Network Security: An Ounce Of Prevention Is Worth A Pound Of Reaction

Imagine you're at a seafood restaurant. One look at the menu, and you know exactly what you want: lobster. Your food arrives, you clean your plate, and then proceed to pull out your EpiPen because you also happen to have a life-threatening shellfish allergy.

Sound improbable? Let's hope so. Chances are, you'd bypass the lobster in favor of the significantly less lethal cod. Preventing damage, after all, is almost always better than reacting to it. Sure, you still need the EpiPen. After all, no matter how diligently you avoid it, sometimes shellfish happens. Just don't invite it to the table.

Now, think of your network — including how you protect it.

Much like an EpiPen for food allergies, you need security capabilities in remediating attacks. But once a breach occurs, your ability to mitigate damage is limited by how quickly you detect and respond to it. Just ask Sony, which experienced one of the most massive breaches of the 21st century, costing an estimated $35 million.  

Truly securing our networks requires practicing preventive medicine. That means diagnosing potential vulnerabilities and integrating pre-emptive measures into our IT infrastructure. Reactive measures alone won't suffice.

For humans, prevention might begin with an allergist. In security, it's the network engineer. No one is better positioned to assess network health risks or to determine the best configurations to prevent attacks. But first, we need to shift our perceptions about engineers' roles in security from the start.

Prevention as a Cyberthreat Cure
While network engineers do care about security, it's not their primary focus. Their perception of security originates from colleagues who focus specifically on security, and thus might be unaware of how network designs and configurations themselves affect security. 

A network engineer's work is judged by the network's functionality, performance, and reliability. Consequently, security measures are often implemented after deployment — with firewalls or VPNs, for instance — instead of earlier, when prevention matters most.

Education Is Critical
I recently interviewed multiple enterprise networking candidates, some of them Cisco Certified Internetwork Expert certified. Unsurprisingly, their concept of security was limited to intrusion detection or event logs. I've yet to hear a candidate mention making actual infrastructure enhancements to secure a router or switch environment. 

If we want to create networks with intrinsic self-protections, we should begin with how we educate network engineers. At many universities, network engineering programs focus on logic, infrastructure, architecture, and visualization. When addressing security, however, curricula are often vague or focused on topics such as intrusion detection and firewalls. And, of course, traditional technologies still matter. But let's also teach how even the simplest capabilities, such as network segmentation (or micro-segmentation), can address threats.

At the same time, we can't simply wait on a new generation of security-minded network engineers to graduate. Those of us already in the field need to change our own perceptions of and approaches to security as well.  

Empowerment
For network engineers, the traditional focus on designing, building, and maintaining networks creates a silo — one unoccupied by security. Unfortunately, this disempowers engineers from playing meaningful roles in their organizations' security strategies. 

It's time for network engineers to abandon convention and believe that network security begins with them — particularly their network designs. 

Think about segmentation technology. It's not a traditional security tool; it's a network tool — one that, used properly, has significant security impact. Without segmentation, for instance, an attacker could easily breach a pharmaceutical company's payroll department and subsequently access the lucrative research and development department. In a well-segmented network, however, the same attacker couldn't access R&D from payroll, because those two traffic streams are isolated from one another.

Planning
Most IT leaders want to avoid introducing too much new technology at once. Eventually the organization tires of it — even solutions designed to protect your system. 

But improving your security posture doesn't always mean large investments of money, time, or resources. Instead of buying new technology to fix old problems, we should utilize our existing capabilities. 

Often, better security is achievable through comparatively simple network tweaks and changes, such as refreshing switches and routers. If your system runs on Oracle, for example, invite networking team members to discuss what they can do to improve basic security hardening — no shiny new security tools needed.

Doing this effectively requires bringing your networking team into security discussions from the start. Early participation allows network engineers to understand their contributions to your security strategy, and to play an active role in its success.

Sustainable, Preemptive Security
Sometimes, no matter how aggressively you respond to a breach, the damage is done. Perhaps Bill Gates said it best: "Treatment without prevention is simply unsustainable."

Ideally, your network should offer its own best defense — a goal that begins with prevention and made possible by your network engineers. They not only know your network better than anyone, but with the right support, education, and planning, they can play a first-line role in securely configuring it. Ultimately your engineers should play a crucial role in your organization's overall security posture by heading off threats from the start.  

Related Content: