F. G. Alu Consulting LLC

I spoke recently about defense in depth and layered defence and had some specific comments regarding the deterrent factor of alarm systems, secure doors and exterior lighting, etc.  As a lover of dogs and cats I thought it only appropriate that I bring these critters into the discussion.

I will, with regret, dismiss felis catus from the category of deterrent from the outset.  I own a 15 pound Bengal (cat, not tiger) who only becomes a serious foe when cornered by one of the dogs.  As with most cats, he makes a dash for cover if their is a loud or unusual noise.  Wisely choosing discretion over valor.  The Dog (Canis lupus familiarus) is a different story.  My disclaimer straight away is that I am by no means a “dog expert” but I am an experienced “dog owner”.  I will be pulling from my experience as the latter.

I believe a dog is an excellent deterrent for the home or business.  We might all agree that dogs could fall into several categories, e.g. working in a K9 unit, working companion, or junk yard guard duty.  Lets look at the difference between a guard dog and the watch dog for example.  On the guard dog side we might envision a large property surrounded by fence and patrolled by one or more large breed (and stereotypically quite nasty) dogs.  The bad guys certainly think twice and consider their options before climbing the fence.  The prospect of the animal being connected to a slow moving extremity is a great deterrent.  The watch dog serves a different purpose and, in my personal experience, an excellent addition to home or business security.

I will use my Cairn Terriers as an example.  I do not think that any goblin looking over the wall would be seriously deterred from advancing at the sight of two 15 or 20 pound barking fur-balls.  What these small guys, aka fur-balls,  will do for us is raise the alarm.  Best motion and sound detector money can buy.  Even when curled up and asleep we can watch their ears follow even the slightest noise, a coffee cup set down on the counter to a chirping bird in the yard.  My dogs are ready to start in when they hear footsteps on the driveway.  The pizza guy or UPS fellow have no chance of surprise.  In fact, one of the most difficult training task for the owner is teaching them not to simply bark at everything!

Of course there is a cost involved.  We need to feed and care for them but the ROI is very good.  Can’t imagine sitting back in a comfortable chair with my alarm control panel in my lap sipping tea and enjoying a good movie.  I sleep well at night knowing that my technological and biological intruder detection systems are vigilant.

Defense in Depth – A term not typically heard in the small business world but something I felt compelled to discuss in that context.

It is typical for a small business to have a trusted technology company or an in-house IT guru to manage their IT needs.  It is also typical for a technology company or resident guru to latch on to particular vendors.  Vendors they have learned to trust based on their product, services and support and hopefully not the profit margin afforded by reselling or representing the product or the vendor.  Being an evangelist for a product, to the exclusion of others, is where these relationships go wrong and a business can become exposed to unnecessary risk.  I make this statement from personal past experience, having traveled down that very path.  We should consider our vendors and their solutions based on functionality, support, their ability to reduce risk for the business, cost to maintain and not how much they might contribute to our bank account as an authorized partner or reseller.

Now to the point, what is “defense in depth”?  It is a strategy used as part of overall Information Assurance (IA) strategy where multiple layers of defense are deployed to address security vulnerabilities in personnel, technology and operations.  This approach enables one to defend against a specific attack using several different methods.  It was in fact conceived by the National Security Agency (NSA) and based on the military tactic to delay an advancing enemy rather than prevent an advance and buy time.

Let’s look and some of the layers involved:

• Physical security (e.g. deadbolt locks, steel doors)
• Authentication and password security
• Hashing passwords
• Anti virus software
• Firewalls (hardware or software)
• DMZ (demilitarized zones)
• IDS (intrusion detection systems)
• Packet Filters
• VPN (virtual private networks)
• Logging and auditing
• Biometrics
• Timed access control
• Software/hardware not available to the public (security through obscurity)

This explanation may add some clarity to my first statements about using a single vendor or solution and the pitfalls of doing so.   Consider using multiple anti-virus solutions across your platform, regardless of how small your company might be.  One vendor on the Firewall and another on the desktop.   It is also important to consider this level of protection as a suite of products to include protection from the many types of malware found in the wild.  The list of very good anti-virus/anti-malware solutions is quite long so one does have a choice.

I point out that although patch management is not specifically mentioned in the list of “layers” I would consider it on a parallel with the anti-virus/anti-malware solution.  Monitor vendor channels such as Microsft, Apple, and the assorted flavors of Linux and install security updates when they are released.  On a test platform first if you wish but install them in production as quickly as possible.  The cost of not doing so far outweighs any unfounded fear that the security update will break the system.  It has been my experience that when a security update is installed and the performance of the system is adversely affected there is another underlying reason why and it is not the fault of the patch itself.

Register with US-CERT, the United States Computer Emergency Readiness Team or the SANS Internet Storm Center and elect to receive security update notifications.  Your preferred anti-virus vendor will typically require registration and one may opt-in for notification via email of threats or outbreaks.  Constant vigilance is the key at this layer.

I must also add a quick blurb about physical security and note that deadbolts and steel doors are shown in parenthesis as a short description.  Not an “alarm system” or what we in the profession call intruder detection and control.  It is certainly not my intention here to denigrate any of the alarm system vendors.  I do take exception, however,  to the marketing of an alarm system as being anything more than a deterrent.  We see, for example, the many television commercials that show the mom and child setting the alarm and feeling safe inside their home and suddenly the bad guy breaks the window glass or breaks through the door.  The alarm sounds and they are saved by a phone call.  Nonsense!  A steel door with  no glass and a 2” safety deadbolt will provide a much higher deterrent level and keep mom and child more secure.  Good outdoor lighting, fences, also add to a good layered security system.  An alarm system is very important but as one of the layers we leverage to keep our people and our business assets safe.