Core security principles—network segmentation, AAA, least privilege, role-based access control, separation of duties, monitoring, backups, encryption, patching, and equipment hardening—form the foundation of a defensible IT environment.
Basic Security Principles
So, here I have a blueprint of an office. In many offices, we have lots of different rooms, and in some buildings, in some businesses, they'll have access control to each one of those rooms, or many of those rooms, depending on what's inside of it. As an example, let's say this is our network room and we don't want everybody to have access to that room. So we only give keys to those individuals that need access to the network room. Perhaps we have a records room. Maybe this room right here is a place that they keep different records in, and we don't want everyone to have access to things like maybe old employee records, so only certain people have a key to get into that room. Maybe this room right here is the CEO's office, and so it has a special key to get inside of it. What this office building has done is it has segmented different rooms in it and has given different access to each one of those rooms.
Similarly, we want to do the same thing with our network resources. So here I have administration, I've got operations, I've got sales. These are the different departments within this business, and each one has its own set of compute power here. So we've got some laptops and desktops associated with it. We also have a specific switch that's associated with the administration network. It has its own network that's tied to it and it's got its own resources that are tied to it: its own set of documents, its own set of access keys, its own set of databases, its own set of servers. So it is all associated with this administration group, and those who are administrators then get access to these resources.
Same thing with operations. We segment out operations and they have their own section, their own data that they deal with, their own documents that they deal with, their own switch and hardware that they have. And the same thing with sales. So we can see that we've segmented this out so that sales can't get access to administration's resources and operations can't get to administration's resources. They're able to segment the traffic out and make sure that we can have more security involved in this.
When we segment out resources, then we can give certain people access to certain things. Part of that is AAA. AAA is the idea that you use authentication, authorization and accounting in order to control the access that people have to certain resources.
Authentication is identifying a specific person. So I have a way of identifying who I am. That's authentication: who I am, identity, establishing an identity. Then you have authorization. What do I have access to? What am I authorized to access? Maybe I'm part of sales, and so now I have access to the sales resources. And then there's accounting. Accounting is a way to log the information of what I have accessed, and there's a certain amount of accountability with that. So if something goes missing, if something gets altered, if something gets exposed, then they can go back and look at accounting for accountability purposes. So this is AAA: authentication, authorization, and accounting.
Then you have this idea of least privilege. Least privilege is the idea that we don't want to open up any security holes if we don't have to. We minimize the impact that a security issue might have.
An example of this is, let's say Suketu, Sonia and Neil are all part of the administration staff. They have access to some of the administration resources, but rather than just give them access to everything, we are going to give them access to just what they need, the least amount of what they need to do their job. So maybe Suketu needs to have access to business ideas. Maybe Sonia needs to have access to finance and partners. And maybe Neil needs to have access to taxes and finance. So they have different access levels, and we change this to meet the minimum amount of what they need to do their job.
Where this really helps out is that Neil then can't go into folders and disrupt folders that he's not supposed to be in or not supposed to be manipulating or changing. So there's more security from that perspective. Or maybe even Neil's account gets compromised. Maybe Neil is completely trustworthy, but Neil's account gets compromised, and now if he had access to everything, everything would be exposed. But if he just had access to finance and taxes, then only those two items are exposed.
The other scenario that comes into play is that maybe Neil is very trustworthy and so we want to give him access to everything, but then he leaves and somebody else replaces him, or he leaves for a while and somebody steps into his role, and perhaps that position or that new person is not quite as trustworthy. So that's another reason to use least privilege: give the least amount of privilege to somebody that you possibly can.
Then there's also this idea of role-based access control, or RBAC. The idea behind this is that you don't assign people to individual resources. Instead, you assign them to a role, and then that role gets assigned to a resource.
For instance, we say the CEO needs to have access to the business ideas and finance and partners and taxes. Maybe those are the things that the CEO needs access to. Once again, it makes sense, well, the CEO should have access to everything. Well, not necessarily. Once again, if his account got compromised, then everything would be compromised. So maybe we just give him access to those things he needs access to. In our example here, Suketu is the CEO. So we assign the role of CEO to Suketu, and then he now can have access to those resources. Same thing, accounting probably needs access to taxes, finances. So accounting has access to those, and Sonia has access to accounting, or she's part of the accounting group, so she has access to those. And same thing, Neil has data entry, and maybe data entry is for something tax related, and so Neil just now has access to taxes through this data entry. So if Neil goes away for some reason and he is no longer there, whoever replaces him now just needs to be added to this role.
There are several reasons why this is an advantage. Number one is, like I just mentioned, let's say Neil leaves, then we can easily replace him because we already have the groups all set up to have access to what they need access to. Another example is we could add another person to this and we give them access to the data entry, and now they immediately can do their job without us figuring out what does Neil have access to and having to go to every single folder to grant that person access to that. So it makes it really easy to add more people. Or perhaps Neil is changing positions and is becoming an accountant now and so needs access to more. Well, all we have to do is change the group membership.
Also, you might have some cross functionality. So maybe the ERC committee, the employee committee, has both Neil and Sonia as part of that group, and it has access to different resources, and people are maybe constantly going in and out of this ERC group. So now very quickly we can add and drop people out of those groups. And then the last thing I'll mention is it also allows us to do audits for these different positions much easier, to see who has access to what.
Next up we have separation of duties. The idea behind this is that no one person is in charge of a whole process to the point where they could leverage that process for their own personal gain.
So let me give you an example. Maybe I'm part of a company and I have the whole purchasing process underneath myself. What I can do is I can say, well, I'm going to set up a fake company. I'll have a fake product. I'm going to cut a PO for that product. I am the one who approves that purchase, and then I'm the one who also cuts the check. So no one else is within this loop. I have set up this fake company, I set up this fake purchase order, and I'm getting a check for it, and really what I'm doing is I'm embezzling from the company.
So what I need to do is I need to make sure within this process that somebody else does the approval step and then somebody else does the writing the check step. That way that has multiple checks and balances. Somebody from the approver step can say, well, what is it? Why are we buying this? What is this for? Somebody from the check writing can take a look and say, oh, we've never wrote a check to this company before. Why are we writing a check to the company now? So it makes sure that no one process is in one person's hands where they could leverage the system.
Another example of that would be if they are leveraging their position to get control over a system. Let's say somebody needs access. They send in the request and the request gets approved by a supervisor or a manager, and then they implement the change. If this was all owned by one person, they could make any changes they wanted to and get into the system and create accounts that they shouldn't be creating within that system. So by creating a ticketing system that has the request go into it, and then a supervisor or maybe a resource owner has to approve of this, so a resource owner approves of it and then an admin or a resource admin is the one that actually implements the change, that would be another process where you could implement different duties within there to separate it out so not one person has control over that system.
Another thing that you're really going to want is good monitoring. A good monitor will monitor things like uptime and performance to make sure and notify you when things go down, or if performance is failing, if it's not going as well. But another thing that you'll want on your network is also good malware detection: software that's installed on your servers and on your machines to make sure that nothing is getting installed on your network that is compromising your network.
Another thing that can monitor other resources is called a security information and event management system. A SIEM is really valuable on your network, and what it does is it can monitor configurations and files, and it can see what changes on your network are happening and who is making those changes. It starts looking for patterns that are inconsistent or would be signs that something is getting compromised. So this SIEM can be a really valuable software to make sure you identify if a system is compromised, and make sure you identify it early so you can mitigate it right away. So these are some monitoring tools that you'll want to have set up and going on your network.
Another necessary is backup. You must have good backups. A couple of things to think about when you're thinking about backups is the frequency of those backups. How frequently are you backing that up? The type, whether it's a full, differential, or incremental. What type of backups do you need to back up? Also, where are these located at? Where are you going to store your backups? And is it in a secure environment? Are you encrypting your backup? Do you have a copy of the key so you can unencrypt it if you ever need it? Have you tested it? Because there are so many times when people have a backup going that they assume is good, but when they go to restore it, it is not a good form of backup. And so that can be problematic as well.
There's a lot that goes into backup. I'm not going to get too in depth into it, but those are some things that you need to think of when you're coming up with a backup solution.
Part of a good security program is also to make sure you have good encryption. Encryption takes the information that you have and encrypts it in a way that people can't really go back and read it unless you have the key to open it up and read it. So encryption allows you to be able to hide the information in plain sight, essentially. But you have to have the keys in order to open it up and view it and look at it.
There are two types of encryption that you need to make sure that you have on your networks. First of all, what's considered at rest, and that is that just in your storage on your networks, you should have all the important data encrypted, all the sensitive data encrypted. But the other way is during transit, when it is moving from one location to another. That is called in transit, and you need to make sure that's encrypted as well. So make sure your data is encrypted in transit and at rest.
To have a secure network, one thing you're going to have to do is equipment hardening. Your equipment comes ready to use for the most part. So when you plug it in in just its default state, it's going to have some security concerns, some security risks.
Let me give you an example of this. Let's say I spin up a new switch on my network, and if I were to plug in my ports and everything was turned off, all the ports were turned off, and it wasn't configured all ready to go, I would, if I didn't know any better, say this is a broken switch and send it back to the company. So the company has to send you a switch with a certain amount of functionality so that when you plug it in it just starts working, and it is not the most secure way of doing this. Same thing when you install a new operating system, or you install a new server, or when you install new routers. All of your equipment is going to come with some services turned on so you have some basic functionality so you can get into it and start configuring it. And if you don't get into it and start configuring it, then it's running off the default settings, which is most likely insecure.
So what you need to do is every time you get a new piece of equipment, no matter what piece of equipment it is, go through a hardening process to identify how to lock that down. That process is going to be different depending on what type of equipment it is. So desktops and laptops are going to have a process, switches are going to have a process, routers are going to have a process. It's going to have a process depending on what brand it is and what level, what model it is within the brand. So there's a lot of things that determine that process, but you have to go through this equipment hardening to make sure that it doesn't have extra services that are running and extra features that are running that are making that piece of equipment vulnerable.
Part of a good security program is making sure you are patching and updating on a regular basis. This includes all of your equipment. We have operating systems on this. We have firmware. We have BIOS updates that need to happen. We have these different things that need to be updated on this equipment, and making sure that's up to date, the software that's running on these, making sure that that's all up to date is going to be really important.
Because what happens, if you recall, there's that zero day that comes out. That means that hackers know of a vulnerability, and then it progresses to, well, now it's common knowledge and a bunch of people try to start leveraging that vulnerability for their own purposes. You want to really quickly be able to get the patch that's going to patch that, to make sure that that machine, that piece of equipment, is not vulnerable. So patching and updating is pretty important for a secure network.
We covered a whole bunch of different security principles. Everything from the idea of segmentation, breaking things apart into smaller segments so that you can control access to it, and you control the access to it with AAA, the authentication, authorization and accounting. We also try to practice least privilege, so if somebody doesn't need access to something, they shouldn't have access to it. We can also use role-based access, that allows us to quickly identify people's roles and add them to all of the resources that they're going to need access to. Then we have separation of duties, which allows you within a process to have different people doing checks and balances. Really it boils down to checks and balances and making sure that there's an audit trail, that people are not flying under the radar doing things that they shouldn't.
We talked about the importance of monitoring and some different types of monitoring, to include the SIEM, the security information and event management. We talked about backups, and I mentioned a few terms with backups but we didn't go in depth into it. I also mentioned encryption and the importance of encryption at rest and in transit. And then we talked about patching and updating and hardening equipment.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →