Professor Avishai Wool, CTO and co-founder of AlgoSec, explains how external connections to partner networks should be managed to maximize security and efficiency
These days, no organization is an island: it needs network connectivity with a range of external parties, including suppliers, business partners, credit card processing companies, market data feed providers, and more. Managing these connections to and from your internal network servers is not only critical to your business; it also impacts on your information security and compliance posture.
Unlike limited, transient connections such as customer access to web portals or VPN access for field teams, permanent connections allow external organizations direct access to and from your internal networked servers, as part of a mutually-beneficial business relationship. But, each connection is also a potential attack vector, and cybercriminals with sufficient motivation and patience can, and will, probe both parties’ networks and their connections to find ways in, no matter how complex the pathway is.
So, how should organizations approach managing an external connection to ensure they are not inadvertently opening holes that could expose your organization to breaches and cyber-attacks, or compliance failures?
First there are contractual obligations. Your external connections will, or at least should, be covered by a contract between your organization and the other party. It governs the commercial, legal, and regulatory aspects of the relationship, as well as the technical aspects, including IP addresses, testing procedures, the geographic location of servers, SLAs and technical contacts. Furthermore, the contract should provide the framework for how any problems should be dealt with, and outline the escalation process.
While a business contract covering the external connection implies a level of trust between organizations, it’s important to remember that someone else is connecting to your network and processes (and vice versa), and that you do not have control over them. There could well be a security issue on the other party’s network that is invisible to you – but when the external connection is established, that issue becomes part of your security and compliance posture.
So while contracts are all well and good, you still need to take steps to protect your organization from the potential security risks that external connections can introduce. Here are the three key issues that organizations should consider when managing the security aspects of a third party connection.
Network segmentation and routing
Network segmentation can minimize the risks from external connections. This means placing the servers needed for the external connection in a demilitarized zone (DMZ), segregating the DMZ from your internal networks using firewalls, and restricting and filtering traffic in both directions using additional controls such as web application firewalls, DLP and IDS or IPS to stop rogue intrusions.
This has several security benefits. First, it filters out malicious content such as malware at multiple points along the connection pathway, reducing the risk of such content getting into either your or the peer’s network. Second, it ensures that should a hacker manage to get through the external connection into your servers, they will be unable to move laterally to other areas of your corporate network, as they will be isolated in the DMZ. Third, it restricts traffic across the connection to only the essential traffic needed for that particular connection, which reduces the processing burden on your security appliances and your overall risk exposure.
Taking care of compliance
It’s also crucial to remember that if the data that is accessed via the external connection is subject to regulatory compliance, then all affected servers on both sides are subject to regulatory compliance requirements and auditing. For example, PCI DSS regulations state that if the connection touches credit card data, then both sides of the connection are in scope. As such, outsourcing the processing and management of regulated data to a partner does not let you off the hook in terms of regulatory compliance. Being aware of this from the outset will enable you to apply appropriate protections to the relevant data traffic, and help you to be compliant and audit-ready at all times.
Maintenance matters
Maintenance of external connectivity covers two types of issues: planned maintenance tasks by your own or the peer’s IT teams, and unplanned outages that were caused by a server or network element failure, or a misconfigured device. These issues are more complicated than internal network maintenance as they require coordination with your peer’s contacts, may involve differentremediation workflows, and need external reviews before a change can be made, in order to comply with the terms of the contract.
To ensure maintenance tasks go smoothly and adhere to contractual or SLA obligations, your IT teams will need to recognize and know that the maintenance activity applies to an external connection. A security management solution can play a key role here, by identifying the applications that have an external connection, and providing access to the contractual and technical information related to the third party connection so that it is on hand when needed. This will help teams quickly understand the guidelines they must follow and subsequently enable them to make the necessary changes more efficiently and without breaching the contract.
A security management solution which includes security policy change management should include a dedicated change workflow for handling changes that involve external connections, including more stringent risk checks, additional review and approval steps, and coordination with the partner peer. Finally, a security policy management system should monitor all the changes made to any of the security devices controlling the external connection, and continuously check whether the security controls are still compliant with pertinent security guidelines, regulatory requirements, and contractual obligations.
In summary, while external connections are key drivers of effective business collaboration, they can introduce security risks to your organization unless you take preventative steps. When planning to set up such connections in your organization, do:
- design and segment your network architecture carefully, to minimize the risks of cyberattacks and lateral exploration by hackers via external connections
- be aware of how the connection with the external party affects your compliance status
- have security policy management systems that provide all the relevant information that IT teams need when considering planned or unplanned changes to your business’ side of external connections, and help them to manage those changes in an automated, streamlined way to ensure that they don’t disrupt the business.
And whatever you do, don’t leave security of these business-critical connections to chance.
[su_box title=”About Avishai Wool” style=”noise” box_color=”#336588″][short_info id=’60697′ desc=”true” all=”false”][/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.