Best Practices

“The skillful tactician may be likened to the shuai-jan. Now the shuai-jan is a snake that is found in the Ch’ang mountains. Strike at its head, and you will be attacked by its tail; strike at its tail, and you will be attacked by its head; strike at its middle, and you will be attacked by head and tail both.”

– Sun Tzu

“The art of war is of vital importance to the State. It is a matter of life and death, a road either to safety or to ruin. Hence it is a subject of inquiry which can on no account be neglected.”

– Sun Tzu

“Bravery without forethought, causes a man to fight blindly and desperately like a mad bull. Such an opponent, must not be encountered with brute force, but may be lured into an ambush and slain.”

– Sun Tzu

“Hence that general is skillful in attack whose opponent does not know what to defend; and he is skillful in defense whose opponent does not know what...

Least privilege

The principle of least privilege (PoLP) is fundamental to constructing robust cybersecurity architectures. It asserts users should only have the bare minimum access required to perform duties. Architects must master least privilege to erect resilient protections. By restricting unnecessary access, risks are reduced, accountability is enabled, and attack surfaces shrink. In the context of zero trust, PoLP also applies to device identities, not just user identities. This is a comment to be applied throughout this chapter regarding least privilege.

Cybersecurity architects hold crucial responsibility for translating least privilege into technical implementations and governing policies. They must audit entitlements and align controls to curtail excess while empowering productivity. The most potent architects embed least privilege judiciously, not dogmatically, leveraging automation and awareness to balance security with usability.

This section will explore best practices...

Patching and development

Proactively patching vulnerabilities represents fundamental cyber hygiene, yet this mundane maintenance can easily lapse amid rapid development. Vigilant patch management must permeate the entire software life cycle to preempt exploitation. Architects hold crucial responsibility for governing patch excellence despite competing priorities.

By championing continuous asset discovery, automated scanning, and policy rigor, architects can embed proactive patching into workflows. Testing and staging updates verify quality assurance before promotion to production. Regular cycles maintain currency amid a threat landscape in constant flux.

However, technical controls alone cannot sustain robust patching. Architects need to foster security-minded cultures through training that underscores patch diligence. Complacency threatens to unravel all preventative work.

With development velocity accelerating, architects must bring discipline to patch operations. Mastering...

MFA

As threats become more sophisticated, sole reliance on passwords for authentication is no longer tenable. MFA strengthens identity verification by requiring multiple credentials representing independent factors. Architects hold responsibility for judiciously driving MFA adoption to protect against unauthorized account takeover while enabling productivity.

MFA should be mandatory for privileged accounts and highly sensitive systems, given the risks of lateral movement upon compromise. However, overzealous mandates undermine usability, prompting workarounds and resistance. Architects must create nuanced policies and choose frictionless MFA options that balance security with efficiency.

By complementing passwords with an additional factor such as biometrics or one-time codes, the attack surface is greatly reduced. Yet MFA also necessitates contingency mechanisms should factors become temporarily unavailable. With training and layered options, MFA can be strengthened without...

Security training

In cybersecurity, humans represent both the weakest link and the strongest defense. While technical controls form the foundation, resilient protection relies on an aware, responsive workforce – a vigilant human firewall. Security architects hold crucial responsibility for instilling comprehensive training that informs, engages, and empowers employees at all levels to identify and prevent threats.

By championing strategic, personalized programs, architects can shape training into an asset that pays perpetual dividends. Immersive simulations and labs provide hands-on experience in recognizing and responding to real-world attacks. Customized training demonstrates relevance for each learner’s unique role.

However, classroom instruction alone has limited impact without cultural reinforcement. Training should be sustained through continuous micro-learning that keeps security top of mind. Architects need to constantly cultivate human defenses through...

Vulnerability scanning

In today’s complex and ever-evolving cybersecurity landscape, a team approach to documentation is essential for achieving comprehensive and up-to-date governance. By strategically dividing responsibilities and employing a diverse set of specialized and general-purpose tools, teams can collaborate effectively throughout the documentation life cycle. Utilizing centralized platforms for collaboration further enhances the efficiency and accuracy of the documentation process.

Best practices for conducting vulnerability scanning

Vulnerability scanning is a critical cybersecurity practice that involves the use of automated tools to identify security vulnerabilities in network devices, systems, and applications. This proactive measure enables organizations to detect and mitigate vulnerabilities before they can be exploited by attackers. This section delves into the best practices for conducting effective vulnerability scans and includes a detailed lab exercise...

Summary

In this chapter, we explored a wide range of cybersecurity best practices that are essential for organizations to implement to strengthen their security posture. From foundational practices such as least privilege and patch management to critical measures such as MFA, vulnerability scanning, and security training, implementing these guidelines enables organizations to build robust defenses aligned with their business needs.

However, these best practices are most impactful when woven together into a cohesive cybersecurity program, not applied in a piecemeal fashion. Cybersecurity architects hold a crucial responsibility to holistically govern the adoption of complementary best practices that provide defense in depth across people, processes, and technology. By thoughtfully combining standards with business objectives, architects can curate tailored best practice toolkits scaling to their unique environment.

Cybersecurity best practices are not merely recommended actions...