Why is an understanding of the layers of your infrastructure important?
It’s important to understand the definition, purpose, and related controls for each layer of infrastructure as the various layers comprise an important aspect of your overall security compliance program and passing your eventual audit.
Network (in a more modern SaaS structure, this is often your cloud provider)
Definition & Purpose: Connection of applications, devices, servers, utilities etc. to allow sharing of data
Examples:
Active Directory (on premise, in office)
AWS (cloud)
Google Cloud Platform (GCP) (cloud)
Azure (cloud)
Related Controls:
Network Segmentation
Logical Access
Network Monitoring/Intrusion Detection
Firewalls
VPN (for when connecting to the network remotely)
Definition & Purpose: Manages a set of programs, applications, or software resources on the server or on a set of end user devices (e.g., laptops, desktops)
Examples:
Windows
iOS
Variations of Linux (e.g., Centos, Ubuntu, Red Hat)
Related Controls:
Logging Configurations
Logical Access (e.g., Administrator Access, Password Configuration)
Encryption Controls
Definition & Purpose: An organized collection of data stored and accessed electronically
Examples:
PostgreSQL
SQL Server Database
MongoDB
Related Controls:
Database Backups
Logical Access
Database Encryption
Encryption at Rest
Audit Logging
Definition & Purpose: A software program designed to carry out a task
Examples:
Client installed on workstation (local application)
Software
Web-based applications
Related Controls:
Logical Access Controls (e.g., Password Requirements, Administrator Access)
Audit Logging
Change Management
Workstation Controls (if application is local)
How does this relate to my audit?
Auditors test all layers of infrastructure unless a layer is specifically stated to be not in scope. Each infrastructure layer has access points and privileges that need to be protected and secure, so it’s important to make sure your organization has the necessary controls in place. For more information on Strike Graph suggested controls, check out our Control Library Collection or contact your CSM directly.