Network Security Architecture: Defense in Depth
Explore defense in depth network security architecture, including layered controls, network zones, and audit evaluation strategies for CISA candidates.
Defense in Depth Concept
Defense in depth is a security strategy that employs multiple layers of controls to protect information assets. For CISA candidates, understanding this architectural approach is essential because it forms the foundation of effective network security design. The principle recognizes that no single control is infallible; by implementing overlapping layers, organizations ensure that the failure of one control does not result in complete compromise.
This strategy originates from military doctrine and applies to information security by placing multiple barriers between an attacker and their target. Each layer addresses different attack vectors and provides additional opportunities for detection and response.
Layers of Defense
Network Perimeter
The network perimeter represents the boundary between the organization's internal network and external networks. Controls at this layer include:
- Border firewalls: Filtering traffic based on rules that define permitted communications
- Demilitarized zones (DMZ): Isolated network segments hosting public-facing services
- Web application firewalls (WAF): Protecting web applications from common attacks such as SQL injection and cross-site scripting
- Email and web gateways: Filtering inbound and outbound content for malware and data leakage
Internal Network
Internal network controls segment the environment and restrict lateral movement:
- Network segmentation: Dividing the network into zones based on security requirements and data sensitivity
- VLANs: Logical separation of network traffic at Layer 2
- Internal firewalls: Controlling traffic between network segments
- Network Access Control (NAC): Verifying device health and user identity before granting network access
Host and Application Layer
Controls at the host and application level protect individual systems and applications:
- Endpoint protection: Antivirus, anti-malware, and endpoint detection and response (EDR) solutions
- Host-based firewalls: Controlling inbound and outbound connections on individual systems
- Application whitelisting: Allowing only approved applications to execute
- Patch management: Keeping systems current with security updates
Network Security Zones
Network security zones group systems with similar security requirements and trust levels. Common zones include the internet-facing zone (DMZ), the internal user zone, the server and database zone, the management zone, and restricted zones for sensitive systems. Each zone has defined access rules governing traffic flow between zones. Auditors should review zone definitions, assess whether systems are placed in appropriate zones, and verify that inter-zone traffic rules follow the principle of least privilege.
Zero Trust Architecture
Zero trust architecture challenges the traditional perimeter-based model by assuming that no user or device should be automatically trusted, regardless of network location. Key principles include verifying every access request, enforcing least privilege, and assuming breach. Auditors should understand how zero trust concepts complement traditional defense in depth strategies.
Audit Approach
IS auditors evaluating network security architecture should review network diagrams for completeness and accuracy, assess firewall rule sets for overly permissive rules, verify that segmentation controls are effective through network testing, evaluate logging and monitoring coverage across all layers, and assess whether the architecture addresses both external and internal threats. Regular penetration testing results should be reviewed to validate the effectiveness of layered controls.