How do you ensure network security architecture is best practice?

Most people miss this however in your strategy 1. Clearly demarc your network boundaries, know your perimeter, data exchange points, file transfer points well. Know which devices are protecting you from external threats. These devices are watchdogs so need special attention . 2. Build your data flow analysis. To do this, identify all business processes and identify data flow paths. Once you have that clarity, its easier to add those controls at vulnerable areas. 3. Know OSI layer, identify potential threats at each layer and build relevant controls. 4. Know your partners, API flows, third parties exchanging data - Ensure your network has the right segmentation planned to contain any potential threat. 5. Don't ignore DDoS, its real

In my experience below would be the starting point when doing network security architecture design - **Assessment and Gap Analysis:** -Inventory**: Catalog all devices, software, and data that are connected to or pass through your network. - Threat Modeling**: Identify potential threats and vulnerabilities based on your specific industry, business operations, and infrastructure. - Gap Analysis**: Compare your current security posture to industry best practices or standards such as NIST, CIS, or ISO 27001 to identify areas of improvement.

Just a quick note, certain industries will have to comply with regulations that require to do assessments. However, it's always a good idea to choose a framework to follow to use as a baseline.

Every industry in today's information security scenario should adapt to frameworks based on the needs and tailor those accordingly. However it's always important to understand that revisiting the security controls, aasesment, operational governance is if utmost important too. Revisit the controls, understand the market trends, enhance or change the security policies according to the market needs and be secure.Also remember over securing is also a blocker. So strategize accordingly.

My go-to strategy usually involves adopting the NIST guidelines as a foundational step. The comprehensiveness of NIST serves as an excellent starting point to gauge where the organization stands in terms of security. Once the initial assessment using NIST is done, I transition to more stringent or specific frameworks based on the unique needs of the organization. This approach ensures that while we are grounded in universally recognized best practices, there's also flexibility to tailor security measures that align perfectly with the organization's objectives, industry specifics, and regulatory demands.

Security by definition is always layered but tailor it to minimize the impact, we shouldn't over do any thing, moreover we may have good tools but if those are not maintained and managed properly or configured properly, you have a risk. Have it properly architected, revamp, revisit and enhance.

Security is layered. There is no 1 plug and play solution. Having said that, it's important to have controls that cover your risk. Keep in mind, not everything is going to be controlled by having a tool. Example, you can have a firewall, but if it isn't configured properly, you still have a gap.

Test your patches as well. Don't break things. I wouldn't put everything on automatic updates. We want security but not to kill productivity. Security shouldn't compromise the workflow (to a certain extent). Keep that in mind.

You can have all bells and whistles, however at the end of the day, it's the user who clicks. We often do awareness training events. This is where we show a presentation on security and trends. It's highly important to keep your employees in the know.

Often times people underestimate the importance of end user education. Phishing remains the most common cyber attack, with approximately 3.4 billion daily spam emails. The global average data breach cost was $4.35 million in 2022. You can set all of the possible security controls in place, but no configuration is full-proof. If and when something slips through your defenses the difference between a close call and an incident comes down to the education and decision making of your users.

Information security training should be on the top priority of any work within the organization. Firstly it's important to understand that we should have the right skills for this role and then train them and train the end users.They are the key, they can either make or break the system. It should be prioritised, don't neglect it if you want your org to be secure.

The basic vulnerability scanning should be done periodically. Have a procedure to fix major issues and put other things on the roadmap. I find it useful to write down who is responsible for each control. This helps organize a to-do list to follow through.