In this lesson,
we will learn about Security Practices.
Security practices involve implementing strategies
such as segmentation, hardening, and monitoring
to protect specialized systems from potential threats.
Segmentation divides a network into smaller,
isolated segments to limit the spread of attack
and reduce the exposure of critical systems
to unauthorized access.
Next, hardening is the process of securing a system
by reducing its attack surface.
Finally, monitoring is the continuous observation
of system activity
to detect and respond to potential security incidents
in real-time.
Let's learn more about segmentation,
hardening, and monitoring.
First, we have segmentation.
Segmentation protects sensitive systems
by dividing a larger network
in into smaller, isolated sections.
This technique makes it more difficult for attackers
to access additional parts of the network
if they manage to compromise one area.
For example, in an office environment,
a company might segment its network
so that employee devices such as laptops and mobile phones
are on a separate network,
from sensitive financial or customer data systems.
A common tool used to do this
is a Virtual Local Area Network, or VLAN.
VLANs allow different devices on the same physical network
to be logically separated into different segments
at layer 2 of the OSI model,
limiting how they communicate with each other.
In practice, segmentation is especially useful
for protecting specialized industrial control systems
or other systems involved in critical infrastructure.
A factory, for example,
might segment its network
so that operational systems
controlling manufacturing machines
are isolated from the broader corporate network,
where email and other non-critical systems exist.
By doing this,
the company can limit potential damage
if the corporate network is breached,
ensuring that attackers cannot easily access
the machine's controlling production.
To implement this isolation,
firewalls can be used in combination with segmentation
to create further separation
between different network segments,
ensuring tighter control
over traffic transiting between these network segments.
Tools like Cisco's Adaptive Security Appliance,
or Palo Alto's Next-Generation Firewalls
can be used to enforce segmentation policies.
They allow network administrators to set rules
about which segments can communicate with each other
and under what conditions.
By carefully managing rules,
organizations can create strong barriers
between different parts of their network,
improving security.
Second, we have hardening.
Hardening improves the system's defenses
by minimizing its vulnerabilities.
This means disabling unnecessary services
or features that could be exploited by an attacker.
For instance, a database system
that is only accessed locally,
should not have a remote login service enabled.
Hardening also involves applying security patches
to address any known vulnerabilities.
So when a manufacturer releases an update for a system,
it's important to apply these patches properly
to ensure the system remains protected
from newly discovered threats.
A real world example of hardening
can be seen in web servers.
If a company runs a website,
it needs to harden its server
by disabling any unnecessary features or services
that are not required for operation.
By doing this, they reduce the attack surface,
meaning, there are fewer web server entry points
for attackers to exploit.
For instance, if the website does not require
File Transfer Protocol,
the administrator should disable that service.
Tools such as Microsoft Security Compliance Toolkit
or open-source solutions like Lynis
can help identify areas where systems can be hardened,
providing guidance on disabling unnecessary services,
or configuring stronger security settings.
Third and last, we have monitoring.
Monitoring is keeping a close watch
on the network and system activity
to identify potential security incidents as they happen.
Real-time monitoring tools
allow organizations to detect unusual behavior,
such as a sudden spike in network traffic
or unauthorized access attempts.
Monitoring can also be done
using Security Information and Event Management
or SIEM Systems,
which collect and analyze data
from across an organization systems
to identify potential security issues.
An example of monitoring inaction
is a retail business
that handles credit card transactions.
By monitoring the payment processing system in real-time,
the business can quickly identify
if an unauthorized person
tries to access the system.
This allows them to respond to potential threats
before they can do serious damage.
Tools such as Splunk or Graylog
can be used to collect and analyze log data
from this type of payment system,
providing real-time alerts
when suspicious activity is detected.
Additionally, intrusion detection systems
like Snort or Suricata
can help identify unusual patterns of behavior
or unauthorized access attempts,
enabling anomalies to be addressed immediately,
and minimizing the risk
to both the business and its customers.
So remember, security practices
focus on keeping systems safe
through strategies like segmentation,
hardening, and monitoring.
Segmentation breaks networks into smaller, separate parts
to limit the impact of attacks.
Hardening secure systems by reducing their vulnerabilities,
often by disabling unnecessary services
or applying security updates,
and monitoring continuously,
tracks system activity to spot and respond
to potential security threats in real-time.
Together, these security practices
provide layered protection,
securing sensitive systems from complex threats.