Home / Blogs

An Introduction to Security and Reliability - What Does It Really Mean?

Brett Watson

I co-authored a book in 2005, titled "Extreme Exploits: Advanced Defenses Against Hardcore Hacks." My chapters focused on securing routing protocols such as BGP, and securing systems related to DMZs, firewalls, and network connectivity.

As I look back over those chapters, I realize that the basic fundamentals of network security really haven't changed much even though technology has advanced at an incredible pace. "Defense in depth" was a hot catch phrase seven years ago, and it still applies today. I believe there are three broad steps any organization can take with respect to security and reliability to get a handle on their current security posture, whether internal (corporate, inside the firewall) or external (Internet, outside the firewall).

Network Assessment

Begin with a "network assessment." This is a broad term that might encompass a holistic view of an organization's Internet security posture, including Internet gateways, firewalls, DNS and email services, and B2B partner connectivity. In addition or alternatively, a network assessment may focus on an organization's internal network, including employee intranets, VPN, electronic mail, DNS, VoIP, vulnerability management and anti-virus services, change management, and business continuity planning and disaster recovery. A network assessment can be tailored to specific security requirements for any organization, but ultimately the assessment will provide a baseline gap analysis and remediation steps to fill those gaps.

Vulnerability Assessments

Once a baseline network assessment is completed, an organization may wish to perform periodic vulnerability assessments. Traditional vulnerability assessments tend to cover applications services and nothing more. However, an organization's security posture must include Internet gateway switches/routers, firewalls, DNS servers, mail servers, and other network infrastructure not directly related to providing service for a specific application. Whether internal or external, vulnerability assessments can uncover critical gaps in security that may lead to credential leaks, intellectual property theft, or denial of service to employees or customers. A well planned and executed vulnerability assessment should eliminate false positives, but can never give an organization 100% confidence that a specific vulnerability can be exploited. Vulnerability assessments should be executed on at least a quarterly basis, but it's not uncommon for larger organizations to execute them on a monthly basis.

Penetration Testing

The next step in assessing your organization's security and reliability is penetration testing. While I typically say that vulnerability assessments give you a "95% confidence level" that a vulnerability exists, penetration testing can give you 100% confidence that a specific vulnerability can be exploited and show you how it can be exploited by attackers. Alternatively, a penetration test may show you that you have proper compensating controls in place to prevent a vulnerability from being exploited. That is to say, the vulnerability exists, but a compensating control is in place that prevents attackers from succeeding.

One only needs to read the news to know that every organization, whether large or small, is susceptible to intrusions across their networks or exploits in their applications and services. It's prudent to execute a network assessment in order to understand your current security posture, and then follow up with periodic vulnerability assessments and penetration tests. These will give you a higher level of confidence that your architecture is sound, and that your staff is adhering to security policies and procedures. Ultimately, your customers trust you to secure your resources and their information, and your brand and market identity are at stake if you don't.

By Brett Watson, Senior Manager, Professional Services at Neustar. Brett's experience spans large-scale IP networking, optical networking, network/system administration and design, and security architecture including high level security policy and architecture, as well as vulnerability assessments and penetration testing.

Related topics: Cybersecurity, DNS, Networks, VoIP


Don't miss a thing – get the Weekly Wrap delivered to your inbox.


To post comments, please login or create an account.

Related Blogs

Related News

Explore Topics

Dig Deeper

DNS Security

Sponsored by Afilias

IP Addressing

Sponsored by Avenue4 LLC


Sponsored by Verisign

Mobile Internet

Sponsored by Afilias Mobile & Web Services

Promoted Posts

Buying or Selling IPv4 Addresses?

Watch this video to discover how ACCELR/8, a transformative trading platform developed by industry veterans Marc Lindsey and Janine Goodman, enables organizations to buy or sell IPv4 blocks as small as /20s. more»

Industry Updates – Sponsored Posts

Verisign Named to the Online Trust Alliance's 2017 Audit and Honor Roll

Attacks Decrease by 23 Precent in 1st Quarter While Peak Attack Sizes Increase: DDoS Trends Report

Leading Internet Associations Strengthen Cooperation

Global Domain Name Registrations Reach 329.3 Million, 2.3 Million Growth in Last Quarter of 2016

Verisign Releases Q4 2016 DDoS Trends Report: 167% Increase in Average Peak Attack from 2015 to 2016

Neustar to be Acquired by Private Investment Group Led by Golden Gate Capital

Verisign Q3 2016 DDoS Trends Report: User Datagram Protocol (UDP) Flood Attacks Continue to Dominate

2016 U.S. Election: An Internet Forecast

Government Guidance for Email Authentication Has Arrived in USA and UK

ValiMail Raises $12M for Its Email Authentication Service

Don't Gamble With Your DNS

Defending Against Layer 7 DDoS Attacks

Understanding the Risks of the Dark Web

New TLD? Make Sure It's Secure

Verisign Releases Q2 2016 DDoS Trends Report - Layer 7 DDoS Attacks a Growing Trend

How Savvy DDoS Attackers Are Using DNSSEC Against Us

Radix Adds Dyn as a DNS Service Provider

Facilitating a Trusted Web Space for Financial Service Professionals

MarkMonitor Partners with CYREN to Deepen Visibility into Global Phishing Attacks

Verisign Named to the Online Trust Alliance's 2016 Honor Roll