major component of security. It's not just the prevention components. It's not just applying confidentiality controls. It's not just applying secure passwords. The detection component is extremely important obviously. Okay. So we get it from the host. Now we're connecting the hosts to the network. And so we can secure the internal network. We can do internal monitoring of network traffic. We can do filtering of network traffic. We can apply things like VLAN segmentation. You can apply guey based segmentation in cloud infrastructures. The internal network can be secured right via segmentation. And so now we say, okay, the internal network. Now we get to something that we're familiar with a little bit when we're talking about the
4:34 castle model or even when you're talking about your home security, which is the perimeter network. And so now you're thinking about securing the perimeter network from, I don't know, things like distributed denial of service attacks, DOS. Those might happen in internal environments, but typically they're leveraged against external IP addresses. You're monitoring your external IP address ranges. You're conducting things like penetration tests. Now a penetration test can apply to all these but I'm just thinking about what an what an external view what the penetr where the penetration tester might start here. Okay. So this leaves us with the two final components here which is our physical facility. And you should know that access to your physical infrastructure is basically death to cyber security. If someone has access to your physical servers, your physical routers and switches, your physical data, that is a huge problem. For
5:22 example, just one quick example, but if I were to if I wanted to bypass the security controls on a Cisco on a Cisco piece of equipment and I had physical access to that equipment, I could I could console in directly to that piece of equipment. I could restart that piece of equipment and then I could enter ROM, ROM monitoring mode and I could bypass the passwords or I could reset the device completely and then I could give myself specific access to the infrastructure. This is just one example of physical facility controls, but you should have a very strong physical facility control and we will talk about that in a subsequent video. But access to the physical facility is critical. We don't think about that when we're thinking about cyber security and applications and data and bits and bites and ones and zeros. But the physical access is absolutely critical. And then finally, another thing that we don't think about is our organizational footprint, users and organizational
6:07 footprint. And we talk about this when we talk about open-source intelligence. Open- source intelligence is literally gathering information about your users and your organization from their digital footprint on the internet somewhere. Typically, all of this is open source. It is openly available. Social media, job posts, the actual websites, cached websites. Your organizational footprint is critical. Your penetration tester oftentimes will actually analyze this as well to gain it to gain information and then they will report this information to you and maybe how they use that information to compromise your internal infrastructure. This is a holistic view of defense in depth. I hope that you found it really interesting. We are going to go into detail about some of these specific components in subsequent videos. As is always the case, engineer, break stuff, have fun. Let's go.
6:57 [Music]
