Proper network security is important for multiple reasons – prevention of liability that might arise from secrets, confidential information, or Personally Identifiable Information (PPI) being leaked, as well as prevention of general network instability and losses arising from said instability and delays in network operations.

Security Terms

Network security revolves around several key terms, several of which have been mentioned in other posts. The main terms used are risk, vulnerability, and threat.

A Threat is probably the first thing people think of – a threat is an actor that causes network problems, either an external actor (such as a hacker, ransomware, phishing, or cyber attacker), or an internal actor (such as a disgruntled employee, or possible just someone who doesn’t realize the consequences of their actions). Threats should be identified and some mitigation done (mentioned later) to minimize the potential for the threat to be realized.

A Vulnerability is some flaw in the network or security design that allows an actor (internal or external, malicious or accidental) to cause a problem. A user who doesn’t understand what phishing is a threat; an email system that allows phishing emails to be delivered to users is a vulnerability. Vulnerabilities can be mitigated with best practices, and should be thought of as the doorway through which a threat enters the network.

Finally, Risk is the consequence of a threat exploiting (purposely or accidentally) a vulnerability. In other words, Risk = Vulnerability x Threat. A larger vulnerability, or a larger threat, can magnify the consequences and the risk that can arise – financial, reputational, or other – even in the absence of the other being large.

Audits

Network audits can be done by general staff, or they can be performed by experts in the field. Network auditors will work to identify vulnerabilities by leveraging their understanding of network operations with existing threats. They will utilize knowledge of common vulnerability exploits to find weak points in the network design. After doing this, they will seek to assign possible risks that can arise, mitigation strategies, and assist in implementing a strategy to reduce vulnerabilities, identify threats, and thereby reduce possible risks. An auditor can even try to obtain physical access to network resources to test physical, as well as logical, security.

Logical Security

Logical Security covers methods involving, primarily, software – means to secure the network against vulnerabilities and threats. These can include forms of encryption – commonly, installing network certificates to provide security that resources being used are what they appear to be. Logins can be synced across multiple systems to provide some type of SSO (Single Sign-On) so that more powerful methods of authentication can be leveraged, and users won’t have to remember as many passwords. MFA (Multi-factor authentication) can be used so that, if one type of authentication is stolen from a legitimate user, the login still fails in the absence of a second form of authentication.

Networks can also be designed so that users only have access to the parts of the network needed. VLANs – Virtual Local Area Networks – can be setup so that users are prohibited from access to network resources and other areas of the network that are outside the scope of their job responsibilities. The Human Resources department may need access to network shares and HR software, for example, but they don’t need access to manage the SQL databases behind that software. A Guest Wifi can be set up and logically isolated from the rest of the network so that company guests (or employees’ own personal devices) can have internet access without secure network access. BYOD (Bring Your Own Device) setups can be even more restrictive, and isolate all devices from others.

Principle of Least Privilege

In all of these designs, the “Principle of Least Privilege” should be kept in mind – users should have the absolute bare minimum access required for proper job performance. While it can be tempting to provide “all access” to simplify management, this provides opportunities for an employee to become an internal threat (deliberate or accidental) by leaking access through a vulnerability to a system they should have never had in the first place.

In another post, I will discuss Physical security methods (locks, port disabling, and so on) that can also be used to secure network resources.