Security Best Practices in Network Environments

Security is always an important subject, and it is fundamental nowadays so that companies and individuals can protect their data and systems against threats. Network security, known as NetSec, has the primary objective of ensuring the integrity, reliability, and availability of digital services and infrastructures. To build a secure and efficient network environment, it is necessary to adopt best practices when developing your security.

What are Best Practices?

This term, “best practices,” may seem a bit overused and even somewhat generic to some people. With that in mind, it is important to properly define what these so-called best practices are. Within a cybersecurity context, “best practices” means that we have a set of established actions and standards aimed at understanding a specific task in order to perform that task in the best possible way — that is, efficiently, effectively, and, above all, securely.

Use Strong Passwords and MFA

Data security does not depend exclusively on a company’s security team; it also depends on us, common users and employees. Thinking about this, the first step to maintaining a secure network environment is to use strong and complex passwords, both on the user side and on the infrastructure side. For curiosity’s sake, I brought research from Hive Systems, which shows that using a simple brute-force attack, a ‘hacker’ would take only 22 hours to discover your password if you used an 8-character password, mixing only uppercase and lowercase letters. Depending on your password policy, it is relatively easy to break them.

Having a compromised password can mean giving the attacker the key to your house’s front door. That is why using complex and non-obvious passwords is so important. To avoid this, it is essential to adopt complex passwords with a combination of uppercase and lowercase characters, numbers, and special characters, in addition to using password managers. Additionally, multi-factor authentication (MFA) must be implemented whenever possible to reduce the risk of unauthorized access.

Implementation of Secure Corporate VPN

After the events of the COVID-19 pandemic, the “new normal” brought with it the home office — a common practice today, but one that requires some care, as employees take part of the corporate infrastructure home and use this same infrastructure from the comfort of their houses. To have a secure connection between the employee’s laptop and the company’s internal infrastructure, it is essential to have a good Corporate VPN service. The VPN will guarantee the use of strong encryption, secure protocols, and robust authentication, preventing the viewing of corporate data in the transit of information between the employee, the internet, and company servers.

Network Segregation and Microsegmentation

Network segmentation minimizes risks by isolating critical systems from less secure devices. This prevents the lateral movement of threats in case of a segment compromise. Microsegmentation, in particular, adds an extra layer of security, ensuring that each service has specific access rules. Imagine that, by not having your networks segregated, it would be possible for information to cross paths: departments that create, handle, and deal with important and confidential documents, which cannot be viewed or accessed by other areas, would be completely accessible. Thinking for a moment, it is possible to understand that this would already violate the pillars of information security. Furthermore, in the event of a potential attack where the attacker manages to establish themselves within the network, they would have total and complete access to everything inside the network, being able to sneak around wherever they wanted, causing whatever damage they wanted. Therefore, segregate your network.

Firewall

It is also part of best practices to have a good next-generation firewall delimiting the perimeter of your network, both internally and externally. Firewalls are the security tools that will analyze the packets entering and leaving the network and will allow the communication, or not, all of this using a ‘rulebase.’ With this in mind, it is crucial to maintain a solid and functional security, creation, and management policy for these firewall rules.

DMZ

Another point worth mentioning is deploying a DMZ in the environment. The DMZ serves as an extra security layer. It is where services that can be accessed from the internet but cannot be accessed from the internal network are usually hosted, isolating services exposed to the internet from the rest of the corporate infrastructure, reducing the risk of compromising the internal network. It is a great alternative considering that the DMZ minimizes the attack surface in the event of a potential intrusion. Services such as web servers, DNS, and email should be kept in the DMZ to minimize risks.

Honeypot and Threat Intelligence

Taking advantage of the DMZ, it is fair that we also mention ‘honeypots,’ a kind of “decoy” environment that was created and thought of precisely for the purpose of attracting potential attacks, making the attacker think it is a fragile and vulnerable environment, easily exploitable. The great “ace in the hole” of honeypots is promoting ease when detecting attacks, having an environment in which we can perform research and threat analysis (including as they occur), and even diverting attacks from the real infrastructure, almost like a “reverse backup.” Coupled with this, the use of Threat Intelligence helps identify malicious patterns and anticipate attacks.

Honorable Mentions

In terms of honorable mentions, we cannot leave out some measures: monitoring and the maintenance of system logs, proxy, and updates. The collection and analysis of logs are fundamental for detecting suspicious activities and responding quickly to security incidents. SIEM (Security Information and Event Management) tools assist in monitoring and correlating events, allowing for broad visibility over potential threats. Observability tools go beyond simple monitoring. They offer an in-depth view of the health of your systems, correlating metrics, logs, and traces to provide actionable insights. In a dynamic environment, identifying and understanding anomalies proactively is essential to anticipate failures. Proxies add a layer of security by controlling and monitoring internet traffic, preventing users from accessing malicious content and masking sensitive information. The use of SSL/TLS Inspection technology is also fundamental to inspect encrypted traffic and identify threats. Keeping operating systems, applications, and firmware updated is essential to mitigate vulnerabilities exploited by attackers. The use of automated patch management helps ensure that all critical updates are applied in a timely manner.

Network security must be approached strategically and integrated, taking into account technologies, processes, and human behavior. As the saying goes: “A chain is only as strong as its weakest link.” Therefore, investing in network security is ensuring the protection of assets and business continuity. Implementing best practices and maintaining a security culture are fundamental steps to mitigate risks and strengthen corporate infrastructure.