All organizations should ensure that unfettered access to the internet is not possible. When it comes to securing internet traffic, Bento Cyber Security Framework focuses primarily on detection and mitigation of malicious content. Organizations must simultaneously treat malicious content as a single source of threat (web attacks) as well as a piece of a greater thread landscape that includes ransomware, identity theft, spear phishing, web attacks, and spam. The reason for the duality is that the nature of the threat and threat mitigation is in perpetual evolution, with increasing overlap from service providers, software solutions, and standards/governance guidance.

This strategy focuses on a small subset of risky vectors such as malicious websites, malicious downloads, and specific forms of traffic rather than attempt to control internet access as a whole. Despite the relatively narrow focus, the magnitude of effort in this area is large and can consume large chunks of IT/IS budgets. Considerations for this strategy include:

	Whether the organization owns perimeter hardware capable of managing traffic and can handle the work-load effectively. The second point is as important as the first, many appliances cannot scan traffic effectively unless they are sized up many times over. It's extremely difficult for boards/managers to understand the necessity to spend exponentially more than expected. For completeness, the hardware should be distributed to all branch offices and remote worker locations.
	Whether the organization has completed a ransomware readiness assessment (or similar cybersecurity readiness) and reviewed recommendations.
	How the organization decides what is necessary and/or allowed. In most small environments internet is fairly open.
	What resources the organization has available to manage firewalls and content filters during day to day operations.
	What tools and technologies protect users when inside the office, when traveling, when working from home, and when accessing company data on mobile devices.
	Understand the scope of devices being protected and how filtration technologies can affect all the devices which attempt to connect to the internet*.
	Whether existing management technologies permit deployment of security tools effectively.
	Whether the organization is capable of enforcing user-choice restrictions for internet browsers.
	Whether or not the browsers used are managed through enterprise-grade management technologies.

BCSF recommends taking an approach where early detection and prevention of malicious content is the focus as this process has far more clear options and is less costly than the alternative. To be successful, most smaller organizations are better off breaking this area into smaller - manageable - problems and addressing them in context of the overall strategy than attempt to implement a comprehensive solution. Another term commonly used for this strategy is “layered defense”.

While it is possible to block certain content from employee use, the inverse is not a practical or feasible approach. Organizations attempting ad-hock content filtration typically enter cycles of blocking and unblocking until a failure causing the entire system to be disabled. This is because most content sources leverage Content-Delivery-Networks and use major providers such as Amazon, CloudFlare, Microsoft Azure, and Google Cloud to supply content. The internet is a dynamic system and such attempts are often valueless and disruptive. Blocking all traffic - effectively and with assurance - requires extraordinary investment in filtration resources. For organizations in need of completely controlling web access on a granular scale for on-premise and remote workers, BCSF refers to NIST SP 800-46 (https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-46r2.pdf).

Components of a secure internet system

There are effective and affordable ways to reduce your organization’s exposure to the more common types of cyber attack on systems that are exposed to the Internet. The following subset of controls applied specifically to this approach:

boundary firewalls and internet gateways — establish network perimeter defenses, particularly web proxy, web filtering, content checking, and firewall policies to detect and block executable downloads, block access to known malicious domains and prevent users’ computers from communicating directly with the Internet
secure configuration — restrict the functionality of every device, operating system and application to the minimum needed for business to function
malware protection — establish and maintain malware defenses to detect and respond to known attack code
patch management — patch known vulnerabilities with the latest version of the software, to prevent attacks which exploit software bugs
device management – tools and processes that ensure master data is coordinated across the enterprise.
user access control — include limiting normal users’ execution permissions and enforcing the principle of least privilege
insider threat detection – uses real-time user activity and threat monitoring to detect early signs of insider threats.

If your organization is likely to be targeted by a more technically capable attacker, give yourself greater confidence with additional focus on:

security monitoring — to identify any unexpected or suspicious activity
user training education and awareness — staff should understand their role in keeping your organization secure and report any unusual activity
security incident management — put plans in place to deal with an attack as an effective response will reduce the impact on your business

Suitable Strategy for Controls

Effective Area	Suggested Strategy	Implementation Notes
Boundary firewalls	Firewall with content filtration, malware scanning, and Layer 7 configuration.	Content filters block generic classes of websites, malware scanning looks at malicious content in more detail, and Layer 7 config can be used to block problematic systems such as peer-to-peer file sharing. Common solutions include Cisco Meraki MX firewalls. Optimal solution is to deploy AMP firewalls to each office, branch, and teleworker. When teleworker protections are not possible, a compensating control is done using company-owned hardware and DNS layer filtration (see next item).
Secure Configuration	In this context, the scope is limited to web filtering. DNS layer security (DNS Filtering) combined with Mobile Device Management and web gateway.	While boundary firewalls work only at the “office", a DNS layer solution applies to the device at all times. It can be used to further control web traffic and reduce what is accessible. This can also include other forms of software designed to affect application/site access. Common solutions include Cisco Umbrella or OpenDNS. These are often the first layer defense but they typically require other solutions (such as MDM and virtual appliances) to meet objectives.
Malware Protection	Anti-malware software scans for viruses, monitors web behavior, reports anomalies and includes behavior monitoring.	Technologies built around early detection and tactical response. Guided threat hunting for Indicators of Compromise, granular isolation of processes, lightweight and fast without false positives. Automated attack isolation and remediation. Common solutions include Malwarebytes EDR.
Patch Management	Assurance that vulnerabilities are patched quickly.	Strong control over operating system patches, critical application patches, and drivers. Systems vary and are often bundled with RMM offered by your service provider.
Device Management	Enforce policy compliance and enable controls.	Mobile Device Management on top of Remote Monitoring and Administration. Common vendors include Windows Intune, Cisco Meraki System Manager, JAMF.
User Access Control	Limiting administrative privileges and assuring that device configuration matches organizational requirements. For critical cloud services the strategy should be to enable organizations to apply conditional access, strong authentication, and reliable auditing.	This topic spans three areas: identity management, access control, and threat management. Identity management solutions, such as Azure AD or Okta, make it possible to authenticate users in real time and reduce risks associated with account compromise, misconfiguration, and on/offboarding. ACL policies for the organization, enforceable and auditable permission schemes and zero trust architecture**. Communication/collaboration platforms such as Microsoft 365 and Google Workspace, both vendors offer advanced security and threat management solutions which enable organizations to manage access and have trust in authentication capabilities. Microsoft refers to to this as "EDR E5" and Google refers to this as Business Plus. These are being continuously revised and quarterly reviews of this technology should be baked into cyber security management.
Insider Threat Detection	While ant-malware performs heuristics on software behavior, monitoring users for malicious activity (intentional and not) will assist with early detection of threats.	Behavior monitoring and active alert systems include employee monitoring software that runs on desktops and cloud application service brokers that analyze cloud application activity logs. Notable solutions include ActivTrak, WorkPuls, Cerebral, Microsoft Cloud Application Security, and Avanan.

Notes:

https://www.nist.gov/itl/smallbusinesscyber/securing-data-devices
* A zero trust architecture requires authorization for any person or device attempting to connect to a network or access network resources, even for users already within the network perimeter (realistically, with the cloud and mobile platforms blurring the network edge, there is no longer a static perimeter to guard).

References

NIST SP 800-41, Guidelines on Firewalls and Firewall policy
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf
NIST SP 800-411, User's Guide to Telework and Bring Your Own Device (BYOD) Security
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-114r1.pdf
NIST SP 800-45, Guidelines on Electronic Mail Security
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-45ver2.pdf

Content Filtration, Layer 7 Firewalls, and Malware Protection

Components of a secure internet system

Suitable Strategy for Controls

References