The recent outage caused by Crowdstrike’s faulty update has create a lot of discussions. I wrote a post on LinkedIn where I asked the readers why are IT professionals using Crowdstrike on some systems that shouldn’t be in need of such protection in the first place.

The answers in various groups were mostly related to:

• protect everything against everyone
• assume the worse
• assume that you are compromised.

I do not agree with such a shallow answer. And this raises a question about Defense in Depth.

Defense in Depth

Defense in Depth is a cybersecurity strategy that employs multiple layers of security controls to protect an organization’s assets and information. This approach is based on the premise that no single security measure is foolproof. By implementing several layers of defense, even if one control fails, others are in place to mitigate risks. The concept is inspired by military defense strategies, where a series of defensive positions are used to delay or prevent an attack.

A common misconception about Defense in Depth is that it requires identical security measures across all layers of an IT environment. In reality, this is neither necessary nor practical. Different layers have different requirements based on their specific functions, vulnerabilities, and the types of threats they are exposed to. Applying the same controls universally can lead to inefficiencies, increased costs, and potential performance issues.

In my opinion, this is what happened in many cases during the Crowdstrike outage: admins installed the EDR solution simply on all available devices, without doing an analysis of the threats they are exposed to. This is called threat modeling, and the first step after identifying the assets to protect is to analyze their threat landscape: this is the set of threats they are potentially exposed to. Once the potential threats are identified, then the appropriate security controls can be defined. But, it is important that the right controls are used based on the risk level of the potential threat. The mistake here is that people try to protect against any potential risk, no matter how improbable it might be. So, it is not worth to protect against every potential risk.

But, this operation is, at least at first sight, expensive, time consuming and very few people know how to do it.

So, what happens in most cases is that people consider to be cheaper to buy additional licenses and accept easily a slight reduction in performance due to the tool monitoring everything (“throw” more hardware on it).

And this might be OK, if everything works perfect all the time. Well, it doesn’t !

If this sounds too theoretical, then let’s have a closer look at various layers where applications run.

• Running at the Web Application Layer: This layer might need strong authentication mechanisms, input validation, and encryption to protect against web-based attacks such as SQL injection or cross-site scripting (XSS).
• Running at the Network Layer: Here, firewalls, intrusion detection systems (IDS), and virtual private networks (VPNs) are more appropriate to guard against network-based threats like DDoS attacks or unauthorized access.
• Running at the Endpoint Layer: Devices such as laptops and mobile phones might require antivirus software, device encryption, and endpoint detection and response (EDR) solutions to prevent malware infections and data breaches.

Each layer of security addresses different risks, and the controls should be tailored to the specific threats and the environment.

For instance, a high-value database containing sensitive customer information might warrant multiple layers of encryption, strict access controls, and regular auditing. In contrast, a low-value, non-critical application might only require basic security measures.

Of course, there are applications having parts that run on more than one layer. When this happens, then you must correctly create the threat model and identify the risks at each layer.

For example, if you have a computer which just displays flights schedules, without having an interaction with the exterior other than retrieving data from an internal webservice, you probably do not need a dedicated endpoint security product for it.

Why? Because you will not allow access to the machine other than the service account for patches and running the required software.

If you’re unsure, and the machine runs Windows, than the default Defender is more than enough.

Create a Threat Model for your endpoints

If you don’t know how to create a threat model for an endpoint (and not only Windows, MacOS and Linux are equally affected), here is a list of potential threats and their mitigations.

Important note:
If you apply correctly the principles of Defense in Depth, you will NEVER all all these potential risks applicable to your devices.

Even if you remotely consider that some or all these risks can occur, do not forget that the Risk is proportional to the Probability of occurrence and Impact effect:

• Probability of occurrence – what are the chances that the risk actually occurs: Very probably, Probably, Sometimes, Unlikely, Never.
• Impact effect: Catastrophic, Very high, High, Medium, Low.

Potential Risks on an Endpoint

• Malware Infections

  • Risk: Viruses, Trojans, ransomware, spyware, and other malicious software can compromise the system.
  • Security Controls:
    • Antivirus/anti-malware software
    • Regular system scans and updates
    • Application whitelisting
    • Sandboxing suspicious files
    • Backup with versioning control (good for ransomware attacks)

• Unpatched Software

  • Risk: Vulnerabilities in outdated software can be exploited by attackers.
  • Security Controls:
    • Automated patch management systems with rollback functionality
    • Regular software updates
    • Vulnerability scanning tools
    • Centralized patch distribution

• Unauthorized Access

  • Risk: Unauthorized users may gain access to the endpoint, leading to data breaches or system compromise.
  • Security Controls:
    • Strong password policies
    • Multi-factor authentication (MFA)
    • User account control (UAC)
    • Role-based access controls (RBAC)

• Data Theft

  • Risk: Sensitive data may be copied, transmitted, or stolen from the endpoint.
  • Security Controls:
    • Full disk encryption (e.g., BitLocker)
    • Data loss prevention (DLP) tools
    • USB port control and removable media encryption
    • Secure backup solutions

• Physical Theft

  • Risk: The endpoint itself may be physically stolen, leading to loss of data and access to the network.
  • Security Controls:
    • Physical security measures (locks, secure storage)
    • Device tracking and remote wipe capabilities
    • Full disk encryption
    • BIOS/UEFI passwords

• Drive-by Downloads

  • Risk: Malicious websites may automatically download and install malware without user consent.
  • Security Controls:
    • Web filtering and browser security plugins
    • Regular updates to browsers and plugins
    • Application whitelisting
    • Disabling automatic execution of scripts in browsers

• Network-based Attacks

  • Risk: Attackers may exploit vulnerabilities in the network to compromise the endpoint.
  • Security Controls:
    • Personal firewall
    • Network segmentation
    • Secure VPN connections
    • Intrusion detection and prevention systems (IDPS)

• Misconfigured Security Settings

  • Risk: Insecure configurations can leave the endpoint vulnerable to attacks.
  • Security Controls:
    • Regular security audits and compliance checks
    • Hardening guides and best practices (e.g., CIS benchmarks)
    • Group policies for centralized management
    • Security baselines and templates

Potential Human Risks

Phishing Attacks

• Risk: Users may be tricked into divulging sensitive information or downloading malicious software through deceptive emails or websites.
• Security Controls:
  • Email filtering with anti-phishing capabilities
  • User awareness training
  • Web filtering and reputation services
  • Multi-factor authentication (MFA)

Insider Threats

• Risk: Malicious or negligent insiders may intentionally or unintentionally cause harm.
• Security Controls:
  • User activity monitoring and logging
  • Least privilege principle
  • Endpoint detection and response (EDR)
  • Insider threat detection tools

Instead of conclusion: Balancing Security and Usability

The most critical aspect of Defense in Depth is balancing security and usability.

Over-securing can lead to decreased productivity, increased costs, and user dissatisfaction.

For instance, implementing multi-factor authentication (MFA) at every step might significantly slow down legitimate users, leading to frustration and potential workarounds that can undermine security.

A well-designed Defense in Depth strategy finds the right balance by applying strict controls where necessary and lighter measures where the risk is lower.

The goal is to create a robust security posture that protects against a wide range of threats without overburdening the system or its users.

 

The post Understanding Defense in Depth in IT Security first appeared on Sorin Mustaca on Cybersecurity.