A Simple Overview of Logical Security
The most used mechanism in the security perspective is authentication, this is the process of providing you as a user, a way to say who you are. In terms of authentication, there are no strict rules to follow up, but of course, best practices when implementing.
Good authentication methods are hard to fake and steal and also are limited in time. It mostly depends on the enterprise to adopt whatever type of authentication to achieve security in any software component.
Login Security
In Login security we can find hardware and software security, the first one is based on physical security, but, the software-based is known as logical security. The thing is that login passwords are exponentially harder to crack, even less when factors like length, alpha + numeric, and special characters are strongly considered in composition.
Another extra layer is the UEFI/BIOS passwords, this one can let an admin or supervisor access the board setup, and if is not protected you can bypass OS security.
More mechanisms applied in the authentication spectrum will result in better security. A modern approach is the multifactor authentication systems, these evaluate more than one credential resulting in improved security, rather than just a password comparison.
Multifactor includes (besides passwords), any form of biometric ID, or PINs, smart cards, software tokens, or any other physical device.
As an example, smart cards or virtual smart cards contain a TPM (Trusted platform module) which is a chip that is inside the main circuit system. This is widely used as another factor for providing authentication.
At this point, the authentication just tells us, who we are, but, what about what can we do, or access? This is all regulated by the authorization mechanism.
In a few words, once I’m authenticated, what can I do now?
By default, a good methodology for this is that people should have the minimum permissions always, this will lead to limiting both intentional and unintentional harm.
Let’s move on to another logical security perspective, Domain security.
The Domain Security
The domain security is based on local security policies.
This is commonly found in organizations. In other words, this is the regulation for users, computers, groups, and resource usage and deployment (it is related to).
The most common and used software of this nature is the Microsoft Active Directory. This is a completely enormous world, that can provide tools for a safe and secure organizational environment.
In terms of users and authentication, Active Directory provides mechanisms to central manage the authentication and authorization of users and groups, all of them inside a domain ecosystem. Domain users and groups and different from the local users and groups of a PC.
My intention here is not to extend on how Active Directory works. But to set the record straight on how domain security can enhance logical security.
Elements like Organizational Units (OU), OU admin groups, policies, logon scripts, and network policies are part of the mentioned suite, so, settings, appliances, and usage may differ on your practical needs.
This domain of security is very focused on companies who decide to apply this kind of security, and the bad thing is that is very product-driven, so you will need to integrate specialized people into that technology.
The domain security can be also found in different products than AD, there are also Linux-based solutions with notable differences.
Get David E Lares S’s stories in your inbox
Join Medium for free to get updates from this writer.
And finally, the most fun one. Communication security.
The communication Security
This is largely based on keeping the bad guys out by providing access restrictions and encryption. In a few words, we can block unwanted connections and secure legit traffic avoiding eavesdropping.
As with physical security though, we are concerned with “egress” as well.
There are a lot of components that live here, and many of them are required to implement, but I’m going to review the most neuralgic ones.
Firewalls
Let’s start with the Firewall and the must-have for achieving general logical security
Firewalls must be bidirectional, here the inbound and outbound rules need to be very clear even tho there are custom ones. The same thing applies to firewall profiles. You can shape the firewall to your expected traffic, set up everything with their proper exceptions
If the firewall lives inside a domain, then proper group policy control should be present too.
Depending on the nature of your server, port security is a big plus in terms of security, with this you can shield up the direct communication endpoints. Let’s say that your server is up for TCP communications, but the thing is that TCP uses ports as well as addresses, you can specify rules for specific types of TCP/IP traffic, maybe for web, emails, FTP, DNS, and so on. Doing this effort can significantly reduce the attack surface.
MAC (Media Access Control) filtering
If you are not familiar with the MAC address, each network interface has a unique address. This address can be used to perform filtering. You can allow access or block routers, DHCP services, PCs, and many more components.
Antivirus/Antimalware
This is based on the reputation databases which can protect you against dangerous sites.
Email Filtering
You can refer to the inbound analysis of the email traffic and evaluate servers, addresses, content, and more. Depending on the combination of elements you can easily determine if that email is legit or not.
I’m not pretty sure but many of the email clients have internal mechanisms for email malware filtering and spam.
The best advice here is to download from trusted sources/sites only.
And so on.
Like I wrote you above. There’s a lot more. We can include IPSec for encryption remotely or locally. Also mention HTTPS, SSL, and TLS protocols for bidirectional encrypted communication websites, VPNs, etc.
Logical security can be also prevented for data loss prevention and whatever type of human error.
That’s it for this post. Make sure to put into practice everything you read from here. And remember, security is not only the famous login/password combination.
Happy securing :)
