Cyber Assurance at the 'Real' and 'Network' Infrastructure layers
When asked the question "What does Cyber mean to you?" the most common answers will typically be 'Penetration Testing', 'Active Threat Monitoring', 'Preventing DDOS breaches at the SOC monitoring layers'. All being crucial operational higher Cyber Assurance layer stack tenets. Sitting within the Cyber Assurance stack at the bottom are the 'Real' and 'Network' layers. These levels are the bedrock of any successful system design, infrastructure, and quality build standards. Both are fundamental building foundations that assure anything built upon, thereafter is underpinned by governing standards, assurance, providing compliance and integrity of your architecture. Sadly, these often get overlooked, left unsupervised, unmonitored, exposed or fail to be assured to the integrity levels required by the Operating Software and Applications suites undertake annually.
Whilst these 'Real' and 'Network' layers possessed 'Assurance', 'Compliance' and 'Certification' at go-live, time has passed, things have changed, components/cables have been added/removed, upgraded, services migrated to virtual instances, building fabric altered or infrastructure moved to new premises. Most offices are vacant and have been during the Coronavirus pandemic, with infrastructure still whirring away in Office and Networks Rooms, possibly not visited/touched for some time. Physical assets remain your most vulnerable access points, which any attacker could easily target. Maintaining the integrity of these is equally important as your possibly exposed 'ports and sockets'. The following bitesize information asks, are your 'Real' and 'Network' layers built right, audited, assured and compliant with a full Cyber Assurance integrity stack?
Building Information Management (BIM)
A recommended starting point for any new builds or complete CIS overhaul by adhering to future compliance within a Cyber Assurance framework for CIS Infrastructure is adopting the IET endorsed Building Information Modelling (BIM). BIM is transforming the way that architecture, construction, engineering and facilities management (FM) industries combine. This collaborative approach is based on shared information models, which should be maintained across the building or infrastructure's lifecycle. Notwithstanding BIM, you must consider and comply with a myriad of governing standards to ensure Cyber compliance is obtained and maintained throughout the lifecycle.
Auditing with post controls
Post installation work or infrastructure changes, do you inspect and audit your 'Real' and 'Network’ infrastructure layers for Physical, Security, Capacity, Tempest, Electrical, Zoning and compliance purposes? Undertaking regular physical inspections and thorough auditing of your Cabinets, Network Rooms, Buildings, and Campuses post-change management events may expose a plethora of vulnerabilities and threats. This should be undertaken and supported by SMEs guiding and mentoring to audit and, importantly, setting post control mechanisms to rectify and prevent future reoccurrences. Focus on the 6 objectives of Cyber Assurance by means of inspection, auditing, compliance, and assurance should entail:
Availability – Flexibility – Economy – Confidentiality – Integrity – Resilience
Remediation for Compliance
Post audit, the most critical element is your remediation of vulnerabilities and non-compliances, leading to re-obtaining compliance and certification to industry standards/regulations. There are a wide range of overlapping industry and government rules/regulations (British Standards, MOD and Government publications) that must be adhered to for compliance and assurance of your ICT Infrastructure. This can be a costly task, and prevention at the first gate is better than the cure. However, once assurance/certification is re-obtained, the work doesn’t stop there. Employing rigour and discipline to maintain the assured status thereafter is paramount.
Summary
The ‘Real’ and ‘Network’ layers are critically important to police, monitor, audit and remediate. It is vital to examine and address these lower layers of the Cyber assurance stack as you do for the higher end to ensure all remain protected, secured, and government body assured.
https://www.imd-group.co.uk/cyber-assurance-at-the-real-and-network-infrastructure-layers/
About Paul Ceaser, Managing Consultant at IMD Group
Jill Broom
Jill Broom
Jill leads the techUK Cyber Security programme, having originally joined techUK in October 2020 as a Programme Manager for the Cyber and Central Government programmes. She is responsible for managing techUK's work across the cyber security ecosystem, bringing industry together with key stakeholders across the public and private sectors. Jill also provides the industry secretariat for the Cyber Growth Partnership, the industry and government conduit for supporting the growth of the sector. A key focus of her work is to strengthen the public–private partnership across cyber to support further development of UK cyber security and resilience policy.
Before joining techUK, Jill worked as a Senior Caseworker for an MP, advocating for local communities, businesses and individuals, so she is particularly committed to techUK’s vision of harnessing the power of technology to improve people’s lives. Jill is also an experienced editorial professional and has delivered copyediting and writing services for public-body and SME clients as well as publishers.
- Email:
- [email protected]
- Website:
- www.techuk.org/
- LinkedIn:
- https://www.linkedin.com/in/jill-broom-19aa824
Annie Collings
Annie Collings
Annie is the Programme Manager for Cyber Resilience at techUK. She first joined as the Programme Manager for Cyber Security and Central Government in September 2023.
In her role, Annie supports the Cyber Security SME Forum, engaging regularly with key government and industry stakeholders to advance the growth and development of SMEs in the cyber sector. Annie also coordinates events, engages with policy makers and represents techUK at a number of cyber security events.
Before joining techUK, Annie was an Account Manager at a specialist healthcare agency, where she provided public affairs support to a wide range of medical technology clients. She also gained experience as an intern in both an MP’s constituency office and with the Association of Independent Professionals and the Self-Employed. Annie holds a degree in International Relations from Nottingham Trent University.
- Email:
- [email protected]
- Twitter:
- anniecollings24
- LinkedIn:
- https://www.linkedin.com/in/annie-collings-270150158/
Tracy Modha
Tracy Modha
Tracy supports several areas at techUK, including Cyber Exchange, Cyber Security, Defence, Health and Social Care, Local Public Services, Nations and Regions and National Security.
Tracy joined techUK in March 2022, having worked in the education sector for 19 years, covering administration, research project support, IT support and event/training support. My most outstanding achievement has been running three very successful international conferences and over 300 training courses booked all over the globe!
Tracy has a great interest in tech. Gaming and computing have been a big part of her life, and now electric cars are an exciting look at the future. She has warmed to Alexa, even though it can sometimes be sassy!
- Email:
- [email protected]
- Phone:
- 02073312000
- Twitter:
- @TracyModha,@TracyModha
- Website:
- www.techuk.org,www.techuk.org
- LinkedIn:
- https://www.linkedin.com/in/tracymodha83,https://www.linkedin.com/in/tracymodha83