End-to-end security

A chain is as strong as the weakest link. We've seen (too) many times organizations which defended very well their borders with state-of-the art firewalls, multi-layered protection, real-time vulnerability assessment while leaving allowing weak/leaked applications accounts.

The investments might be jeopardized by a single overlooked configuration item.

Therefore, we propose a holistic approach ensuring hardening for each of the layers involved:

• Border, layered security

• Application publishing and reverse proxies

• Hypervisor security

• Container-based security (Kubernetes), network interconnects to remote Data Centers, Clouds, SaaS apps

• NAC: Access to internal network and Wi-fi

• Authentication & Federation: LDAPs, AD-FS

• OS hardening: server and workstations group policies

• Authorization: SSO, Privileged Access Management and Audit, On-demand Privileged Access, Application-Aware Firewalls, segregation of duties (SAP GRC, Archer GRC), credential Vault

• Encryption: Certificate Management (PKI infrastructure and certification authorities), always encrypted server to server communication, disk/database / backup/archive.

• Security Information and Events Management (SIEM): correlations of security events and alerts from multiple sources (Elasticsearch, Splunk, Apache Metron).