2

Some days ago, I was talking with a friend about the Snowden revelations and its impact on Infosec awareness and how quite a number of (supposedly) secure alternatives to established services have emerged in the last month.

However, we quickly agreed on the fact that all that application layer security (if it indeed works) is useless if you don't trust all underlying layers, such as the OS (might be backdoored) or even the hardware (there were some really spooky news about the NSA fiddling with hardware sent via mail). This idea seems so basic and intuitive, yet I wasn't able to find any scientific literature on it. Is there a commonly used name for it?

  • 1
    Your basic premise is flawed: security on a higher layer (eg. SSL) works just fine even if that on a lower layer (eg. your Ethernet cable) is broken. – Mark Aug 25 '15 at 19:13
  • 1
    Well, it doesn't really help me to know nobody can listen into my network traffic if the bad guys can simply get all the information exchanged at the very source (my client device), does it? (focusing on confidentiality only, here, of course SSL does provide more than that) – TheWolf Aug 25 '15 at 19:23
4

The term you are looking for is defense in depth.

It's a term that describes security defences structured so to be layered around what you want to protect; this includes not only security of all ISO/OSI layers but also e.g. physical security:

  • server room with locked doors
  • security badges to access the building
  • security guards inside and outside the building
  • background checks on personnel
  • personnel training against social engineering attacks
  • insurance for theft, loss of service, legal issues etc.
  • anything else for which an attack is feasible

Note that a protection model based only on information security, without e.g. physical security, is doomed to failure.

1

Defense in depth and layered security are often used interchangeably. The idea is that a flaw in any single layer of your defense (e.g., your endpoints) will not result in complete and utter breach of all your systems.

This isn't "official" per-se, but I like to break the layers down into:

  1. Human
  2. Physical
  3. Endpoints
  4. Network
  5. Application
  6. Data

I wrote a really in-depth guide based on these 6 layers here:

https://www.varonis.com/ultimate-guide-to-layered-security/

And SANS has a whitepaper about layered security that is also pretty good (though outdated) here:

https://www.sans.org/reading-room/whitepapers/analyst/layered-security-works-34805 [PDF]

0

I'm not aware of one from the information security field (though there are terms like Confidentiality / Integrity / Availability and such) but there is the OSI model. That's a pretty universally known model.

0

Im not aware of a standard framework that is sanctioned by a central governing body and universally accepted by the infosec community.

Most models are mapped 1:1 with the OSI model, which kinda makes sense. Perhaps we need a few sub layers in there to cover the breadth and depth of different attack vectors. The human attack vector for example doesn't really fit into that framework.

In addition to the human attack vector, I personally believe that a infosec layered model could perhaps do with a compliance layer as well.

This could make an interesting PhD, or master project for someone.

(Or even for the collective brain of this board to come up with a baseline framework that could act as a basis for any potential standard)

  • 1
    SABSA is a framework that is heavily utilized in many enterprises. Depending on the definition of sanctioned or universal, it depends where it fits – Motivated Aug 28 '15 at 7:38
  • +1 Absolutely. From what I understand it is about risk management and meeting criteria for certification? I would suggest that this would be one of the frameworks included in the Compliance layer of our hypothetical, standardised layered information security model. – TheJulyPlot Aug 28 '15 at 7:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.