Cybersecurity Basics From the Outside In

The elements of effective cybersecurity are both a broad and a deep subject for discussion, and the details of anyone particular element bears an in-depth discussion of its own. That said, such details are often best left to companies’ cybersecurity teams to investigate and implement – but in no regard should executive teams remain completely uninformed of the high-level elements that should comprise proper, well-rounded cybersecurity within their organizations.

With that in mind, then, what are the elements of effective cybersecurity with which executives and other stakeholders should have, at the very least, a working familiarity?

Cybersecurity: Begin at the Beginning

While the details of implementation may vary from one company to another, or between infrastructures, it is always critical for cybersecurity teams to put two fundamental concepts into action: Security by Design, and Defense in Depth. The principle of Security by Design means that cybersecurity elements are carefully considered at the outset of software or system development, and not just patchworked into place on an ad hoc basis after the fact. Foreseeing a need before it happens offers a robust, preventative Security by Design.

If truly practicing security by design, however, the system should also include an approach of Defense in Depth. It’s a simple concept: The cybersecurity scheme should incorporate security at all levels in an attempt to first defend against inappropriate network access, and then to defend against bad actors who manage to get inside of an organization’s network. An important note here is that “bad actors” include hackers, yes – but can also include rogue employees and admins who might come from the inside of the network. Defense in Depth helps in these kinds of situations by ensuring that network access does not equate to unlimited access to sensitive resources, thanks to layers of defense.

Yet these two concepts are only the beginning of a winning strategy to protect an organization’s critical infrastructure and assets – and here are a few elements, in a little more detail, that can help.

Cybersecuring the Perimeter

The first line of defense should always be that which may stop cyberattacks from ever penetrating into the interior of an organization’s network. Firewalls are commonplace, but will only be effective if managed properly; that is, all ports should be properly locked down, and factory-default passwords changed. In that regard, proper password management across the entire organization should also be considered a part of securing the perimeter: Password policies should mandate (and enforce) that passwords meet minimum complexity requirements, and are frequently rotated. Requiring strong passwords prevents hackers from gaining access to a network simply by guessing weak passwords, and frequent rotation helps to keep them from using otherwise-valid login credentials to which they have somehow gained access.

Cybersecuring the Interior

Whether it’s through a firewall breach, a stolen password, a brute-force attack, or any other mechanism, it’s a prudent assumption that the perimeter can (and will) be breached. This, in turn, leads to the necessity of cybersecurity elements that can protect the interior of a network.

As a bedrock principle of internal network security, all users – including admins – should be granted access to only those resources that are necessary for performing their roles. This is the Principle of Least Privilege, and ensures that no one can access resources beyond those which they require. This can prevent hackers with stolen passwords from seeing everything on the network, for example, and thus also prevent them from “bouncing” internally from resource to resource until they find something of interest, but can also help with inadvertent, inappropriate access to sensitive resources on the part of users who actually have no ill intentions.

Furthermore, privileged access should not only be limited to the least required, but should also be limited by circumstances. That is, privileged access to sensitive resources should be restricted not just by role, but also by factors such as whether the time and IP location of the attempted access is appropriate. Limiting privileged access in this manner not only protects against dedicated hackers, but also against opportunistic access through third parties.

A Least- and Limited-Privilege Example

Suppose, for example, that a third-party network engineering consultant has been retained to work on two servers within an organization’s network. Obviously, access will need to be granted to the consultant – but the contractor should only be able to see the two servers on which they are to work, and permissions set only for the time period specified for the work to be performed. Furthermore, if the contractor with this privileged access is working remotely, the access should be granted only if the worker attempts the access from a known, trusted location or within pre-defined work hours. To take this even further, permissions can be granted at a granular level, refining rights to specific actions and activities (queries and command line) and disallowing other actions even within the allowed resource.

Session Monitoring is a Cybersecurity Essential

Executives should also ensure that their organization has real-time session monitoring. At a minimum, this allows cybersecurity teams to be alerted when suspicious activity is taking place – which in turn allows them to assess the situation and to take appropriate action as necessary. That in itself is an important element of cybersecurity – but it relies on human interaction. To enhance real-time monitoring, such a system should be able to not only detect suspicious activity, but also to automatically terminate suspicious sessions when a user, despite their privileges, attempts an unauthorized action.

Session monitoring serves an additional, practical function: audit and review. Whether to prove compliance with cybersecurity regulations, trace the history of session activity to uncover the source of a network issue, or simply to replay for training purposes, robust session monitoring complete with OCR recording and searchability is essential.

The Ultimate Cybersecurity Essential: Ease of Use

Of course, none of these defense mechanisms will be effective if they are not used – and they are much more likely to be in use if their installation and management can be readily accomplished by cybersecurity teams and have minimal impact on teams’ daily workflows. Systems that are too complex to understand, or too unwieldy to manage, will be ignored – and without proper use and management, they can leave gaping holes in an organization’s cybersecurity.

Fortunately, privileged access management (PAM) solutions exist that can provide all of the above – as long as they are robust and provide all of the essential elements:

• Access management to secure and control external access
• Password management to enforce policies and rotate passwords
• Least Privilege control of who can see what resources, and under what circumstances
• Real-time session monitoring with automatic security protocols
• Easy to understand and to use, without sacrificing control

It’s unlikely that any cybersecurity scheme will be 100% effective now and for all time – hackers are clever and ever-evolving, and the low risks and high potential rewards of innovating new methods of attack means that achieving a secure IT infrastructure will always remain more of a journey than a final destination. But the devil is often in the details – and armed with an understanding of the essentials of cybersecurity, an organization will be prepared to carry this fight into the future.