Reinforcing cybersecurity: The network's role to prevent, detect, and respond to attacks – Help Net Security

It’s always DNS. That’s what the famous internet meme popular among sysadmins says anyway. It’s funny because while clearly, every network issue doesn’t resolve to some funky DNS issue, too many network admins have banged their heads against their keyboard for hours only to find out that the culprit was indeed some DNS issue.

Yes, it might not always be DNS, but when it comes to cyberattacks, it is too often the network.
Example: In the SolarWinds Supply Chain Attack of 2020, malicious software was able to communicate back to the attacker’s servers, unfamiliar domains, and IP addresses that were not detected before the damage was done.
In 2022, an attacker was able to steal $235,000 in cryptocurrency by employing a BGP hijack against Celer Bridge. This attack highlighted universal problems that aren’t restricted to cryptocurrencies and should serve as a cautionary tale for any organization that conducts business on the internet.
Here is some data that is scaring the pants off of CIOs right now.
Let me be clear. In the face of a sufficiently determined attacker, almost any organization is at risk. However, with the proper framework, many of the network-related exploits that we all read about on Reddit, StackOverflow, or the New York Times can be prevented, or their effects can be significantly reduced.
I believe the key to better network security can be summed up with the triad of Prevent, Detect, and Respond.
DNS issue
This triad acknowledges that while an ounce of prevention is worth a pound of cure, sometimes an attack slips through the cracks. In these cases, it is how you respond that separates an average Tuesday from a multi-million dollar headline-making attack.
I sum up the organization network security triad as such:
Each of these topics is worth an entire article or even an O’Reilly Book itself. But to give you an idea of how to use the framework, I’ll give you a few questions to ask your network team to determine your level of organization maturity in each area:
Prevent:
Detect:
Respond:
There is no single correct answer to any of these questions. However, with answers in hand, you will be able to get a sense of how mature your organization is on its network security journey.
This article could easily have been titled “An ounce of prevention is worth a pound of cure.” If the average breach takes nine months to detect and costs nearly $5 million, it is worth asking, “Is my organization doing enough to prevent breaches in the first place?”
While the ultimate solutions can look very different, through the combined efforts of prevention, detection, and response strategies, organizations can not only defend against cyber threats but also build resilience and adaptability into their digital infrastructure. Why? Because it’s always the network.