Strengthen IT: Layered Security & Physical Layer Defense Pt. I

Strengthening the Physical Layer

In the 1930s, France constructed an extensive defensive fortification known as the Maginot Line, intending to thwart potential invasions. The strategy was straightforward: identify all potential attack routes, heavily fortify these areas with manpower and defensive structures, and thus, prevent any incursions. However, this approach failed to consider the possibility of unforeseen attack methods. This historical example is surprisingly relevant to contemporary IT security. Many businesses today rely solely on antivirus software as their primary line of defense, akin to the Maginot Line. Yet, the digital landscape is riddled with threats that can bypass antivirus protections. Cybercriminals are continuously developing new viruses at a staggering rate – approximately 100,000 new types each day. Often, these viruses are rigorously tested against all available antivirus platforms before their release into the wild. Even the most advanced antivirus solution, capable of identifying and neutralizing every threat, would still be insufficient. Numerous attack vectors exist that completely bypass antivirus software. For instance, an attacker might trick an employee into clicking a malicious link or exploit weak passwords, rendering antivirus efforts futile. There are multiple layers of potential vulnerabilities in a network: physical, human, network, and mobile. A robust defense strategy requires prompt detection and response to breaches at each of these levels. Focusing on the physical layer, which encompasses all the devices within an office, it’s the easiest to secure but often overlooked. Consider these points:

• Last year, 60% of businesses in California reported smartphone thefts, and 43% lost tablets containing sensitive data.
• High-profile security breaches, like those involving Chelsea Manning and Edward Snowden, happened due to access to sensitive information on devices.
• Comptia conducted an experiment by leaving 200 USB devices in public places to see if people would use them on their work or personal computers. 17% of people did just that.

To secure the physical layer, businesses should:

1. Always supervise or securely store computers and devices.
2. Restrict device usage to authorized personnel only.
3. Avoid using unfamiliar USB devices.
4. Properly destroy old hard drives before disposal.

In the next installment, Part II, we’ll delve into the human and network layers of security.