21 Apr 2021

Cyber Assurance at the 'Real' and 'Network' Infrastructure layers

Guest blog: Paul Ceaser BSc QCVS, Managing Consultant at IMD Group as part of our #Cyber2021 week.

cyber_week_1200x628px_final.jpg 1

When asked the question "What does Cyber mean to you?" the most common answers will typically be 'Penetration Testing', 'Active Threat Monitoring', 'Preventing DDOS breaches at the SOC monitoring layers'.  All being crucial operational higher Cyber Assurance layer stack tenets. Sitting within the Cyber Assurance stack at the bottom are the 'Real' and 'Network' layers. These levels are the bedrock of any successful system design, infrastructure, and quality build standards.  Both are fundamental building foundations that assure anything built upon, thereafter is underpinned by governing standards, assurance, providing compliance and integrity of your architecture. Sadly, these often get overlooked, left unsupervised, unmonitored, exposed or fail to be assured to the integrity levels required by the Operating Software and Applications suites undertake annually.   

Whilst these 'Real' and 'Network' layers possessed 'Assurance', 'Compliance' and 'Certification' at go-live, time has passed, things have changed, components/cables have been added/removed, upgraded, services migrated to virtual instances, building fabric altered or infrastructure moved to new premises. Most offices are vacant and have been during the Coronavirus pandemic, with infrastructure still whirring away in Office and Networks Rooms, possibly not visited/touched for some time.  Physical assets remain your most vulnerable access points, which any attacker could easily target. Maintaining the integrity of these is equally important as your possibly exposed 'ports and sockets'. The following bitesize information asks, are your 'Real' and 'Network' layers built right, audited, assured and compliant with a full Cyber Assurance integrity stack? 

Building Information Management (BIM)  

A recommended starting point for any new builds or complete CIS overhaul by adhering to future compliance within a Cyber Assurance framework for CIS Infrastructure is adopting the IET endorsed Building Information Modelling (BIM). BIM is transforming the way that architecture, construction, engineering and facilities management (FM) industries combine. This collaborative approach is based on shared information models, which should be maintained across the building or infrastructure's lifecycle. Notwithstanding BIM, you must consider and comply with a myriad of governing standards to ensure Cyber compliance is obtained and maintained throughout the lifecycle. 

Auditing with post controls 

Post installation work or infrastructure changes, do you inspect and audit your 'Real' and 'Network’ infrastructure layers for Physical, Security, Capacity, Tempest, Electrical, Zoning and compliance purposes? Undertaking regular physical inspections and thorough auditing of your Cabinets, Network Rooms, Buildings, and Campuses post-change management events may expose a plethora of vulnerabilities and threats. This should be undertaken and supported by SMEs guiding and mentoring to audit and, importantly, setting post control mechanisms to rectify and prevent future reoccurrences. Focus on the 6 objectives of Cyber Assurance by means of inspection, auditing, compliance, and assurance should entail:    

Availability – Flexibility – Economy – Confidentiality – Integrity – Resilience 

Remediation for Compliance 

Post audit, the most critical element is your remediation of vulnerabilities and non-compliances, leading to re-obtaining compliance and certification to industry standards/regulations. There are a wide range of overlapping industry and government rules/regulations (British Standards, MOD and Government publications) that must be adhered to for compliance and assurance of your ICT Infrastructure.  This can be a costly task, and prevention at the first gate is better than the cure.  However, once assurance/certification is re-obtained, the work doesn’t stop there. Employing rigour and discipline to maintain the assured status thereafter is paramount. 

Summary 

The ‘Real’ and ‘Network’ layers are critically important to police, monitor, audit and remediate.  It is vital to examine and address these lower layers of the Cyber assurance stack as you do for the higher end to ensure all remain protected, secured, and government body assured. 

https://www.imd-group.co.uk/cyber-assurance-at-the-real-and-network-infrastructure-layers/

About Paul Ceaser, Managing Consultant at IMD Group

Paul is a Managing Consultant for IMD Group, a consultancy firm focused on putting people at the heart of business transformation. Paul is a motivational and dynamic award-winning Programme Delivery Director, CTO, Director of IT and Voice/Data Operations, with 30yrs experience within the Royal Signals as a Technical Officer Telecommunications. A track record of achieving increased efficiency on Service Operations and Service Transition within all infrastructure and telecommunication sectors and possessing significant experience of complex operational Digital and Data transformation within the private sector. Driving positive change through successful multiple Digital Transformation projects for Voice, Data and IT services.

 

Jill Broom

Jill Broom

Head of Cyber Resilience, techUK

Annie Collings

Annie Collings

Programme Manager, Cyber Security and Central Government, techUK

Raya Tsolova

Programme Manager, techUK

Tracy Modha

Tracy Modha

Team Assistant - Markets, techUK