Physical Layer - Easiest or Hardest to Defend?

Most of us who go to an office every day have gotten used to having to wear our ID badges and using them to access buildings, specific facilities, and sometimes even as part of the login process. Securing the physical facility is the most direct, and often the most obvious way of protecting the physical layer. But challenges abound, especially due to our problems in the meatspace layer (as we discussed in this post.) How many people in your office will challenge someone who may be wandering around without a badge? How well protected is your network closet, even from employees? 

http://cyberunited.com/2013/10/08/the-human-risk-factor-proactively-managing-the-insider-threat/

Some other questions to consider:

• Do you regularly check for rogue wireless access points?
• Can your employees identify when they might be subject to a keystroke logger?
• Is everyone required to use an anti-virus application to connect to the network?
• What's your policy on removable media (CD's, thumb drives, etc?)
• How often do you audit your username and password databases?

Defense in Depth

When creating your strategy for securing information on your systems and in your network, always remember to plan for a layered security approach. A useful tool for identifying different layers of security is the OSI network model, displayed using the infographic below.

http://securityblog.s21sec.com/2009/06/attacks-on-layer-two-of-osi-model-i.html

While the OSI model only includes seven layers, there is one missing. Layer 8, which may be the most difficult to secure, is often referred to as the "Political Layer" or, to use a more recent term "Meatspace." Each layer in the model has unique challenges and tools for security, and each type of attack has some well known examples of successful break-in. In future blog posts, we'll discuss some of the attacks directed at specific layers, and some of the tools and techniques for combating those attacks.