The Issue with Point Solutions

The security landscape is constantly evolving. To have any chance, security solutions also need to grow. There needs to be a more focused approach, continually developing security in line with today’s and tomorrow’s threats. For this, it is not to continuously buy more point solutions that are not integrated but to make continuous investments to ensure the algorithms are accurate and complete. So, if you want to change the firewall, you may need to buy a physical or virtual device.

**Complex and scattered**

Something impossible to do with the various point solutions designed with complex integration points scattered through the network domain. It’s far more beneficial to, for example, update an algorithm than to update the number of point solutions dispersed throughout the network. The point solution addresses one issue and requires a considerable amount of integration. You must continuously add keys to the stack, managing overhead and increased complexity. Not to mention license costs.

Would you like to buy a car or all the parts?

Let’s consider you are searching for a new car. Would you prefer to build the car with all the different parts or buy the already-built car? If we examine security, the way it has been geared up is provided in detail.

So I have to add this part here, and that part there, and none of these parts connect. Each component must be carefully integrated with another. It’s your job to support, manage, and build the stack over time. For this, you must be an expert in all the different parts.

**Example: Log management**

Let’s examine a log management system that needs to integrate numerous event sources, such as firewalls, proxy servers, endpoint detection, and behavioral response solutions. We also have the SIEM. The SIEM collects logs from multiple systems. It presents challenges to deploying and requires tremendous work to integrate into existing systems. How do logs get into the SIEM when the device is offline?

How do you normalize the data, write the rules to detect suspicious activity, and investigate if there are legitimate alerts? The results you gain from the SIEM are poor, considering the investment you have to make. Therefore, considerable resources are needed to successfully implement it.

**Changes in perimeter location and types**

We also know this new paradigm spreads the perimeter, potentially increasing the attack surface with many new entry points. For example, if you are protecting a microservices environment, each unit of work represents a business function that needs security. So we now have many entry points to cover, moving security closer to the endpoint.

Network Security Components – The Starting Point:

Enforcement with network security layers: So, we need a multi-layered approach to network security that can implement security controls at different points and network security layers. With this approach, we are ensuring a robust security posture regardless of network design.

Therefore, the network design should become irrelevant to security. The network design can change; for example, adding a different cloud should not affect the security posture. The remainder of the post will discuss the standard network security component.

Understanding Identity Management

**The Role of Authentication** 

Authentication is the process of verifying an individual or entity’s identity. It serves as a gatekeeper, granting access only to authorized users. Businesses and organizations can protect against unauthorized access and potential security breaches by confirming a user’s authenticity. In an era of rising cyber threats, weak authentication measures can leave individuals and organizations vulnerable to attacks.

Strong authentication is a crucial defense mechanism, ensuring only authorized users can access sensitive information or perform critical actions. It prevents unauthorized access, data breaches, identity theft, and other malicious activities.

There are several widely used authentication methods, each with its strengths and weaknesses. Here are a few examples:

1. Password-based authentication: This is the most common method where users enter a combination of characters as their credentials. However, it is prone to vulnerabilities such as weak passwords, password reuse, and phishing attacks.

2. Two-factor authentication (2FA): This method adds an extra layer of security by requiring users to provide a second form of authentication, such as a unique code sent to their mobile device. It significantly reduces the risk of unauthorized access.

3. Biometric authentication: Leveraging unique physical or behavioral traits like fingerprints, facial recognition, or voice patterns, biometric authentication offers a high level of security and convenience. However, it may raise privacy concerns and be susceptible to spoofing attacks.

Enhancing Authentication with Multi-factor Authentication (MFA)

Multi-factor authentication (MFA) combines multiple authentication factors to strengthen security further. By utilizing a combination of something the user knows (password), something the user has (smartphone or token), and something the user is (biometric data), MFA provides an additional layer of protection against unauthorized access.

**The Role of Authorization**

Authorization is the gatekeeper of access control. It determines who has the right to access specific resources within a system. By setting up rules and permissions, organizations can define which users or groups can perform certain actions, view specific data, or execute particular functions. This layer of security ensures that only authorized individuals can access sensitive information, reducing the risk of unauthorized access or data breaches.

A.Granular Access Control: One key benefit of authorization is the ability to apply granular access control. Rather than providing unrestricted access to all resources, organizations can define fine-grained permissions based on roles, responsibilities, and business needs. This ensures that individuals only have access to the resources required to perform their tasks, minimizing the risk of accidental or deliberate data misuse.

B.Role-Based Authorization: Role-based authorization is a widely adopted approach simplifying access control management. Organizations can streamline granting and revoking access rights by assigning roles to users. Roles can be structured hierarchically, allowing for easy management of permissions across various levels of the organization. This enhances security and simplifies administrative tasks, as access rights can be managed at a group level rather than individually.

C.Authorization Policies and Enforcement: Organizations must establish robust policies that govern access control to enforce authorization effectively. These policies define the rules and conditions for granting or denying resource access. They can be based on user attributes, such as job title or department, and contextual factors, such as time of day or location. Organizations can ensure access control aligns with their security requirements and regulatory obligations by implementing a comprehensive policy framework.

**Step1: Access control** 

Firstly, we need some access control. This is the first step to security. Bad actors are not picky about location when launching an attack. An attack can come from literally anywhere and at any time. Therefore, network security starts with access control carried out with authentication, authorization, accounting (AAA), and identity management.

Authentication proves that the person or service is who they say they are. Authorization allows them to carry out tasks related to their role. Identity management is all about managing the attributes associated with the user, group of users, or another identity that may require access. The following figure shows an example of access control. More specifically, network access control.

Identity-centric access control

It would be best to have an identity based on logical attributes, such as the multi-factor authentication (MFA), transport layer security (TLS) certificate, the application service, or a logical label/tag. Be careful when using labels/tags when you have cross-domain security.

So, policies are based on logical attributes rather than using IP addresses to base policies you may have used. This ensures an identity-centric design around the user identity, not the IP address.

Once initial security controls are passed, a firewall security device ensures that users can only access services they are allowed to. These devices decide who gets access to which parts of the network. The network would be divided into different zones or micro-segments depending on the design. Adopting micro-segments is more granular regarding the difference between micro-segmentation and micro-segmentation.

Dynamic access control

Access control is the most critical component of an organization’s cybersecurity protection. For too long, access control has been based on static entitlements. Now, we are demanding dynamic access control, with decisions made in real time. Access support must support an agile IT approach with dynamic workloads across multiple cloud environments.

A pivotal point to access control is that it is dynamic and real-time, constantly accessing and determining the risk level. Thereby preventing unauthorized access and threats like a UDP scan. We also have zero trust network design tools, such as single packet authentication (SPA), that can keep the network dark until all approved security controls are passed. Once security controls are passed, access is granted.

**Step2: The firewall design locations**

A firewalling strategy can offer your environment different firewalls, capabilities, and defense-in-depth levels. Each firewall type positioned in other parts of the infrastructure forms a security layer, providing a defense-in-depth and robust security architecture. There are two firewalling types at a high level: internal, which can be distributed among the workloads, and border-based firewalling.

Firewalling: Different network security layers

The different firewall types offer capabilities that begin with basic packet filters, reflexive ACL, stateful inspection, and next-generation features such as micro-segmentation and dynamic access control. These can take the form of physical or virtualized.

Firewalls purposely built and designed for a particular role should not be repurposed to carry out the functions that belong to and are intended to be offered by a different firewall type. The following diagram lists the different firewall types. Around nine firewall types work at various layers in the network.

Example: Firewall security policy

A firewall is an essential part of an organization’s comprehensive security policy. A security policy defines the goals, objectives, and procedures of security, all of which can be implemented with a firewall. There are many different firewalling modes and types.

However, generally, firewalls can focus on the packet header, the packet payload (the essential data of the packet), or both, the session’s content, the establishment of a circuit, and possibly other assets. Most firewalls concentrate on only one of these. The most common filtering focus is on the packet’s header, with the packet’s payload a close second.

Firewalls come in various sizes and flavors. The most typical firewall is a dedicated system or appliance that sits in the network and segments an “internal” network from the “external” Internet.

The primary difference between these two types of firewalls is the number of hosts the firewall protects. Within the network firewall type, there are primary classifications of devices, including the following:

• • Packet-filtering firewalls (stateful and nonstateful)
  • Circuit-level gateways
  • Application-level gateways

Zone-Based Firewall ( Transparent Mode )

Understanding Zone-Based Firewall

Zone-Based Firewall, or ZBFW, is a security feature embedded within Cisco IOS routers. It provides a highly flexible and granular approach to network traffic control, allowing administrators to define security zones and apply policies accordingly. Unlike traditional ACL-based firewalls, ZBFW operates based on zones rather than interfaces, enabling efficient traffic management and advanced security controls.

Transparent mode is a distinctive feature of Zone-Based Firewall that allows seamless integration into existing network infrastructures without requiring a change in the IP addressing scheme. In this mode, the firewall acts as a “bump in the wire,” transparently intercepting and inspecting traffic between different zones while maintaining the original IP addresses. This makes it ideal for organizations looking to enhance network security without significant network reconfiguration.

CBAC – Context-Based Access Control Firewall

Understanding CBAC Firewall

– CBAC Firewall, short for Context-Based Access Control Firewall, is a stateful inspection firewall operating at the OSI model’s application layer. Unlike traditional packet-filtering firewalls, CBAC Firewall provides enhanced security by dynamically analyzing the context and content of network traffic. This allows it to make intelligent decisions, granting or denying access based on the state and characteristics of the communication.

– CBAC Firewall offers a range of powerful features that make it a preferred choice for network security. Firstly, it supports session-based inspection, enabling it to track the state of network connections and only allow traffic that meets specific criteria. This eliminates the risk of unauthorized access and helps protect against various attacks, including session hijacking and IP spoofing.

– Furthermore, the CBAC Firewall excels at protocol anomaly detection. Monitoring and comparing network traffic patterns against predefined rules can identify suspicious behavior and take appropriate action. Whether detecting excessive data transfer or unusual port scanning, the CBAC Firewall enhances your network’s ability to identify potential threats and respond proactively.

**Additional Firewalling Types**

• Internal Firewalls 

Internal firewalls inspect higher up in the application stack and can have different types of firewall context. They operate at a workload level, creating secure micro perimeters with application-based security controls. The firewall policies are application-centric, purpose-built for firewalling east-west traffic with layer 7 network controls with the stateful firewall at a workload level. 

• Virtual firewalls and VM NIC firewalling

I often see virtualized firewalls here, and the rise of internal virtualization in the network has introduced the world of virtual firewalls. Virtual firewalls are internal firewalls distributed close to the workloads. For example, we can have the VM NIC firewall. In a virtualized environment, the VM NIC firewall is a packet filtering solution inserted between the VM Network Interfaces card of the Virtual Machines (VM) and the virtual hypervisor switch. All traffic that goes in and out of the VM has to pass via the virtual firewall.

• Web application firewalls (WAF)

We could use web application firewalls (WAF) for application-level firewalls. These devices are similar to reverse proxies that can terminate and initiate new sessions to the internal hosts. The WAF has been around for quite some time to protect web applications by inspecting HTTP traffic.

However, they have the additional capability to work with illegal payloads that can better identify destructive behavior patterns than a simple VM NIC firewall.

WAFs are good at detecting static and dynamic threats. They protect against common web attacks, such as SQL injection and cross-site scripting, using pattern-matching techniques against the HTTP traffic. Active threats have been the primary source of threat and value a WAF can bring.

**Step3: Understanding Encryption**

Encryption is an encoding method that allows only authorized parties to access and understand it. It involves transforming plain text into a scrambled form called ciphertext using complex algorithms and a unique encryption key.

Encryption is a robust shield that protects our data from unauthorized access and potential threats. It ensures that even if data falls into the wrong hands, it remains unreadable and useless without the corresponding decryption key.

Various encryption algorithms are used to secure data, each with strengths and characteristics. From the widely-used Advanced Encryption Standard (AES) to the asymmetric encryption of RSA, these algorithms employ different mathematical techniques to encrypt and decrypt information.

**Step4: Network Segmentation**

Macro segmentation

The firewall monitors and controls the incoming and outgoing network traffic based on predefined security rules. It establishes a barrier between the trusted network and the untrusted network. The firewall commonly inspects Layer 3 to Layer 4 at the network’s edge. In addition, to reduce hair pinning and re-architecture, we have internal firewalls. We can put an IPD/IDS or an AV on an edge firewall.

In the classic definition, the edge firewall performs access control and segmentation based on IP subnets, known as macro segmentation. Macro segmentation is another term for traditional network segmentation. It is still the most prevalent segmentation technique in most networks and can have benefits and drawbacks.

Same segment, same sensitivity level 

It is easy to implement but ensures that all endpoints in the same segment have or should have the same security level and can talk freely, as defined by security policy. We will always have endpoints of similar security levels, and macro segmentation is a perfect choice. Why introduce complexity when you do not need to?

Micro-segmentation

The same edge firewall can be used to do more granular segmentation; this is known as micro-segmentation. In this case, the firewall works at a finer granularity, logically dividing the data center into distinct security segments down to the individual workload level, then defining security controls and delivering services for each unique segment. So, each endpoint has its segment and can’t talk outside that segment without policy. However, we can have a specific internal firewall to do the micro-segmentation.

Example: Network Endpoint Groups

**Types of Network Endpoint Groups**

Google Cloud offers different types of NEGs tailored to various use cases:

1. **Zonal NEGs**: These are used for grouping VM instances within a specific zone. Zonal NEGs are ideal for applications that require low latency and high availability within a particular geographic area.

2. **Internet NEGs**: Useful for including endpoints that are reachable over the internet, such as external IP addresses. Internet NEGs allow you to incorporate externally hosted services into your Google Cloud network seamlessly.

3. **Serverless NEGs**: Designed for serverless applications, these NEGs enable you to integrate Google Cloud services such as Cloud Functions and Cloud Run into your network architecture. This is perfect for modern applications leveraging microservices.

**Benefits of Using NEGs in Google Cloud**

NEGs offer several advantages for managing and optimizing network resources:

1. **Scalability**: NEGs facilitate easy scaling of applications by allowing you to add or remove endpoints based on demand, ensuring your services remain responsive and efficient.

2. **Load Balancing**: By integrating NEGs with Google Cloud Load Balancing, you can distribute traffic efficiently across multiple endpoints, improving application performance and reliability.

3. **Flexibility**: NEGs offer the flexibility to mix different types of endpoints, such as VMs and serverless functions, enabling you to design hybrid architectures that meet your specific needs.

4. **Simplified Management**: With NEGs, managing network resources becomes more straightforward, as you can handle groups of endpoints collectively rather than individually, saving time and reducing complexity.

**Implementing NEGs in Your Cloud Infrastructure**

To implement NEGs in your Google Cloud environment, follow these general steps:

1. **Identify Your Endpoints**: Determine which endpoints you need to group together based on their roles and requirements.

2. **Create the NEG**: Use the Google Cloud Console or gcloud command-line tool to create a NEG, specifying the type and endpoints you wish to include.

3. **Configure Load Balancing**: Integrate your NEG with a load balancer to ensure optimal traffic distribution and application performance.

4. **Monitor and Adjust**: Continuously monitor the performance of your NEGs and make adjustments as needed to maintain efficiency and responsiveness.

Example: Cisco ACI and microsegmentation

Some micro-segmentation solutions could be Endpoint Groups (EPGs) with the Cisco ACI and ACI networks. ACI networks are based on ACI contracts that have subjects and filters to restrict traffic and enable the policy. Traffic is unrestricted within the Endpoint Groups; however, we need an ACI contract for traffic to cross EPGs.

**Step5: Load Balancing**

Understanding Load Balancing

Load balancing is the process of distributing incoming network traffic across multiple servers or resources. It helps avoid congestion, optimize resource utilization, and enhance overall system performance. It also acts as a crucial mechanism for handling traffic spikes, preventing any single server from becoming overwhelmed.

Various load-balancing strategies are available, each suited for different scenarios and requirements. Let’s explore a few popular ones:

A. Round Robin: This strategy distributes incoming requests equally among the available servers cyclically. It is simple to implement and provides a basic level of load balancing.

B. Least Connection Method: With this strategy, incoming requests are directed to the server with the fewest active connections at any given time. It ensures that heavily loaded servers receive fewer requests, optimizing overall performance.

C. Weighted Round Robin: In this strategy, servers are assigned different weights, indicating their capacity to handle traffic. Servers with higher weights receive more incoming requests, allowing for better resource allocation.

Load balancers can be hardware-based or software-based, depending on the specific needs of an infrastructure. Let’s explore the two main types:

Hardware Load Balancers: These are dedicated physical appliances specializing in load balancing. They offer high performance, scalability, and advanced features like SSL offloading and traffic monitoring.

Software Load Balancers are software-based solutions that can be deployed on standard servers or virtual machines. They provide flexibility and cost-effectiveness and are often customizable to suit specific requirements.

**Scaling The load balancer**

A load balancer is a device that acts as a reverse proxy and distributes network or application traffic across several servers. This allows organizations to ensure that their resources are used efficiently and that no single server is overburdened. It can also improve running applications’ performance, scalability, and availability.

Load balancing and load balancer scaling refer to efficiently distributing incoming network traffic across a group of backend servers, also known as a server farm or pool. For security, a load balancer has some capability and can absorb many attacks, such as a volumetric DDoS attack. Here, we can have an elastic load balancer running in software.

So it can run in front of a web property and load balance between the various front ends, i.e., web servers. If it sees an attack, it can implement specific techniques. So, it’s doing a function beyond the load balancing function and providing a security function.

**Step6: The IDS** 

Traditionally, the IDS consists of a sensor installed on the network that monitors traffic for a set of defined signatures. The signatures are downloaded and applied to network traffic every day. Traditional IDS systems do not learn from behaviors or other network security devices over time. The solution only looks at a specific time, lacking an overall picture of what’s happening on the network.

**Analyse Individual Packets**

They operate from an island of information, only examining individual packets and trying to ascertain whether there is a threat. This approach results in many false positives that cause alert fatigue. Also, when a trigger does occur, there is no copy of network traffic to do an investigation. Without this, how do you know the next stage of events? Working with IDS, security professionals are stuck with what to do next.

A key point: IPS/IDS  

An intrusion detection system (IDS) is a security system that monitors and detects unauthorized access to a computer or network. It also monitors communication traffic from the system for suspicious or malicious activity and alerts the system administrator when it finds any. An IDS aims to identify and alert the system administrator of any malicious activities or attempts to gain unauthorized access to the system.

**IDS – Hardware or Software Solution**

An IDS can be either a hardware or software solution or a combination. It can detect various malicious activities, such as viruses, worms, and malware. It can also see attempts to access the system, steal data, or change passwords. Additionally, an IDS can detect any attempts to gain unauthorized access to the system or other activities that are not considered standard.

**Detection Techniques**

The IDS uses various techniques to detect intrusion. These techniques include signature-based detection, which compares the incoming traffic against a database of known attacks; anomaly-based detection, which looks for any activity that deviates from normal operations; and heuristic detection, which uses a set of rules to detect suspicious activity.

Example: Sensitive Data Protection

Challenge: Firewalls and static rules

Firewalls use static rules to limit network access to prevent access but don’t monitor for malicious activity. An IPS/IDS examines network traffic flows to detect and prevent vulnerability exploits. The classic IPS/IDS is typically deployed behind the firewall and does protocol analysis and signature matching on various parts of the data packet.

The protocol matching is, in some sense, a compliance check against the publicly declared spec of the protocol. We are doing basic protocol checks if someone abuses some of the tags. Then, the IPS/IDS uses signatures to prevent known attacks. For example, an IPS/IDS uses a signature to prevent you from doing SQL injections. 

Example: Firewalling based on Tags

**Step7: Endpoint Security** 

Move security to the workload

Like the application-based firewalls, the IPS/IDS functionality at each workload ensures comprehensive coverage without blind spots. So, as you can see, the security functions are moving much closer to the workloads, bringing the perimeter from the edge to the workload.

Endpoint security is an integral part of any organization’s security strategy. It protects endpoints like laptops, desktops, tablets, and smartphones from malicious activity. Endpoint security also protects data stored on devices and the device itself from malicious code or activity.

Endpoint Security Tools

Endpoint security includes various measures, including antivirus and antimalware software, application firewalls, device control, and patch management. Antivirus and antimalware software detect and remove malicious code from devices. Application firewalls protect by monitoring incoming and outgoing network traffic and blocking suspicious activity.

Device control ensures that only approved devices can be used on the network. Finally, patch management ensures that devices are up-to-date with the latest security patches.

Network detection and response 

Then, we have the network detection and response solutions. The Network detection and response (NDR) solutions are designed to detect cyber threats on corporate networks using machine learning and data analytics. They can help you discover evidence on the network and cloud of malicious activities that are in progress or have already occurred.

Some of the analyses promoting the NDR tools are “Next-Gen IDS.”  One significant difference between NDR and old IDS tools is that NDR tools use multiple Machine Learning (ML) techniques to identify normal baselines and anomalous traffic rather than static rules or IDS signatures, which have trouble handling dynamic threats. The following figure shows an example of a typical attack lifecycle.

**Step8: Anti-malware gateway**

Anti-malware gateway products have a particular job. They look at the download, then take the file and try to open it. Files are put through a sandbox to test whether they contain anything malicious—the bad actors who develop malware test against these systems before releasing the malware. Therefore, the gateways often lag one step behind. Also, anti-malware gateways are limited in scope and not focused on anything but malware.

Endpoint detection and response (EDR) solutions look for evidence and effects of malware that may have slipped past EPP products. EDR tools also detect malicious insider activities such as data exfiltration attempts, left-behind accounts, and open ports. Endpoint security has the best opportunity to detect several threats. It is the closest to providing a holistic offering. It is probably the best point solution, but remember, it is just a point solution. 

**DLP security-

By monitoring the machine and process, endpoint security is there for the long haul instead of assessing a file on a once-off basis. It can see when malware is executing and then implement DLP. Data Loss Prevention (DLP) solutions are security tools that help organizations ensure that sensitive data such as Personally Identifiable Information (PII) or Intellectual Property (IP) does not get outside the corporate network or to a user without access. However, endpoint security does not take sophisticated use cases into account. For example, it doesn’t care what you print or what Google drives you share. 

**Endpoint security and correlation-

In general, endpoint security does not do any correlation. For example, let’s say there is a .exe that connects to the database; there is nothing on the endpoint to say that it is a malicious connection. Endpoint security finds distinguishing benign from legitimate hard unless there is a signature. Again, it is the best solution, but it is not a managed service or has a holistic view. 

**Security controls from the different vendors-  

As a final note, consider how you may have to administer the security controls from the different vendors. How do you utilize the other security controls from other vendors, and more importantly, how do you use them adjacent to one another? For example, Palo Alto operates an App-ID, a patented traffic classification system only available in Palo Alto Networks firewalls.

Different vendors will not support this feature in a network. This poses the question: How do I utilize next-generation features from vendors adjacent to devices that don’t support them? Your network needs the ability to support features from one product across the entire network and then consolidate them into one. How do I use all the next-generation features without having one vendor?

**Use of a packet broker-

However, changing an algorithm that can affect all firewalls in your network would be better. That would be an example of an advanced platform controlling all your infrastructures. Another typical example is a packet broker that can sit in the middle of all these tools. Fetch the data from the network and endpoints and then send it back to our existing security tools. Essentially, this ensures that there are no blind spots in the network.

This packet broker tool should support any workload and be able to send information to any existing security tools. We are now bringing information from the network into your existing security tools and adopting a network-centric approach to security.