Layer model for information security - scientific name?

Question

Some days ago, I was talking with a friend about the Snowden revelations and its impact on Infosec awareness and how quite a number of (supposedly) secure alternatives to established services have emerged in the last month.

However, we quickly agreed on the fact that all that application layer security (if it indeed works) is useless if you don't trust all underlying layers, such as the OS (might be backdoored) or even the hardware (there were some really spooky news about the NSA fiddling with hardware sent via mail). This idea seems so basic and intuitive, yet I wasn't able to find any scientific literature on it. Is there a commonly used name for it?

Answer 1

The term you are looking for is defense in depth.

It's a term that describes security defences structured so to be layered around what you want to protect; this includes not only security of all ISO/OSI layers but also e.g. physical security:

• server room with locked doors
• security badges to access the building
• security guards inside and outside the building
• background checks on personnel
• personnel training against social engineering attacks
• insurance for theft, loss of service, legal issues etc.
• anything else for which an attack is feasible

Note that a protection model based only on information security, without e.g. physical security, is doomed to failure.

Answer 2

Defense in depth and layered security are often used interchangeably. The idea is that a flaw in any single layer of your defense (e.g., your endpoints) will not result in complete and utter breach of all your systems.

This isn't "official" per-se, but I like to break the layers down into:

1. Human
2. Physical
3. Endpoints
4. Network
5. Application
6. Data

I wrote a really in-depth guide based on these 6 layers here:

https://www.varonis.com/ultimate-guide-to-layered-security/

And SANS has a whitepaper about layered security that is also pretty good (though outdated) here:

https://www.sans.org/reading-room/whitepapers/analyst/layered-security-works-34805 [PDF]

Answer 3

I'm not aware of one from the information security field (though there are terms like Confidentiality / Integrity / Availability and such) but there is the OSI model. That's a pretty universally known model.

Answer 4

Im not aware of a standard framework that is sanctioned by a central governing body and universally accepted by the infosec community.

Most models are mapped 1:1 with the OSI model, which kinda makes sense. Perhaps we need a few sub layers in there to cover the breadth and depth of different attack vectors. The human attack vector for example doesn't really fit into that framework.

In addition to the human attack vector, I personally believe that a infosec layered model could perhaps do with a compliance layer as well.

This could make an interesting PhD, or master project for someone.

(Or even for the collective brain of this board to come up with a baseline framework that could act as a basis for any potential standard)