Infographic: The Layered Cybersecurity Defense

A layered approach to cybersecurity is necessary to combat modern threats facing organizations today. What solutions are in a layered security program?

Perimeter Security

Perimeter security solutions protect data between a private internal network and an external public-facing network.

In short, it’s a protective shield for your business.

Traditionally, perimeter security has been the be-all and end-all of cybersecurity insofar as guarding networks was concerned. Once upon a time, it was often sufficient for companies to use just a perimeter firewall solution.

Now, that’s not the case today, but perimeter security still plays a vital role in securing data internally for businesses.

There are several solutions that can achieve this. The most notable are unified threat management and a web application firewall.

Unified threat management is a comprehensive solution that will include a lot of tech that you’re likely already familiar with. Antivirus; firewall; intrusion detection; spam filtering; content filtering; and in some cases, VPN support for encrypted communications.

A UTM is an excellent tool for uncovering and nullifying potential threats attempting to gain access to your network.

A web application firewall, or WAF, is similar, but focuses on data traveling between the end user and the cloud app they’re using. Because so many businesses today store, handle, and access data in the cloud, WAFs have become important tools to supplement cybersecurity strategies.

Network Security Monitoring

Monitoring tools provide total visibility into your network and find vulnerabilities.

These tools include vulnerability scanning, security information and event management (SIEM), and network detection and response (NDR).

Vulnerability scanners use machine learning to automatically assess risks associated with functions and processes across your hybrid network—whether in the cloud or internally.

When vulnerabilities are detected, they are prioritized in terms of their threat level and patched to ensure safety.

SIEM is a monitoring and event management solution that can be integrated with several major tech providers like Microsoft. This solution will alert you if it recognizes, for example, a suspicious login or excessive failed login attempts, in addition to general instances of abnormal behavior across your network.

The SIEM effectively creates a centralized database of any and all threats and abnormalities discovered by the solution, escalating them to your IT team in real-time for remediation.

Network detection and response (NDR) is similar, but is more focused on network traffic analysis (NTA), detecting anomalies and providing more granular data on security events that raise suspicion.

An NDR solution will help a business increase their visibility into their network profile, offering a more extensive approach to threat detection than SIEM alone.

Security Awareness

Security awareness is a major issue when it comes to cybersecurity and is frequently neglected or overlooked by decision makers.

With human error the leading cause of data breaches and other successful cyberattacks, businesses should not take for granted the ability of their own workforce to avoid attack.

Investing in a cybersecurity awareness program is an excellent way to safeguard a business and will become a necessity as cybercriminals continue to rely heavily on social engineering as a primary attack vector going forward.

Endpoint Protection

Just as WAFs are more significant in 2021 because of the increased use of cloud apps in organizations, endpoint protection is also important because of the modern prevalence of the Internet of Things (IoT), which has led to substantial increase in the number of devices businesses have to protect.

Endpoints are everywhere in a modern business environment—smart TVs, mobile devices, printers, vending machines—you name it.

In 2015, there were 15 billion Internet-connected IoT devices worldwide. In 2020, that figure had doubled to 30 billion—by 2025 it will be 75 billion.

To manage these endpoints, businesses should utilize domain name system (DNS) protection. DNS is best thought of as a sort of “phonebook” for computers, which understands IP addresses rather than human language.

Of course, not every “number”, or site in the phonebook is trustworthy and there are many malicious sites out there. DNS protection stops access to malicious sites, and can be extended to all devices under a network, meaning an employee browsing on their phone using your company network won’t accidentally let a cyberattacker into your business by visiting a dangerous website.

Cisco has indicated that over 90% of attacks are done via DNS and only two-thirds of organizations monitor their DNS records.

Then we have managed detection and response (MDR), which is an endpoint protection service that detects, prevents, and responds to attacks across all vectors.

As opposed to searching for the characteristics of malware—which can be hidden or changed to something unrecognizable—as a traditional protection service would, MDR monitors the processes of every endpoint, recognizing deviations from the norm and responding.

Finally, we have persistence detection. “Persistence” refers to a modern hacking process, whereby cybercriminals gain access to your systems and wait for the opportune moment to strike by lingering silently in the background undetected.

This solution uses advanced technology to sniff out bad actors hiding in plain sight by collecting information and activity associated with persistent mechanisms that evade other cybersecurity technologies.

Information Security

Information security is essential in preventing data leakage and other forms of unintentional data loss.

Information security is all about access and stopping inadvertent data loss. Data loss prevention (DLP), for example, is about preventing data leakage, which refers to the unauthorized transfer of data from inside your organization to outside.

DLP aims to rectify this issue by establishing clear standards for your data through labeling and categorizing. This means determining where certain data should be stored, who has access to it, and where it can be shared.

This approach is a typical standard in cybersecurity programs and avoids the significant issues that data leakage can bring to a business.

Email protection, meanwhile, operates on the same premise; only for your email communications. Email protection solutions help prevent many common vectors like phishing attempts, spam, and viruses communicated to end users through email servers.

Authentication Protocols

Authentication solutions ensure the people accessing your business data are who they say they are.

Authentication is a simple and incredibly effective way of preventing unauthorized users accessing your business data, and yet is not taken seriously and often overlooked by companies in their security policies.

Microsoft estimates that using MFA stops 99% of all automated brute force attacks.

Multifactor authentication (MFA), which requires the use of a secondary device or method to authenticate a user, has proven especially useful in preventing breaches, and solutions that cater to this are capable of protecting every app or software service you use; in addition to meeting modern compliance standards.

Likewise, automated password management solutions mean that you can ensure your employees are consistently staying up-to-date with strong passwords.

This tech can push password change automation, keep a full trail of password history, and encrypt all the information tracked.

Critical Asset Security

In case of data disaster, businesses need to retrieve lost information as soon as they possibly can.

Backup and disaster recovery (BDR) is aimed at making sure that any vulnerable information in your business, whether it’s data stored on internal servers, external cloud data, or website data, is backed up and can be restored instantly.

BDR is a way of preparing for the worst, because data breaches can be incredibly costly to SMBs.

The average time it takes for a company to identify and contain a data breach in their system is 279 days—that’s over nine months

The issue is that many businesses do not have any form of BDR in place, making this an important part of any cybersecurity strategy.

Then we have software-as-a-service backup, which protects the data that people handle on their cloud apps, as well as website backup, which restores all data from your website in the event of a breach.

If you are in need of cybersecurity services but don't know where to start, consider reaching out to DOT Security. Our experts can conduct a risk assessment and help build a strategy for your security.