Lately, cyber security has become a serious problem, even for small businesses. A few of our small customers are experiencing malware, scamware, and ransomware attacks!

Reading the news, we found that most attacks are a result of their weakness in security products, poor implementations, and insider jobs, particularly with complex services hosted in the public cloud. As a result, a large number of hackers and so-called security experts are profiting handsomely from these high-profile attacks.

To protect you against attacks, most consultants and vendors in the industry have made things more complicated than necessary. They would introduce concepts such as single-sign-on, multi-factor authentication, and "Zero-trust". Most vendors are simply wrapping additional layers and software in their proprietary one-size-fits-all public cloud onto your IT infrastructure. The associated complexity, and vendor proprietary technology dependencies often cause more usage impedance without security improvements. Often, along with additional layers of complexity, they would introduce more security holes. They would weak and poorly designed and managed centralized global management layers such as Microsoft Active Directory, which is outdated and not originally designed for public cloud use. These security measures, particularly those in the public cloud, often hide low-level audit trails and accurately modelled transaction logs from you and expose more attack entry points to the public, leading to significantly larger attack risks, Finally, not trusting users as a default position for every transaction would often lead to poor user accessibility and useability resulting in user resentment.

ECL has a different approach to the security problem. While some of our peers are preaching to trust no one in the so-called "Zero-trust" model, we preach the "Zone-trust" model.  The "Zero-trust" model is extremely challenging to implement, expensive to operate, and manage your business and personal security when you trust no one! It is impractical. Almost all companies with more than a handful of employees were able to implement it correctly. On the other hand, with "Zone-trust", we can implement your security system more quickly and effectively in an "Agile" manner. We would instead start by trusting all your users and devices. We then refine and narrow this trust with a technique called "isolation". Here, we would use a series of "firewalls" within your private cloud to isolate your IT subsystems into separate independent and sufficiently secured zones. We would first leverage existing network devices' and applications' built-in native security systems. Most of the time they are more than sufficient for practical purposes! You won't need additional software or hardware! If stronger "firewalls" are required, we would wrap a weak security zone using an open source and transparent internal firewall to strengthen the "gates" and encrypt traffic between "zones".  Each security zone would have its unique, independent access authentication methods, auditing logs, and security management. The aim is to minimize overlapping or globally shared security resources. Using a well-monitored, decentralized, privatized, and self-maintained security zone model makes life easier for authorized users but much more difficult for unauthorized users. Furthermore, we would enable audit trails, security logs, and monitoring within each security zone. They would alert us to potential access abuses and hacking attempts before the actual breaches happen.

A fully isolated system in a security zone is hackproof and immune to attacks, despite the underlying access operating system and the application software being insecure! For example, even an obsolete Windows XP PC running insecure some insecure HVAC applications can be operated very safely when it is totally isolated. Rather than adding complex security layers and using a global cloud-based authentication, shedding them would be our recommended practice. Appropriately isolating systems into finer and defining independently managed security trust zones is what we would do for you. Not only do we use this "Zone-trust" model for network design to protect against attackers, but we also use it for isolating breaches and containing damages from attackers.  Our "Zone-trust" model is an alternative to the "Zero-trust" model, which is unreasonably expensive to implement, a force-fit to existing devices and applications, hard to use, and easily breached due to increased attack surface, weak global publicly accessible cloud security systems, and unfriendly and frustrating user authentication procedures. Rather than using proprietary software to implement "Zero-trust" by other vendors, we would use open-source software to implement "zone-trust" more effectively and less expensively.

Those who are in the IT security business would notice that our "zone-trust" model appears to be a top-down implementation of the "Zero-trust" model in reverse. In the "Zero-trust" model parlance, rather than using flatly not trusting each device and user from the bottom up, we would implement a hierarchical macro--segmentation of your network from the top down to a sufficiently lower level to get the job done. However, the main difference in our security implementation is that we would use distributed local native system security databases and local distributed security management tools instead of globally stored security databases and tools. Our model better defines the relationship between the clients and the target server. For example, each HVAC system has its own unique user and device schema -- it may only need to be accessed by authorized technicians, and nobody else.  Some technicians are only allowed to read, while others are allowed to write and update configurations. This can be accomplished easily by allowing the techs direct access using a simple native configuration of the local HVAC server and local firewall routing. We would add a simple local custom filtering script to further verify the insiders' user patterns, which are unknown to any outsiders. Coupling this with proper logging, auditing, and alerting, these simple measures are more than sufficient in practice than other fancy cloud-based software layers. Accomplishing this security measure is extremely difficult to do with a central cloud-based Active Directory, if not impossible. There is no need to force-fit Active Directory roles for the users with dozens of irrelevant attributes, renewals of certificates, and proprietary client-side agents, which will eventually create many security side effects causing frequent authentication failures, machine downtime, and administration nightmares. The one-size-fits-all cloud-based security system would even introduce an extra layer of failure due to non-technical factors such as the admin being unable to navigate the constant change of the management tools in the cloud, credit card payment rejection, global exposure, and simple data center failures. The latter happened many times with Microsoft, Google, Cloudflare, and other firms in the public cloud in the past year alone. By the way, despite the distributed nature of management in our "zone-security" model, central monitoring and reporting are possible. Unlike many "Zero-trust" implementations, we can easily and effectively monitor decentralized, distributed hierarchical security databases in a "functional style" with little or no "side effects" and "risk of management system breaches", that are prevalent is a centrally directed system such as Active Directory or third-party management super- layers built on top of it.

Lately, ECL has been busy monitoring and fending off attackers by assisting our clients in creating security zones and isolating old and insecure systems, especially in the healthcare industry. We have been simulating attacks and attack recoveries.  We often had to repatriate servers from the public cloud back to the private cloud for better security isolation, improved performance, more network simplifications, more control of data, and major cost reductions. Usually, we would start first by isolating and securing the most vulnerable systems: HVACs, PBXs, Wi-fi networks, cell phones, email servers, file servers, terminal servers, instant messaging, video conferencing servers, and most importantly security supervisory systems. Then, we would test zone perimeters, simulate security breaches, and dry-run recoveries from potential breaches. All networks built and managed by ECL use this "zone-trust" model by default. We will be happy to demonstrate our implementation of cyber security. Also, please enquire about our Systemaster program, where we even provide insurance against cyber-attacks.