Cyber Assurance at the 'Real' and 'Network' Infrastructure layers
When asked the question "What does Cyber mean to you?" the most common answers will typically be 'Penetration Testing', 'Active Threat Monitoring', 'Preventing DDOS breaches at the SOC monitoring layers'. All being crucial operational higher Cyber Assurance layer stack tenets. Sitting within the Cyber Assurance stack at the bottom are the 'Real' and 'Network' layers. These levels are the bedrock of any successful system design, infrastructure, and quality build standards. Both are fundamental building foundations that assure anything built upon, thereafter is underpinned by governing standards, assurance, providing compliance and integrity of your architecture. Sadly, these often get overlooked, left unsupervised, unmonitored, exposed or fail to be assured to the integrity levels required by the Operating Software and Applications suites undertake annually.
Whilst these 'Real' and 'Network' layers possessed 'Assurance', 'Compliance' and 'Certification' at go-live, time has passed, things have changed, components/cables have been added/removed, upgraded, services migrated to virtual instances, building fabric altered or infrastructure moved to new premises. Most offices are vacant and have been during the Coronavirus pandemic, with infrastructure still whirring away in Office and Networks Rooms, possibly not visited/touched for some time. Physical assets remain your most vulnerable access points, which any attacker could easily target. Maintaining the integrity of these is equally important as your possibly exposed 'ports and sockets'. The following bitesize information asks, are your 'Real' and 'Network' layers built right, audited, assured and compliant with a full Cyber Assurance integrity stack?
Building Information Management (BIM)
A recommended starting point for any new builds or complete CIS overhaul by adhering to future compliance within a Cyber Assurance framework for CIS Infrastructure is adopting the IET endorsed Building Information Modelling (BIM). BIM is transforming the way that architecture, construction, engineering and facilities management (FM) industries combine. This collaborative approach is based on shared information models, which should be maintained across the building or infrastructure's lifecycle. Notwithstanding BIM, you must consider and comply with a myriad of governing standards to ensure Cyber compliance is obtained and maintained throughout the lifecycle.
Auditing with post controls
Post installation work or infrastructure changes, do you inspect and audit your 'Real' and 'Network’ infrastructure layers for Physical, Security, Capacity, Tempest, Electrical, Zoning and compliance purposes? Undertaking regular physical inspections and thorough auditing of your Cabinets, Network Rooms, Buildings, and Campuses post-change management events may expose a plethora of vulnerabilities and threats. This should be undertaken and supported by SMEs guiding and mentoring to audit and, importantly, setting post control mechanisms to rectify and prevent future reoccurrences. Focus on the 6 objectives of Cyber Assurance by means of inspection, auditing, compliance, and assurance should entail:
Availability – Flexibility – Economy – Confidentiality – Integrity – Resilience
Remediation for Compliance
Post audit, the most critical element is your remediation of vulnerabilities and non-compliances, leading to re-obtaining compliance and certification to industry standards/regulations. There are a wide range of overlapping industry and government rules/regulations (British Standards, MOD and Government publications) that must be adhered to for compliance and assurance of your ICT Infrastructure. This can be a costly task, and prevention at the first gate is better than the cure. However, once assurance/certification is re-obtained, the work doesn’t stop there. Employing rigour and discipline to maintain the assured status thereafter is paramount.
Summary
The ‘Real’ and ‘Network’ layers are critically important to police, monitor, audit and remediate. It is vital to examine and address these lower layers of the Cyber assurance stack as you do for the higher end to ensure all remain protected, secured, and government body assured.
https://www.imd-group.co.uk/cyber-assurance-at-the-real-and-network-infrastructure-layers/
About Paul Ceaser, Managing Consultant at IMD Group
Dan Patefield
Dan Patefield
Dan leads the techUK Cyber Security programme, having originally joined techUK in August 2017 as a Programme Manager working across the Cyber and Defence programmes. He is responsible for managing techUK's work across the cyber security eco-system, bringing industry together with key stakeholders across the public and private sectors. Dan also provides the industry secretariat for the Cyber Growth Partnership, the industry and Governmnet conduit for supporting growth across the sector. A key focus of his work is to strengthen the public-private partnership across cyber security to support further development of UK cyber security policy.
Before joining techUK he worked as Forum Lead for the Westminster eForum. In this role he had a focus on the technology and telecoms space, on issues ranging from Broadband and Mobile Infrastructure, the Internet of Things, Cyber Security, Data and diversity in tech. Dan has a BA in History from the University of Liverpool.
- Email:
- [email protected]
- Phone:
- 020 7331 2165
Jill Broom
Jill Broom
Jill is techUK’s Programme Manager for Cyber Security, working across the cyber eco-system to bring industry together with key stakeholders across the public and private sectors.
Prior to focusing in on techUK's cyber security work, Jill was also part of techUK's Central Government programme team, representing the supplier community of technology products and services to Whitehall departments.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
- Email:
- [email protected]
- Twitter:
- @honeybroom
- Website:
- www.techuk.org
- LinkedIn:
- https://www.linkedin.com/in/jill-broom-19aa824
Annie Collings
Annie Collings
Annie joined techUK as the Programme Manager for Cyber Security and Central Government in September 2023.
Prior to joining techUK, Annie worked as an Account Manager at PLMR Healthcomms, a specialist healthcare agency providing public affairs support to a wide range of medical technology clients. Annie also spent time as an Intern in an MPs constituency office and as an Intern at the Association of Independent Professionals and the Self-Employed.
Annie graduated from Nottingham Trent University, where she was an active member of the lacrosse society.
- Email:
- [email protected]
- Twitter:
- anniecollings24
- LinkedIn:
- https://www.linkedin.com/in/annie-collings-270150158/
