hey what's going on you guys welcome back to my channel nicholas moy here and in this video
i'm gonna be answering the question what is defense and depth let's go ahead and get into
it so defense in depth is the idea of layering cyber security controls on top of each other now
when we think of cyber security a lot of times we think oh this is technical this is like a computer
security control or something like that that's just kind of like stacking on top of each other
but that's not always the case many times cyber security control can also involve
physical security logical security and administrative security controls so as part of my
role as a cloud security architect one thing that i'm always looking for are the security controls
in a new project that's being built out what do i mean by that well there's going to be you know
servers more than likely there's going to be some kind of compute resource some kind of storage
service maybe there's a database maybe there's some integration with an environment outside of
the cloud environment that you know the developers or the the it guys are trying to build inside and
my job as a cloud security architect is to assess that environment for adequate security controls
that a is compliant makes sure it's it's following the standards of the governance that needs to be
there um if it's applicable not always applicable but if it is you need to make sure it's there
and b or two is to make sure that it's sufficient right that it is sufficient for the type of and
the type of environment the type of data that's being handled all the above we want to make sure
that we're dealing with the right security for this use case when i look at that i have
to look at it through the the lens of defense and depth okay if i am a hacker how would i
get through here how would i get through and penetrates to access some type of valuable data or
valuable resource that i want to access you know maybe they want to access the server because they
want to mine bitcoin and not have to pay for the server they want to do it on someone else's dime
well if that's the case i need to protect that server and make sure that that's not going to be
possible and if it is possible i need to make sure i have monitoring to make sure that you know we
can stop it if that ever happens if it's data that i'm trying to protect and i do not want anybody to
access this data because it's very sensitive like for example patient records or something like that
well we need to make sure that we have layers of security so that in case one security control is
broken not only are we alerted on it but there's another security control that's there as a backup
to prevent that hacker from getting even closer if we look at a castle we have you know typically
a moat we typically have like a drawbridge you have a huge wall you typically have uh
soldiers and and arrow men and they're like shooting arrows fiery arrows and you have like
cannons and all that stuff like really cool stuff right all of these are security
controls that prevent the outside army or the outside bad guys from getting in
to the castle okay these are all security controls these are physical security controls because this
is a a battle scene that we're looking at but if we think about it in cyber security sense
there's still some application here right if you're if a hacker wanted to get into
to a data center he can go in a couple different ways he can try to walk in through the front door
he can try to barge in he can try to come in through the ceiling right he can come
in through the roof maybe if there's a way to do that maybe there's like a glass hopefully not but
if there is if this data center wasn't very secure maybe he could shatter the glass in the ceiling or
he could break through a window you know what are we doing to protect that if that's the case
so those are some physical security concerns that we have and we have to install controls to prevent
those things from being compromised and if they are compromised we need to have a backup this
is that defense and depth we're talking about but on a logical front and that was physical
now we're talking logical logical being technical okay can the hacker maybe access
the data in the data center through the internet what are we doing about that is our firewall
are we blocking ports are we monitoring the server are we monitoring the data the database
what are we doing about that these are the types of questions we have to answer and as
a cloud security architect i'm always thinking about these types of things
the third control family that i mentioned was the administrative controls what on earth is that
honestly it's not the fun part it's a little bit boring but administrative controls is
the process of writing policies and procedures these are rules we're writing these rules that
allow and disallow certain activity from taking place well nick why would i write an
administrative control if i'm if the hacker's out there he's not going to follow the rules
you're right he's not going to follow the rules or she they're not going to follow the rules but they
may have a harder time getting in if the people inside the organization that do have access
to that data center to that data if those people are following the rules everyone outside of the
organization they will have a harder time getting in because you set rules people follow people
should follow it doesn't always happen not on a perfect world but we want to set policies in place
to provide guidance to people on the inside not everyone knows security this is the reason why we
know security this is why we are learning security it's because we want to provide guidance to
all the other professionals that we work with a perfect example of this is a network engineer a
network engineer knows networking they know it really well i know some really smart network
engineers the network engineers don't always know security they know what a firewall is
and sure they've probably set a few up but they would not know what's the best way to set it
up for every single situation that's not their job they go to a cyber security engineer to ask
hey cyber security engineer how should i configure this firewall
i have an idea because i've done this a few times hopefully but can you double check my work
and make sure that i'm doing a good job that that is what i'm talking about okay and so
the administrative controls the policies and procedures is something that the cyber security
engineer can provide to the network engineer and can say hey thanks for asking here's our
policy on this can you make sure this is done this way and then they let them know when it's
done and then the cyber security engineer can go in and double check and make sure it's all good
and if there's any critiques that need to be made they make them boom super easy
done so that's administrative controls so so far we've talked about physical security controls
we've talked about logical security controls and we've talked about
administrative security controls those are the three different type of control families
and there's lots of there's lots of controls lots of security controls that you put in place
from those three different control families that's create a layered defense and that's all this is
now i can't come and tell you that every single time you need to have a firewall
you need to have xdr you need to have edr you need to have it doesn't always apply
you know if we're dealing with a web host do we want to block all of the ports going to
that web host what i mean by web host is like a web server like a like a wordpress website
we don't want to block everything but we do want to block some things right so
i can't say that there's a blanket answer but what i can't say to answer this question on defense in
depth is that it is going to be layered it is the idea of stacking those security controls on top
of each other until you have them all sorted out and let me go ahead and say this right off the bat
you're not going to get this perfect technology changes there's no such thing as 100 security
but there is something that you can do to improve every day as the technology changes we
learn log 4j just happened right before christmas the whole world got affected by that do you think
the whole world was thinking about that a few weeks but prior to christmas no we weren't
thinking about that there are certain times where we can catch that some people are catching those
vulnerabilities earlier than others but it's not it's not a perfect scenario not everyone is
on top of every single thing all the time and the cyber security landscape is growing so quickly
and the cyber security landscape is growing so quickly that
it's practically impossible but we do have to do our best and creating those defense and depths
the layers of defenses it's a good way to do that so anyways i will get off my soapbox now
i hope you found this helpful i didn't really do the whole traditional video this time i didn't
do like the whole smash the like button but smash the like button if you haven't already
thanks thanks for smashing the like button um yeah let me know what you thought about this if
you uh if you like this leave me a comment down in the section below alright so that about wraps up
this video on defense in depth i hope you found this helpful if you have any questions leave them
down in the comment section below make sure to smash the like button and hit that subscribe
button because i'm going to be creating more content on cyber security security architecture
and uh just the cloud in general these these are the types of things i like
i might be talking about crypto too i'm kind of dabbling and experimenting with that idea
um but uh yeah this is what's going on thank you for watching i appreciate it make sure to uh
to let me know if you enjoyed this and i will see you in the next video