Modern System Administration

Chapter 8. Infrastructure Security

Early in my career as a Unix system administrator, I felt total dread when I saw many failed login attempts coming from external IP addresses outside of the US because we had only two people focused on security, covering everything from the physical network to network and host intrusions for our Unix systems. Seeing the failures made me wonder about other malicious activity we weren’t detecting. Talking through these concerns with the security team helped me better understand the risk and motivations of the attackers, learn about the patterns of behavior and resources, and build up the relationship between groups.

You can’t have perfect security, but you can collaborate with other parts of the organization to establish acceptable levels of security. The amount of security work that every organization needs to do to achieve “acceptable levels of security” cannot be distilled and assigned to one team, especially as the attacks evolve and become more costly to detect or repair. In this chapter, I focus on sharing general security principles so you can define security, explain threat modeling, and have a few methods for communicating security values during architecture planning.

What Is Infrastructure Security?

Infrastructure security protects hardware, software, networks, and data from harm, theft, or unauthorized access. Unfortunately, many people view security as being at odds with desirable features and user convenience, which can exacerbate ...