A week ago Leon Adato shared a fine post titled What “Old” Network Engineers Need To Remember. I enjoyed reading his post and agreed with every point. And so I thought I’d make my own list this week and share my thoughts on how “Not” to be a bad network security engineer.
So let’s get right two it shall we?
- Don’t assume bad motives. Too often we assume that users are doing something they shouldn’t be and when we get the call that their computer has malware or we find something funny in the logs we treat them pretty bad. Sure, some people are jerks and try to get around the rules. But most people just want to get work done with as little friction as possible.
- Don’t assume that everyone knows the latest malware or ransomware delivery methods. I have a friend that works for an autoparts distributor. He deals with shipments all the time. One of the emails he received was a failed shipping notification. He opened it and boom! Cryptolocker. It encrypted everything on the shared drives he was connected to and left the business limping along for a few hours while they restored the previous nights backups. He had no idea. Malware and Ransomware isnt in his job description.
- Educate your users in a way that isn’t demeaning to them. I know the old “Nick Burns” videos are humorous. But again, if you take the time to train your users and your not a jerk about it, they’re more apt to respond in a positive manner.
- Now for the technical stuff. If you’re using a ton of ACL statements to control traffic, please add remarks. By adding remarks to your ACL statementns those who come after you will think you’re a pretty nice guy. I’ve inherited ACLs with thousands of lines and no clue what any of the entries were for. Not cool!
- Use Event Logging and Correlation to your benefit. Too many network security professionals try to get by without a solid logging and correlation strategy. So instead of having all the info, they tend to tread water trying to keep up with what’s going on in the network. There are a number of SIEM solutions today that offer event correlation and really good filtering on the logs. If you don’t have one, build a case for one and present it to upper management.
It’s true that we’re in a very tough spot some times. We manage systems that have a lot of power in terms of network connectivity. It’s good for us to be transparent to users but at the same time we don’t want our users activity to be transparent to us. It’s quite a balance we have to strike, but it’s worth it when we can. And using some of the more advanced tools made available today can help give us the visibility we need. Here’s a good example of how you can use Solarwinds LEM to create rules for real-time correlation and response.. This is just one example of how we can use today technology to provide security services while being somewhat transparent to users. And as far as the five points mentioned above, these are but a few point I’ve learned over the years that have proven to be useful. There are many more of course. If you have one perhaps you’d share it below. Iron sharpens iron after all!