White Badger Security Blog

Common wisdom says that we humans use less than 10% of our brains’ capacity in a lifetime. I assert that the same is true for enterprise networking hardware and software.

As referenced by Paul in his recent post, we very frequently run in to organizations that have an overwhelming urge to add something to their systems to make them more secure. In reality, some of the deepest changes that will have the biggest impact on security are all around you in the environment you already have.

For example, all Cisco switches support VLANs, but a full half of the organizations we have dealt with have not seriously explored using that functionality to help separate network devices from each other. Where VLANs are implemented, at least 75% of those organizations don’t properly use a firewall or layer 3 access lists to prevent traffic from flowing between the network segments. Back down to layer 2, all Cisco switches support some form of MAC filtering or limitation of MAC addresses per port, but even those basic controls are almost never enabled in deployments we’ve seen. These are defenses for some of the most basic network attacks and can be enabled safely in some combination for 98% of all deployments.

The examples could go on endlessly, but the important thing to illustrate is that most all of your network is only delivering 10% of its potential from a security standpoint at any given time. Unlike the brain, accessing the remaining 90% is as simple as testing the functionality, configuring it, and deploying it to current installations.

To make the point directly, your organization has likely been purchasing all the hardware and software you need to be secure for years. The missing piece is the knowledge and experience required to put the pieces together in a way that makes them work effectively and securely together. That’s where we come in.

This morning I found myself thinking of the many commercial and government organizations we’ve run into over the years that have an urge to buy something… something, as in almost anything they can plug in that purports to improve their cyber security posture. “Surely there is something I can purchase and plug in to fix (this or that cyber security issue). There has to be something I can buy!”, goes this line of thinking.  Something that will help these organizations delay –or even avoid– the challenging but lasting solutions that would result from correcting the underlying fundamental pervasive deficiencies in network architectural design, technical training, readiness, incident response, policy and more. “Surely there is something on the market today will let us avoid the hard decisions until the next budget cycle – if ever!”

If only things were this simple. Unfortunately, there is nothing on the market today that fits this description, no matter what some product vendors would like for us to believe.  While many security products do work from a tactical point solution perspective, each comes with its own support, maintenance and all-too-often cyber security holes of their own. Meanwhile such organizations have fewer IT budget dollars and time left to fix the true cause of many of their problems, their network’s flawed architectural design.

Fortunately, there is good news. One of reasons why decision makers put off tough architectural design decisions is because they often believe significant outlays of capital expenditure and network downtime would be involved. Neither assumption is normally true.

The logical configuration of an enterprise network can be re-aligned to support multiple security objectives at once from a fundamental architectural design standpoint, while simultaneously improving network functionality and reliability. To do this, the logical and physical interconnectivity of routers, switches, firewalls, DMZ configurations, VLAN configurations, proxy servers, remote access infrastructure, DNS, databases, servers, enterprise authentication, Active Directory domain(s) configuration, domain policies, Group Policies and more are all fair game for enterprise-wide re-configuration. Such reengineering can lower the cost of network operations more than sufficiently to pay for the entire exercise. The return-on-investment payoff timeframe can be year or less – and all without any additional network downtime.

Sound impossible?  Don’t believe it can be done?  Good, then I’m glad I’ve piqued your interest. Give me a call and I will personally help you to understand exactly how we do all this and more – and I will even use your network as an example, gratis on the house.  So what are you waiting for? Call me. When you do, choose the option for our enterprise security services team and then ask for me. I look forward to speaking with you very soon.