Best Practices for Layered Security

• Follow Least Privilege
  When segmenting your network, it’s important to minimize who and what has access within and across systems according to actual need.  By following the principle of least privilege and role-based access, you can limit hosts, services, users, and networks from accessing data and functions that are outside their immediate responsibility. This will strengthen the overall security posture while also making it easier to monitor traffic throughout your network.
• Limit third-party access
  It is vital to limit third-party access to your network to minimize exploitable entry points. Third-party remote access risks remain a key vulnerability for organizations.  Some ways to accomplish this are to create isolated portals for third parties that need access to your network to provide services.
• Audit and monitor your network
  Segmenting your network is just the first step to a strong segmentation strategy.  The next step is continually monitoring and auditing your network to ensure the architecture is secure and identify gaps in your subnetworks that could be exploited. Monitor your network so you can quickly identify and isolate traffic or security issues. Then conduct regular audits to surface architectural weaknesses. This is especially important as your business evolves and grows; as your business changes, your network architecture may no longer meet your needs. Regular audits can help you assess when and where you need to adjust your network segmentation design for optimal performance and security.
• Make legitimate paths to access easier than illegitimate pathways
  When evaluating and planning your architecture design, pay attention to how you plot access and what paths users will take to connect to your network.
• Combine similar network resources
  Save time and reduce security overhead by combining similar network resources into individual databases. As you review your network, categorize data by type and degree of sensitivity.
• Don’t over-segment
  Gartner notes that one of the most common errors organizations make when segmenting their networks is over-segmenting, or creating too many zones. Having too many segments adds unnecessary complexity and makes it harder to manage your network as a whole.  Keep in mind, you must create policies that define what has access between each pair of zones. So the more zones you create, the more policies you need to manage. “Over segmenting” can quickly expand the scope of your security management, making it costly and inefficient. Think of it this way: While you want to group similar network resources, be careful to “build a fence around the car park, not a fence and gate around every car.”
• Visualize your network
  In order to design effective and secure network architecture, you first need to understand who your users are, what components make up your network, and how all the systems relate to one another. In other words, without a clear picture of your current state, it will be difficult to plan and achieve your desired state.

Proactive Security Best Practices

• Shift the conversation to RISK
  No business is ever 100% secure. You can have the best security technology and processes in place, but there’s always the risk that a new type of attack could hit your company first. Yet, the conversation often focuses on an almost binary view of either being secure or not. This all-or-nothing proposition denies the reality of the situation.
• Define your Mission Critical Assets
  Companies should define their mission critical assets and heighten their security around these items. Additionally, companies should regularly review their security policies for these “Mission Critical Assets”.  Discover if they’re important individuals, systems, access points, or data. While it’s impossible to every step, defining and protecting a company’s Mission Critical Assets should be the top priority for anyone providing cybersecurity
• Secure your environment at different levels
  From human capital to technology assets. From layer 1 – 7 you are accounting for cybersecurity across all levels.  One level many dont take into account is LEADERSHIP. Nexigen focuses the conversation on RISK and calculates recommendations into a correlated financial impact.  This is a much cleaner approach when talking with leadership.  Nexigen recommends aiming for making the WISEST investment with your leadership team.  Its hard to not fear the sticker shock some times but leadership needs confidence in there IT systems.  We work to not undershoot which may miss the mark and leave clients unprepared for potential breaches.

Absolute Visibility Practices

• Achieve complete asset discovery
  The new breed of connected devices operates without being restricted to traditional perimeters. So, organizations need to identify and detect a wide range of assets, including those connected to their networks and those that operate wirelessly.
• Context is key to understanding gaps and risks
  IT and security teams need to understand not only what devices are connected to their environments but also the context of each asset.
• Manage legacy issues
  One of the biggest threats to retaining complete visibility of all corporate assets is retaining legacy software and hardware.
• Deploy monitoring fabrics
  As cyber threats become increasingly sophisticated, it’s crucial to not only monitor and detect potentially malicious activity at one level but across your entire technology ecosystem in an “Integrated” approach.
• Embrace identity and access management
  With employees accessing networks and logging in to applications from new devices and locations, organizations must be able to identify and verify them immediately.
• Automate policy enforcement
  As soon a risk or vulnerability is identified, it’s crucial to address and mitigate it immediately. Relying on people to do this manually is a challenging process that’s liable to human error.