In the traditional model of overall Cybersecurity, only one layer of defense has been used. This is most commonly associated with that of legacy systems, especially that of the Critical Infrastructure, which includes the oil and gas pipelines, water supply lines, the national power grid, nuclear facilities, agricultural and food supply chain, etc. But as the world is becoming almost fully digital and virtual, using just one layer of security is clearly not enough.
When it comes to protecting an IT and Network Infrastructure and the assets that reside within them, the call for using a Two Factor Authentication (also known as “2FA”) is now being implemented. In this instance, two layers of security are used. For example, when it comes to Physical Access Entry applications, very often an employee is now issued a Smart Card which stores their credentials. After swiping this into a reader, he or she is then allowed into the main point of entry. To gain further access inside the office and other areas, they may have to enter a PIN number on a specialized console. The same holds true for Logical Access Applications.
Regarding Logical Access Applications, an employee will often still have to enter a password to log into their workstation and use a more specialized device, such as an RSA Fob or even a Biometric device (such as Fingerprint Recognition or Iris Recognition) to gain access to the shared folders on the corporate server.
But even this 2FA approach is starting to prove vulnerable. For example, not only is the Cyberattacker able to break through the first layer of defense, but there is also a high probability that they will be able to tear down the second wall of defense as well. What is a business or a corporation to do?
The answer lies in implementing multiple layers of security, perhaps as many as four or five layers. This kind of approach is often referred to as a “multimodal” or “Layered Security” approach. This is the focal point of this series.
What Is Layered Security?
Layered Security can be defined specifically as follows:
“[It] refers to security systems that use multiple components to protect operations on multiple levels, or layers. This term can also be related to the term defense in depth, which is based on a slightly different idea where multiple strategies and resources are used to slow, block, delay or hinder a threat until it can be completely neutralized. Layered security may also be known as layered defense.”
(Source 1: https://www.techopedia.com/definition/4005/layered-security)
As can be discerned from the above definition, the basic premise is that deploying at least three or more layers of defense has a much higher statistical probability of thwarting a Cyberattacker than having just one or two layers. In other words, the likelihood that a Cyberattacker will reach their ultimate target will diminish each and every time that they break through a line of defense. Thus, having as many layers of security as possible is the best scenario for any business or corporation when it comes to protecting their IT Assets, primarily that of the Personal Identifiable Information (PII) of their customer base.
It is important to note that the Layered Security approach can be used in both Physical Access and Logical Entry applications, but it is typically deployed far more often in the latter scenario, especially when it comes to Network Security.
A Diagram of Layered Security
A simplified view of how a Layered Security approach can be used for a Physical Access Entry application can be seen below:
Next up: The next article in this series will explain why a layered security approach to Cybersecurity is important from the standpoints of both a business/enterprise and its customers.
Sources/References:
General supporting sources:
https://en.wikipedia.org/wiki/Layered_security
https://www.ibm.com/support/knowledgecenter/en/ssw_ibm_i_73/rzaj4/rzaj40a0internetsecurity.htm
https://www.ericom.com/whatis/layered-security/
https://www.gosolis.com/blog/the-benefits-of-layered-security-and-how-it-can-improve-your-business/
Ravi Das is a Cybersecurity Consultant and Business Development Specialist. He also does Cybersecurity Consulting through his private practice, RaviDas Tech, Inc. He also possesses the Certified in Cybersecurity (CC) cert from the ISC2.
Visit his website at mltechnologies.io
