Cyber Assurance at the 'Real' and 'Network' Infrastructure layers
When asked the question "What does Cyber mean to you?" the most common answers will typically be 'Penetration Testing', 'Active Threat Monitoring', 'Preventing DDOS breaches at the SOC monitoring layers'. All being crucial operational higher Cyber Assurance layer stack tenets. Sitting within the Cyber Assurance stack at the bottom are the 'Real' and 'Network' layers. These levels are the bedrock of any successful system design, infrastructure, and quality build standards. Both are fundamental building foundations that assure anything built upon, thereafter is underpinned by governing standards, assurance, providing compliance and integrity of your architecture. Sadly, these often get overlooked, left unsupervised, unmonitored, exposed or fail to be assured to the integrity levels required by the Operating Software and Applications suites undertake annually.
Whilst these 'Real' and 'Network' layers possessed 'Assurance', 'Compliance' and 'Certification' at go-live, time has passed, things have changed, components/cables have been added/removed, upgraded, services migrated to virtual instances, building fabric altered or infrastructure moved to new premises. Most offices are vacant and have been during the Coronavirus pandemic, with infrastructure still whirring away in Office and Networks Rooms, possibly not visited/touched for some time. Physical assets remain your most vulnerable access points, which any attacker could easily target. Maintaining the integrity of these is equally important as your possibly exposed 'ports and sockets'. The following bitesize information asks, are your 'Real' and 'Network' layers built right, audited, assured and compliant with a full Cyber Assurance integrity stack?
Building Information Management (BIM)
A recommended starting point for any new builds or complete CIS overhaul by adhering to future compliance within a Cyber Assurance framework for CIS Infrastructure is adopting the IET endorsed Building Information Modelling (BIM). BIM is transforming the way that architecture, construction, engineering and facilities management (FM) industries combine. This collaborative approach is based on shared information models, which should be maintained across the building or infrastructure's lifecycle. Notwithstanding BIM, you must consider and comply with a myriad of governing standards to ensure Cyber compliance is obtained and maintained throughout the lifecycle.
Auditing with post controls
Post installation work or infrastructure changes, do you inspect and audit your 'Real' and 'Network’ infrastructure layers for Physical, Security, Capacity, Tempest, Electrical, Zoning and compliance purposes? Undertaking regular physical inspections and thorough auditing of your Cabinets, Network Rooms, Buildings, and Campuses post-change management events may expose a plethora of vulnerabilities and threats. This should be undertaken and supported by SMEs guiding and mentoring to audit and, importantly, setting post control mechanisms to rectify and prevent future reoccurrences. Focus on the 6 objectives of Cyber Assurance by means of inspection, auditing, compliance, and assurance should entail:
Availability – Flexibility – Economy – Confidentiality – Integrity – Resilience
Remediation for Compliance
Post audit, the most critical element is your remediation of vulnerabilities and non-compliances, leading to re-obtaining compliance and certification to industry standards/regulations. There are a wide range of overlapping industry and government rules/regulations (British Standards, MOD and Government publications) that must be adhered to for compliance and assurance of your ICT Infrastructure. This can be a costly task, and prevention at the first gate is better than the cure. However, once assurance/certification is re-obtained, the work doesn’t stop there. Employing rigour and discipline to maintain the assured status thereafter is paramount.
The ‘Real’ and ‘Network’ layers are critically important to police, monitor, audit and remediate. It is vital to examine and address these lower layers of the Cyber assurance stack as you do for the higher end to ensure all remain protected, secured, and government body assured.