Now we'll analyze a few scenarios showing the effectiveness of the defense and depth model against various
types of attacks automated attacks on the specific services.
The first scenario
such an attack was conducted 10 years ago by the Code Red virus used loopholes in the security of the
Microsoft web server
not going into detail of the virus strategy.
Let's consider whether the independent security measures of each functional layer of the system could
stop the attack.
The network firewall should block the attempt to send modified HTP packets used by the virus to attack
vulnerable HTP servers at the perimeter of the network.
Half of these packets would probably be blocked indeed
if the web servers were placed in the demilitarized zone.
The virus will infect only the computers in the DMZ.
If the operating system was regularly updated it could help block 9 out of 10 attacks.
The virus exploited the vulnerability unknown months before the wave of attacks the virus scanner would
detect and Block 9 out of 10 attacks in the application layer.
The strength of the defense and depth model is that even though individual solutions are not infallible
if they are truly independent of each other you can count the probability of the attack by multiplying
the individual probabilities.
The final value is much less than the individual probabilities values
considering are optimistic assumptions threat probability amounts to point 0 4 percent and was counted
by multiplying 40 percent times 1 percent times 10 percent.
The next scenario we will consider is an automated attack utilizing several types of propagation technique.
This was a strategy employed by the Nimda computer virus it's spread via e-mail and local networks but
it also infected remote web servers.
The virus is known to use 12 ways to infect computers.
The defense in-depth model will not only lower the threat of infection but it would also limit the number
of infected computers in case of an attack.
It would require setting up an application firewall at the perimeter level that would analyze incoming
data transmissions and not only their packet headers.
The firewall would detect and block modified requests thus preventing the virus from spreading via e-mail.
That was however only one of the ways the virus spread.
So you're still at risk
protecting each computer by a firewall would keep the virus from spreading through local networks.
Regularly updated network firewalls should block this mechanism.
Operating system updates would eliminate the threat of the Nimda virus almost completely unless the
attack would come from a modified version of the worm
and then the used social engineering methods as well.
It tried to get users to start the program by opening an email attachment but an effective security
policy could counter even this method of attack no security measure is 100 percent effective.
Sometimes this ratio amounts to 15 percent but by combining many security solutions you can make your
system relatively secure.
This is called The Swiss cheese model.
A piece of swiss cheese has a lot of holes but because individual slices stick close together few holes
go through.
Similarly in the case of security some holes may look more serious than others but there is no open
attack path.
Now a few more examples of the effectiveness of the defense and depth model
hypothetical response of a computer secured on the basis of this model is presented in the slide below.
You can analyze it on your own.