crowmoor.se

I meet with many security departments in my line of work. One thing that has been showing it´s ugly face during the last two years is the reference to ‘The network group’, often spoken with a bit of fear. Anytime that I present Credential Theft Mitigation or Identity Security it is unavoidable that someone reference that ‘network group’ just like they are the deciding force for security. No matter if it´s the CISO, the CIO or any other, apparently the firewall administrator is the king and god when it comes to security.

I have spent some time helping a customer managing this and what we concluded was the following:
-network security seldom solves modern security problems
-network security normally has the privilege of problem definition for security due to history
-network security is normally backed by strong vendors with a large number of three-letter-acronyms to cloud the discussion
-network security points at Cloud act as a reason to keep the resources on-prem.

Did I mention that the pentester got domain admin for the fifth year in a row within a few hours? But that is of course the serverpeople fault.

To be frank, a lot of resources are spent on network security projects that has little to no validity in a modern world. Network security has played it´s role but is now to a large extent obsolete and should be regarded as legacy.

Moving forward, network security should first of all be mandated to use domain user accounts, no network management should be allowed to use local accounts. Second is to use privilege access workstations. There are so many vulnerabilities and flaws built in to the management of networks, despite the number of mechanisms they have, that having dedicated management workstation should be a no-brainer. Third, network security should be second to identity security, or even better, part of the security department.