Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: What's important on your network? SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
What's important on your network?

Often when you ask someone what is important on their network, they will say "Everything".  But that cannot be the case.  You have to determine your High Value Targets first.  A High Value Target is a device, system, database or resource that you cannot live without and still accomplish your mission.  If you look at this from a military perspective, it is the key targets that can win you or lose you the war.  This may seem like common sense, but strangely many people have not considered this.  We protect networks so they can accomplish some defined mission whether it be information sharing or business related as examples.  Too often its seems we forget the mission part and don't really factor it into why we are doing security; whether designing an infrastructure or monitoring that infrastructure.  It becomes just a checklist....IDS (check)...Firewall(check)...Antivirus(check)...logs(check)...but are you really focusing on what is critical?

To protect a network/resource properly, you have to know your High Value Targets. In order to do this, your going to have to talk with your different business areas that make up your company/organization and understand what is important to them and what risk are they willing to take.  It may be that you have to help guide them to even get them to understand what you are asking.  That is ok, because it shows them that you are concerned and your are willing to take the time to help them and help yourself learn.  If you don't understand what is important to the company/organization, then your ability to design or monitor an infrastructure effectively is greatly diminished.  I would venture to say that we do a better job understanding our High Value Targets when it comes to designing the infrastructure but we fail when it comes to understanding it in order to effectively monitor it.  If you asked all your analysts on your different shifts (or however your monitoring) what the top five High Value Targets were on your network, what answers would you get?  Would those answers line up with the business owners?  An attack or anomalous traffic toward one asset may not be that worrying, but what if its toward one of your High Value Targets? 

In today's world, the threat has become very tailored and very specific.  We have so much traffic to monitor on our infrastructures today that we have to have a tailored and structured approach to monitoring.  You have to know what has the priority when it comes to protecting and/or monitoring.   What can't the company/organization live without?  I can assure your that the attacker is trying to find or already knows your high value targets.  The real question is do you know what they are?

Lorna

165 Posts
ISC Handler
I couldn't help but think of "Compliance" when the word "Check list" was mentioned. While compliance plays a very important role in today's business, I feel it gives non-security IT Staff a false sense of comfort knowing that they are compliant with the rules put forth by xyz. Compliance does address some concerns about priority targets, but it's usually specific to one type of target and doesn't usually consider the various forms of attacks companies are currently under. Security should be looked at in a holistic view and then augmented to include certain compliance instead of relying on compliance to determine your security strategy.

I'm getting off my soapbox now...:)
Anonymous
On similar lines ...
http://kavatch.wordpress.com/2012/02/12/security-is-as-strong-as-the-weakest-link/
xpl0it

1 Posts
Organizations that are governed by HIPAA regulations need to perform periodic risk assessments. That is one BIG benefit of regulatory compliance. Otherwise it seems that there is far less concern. These assessments should contain locations of pii. Systems with pii should rate higher on the risk scale. Business continuity planning with a security emphasis is important.
xpl0it
2 Posts
The higher PCI levels specify risk assessments as well, but there seems to be no enforcement or audit, until after you have a Cardholder Data loss.
xpl0it
28 Posts

Sign Up for Free or Log In to start participating in the conversation!