Here are the foundation fundamentals of a possible Security Enterprise Architecture method :
- Stop fighting the malware game. Learn to co-exist in a malware-infested environment with a zero-trust model. Time to treat the internal network as if it were the Internet.
- Stop focusing on the latest and greatest tools from the hottest vendors; because more tools are not stopping security breaches, they only slow them down.
- Focus on the critical systems that matter for data protection (systems with customers data, Social Security number data, and credit cards, intellectual property, financial records, Data Privacy data, etc.). Do your best with the rest of the company environment, but don’t put your career on the line with battles that don’t matter,
- Systematic label information (classification: Personal, Public, Internal Use, Business Confidential, Customer Info + Data Privacy + Company Y) and focus on the most important one.
- Monitoring servers health/status, use a strong SIEM with daily report,
- Segregation … everything going inside/outside the Data / Server network must be filtered and screened. Use a dedicated Dev / Test environment, and put ICT guys, Devs and consultants in a dedicated VLAN.
- Consider everything outside the Data / Servers network as “untrust” (printers, users, internet, VOIP, VPN, …),
- For externals, ICT Support, … utilizing a “jump-box”. It will track all access and recommend using two-factor authentication for each security zone for additional layers of security before accessing a critical server. The jump box will log and control all access to each security zone.
- If possible, devalue stored sensitive data through encryption/tokenization methods for data at rest. As a minimum, recommend application level encryption, not database encryption. This keeps a database administrator from looking at sensitive data. Stop storing encryption keys on the same servers performing encryption and use the slit-key method of storing keys on different servers with file directory permissions.
- Also consider splitting data if possible. The data needs to be joined for usage (Aka: table joins via encryption). Be cognizant of performance issues and latency.
- Use asymmetrical network routing to the Internet by splitting network traffic and reduce the threat of malware packet sniffing since 50% of the data is missing.
- No confidential data or unsafe data in Development and Test.
The benefits of this architecture method:
- Fewer battles with the CIO and business operations
- You appear as a more flexible CISO and viewed as “business friendly”
- Quick-win, leverage what is already within your enterprise
- Better cybersecurity posture with reduced cyber risk
The mentioned architecture method is one of many ways to implement a successful cybersecurity program when a budget is not where it needs to be in your organization.