[MUSIC] Let's look at the idea of defense in depth then. Defense in depth is a move away from the historic position when we first started to connect our networks together we had the idea of maintaining a strong perimeter. And conceptually this is very similar to the perimeter of a medieval castle. Just think about a medieval castle. One big wall around the outside protecting what's on the inside. And right up until about 2000 the year 2000 that was a very common model that we saw. Is that an appropriate model? Yeah, absolutely not. And we can almost instinctively understand why. Is everybody inside our network trusted? And if they are trusted, how trustworthy are they? Is there any possibility of an insider threat? What if somebody breaches the perimeter? Should they have access to everything? Or should we try to create security zones, different layers of protection? And this layering of protections is what we're talking about with defense in depth. So around 2005 this became something that was popularized. And defense in depth looks at layering different controls but also different types of control to protect our assets. And one of the important benefits that defense in depth recognized was the idea of training as a control. Now in the last chapter we looked at the definition of a zero day threat. Our technology may not be able to detect zero day threats. A human being might be able to. It's not a guarantee, but a user typically is the entry point for malicious software, something like ransomware. And if that user is a point of weakness of vulnerability, we may have a problem. If we can improve that situation and get them towards being a strength, they might report things for us. Help us combat zero day threats as one example. So training becomes really important. How can we expect people to behave according to our policies and procedures unless we train them? So at the heart, what we're protecting is our assets. And here we have a model that looks a little bit more like an onion than a medieval castle. We have lots of layers of controls. We see administrative controls and these are the three control types that we talked about at the start of the chapter. Administrative control is telling people what to do. Very hard to manage people's behavior and complain about them not doing what they should if we haven't documented what good looks like, what they should be doing. And these are our policies, procedures, standards, guidelines and so on. We have logical also known as technical controls, things like antivirus, firewalls, all of these are examples of logical or technical controls. And then we have physical controls. Physical controls typically are controlling access to something, some sort of gap in a perimeter, a physical perimeter, a locked cupboard, a filing cabinet with a lock, a wall, a fence. All examples of some kind of physical control. And by using different types of physical logical and administrative controls, we layer all of these different control types, we gain strength. If we had just key based locks protecting our buildings, any lock picker could break into our building. If we have some key based locks, some swipe locks, some fingerprint, biometric based locks. All of those different control types are complementing now an attacker doesn't just need the skill set of a lock picker, they need all these different skills as well. If we combine that with administrative controls, reminding people to secure areas to report suspicious activity, visitors without ID badges and so on. All of this improves our security posture. We're relying on no single control, we're relying on this combination this layering of controls. Rings of protection. When we do give our users those people that were trusting access to systems and services once they authenticated should they have access to everything? Absolutely not, we should minimize access to what is needed. As little as is needed but no less. This is about ensuring that users and processes have the lowest level of authority needed to accomplish a function, their role usually. And what we want is a granular set of permissions based on the role, something simple. At least conceptually in practice this is very hard to manage effectively and a lot of organizations struggle. This is because there are so many different people with so many different requirements and those requirements are usually fairly fluid, fairly dynamic. So this is the idea of least privilege then it's an abstract concept but it is one that we can apply. Just think about your organization, your business, your university, your home, do you operate in line with this? Most organizations struggle to manage this perfectly. They're on a continuum. It's not they do not or they do it's that they try to do and that there are some gaps. I want some. And just as an example I once visited a call center and it was a an I. T. Help desk and they had 24 users on this help desk and each one of them was given two main administrator rights to computer systems that complete access to everything. And when I asked why the help desk manager said well because they need lots of different functions for example the ability to reset printers. Now we can be more granular than that. It's not super administrator or normal user. Most systems allow for gradual assignment of permissions. In the Microsoft world there is a print administrator capability that lets you reset those print jobs you don't need all of the permissions it's not all or nothing. Usually you can build these privileges up in a granular way. The same is true on all other operating systems. And in many lines of business applications as well linked to the concept of least privilege privilege is the ability to do something, we have the idea of knowledge so need to know is about knowledge rather than capability, privilege to do something. So conceptually it is linked to least privilege but it is different. What we're saying now is that you have to have a requirement to know something before we will share it with you again. Just think about your your place of study or work. You have to have access to everything on the shared drive. Probably not. There are probably folders or shares that you can't access has been restricted and this is because there is not a need to know. Usually you're not given that outright because you do not have a need to know. One way we can accomplish need to know is by using and developing out the use of classification levels. Our subjects are users have a clearance level. Our assets are information assets for example, a file has a classification level. We assign a classification level and they're in the bullet point bullet list, we see an example classification level. This is just a sample one what an organization has will vary and should be according should be varied according to its need in this classification system. We have public things which are already in the public domain restricted things which should not be shed in the public domain secret, high level of security, top secret even higher. Again. Now, if we had, let's just give an example, if we had a general in the military with top secret clearance and the general was working on one of three projects, there were three projects in in their building and the general wanted to access all three projects, Project A PROJECT B and project See if the general was working on project A. The general would have a need to know the general's clearances. Top secret project is classification is top secret, we have a match, there is a need to know and the classification is correct if the general was not working on Projects B and C. Even though that the generals clearance is top secret and Projects B and PROJECT C have a classification of top secret because there is no direct need. Ordinarily we would not provide access to the general, even though the general's clearance is sufficient, there is no need to know that information. Therefore we would not provide it so need to know relates to knowledge. The classification system usually provides access to everything unless we implement the concept of need to know the general just with the clearance and classification level would have access to all three projects. What we're trying to do is use this idea of need to know to break that classification level up into groups of knowledge, groups of interest
