2

Our company is comparing and discussing network security models and I would like to know what the "best" model is based on objective measurable data. To aid in this, I am looking for a summary and statistical comparison of networking models such as:

  • A "flat network" where servers are on the same network as clients
  • A DMZ model in which all servers exist in a single DMZ
  • A siloed network where there are multiple secured or hardened islands or silos
  • Potentially other configurations or layouts

Such a study should quantify and compare things like:

  • Percentage of companies with a given model which have experienced a breach
  • Vulnerabilities detected by Vulnerability scanners compared by model
  • Costs of breaches versus cost of maintenance for a given model
  • Measurement and comparison of revenue and business lost to complexities of the models and the impact to customer confidence and customer recommendations
  • Etc.

My feeling is that the general security wisdom is "use a DMZ," but I am questioning if real-world data actually backs up the value of this model. My preliminary search was unable to find any such study or analysis. Does any such data exist or have any studies been undertaken to analyze and quantify the security of various network topologies?

  • A quick Google search turned up many references to related studies. Most of these will cost you money to read them. – Ron Maupin Mar 22 '16 at 18:12
  • @RonMaupin - I had trouble finding any. Do you have some links? Abstracts may be sufficient and I do have access to several journals (JSTOR, etc) – James Shewey Mar 22 '16 at 18:13
  • You need to search for network security case studies. Product and/or resource recommendations are explicitly off topic here. – Ron Maupin Mar 22 '16 at 18:16
  • 2
    The "best" topology in terms of maintainability and security will result in an opinion based answer. No two networks are exactly the same, so there is no single "best" that can cover every single one of them. For example, ask a small/medium corporation, an entirely web based company, and a large defense contractor what is "best" and you will get three entirely different answers. – YLearn Mar 25 '16 at 21:07
  • 2
    @JamesShewey, the issue is that some "average" will not provide the "best" solution. Perhaps one model is widely deployed, but on average is the least compromised. Does that mean that it is the "best"? How about if all the higher risk companies tend to use a different model than the most common? Or since higher risk companies are using one model, is that the "best"? Even if they are compromised more on average? Or is the least compromised solution the "best"? Even if it costs an average of $10M to deploy vs. $50k? Your "best" is still very vague and opinion based at best. – YLearn Mar 25 '16 at 21:59
3
+25

There is no "best" as you are trying to define it. There is only a "best for you" which is something that you need to determine.

Security can be viewed from a number of different ways. For instance, I was once taught that security is a balance between securing a device and usability. A very secure system is one that is entirely disconnected, embedded in 10' of concrete, and buried 300' underground in an undisclosed location. This would also be very maintainable as you wouldn't have to worry about patches, updates, password refreshes, etc. However it is also a system that is entirely unusable. Your company will need to make the best judgments about where between extremes your own operations and user base would be comfortable.

Beyond that, is the risk vs. cost balance. Much like redundancy (and the redundancy vs. security is another balance to consider when you allocate resources), you will need to evaluate your individual risks, how much risk your company is willing to take, and how much money they have available and are willing to spend on security. Most companies won't want to spend more on securing something than it is worth. You will never walk into a retail store to find a $2 anti-theft tag on a $1 pack of gum.

And of course, when counting the costs there are always the "soft" costs. Extra staff (or more knowledgeable staff) to maintain the required level of security (or redundancy). Support costs. Extra complexity that could result in extra lost time/productivity when there is a problem. End user support issues. And on and on and on.

Unfortunately in life, both security and redundancy also have diminishing returns. By this I mean that you can make fairly significant steps to increase either (or both) for relatively little cost. But the further you want to increase those benefits, the steeper the costs get. For instance, you can get a 90% uptime (at 100% capacity) with relatively few costs, but to get 99% (at 100% capacity) expect to pay quite a bit more. To get to 99.999% (at 100% capacity), will likely cost you at least double your costs to get to 99%.

Beyond the issue of "best" is that you are looking for studies to back your decision up. This is also problematic as most companies do not disclose details of their security. Sure, they may say they use product X or vendor Y, but they generally won't provide a full picture. Why? Because the more information they reveal, the easier it would be to exploit any vulnerabilities in the system. The most secure companies will reveal almost nothing at all.

Trying to get an "average" of all companies is trying to treat apples and oranges the same (as well as bananas, grapes, kiwi, peaches, pears, pineapples, ...). Most knowledgeable professionals will tell you there is a world of difference between how different types of companies/businesses perceive and address security. Retail, financial, banking, web-based, edu, manufacturing, services, software design, intellectual property, and so on have different needs and risks. Trying to lump them all together into some "average" just doesn't work.

In the comments you keep looking for a "magic bullet" answer, so instead let's compare this to something outside IT. Would you try to find out if a property you were interested in buying was priced fairly by averaging all the property sales in the country? No, you look for "comparables" preferably in the same neighborhood, of the same type (residential vs. commercial, single family vs. condo, etc), with a similar number of bedrooms/baths, square footage, etc. You then evaluate how the costs compare based on the features (full finished basement, three car garage, pool, etc), condition (upgraded kitchen, new roof, etc), location (quiet non-busy street, good school district, near shopping or public transit, etc) and any other important aspects of the properties before making your best judgement on how the prices compare.

Does a quantitative study that takes place in New York city providing the average cost of an apartment as $X help if you are looking for an apartment in Chicago? Neither would a study averaging security models of all companies help your company.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.