- [Instructor] To completely defend against today's threats,
security professionals, otherwise known as the good guys,
have to be right 100% of the time.
Now the miscreants, or the bad guys,
they actually have to be right only once to do harm.
In order to protect your network,
you must have a balance between visibility,
and between control.
You must combine tools like network Meta-data extraction,
and NetFlow, malware detection, IPS, threat intelligence,
full packet capture, server and endpoint logs,
and much more, right?
This is actually easier said than done, right?
Complexity is actually the enemy of security, right?
The more complex your environment,
the harder it is to monitor and protect it.
And now you want to reach a good point
where the capability of the security monitoring tool
you actually have deployed is greater than
the complexity involved managing such tools
or such products, right?
You can never get a 100% secure network.
No product of any size, any type of vendors,
or any type of security products
can actually provide you 100% security at a given time.
So anti-virus and firewalls are not just enough
to stop advanced targeted attacks.
You actually must have a balance between products,
people, and processes in order to
successfully monitor and protect your network.
You should always assume that your network is actually
compromised and think like an attacker.
Now in previous lessons,
you learned what is defense in depth.
You must apply these concepts to successfully
monitor your network.
Use a layered onion diagram to understand how to protect
your critical assets and how to place
visibility and control tools within your network.
This layered diagram actually will help you
understand the traffic flows and where you actually have
security gaps and how to deploy technologies,
and security technologies and visibility technologies
to close those gaps.
You must also understand what you're looking for, right?
Things like connections to Command and Control servers,
Indicators of Compromise, internal botnet traffic,
DNS Resolvers, and much more.
So again, always assume that you're network has been
compromised and think like an attacker.