I have recently started to focus more on security. Some people might say it was inevitable, with my first long-term job being with Securitas in Sweden, working as a Flygplatskontrollant (airport security screener), Ordningsvakt (public order officer), and Skyddsvakt (armed protective security guard). So security should be right up my alley, right?
Not really. I have always felt that cybersecurity has been a bit too abstract for my taste compared to physical security. But lately I have started thinking about it more from the strategic point of view than from the technical point of view. The experiences I've had with this blog of different issues (The Day My Logging System Became My Security System) and different server configurations (The Redirect That Confused LinkedIn and My Bot Detection Broke My SEO) have definitely had an impact on this change in perception.
I Was Starting From the Wrong End
I think my main shift was realising that I was starting from the wrong end. As with most other technical topics, I started by looking at the application and implementation. With security, it becomes extremely abstract if you go in with the thought process of, "I need to learn all the alternatives and how they work."
When I did that, I lost the important thing: the concepts.
After implementing several surprisingly simple fixes, I realised that when looking at security within the sphere of information, I had to start with the concepts. And even if the concepts are many, and all the different certificates and providers form a maze, I then took a further step back and had an epiphany.
This is just like my old security experiences, but with different names.
Just as in the world of physical security, there are layers, and each layer has different components within it. Instead of thinking, "I need to defend my data," I replaced the word data with daily sales cash. So I started mapping it from there instead, using terminology I was familiar with.
Making Cybersecurity Physical
In my head, I did a mapping between what I already knew and what I needed on my server.
1. Asset Protection
This can be things like walls, fences, and armoured cars. It also includes things like safes and vaults. The point is not necessarily to make the object impossible to steal, but to make moving or accessing it sufficiently difficult. These things are there to make it more difficult to move the item to somewhere other than where the owner wants it.
Does this really have a virtual counterpart? Apart from classical physical security, such as making sure there are locks on the doors to the server room - yes!
I view this very much as encryption at rest. Encryption is a bit like a safe. A big, heavy thing that makes what you want to protect harder to move. Not because you cannot move a safe, but because you will need to spend a long time grinding through the safe to get to what is inside.
So encryption is like the armoured sides of a safe.
2. Access Control
Now we are starting to look at things that can very much be translated into computer-based security. In the real world, these are things such as locks, street bollards, fences, and guards.
These are the things that make it hard to get through your asset protection. Access control is not just forcing someone to log in to a system. Access control is controlling the flow to where we want it and making it harder to gain access to places we do not want someone to have access to.
What would this be in the virtual world? Easy!
- A firewall is like a fence or a bollard, making sure there is only physical access where we want physical access and preventing someone from just driving a car straight through the window.
- Encryption keys are the physical lock on the safe. Without one, it will take a lot more effort and time to get in.
- Login systems are a security guard checking your ID before you are let in.
3. Detection and Monitoring
Here we have, in the physical world, things like alarms, CCTV systems, removing hiding places by having good lighting, and similar measures.
This is also very easy to mentally map to the virtual world. We have log files, monitoring file sizes, email alerts when something unexpected happens. There are tons of different ways to detect changes and monitor your system, both proprietary and self-made.
From Products to Purpose
The mistake I made previously with this was that I focused too much on brand names rather than what they do. Is there a difference between Linux's UFW and a Windows software firewall? Of course!
But instead of looking at the detailed capabilities of the different brands, look at:
- Can you use it?
- Is it worth the cost?
- Is it proportional?
Can you use it?
If you are using Linux, it's not worth the time to compare Brand Name Firewall software with UFW if you cannot use one of them on Linux. You simply only have one of them available to you.
Do you need to learn all the details of how every option works? No!
You just need to understand the thing that locks down everything apart from the door you want to have open. There are plenty of bells and whistles on almost all the options, but will you need to use them all? Probably not.
Learn incrementally based on what you need, and don't overengineer things that you will not need. Why build a reinforced concrete bunker with patrolling armed guards when all you need is a picket fence?
Is it worth the cost?
For my blog, which doesn't really contain any super-secret data, I don't lose any money from it being down. Should I start spending hundreds of hours finding all the edge cases? Should I spend thousands of pounds on security solutions?
Not really. It would cost me more than what it is worth protecting. Here I want to point out that cost is not just monetary. Cost includes working hours, effort spent, load times, price, and anything else the solution demands from you or the system.
The worst case I have had so far was my logging system filling up my storage, and I needed to spend some time cleaning it up and making sure nothing had been planted. It cost me about six or seven hours to solve, but that was it. To me that is a low cost.
Should I have seen that this would happen? Probably. But I would have needed to spend a lot more time thinking about it. I lived and learned. Next time, I know to take this into account.
Is it proportional?
This is similar to the cost evaluation. In security, we have something called the proportionality principle.
If someone cusses you out, would it be proportional to tackle them to the ground and break their ribs? Not really.
The same applies in IT security. If someone is probing an endpoint that you do not even have available, is it worth locking down the entire system? I would argue it's not, because just as with the cursing, sure, it can be annoying, but it shouldn't really have any impact, and people stop cursing at you if they don't get a reaction.
Seeing the Forest Again
I had focused on learning every single detail of every single preventive measure I could think of. This made security extremely complicated and complex. But it is a case of, "I couldn't see the forest for all the trees." I was trying to remember every single branch in the forest when all I needed to learn was how not to walk straight into a tree.