Show notes
Layered security refers to the practice of combining various security defenses to protect the entire system against threats. The idea is that if one layer fails, there are other functioning security components that are still in place to thwart threats. In this episode of the Inside Out Security Show, we discuss the various security layers. Human Physical Endpoint Network Application Data Cindy: Hi and welcome to another edition of The Inside Out Security Show. I’m Cindy Ng, a writer for Varonis’ Inside Out Security Blog, and as always, I’m joined by security experts, Mike Buckbee and Kilian Englert. Hi, Kilian. Kilian. Hi, Cindy. Cindy: Hey, Mike. Mike: Hey, Cindy. You call us security experts. I’m actually, where I don’t know if you can see it, “I have a fake internet job”…because I still haven’t been able to explain my job to my mom and dad. “He does something.” Human Cindy: We’ll see who’s most fake at the end, okay? So recently, Rob wrote a layered security guide and I thought it would be interesting for us to go through each of the layers and share stories that we’ve read or heard as it relates to each of the layers. The idea with layered security is that you want to make sure that you have many different layers of defense that will protect you. If there are any holes, just in case something gets in, you might have a security layer that serves as a backup that will catch it. So the first layer to start is the human layer. So that layer is all about educating people to spot scams and be cautious about the passwords that they give out, their social security numbers that they give out, their credit card information. This layer, Kilian, you talk about this a lot. I feel like, increasingly, criminals are using and exploiting services that we rely on and turning it into like an attack vector, like there is an article recently about people texting you pretending to be Google and saying, “Hey, there was this suspicious attempt to get it in.” And we talked about passwords and alternatives and using two factor and it’s kind of like, “Oh man, I have to check my text messages and make sure I’m not scammed again,” like another thing to worry about. Kilian: Oh, yeah. People, by nature, want to be trusting of other people. We kind of have been trained since day one to feel kind of bad about being suspicious … The bad guys out there know this and they exploit it. It’s so much easier to go after a person and just kind of play off of emotions because they’re far more malleable than a system, and people often are not trained or educated around security practices. And even if they are, they’re kind of trained into a certain mindset. So if they see something that looks semi-legitimate like, “Hey, a text from Google. Oh, they’re protecting me. They have my login name or my IP address or something, NIC address,” because most people are not going to investigate that closely, it’s going to look fairly legitimate like, “Oh, hey, Google’s looking out for me. This is great.” It’s very easy to, just with a little bit of a legitimacy, to get people to kind of go along with it and it’s…the con of that sort is as old as time basically and it’s only getting easier any more, too. Mike: I’ll go with something that you said Kilian, which is that it’s really about our mindset. And I think from a security practitioners’ standpoint, we’re typically very focused on exploited time and this and do this things and so we forget a lot about on the human layer which is education and like how to educate your users and to help make them part of your line of defense. I think a fun activity for that is actually to do phishing, and there is a couple of companies that do this, that do like fake phishing attacks, and then basically, so I go, “You clicked on this so we are reporting you to IT.” And it’s kind of almost like in hospitals where they like shame the doctors into making sure they wash their hands all the time. You’re kind of like trying to enforce this IT hygiene aspects on all of your users, and either hire a company or you have some free time, you can just try to phish your users individually to mess with them. Kilian: Sure. Physical Cindy: Our next layer is the physical layer , and you know, I would be like the worst security person to hire because I wanted to skip talking about this layer. There are so many layers and Mike’s like, “Why aren’t we talking about it? It’s the most important one.” And Kilian is like, “It’s often overlooked.” And I said, “It’s just the physical layer, like everybody gets that.” Tell us a little bit more about the physical layer. Kilian: I guess I’ll jump in. It is so often overlooked. We worry about firewalling the data off to protect from external attacks and stuffs that come in over the wire. But how many times in businesses do people check badges? You can walk into a corporation. If the guy sitting at the desk is distracted for a minute, and then you’re inside and nobody looks twice at you. If the doors aren’t locked in the server room, you walk in, plug in a USB device. Basically, once you have physical access to something, it’s game over. There’s no other layer of security that they probably can’t get around at that point. And we rely so much on just kind of observing people and we put a lot of faith in locks, too, like physical key locks. They’re such a terrible false layer of security. Most front door locks or bike locks or anything else are easily defeated within seconds. The physical layer is often overlooked but it’s such a false layer of security, too, that we know we have somebody watching the door. Because again, we are relying on people and people want to be trusting. Mike: What I was going to mention with respect of the physical layer was I think a lot of things are changing. So businesses are much more just personnel, lots more different, just physical branches, places, people working from all sorts of different remote situations, as well as it used to be everything was hard wired, and now, most every place has WiFi. And so you have this very different situation of like everyone in the office walking in with the WiFi radio that’s connected to the internet. But we don’t think about that. We just like, oh, we are on our cellphones, but if there’s malware on there that potentially perform an attack or some form of disruption. There are some real interesting exploit tools that basically do things like DHCP exhaustion on a network and so you have to do things like MAC filtering. I worked on a high security environment on the military. They have things like if you unplug a computer from the wall from the CAT5 and plug it back in, it won’t let it back on the network as it lost the MAC connection. You can’t just bring a laptop in and plug it into the Ethernet port in the waiting room. Things like that, like very good sensible suggestions. Cindy: I just had a paranoid thought that when I go home, I want to like install 10 locks, put on a password, and I need somehow to after-authenticate myself to get in. So in terms of a business security, like can you go overboard in terms of putting like a trillion locks on something? And then what’s kind of a good balance for an extreme paranoia or paranoid person like me? Kilian: I’ll get dogs with bees in their mouth so when they bark, they shoot bees at you. Mike: From a business standpoint, I think the biggest thing is actually more procedures, procedures around access to servers, access to changes, that kind of thing. And then from there, the procedures are implemented that helps with the recognition of what’s a threat and what isn’t. On a personal level, something that I’ve been seeing a lot more in terms of physical stuff is skimmers on ATMs. That’s probably like we were talking like a personal sort of physical attack. That’s probably the big one, that every ATM you go to, you sort of want to tap at the card holder to see if it falls off because it’s so easy to put a skimmer on. Kilian: That kind of distilled… it’s situational awareness, kind of being observant of the people and things around you, what you’re interacting with. Endpoint Cindy: Another thing we need to be alert and aware of are endpoints – protecting devices, PCs, laptops, mobile devices, from malicious softwares. People really like using endpoint protections to guard against a ransomware, and people’s found out it’s not really effective. But if it’s not ransomware, malware can really sit on your system for like six months before it’s even identified. But people also really want to protect their endpoints. What are your response and thoughts on this? Mike: I’ll go. I guess my first thought is we’re talking about layered security, and so no solution is going to be a homerun 100% of the time. And so what we are really trying to work on is percentages, reducing the surface area we can be attacked on, reducing the opportunities for an exploit. An endpoint security can certainly be part of that but it’s not a complete solution. But by limiting the types of apps that can be run, the type of traffic that can come in, it’s a way of helping to manage that risk. And that’s what we’re talking about with all layers, is how can we manage risk at all this different layers? And hopefully by doing that simultaneously at all the layers, we really improve our security much more than if we thought, “Okay, it’s just endpoint security or it’s just doing training of the users.” Kilian: The way I would think about it, too, is if you ever see the machines for like looking for gold or sifting rocks, like you have the different size of screens. Endpoint protection antivirus, I would think, is like the biggest size of screen. It’s gonna get like the bigger rocks out, so the kind of most obvious, most basic vulnerabilities. And kind of, as you go through and sift out the different pieces, that’s exactly what it is. You can just, multiple layers, sift out different things that one might not catch until you get it. And then just good patch management, too, on endpoints and servers, things like that. If you leave vulnerabilities that have been patched for 10 years on your system, that’s kind of inviting trouble in a lot of ways. But then people often overlook it. Mike: Those are the big holes in your screens as your trying to through all the data and everything is falling through these unpatched systems. Cindy: But there are a whole bunch of alerts. People get thousands of them, like daily and weekly. That’s another annoyance. You can’t actually check thousands of alerts every day. Mike: And for all this sort of systems that monitor the things, all the vendors, us included, are trying to…people talk about alert fatigue. If you get an alert every 10 minutes, like, “Oh, something’s happening, something’s happening,” like you just cease to care about. It’s not something that actually needs responded to or thought about. So there’s a lot of work with like machine learning, better filtering, and better tracking on how to handle that to reduce that amount of alert fatigue. But you’re absolutely right, Cindy. Cindy: And also make alerts that are really worth alerting on so that you’re not like, “Oh my God, my blood pressure is increasing,” and then you end up in the hospital or something. Mike: What kinds of alerts are you getting? Network Cindy: No, listen, it’s not me. I’m just hearing all these stories when I go to conferences and I go, “If I had that many alerts, I will just be like…ahhhhh! Watch out for the crazy woman.” So another layer we should talk about is network security. I’m thinking firewalls, intrusion prevention, detection system, VPNs. And I was kind of tricked to read an article that says “Utility board hears about network security.” And I was like, “Oh, they’re really serious about network security.” Like, “What about the other stuff?” So I went through and I read it. I clicked on it and I read it and they take security seriously. Like in the article, the IT director talked about network security. He made references to all those different layers that we’re talking about so far. And he made the analogy of a Swiss cheese as security and you put layers upon layers of them and said, “That even then with all the layers of cheese, a small hole, so a small hole in your security can be catastrophic.” And I thought it was just really great that they’re talking about it. And further on in that article, it mentioned that a board member requested that presentation because he had heard about a utility at a utilities conference that there was a hacking of an electrical system in Colorado. So we hear a lot about things that go wrong in companies and they’re not doing anything about it. But I really liked that they’re saying, “Hey, I’m protecting our utilities network.” And it’s a great way to get more of like security funding, too, because security systems are expensive, like whether it’s network. Even if it’s like a $200 thing, you still have to be like, why do you need this, and explain. So back to network security, the talk that they had, presentation they had, it’s a great way to just get money like, say, there is an article in Rob’s layered security guide about “ What’s the difference between a $1000 one and a $200 one?” Mike: For a firewall, you’re talking about? Cindy: For a fire…yeah. I went on a tangent. I think someone… Kilian: I mean, you brought up an interesting point. That article, I thought, was really kind of fascinating because the one thing that kind of really, if I can pick one thing a security thing that scare me on a daily basis, it’s a lot of this, like command and control type, or not command and control but the SCADA systems or the industrial control systems that run a lot of our infrastructure. And back to the unpatched systems, these things are from the whatever, ’80s, ’90s, that they said, “Oh, well, hey, we can monitor whatever, our damn controls online, stick it on a network with an IP address,” and then it controls kind of a vital piece of infrastructure, like something in the physical world that can cause a lot of damage. Or the controls at the electrical system, you can wipe out power and that will cause a lot of problems in the physical world. Network security is, again, one of the critical layers. Again, if you have to connect it to a network, at least run it through something. You still need the defense and depth across the whole board, but that’s kind of the first line of defense for a kind of network connected systems. Mike: The only other thing I was going to mention is that I think a lot of times, people think of network, especially with from a lot of employees, it’s like, “We need VPNs for very everyone. We have VPNs for everyone. We’ll be protected.” But you have to remember that also, it’s sort of like punching a hole in your firewall because VPN, it’s like making a home computer as if it was on your network, and all the ensuing issues that that can cause. Kilian: And then we can tie it right back to physical security then. On your VPN at Starbucks, you walk away for a few minutes, someone walks up, plugs something in, or you don’t lock your laptop, then the internal network’s compromised. Mike: I know for sure there has been multiple reports on people getting ransomware on their networks from, like someone at home and they get like an infection, they bring it to the IT group. Like, “Oh, Bill in IT, he’ll help me out. He’s always such a nice guy.” They bring it in. Like, “You look at this real quick? It’s real weird.” “All right, let’s plug it in the network.” And, boom, the network is now infected with ransomware. Good intentions gone awry. Application Cindy: Oh my God, I’m so scared that whenever you guys just share stories and I get like extra, extra scared. Okay, the next two on application security , that, there’s a lot to talk about in that one. I wrote a blog post about it, that our IT people won’t let me install anything on my computer. When we talk about applicatio…
Full show notes at the publisher 
Our TOPPODCAST Picks 
Stay Connected
