Any Defense In Depth strategy requires a technology component. Yes, we’ve already seen that people play an important role, but technology is used where consistency and repeatability are needed.

You could have someone assigned to capture and analyze every packet that is aimed toward your your network, but they wouldn’t be able to do this with the speed and consistency required to effectively protect your information assets. That is where technology comes in.

Your small or medium business, or even your home, network needs to have some technology used to help defend and protect.

Consider the use of these basic technologies in your defense in depth strategy…

• Anti-virus and anti-spyware – Defends against malware and helps to ensure availability and confidentiality. Your computers stay running and the information on them stays in the organization. Opportunities to accidently install viruses and spyware come from shared files, or even from just surfing the Internet. Even legitimate sites often will spread malware!
• Firewall – Defends against unauthorized access and helps to protect the perimeter of your network. Your connection to the Internet is being frequently tested for openings that would allow entrance to hackers. The firewall is a basic first line of defense.
• File system encryption – Defends against loss of data if the computer is stolen. Many solutions exist, but both Windows and Mac OS X have built-in features for encrypting the file systems. Learn how to use this feature, and then make sure that you really are using it!
• Automatic Backup – Makes your information available in the event of a disk drive failure. This is an often overlooked element to information security in the small business. The usability of the backups should periodically be tested.

Of course, there are many others steps that can be taken ranging from segmenting your network to installing (and monitoring) intrusion detection/prevention systems to installing hardware encryption to active application scanning to multi-tiered firewall architectures to data classification systems to access control methodologies to …

So, by now we have learned that just being careful (the People element) is not all you need for good information security. You also need technology to supplement your people.

The last element of Defense in Depth is Operations. We will be looking at that in the next week or so…

- Dan

Can a small or medium sized business do Defense in Depth?

How about the home user?

The phrase “defense in depth” is tossed around in the Information Security field as if everyone knows what is being talked about.

Just what is Defense in Depth?

The National Security Agency has put out a short paper which discusses a strategy for defense in depth.

I certainly encourage you to take a look at that paper.

The defense in depth strategy focuses on three important elements as we work toward information assurance. These elements are:

• People
• Technology
• Operations

We will soon begin looking at each of these elements as it related to Information Security and the small business or home user.

- Dan