At the outset we have observed that in any enterprise a security incident usually emancipates on a single or a few systems on the corporate network. However, due to weak network security design, the problem gets severely aggravated leading to an avalanche of security incidents on the corporate network.
In reality, most of the network security problems could be effectively mitigated from the ground-up if the corporate IT networks are designed with recommended security best practices from the beginning. Nevertheless, even if a corporate network was not designed with security best practices, it is still possible to perform a security assessment of the current network logical design to unearth hidden or potential flaws that might prove to be very disastrous at a later stage, through a simple process called “adversarial review”.
The adversarial review process is not conducting a direct physical attack of our corporate network per se, but it actually involves conducting an analytical thought process of creating attack scenarios of how attackers can attack our network. By creating these attack scenarios and identifying measures that could be used to prevent them, we can locate flaws in the network architecture design or potentially weak links that do not follow defense-in-depth principles.
The adversarial review process has to be especially performed on those devices that are used to implement the security infrastructure of the corporate network. The overall security posture of a network is dependent on the security of the individual components that make up the network. [Watch out for my detailed article on how to conduct the adversarial review wherein I elucidate the process with a fictional network design in one of the forthcoming issues of NWME]
The output of this review process can then be taken to create a “defense-in-depth” architecture that will employ security zones separation as one of the core network defense principles. The resultant network security design will consists of separate logical multiple security zones based on their criticality and sensitivity level. A security zone, is a logical grouping of resources such as systems, networks, or processes that are similar in degree of acceptable risk.
Enterprises must implement defense-in-depth architecture by forming security zones. Each security zone where appropriate will control access to the other subnets and will be protected by the appropriate technologies. Grouping resources based on similarities in security-related attributes will strongly aid us to limit the attacker’s area of influence if he gains access to a system inside the perimeter network.
As corporate networks continue to evolve in to full blown ecommerce networks and as companies continue to get acquired and their corporate networks getting merged with other networks, a little effort expended to assess the security design of the corporate IT network will go a long way to help organizations deal with the burgeoning security issues faced by today’s enterprises.
Analyzing how attackers can compromise our networks can help us find our network’s weaknesses so that we can plan on improving our network’s security. The adversarial review is a passive offline process to identify potential weaknesses of our networks and offers multiple ways of protection even from unknown vulnerabilities. The output of this adversarial review process can then be applied to create a secure network design for our corporate networks.
