The Four Horsemen of Network Security

Originally published by Netography.

Written by Martin Roesch, CEO, Netography.

One of the fundamental organizing principles for network security is that we have four fundamental things to secure—users, applications, data, and devices. I sometimes jokingly refer to them as the four horsemen of network security where each represents a different facet when we’re thinking about securing the Atomized Network which includes legacy, on-premises, hybrid, multi-cloud, and edge environments.

Most security technology exists to secure the four horsemen or broker access and manage the interactions between them. We deploy tools like cloud security posture management (CSPM), attack surface management (ASM), and firewalls to enable their security. We also do tasks like vulnerability management and patching to enforce compliance policies. And we continue to raise the bar for attackers with aggressive measures like zero trust network access (ZTNA) with the goal of forcing authenticated access to resources on the network and devices and encrypting everything – including network traffic – by default.

Looking at this within the context of the threat continuum, organizations spend a lot of time and effort focused on the “Before” phase—discovering, configuring, and hardening the environment. The goal is to make it hard to break into a network at all in the first place and hopefully obviating the need for other security technologies.

In practice, there are always methods of getting in that people don’t anticipate. Authentication mechanisms can be subverted, vulnerabilities in software can be exploited, and identity-based access control systems can be abused to gain deep access into the network. The pervasive use of encryption has blinded deep packet inspection (DPI) technologies we’ve traditionally relied on to detect attacks on the network in favor of identity-based mechanisms for brokering access. The recent Uber attack is a good example. As described online, an attacker bypassed MFA by spamming a contractor’s MFA device, repeatedly requesting the user to confirm they were logging in. Eventually, the contractor relented and clicked “yes,” and the attacker was in and able to move laterally to gain access to critical infrastructure.

Because user error reliably happens and we have the majority of our eggs in the Before basket, it’s important to get a handle on the “During” and “After” phase, particularly the After phase where real-time and retrospective technologies provide more “at bats” to identify the presence of an attacker post-compromise so that the rest of the “scope/contain/remediate” activities in the After phase can be initiated.

What happens when an attack lands unhindered on a device and the only line of defense at that point is endpoint detection and response (EDR) because the nature of today’s Atomized Networks renders traditional network-based DPI approaches unworkable? EDR is obviously valuable and provides unique visibility into local processes and system activities. However, its capabilities to detect and contain are limited if the attacker uses techniques outside its scope of coverage and area of responsibility. Additionally, the number of devices on networks are rapidly compounding and it’s not uncommon for devices in Atomized Networks to be incapable of running EDR agents. Entire classes of devices can be left unprotected which means having an effective network security architecture beyond access control and access brokering is even more important.

Enterprises have become functionally blind to the composition and activities of their Atomized Networks and when there is a compromise that ultimately translates to longer dwell time and more damage done by attackers. After an attack, we need a way to gain visibility and control of network traffic across users, applications, data, and devices that is unaffected by encryption and can be deployed when and where it’s needed in minutes. The priority is to minimize time to detect and respond because rapid response can mean the difference between a minor incident and a major breach.