Map and Secure Your Network

Company networks should be protected against employee accidental or intentional actions and basic and advanced cyber threats that originate from attackers outside your company. Basic threats utilize known signature-based malware that can be detected and protected by properly arranged network and endpoint security defenses, including intrusion prevention systems, secure web and email gateways and antivirus platforms. Advanced threats typically cannot be detected by traditional signature-based defenses. They often employ zero day attacks whereby they target a weakness in software that is unknown to the vendor and exploit it before the vendor becomes aware and develops a patch. Once developed, the patch should be quickly downloaded onto all operating systems, applications and devices that utilize the software.

After a network is breached, malware can be intended to immediately damage or steal information or it can be designed as an Advanced Persistent Threat (APT attack), which is a sophisticated cyber-attack in which an attacker stays undetected for long periods of time to steal data and/or cause physical damage. APT attacks commonly target organizations that handle high-value information or have valuable intellectual property. To enhance the company network protection against these threats the company network security should be configured to inspect outbound traffic, as well as traffic flowing into the network.

Your company's private network may consist of a single local area network (LAN) that is designed to provide networking capabilities between your computers and other resources, such as printers or servers. Or it can increase in complexity utilizing routers to interconnect multiple LANs forming your private network. Because each network can have different levels of sophistication, many businesses will rely on their equipment, software and service providers to design and maintain their network and its security.

Whether companies rely on outside providers or their internal IT departments for network security, creating layers of protection or a “defense-in-depth” approach can help provide a sound strategy for network security. A defense-in-depth strategy uses multiple devices, products and procedures rather than relying on a single device or product to enforce security. This bulletin outlines a number of strategies that can help provide a defense-in-depth approach to network security:

Map your network

A key step of a defense-in-depth strategy includes mapping your network to understand how the equipment and systems are interconnected to confirm that all applications, software and information on the private network cannot be directly accessible from the Internet or unauthorized users. The network will commonly interconnect multiple devices rather than relying on a single device or product to enforce security. It typically consists of three security layers; the company private network, the demilitarized zone (DMZ) and the perimeter protection(s) to the Internet. Risk control considerations include, but are not limited to:

• Is the network segmented and segregated into security zones?
• Are different security measures applied to different security zones, depending on the type of information in that zone and the risk associated with it?
• Does the information with the highest risk have the highest level of protection applied?  

Private network

Sensitive and confidential data should reside on the private network and never be directly accessible from the Internet or unauthorized users. Your private network should be designed in accordance to your access privileges and control policies.

Common equipment residing in the private network includes computers, printers and servers. Three common servers used to store and access data include database servers, file servers and application servers. All equipment will be interconnected via switches and routers.

Trace department business functions from the users’ computers back to the physical servers that house their data. Confirm that systems of the same sensitivity level are segregated from systems of different trust levels. Your network design should allow users to have access to the information they need to do their job, but they should be denied access to other non-job-related information.

Demilitarized Zone (DMZ)

The DMZ is a sub network that separates the private network from the Internet. Any device that is intended to connect directly to the Internet should be placed in the DMZ and protected by firewalls or other endpoint intrusion protection systems. The devices located in the DMZ are accessible from the Internet and from the private network. All transactions are screened through them before being allowed to travel from the Internet to the private network or vice versa. This restricts the ability of hackers or other unauthorized users to directly access equipment, servers or data in the private network via the Internet.

Although there are many types of servers that can be utilized, common devices in the DMZ will include mail servers, web servers and proxy servers. Mail servers act as an electronic post office and are used to send and receive emails. Their software is built on standardized industry protocols for handling mail messages. The primary purpose of the web servers and proxy servers is to provide secure connections to the Internet and domain sites and to provide Internet access to your company website. In addition, they can also provide secure connections to database servers to support e-commerce and other business functions.

Cloud security

If your company has decided to operate in a private, public, or a hybrid cloud, following controls should be discussed with the internal and cloud solution providers’ security teams:

• Ensure proper security configuration.
• Control access to the cloud – enforce authentication and authorization.
• Encrypt communications—whether communications go over public networks or within a secure private network, they should be encrypted to avoid unauthorized exposure of data, while in-transit.
• Plan and prepare back-ups and disaster recovery procedures.
• Normalize security controls; Private cloud systems should follow private cloud security best practices, as well as traditional network security measures for the local data center.
• Avoid separate security strategies and tools in each environment—adopt a single security framework that can provide controls across the hybrid environment.
• Carefully control access to data using identity and access management (IAM) systems and applying consistent security policies for cloud and on-premises systems.  

Endpoint security

Endpoint security refers to a methodology of protecting the network perimeter at the connection points to the Internet. The common connection points include Ethernet connections, DSL connections and wireless connections. Each device that can connect to your network creates a potential entry point for security threats. Endpoint security is designed to secure each endpoint on the network created by these devices. 

A common security configuration to protect these endpoints includes network firewalls, intrusion detection systems (IDS) and intrusion prevention systems (IPS) that are inserted at the connection to the outside public network. All incoming and outgoing communications (both hard line and wireless) must pass through the network firewall and intrusion detection and prevention systems.

In addition to perimeter firewall placement, firewalls, IDS and IPS installed internally within the network can be used to segment the network into unique security domains supporting enhanced layers of defense. Proper configuration of the devices will require close collaboration with your service provider to ensure it will achieve your data loss prevention security requirements.

Firewalls

Firewalls are a fundamental network security solution. They are used to permit only appropriate traffic to enter and leave the company network. When information or files are sent from one place to another on the Internet, the information is divided into packets. In addition to the raw data it contains, the data packets also have headers that include metadata such as the IP address of the origin and destination of the packet. Firewalls analyze the packet headers to confirm they comply with predetermined criteria such as protocol type, source address, destination address, source port and/or destination port. Packets that do not match the policy are rejected.

Intrusion detection and prevention systems

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) can work together with firewalls to analyze traffic to determine if it is legitimate or if it matches a known attack pattern. These systems provide another level of security because in addition to analyzing the packet header, they can also analyze packet content. An IDS product will alert on invalid traffic, while an IPS will block the traffic. An example might be a packet header that the firewall is configured to allow, but the detection or prevention system would determine the packet content is not approved user traffic based on a known hacker attack pattern.

For the security devices to be effective, it is important to assign a technically qualified individual from your IT security team to monitor and respond to the alerts as they are generated.

Two-factor authentication

For access to any system or network that contains sensitive data, requiring two-factor authentication can help to reduce the incidence of online fraud or theft because stealing the victim's password is not enough to give a thief access to their information. An authentication factor is an independent category of credential used for identity verification. The three most common authentication factors are often described as something you know (e.g., password), something you have (e.g., smart phone or access card) and something you are (e.g., biometrics such as fingerprints). Some technologies are also using location (e.g., GPS coordinates) and time of day for additional authentication factors.

A common example of two factor authentication is a bank card. The card itself is a physical item and the personal identification number (PIN) is the “something you know.” Requiring these two elements makes it more difficult for someone to access the user's bank account because they would have to have the physical item in their possession and also know the PIN.

Equipment and service providers can offer a range of devices and solutions for implementing two factor authentication to provide access for local, remote and mobile users.

Internet communication security

Hypertext Transfer Protocol (HTTP) is the foundation for data communication across the Internet. HTTPS (also known as HTTP over TLS or HTTP over SSL) utilizes Transport Layer Security (TLS) and Security Sockets Layer (SSL), which are industry certification standards for cryptography protocols to achieve communication security over the Internet. In addition to encryption, additional levels of security such as incorporating digital certificates using public key infrastructure (PKI) to prevent man-in-the-middle attacks by verifying (authenticating) that the site you are contacting is indeed what it portrays to be are available. Consult with your service provider about available options for security for your site.

Remote access security

If your employees are allowed to use remote access, the network should be arranged so that all communications must pass through the network firewall to get to the internal network. In addition, incorporating HTTPS and encryption for wireless data transmissions over insecure networks such as public Wi-Fi access points is an important control to prevent intruders from accessing sensitive information.

The mobile device security policies should be followed. See Travelers Risk Control article Cyber Security Policies for additional information.

Virtual Private Network (VPN)

If your company regularly provides remote access to employees or connects with other remote office locations, another security option is to utilize a Virtual Private Network (VPN). VPNs allow a company to send and receive data across public networks while maintaining security. These systems use encryption and other security mechanisms to ensure that only authorized users can access the company network and that the data and transmission cannot be intercepted. Common selection criteria for choosing VPN service providers should include, but not be limited to, the level of security and the transmission speed and capacity.

Wireless Local Area Network (WLAN)

If your company operates a Wireless Local Area Network (WLAN) for the use of customers, guests and visitors, it is important that it be segregated from the main company network so that traffic from the public network cannot traverse the company’s internal systems at any point. Incorporating HTTPS for wireless data transmissions is an important control to prevent intruders from accessing sensitive information.

The public access network should have defined acceptable use policies and be monitored for inappropriate use. Terms and conditions for use should be posted whenever a user attempts access and arranged so the user is required to “click to accept” prior to be allowed access into the WLAN. 

Payment card security

Nearly all businesses accept payment by credit or debit cards. It is important to have security steps in place to ensure the customer information is safe and complies with bank and processor contractual requirements. At a minimum, your program controls should comply with federal regulations, the PCI Security Standards Council and the security agreements of companies that transact the payment cards you accept. Restrict access to only employees who need access. Also, segregate your payment processing systems from other company network systems that may be less secure.

Internet of Things “Interconnectivity of devices”

The Internet of Things (IoT) refers to the ever-growing network of physical objects that feature an IP address for Internet connectivity and the communication that occurs between these objects and other Internet-enabled devices and systems. With equipment ranging from printers to photocopiers containing hard drives and/or building security devices or building HVAC (heating, ventilating and air-conditioning) systems connected to central control panels, it is important to examine the equipment and develop appropriate security protocols given the type of device and information contained or transmitted from the device.

A common security control is to technologically segregate these devices and systems from your company network. By doing this, if they are breached, the attacker cannot use them as an entry point into your company IT network. In addition, other controls include, but are not limited to:

• Change default passwords on all devices.
• Require the use of strong passwords. This may require updating devices to move away from 4 number PINs.
• Use encryption if the device is intended to store or transmit sensitive information.
• Utilize a dedicated firewall or other intrusion protection if the system can connect to the Internet.
• Consider using a Virtual Private Network (VPN) for communications.
• Disable remote access to IoT devices when not needed.
• Modify the privacy and security settings of the device to your needs.
• Disable features that are not being used.
• Establish a process to ensure software updates and patches are installed in accordance to your company policy.

Business continuity

Once you have completed mapping and securing your network, identify any critical equipment or systems and evaluate the potential business impact if they should fail or are breached. Also, look for critical network connection points that could result in major outages if they were damaged. If these should fail, what impact could this have? If significant exposures are identified, back-up equipment or network redesigns should be added or implemented as needed.

Always keep your map current. Update the network map whenever the devices are added or removed from the network.