What is Composite Security?

Organizations commonly face multimodal cyberattacks, where an attacker employs various mechanisms to attempt to crack an organization’s defenses. This threat is exacerbated by the rise of AI and automated attacks, which enable an attacker to efficiently develop and deploy multiple exploits against an organization. To protect against these complex, multimodal attacks, organizations must implement composite security.

What Gartner Means by Composite Security

Composite security is linked to the security principle of defense in depth, where an organization doesn’t rely on a single security control or solution to protect against cyber threats. This approach leaves the organization vulnerable if an attacker identifies a way to bypass or overcome their lone control.

Gartner defines composite security as a combination of multiple security strategies which may not be enough on their own, but in combination, serve to frustrate and impair an attacker. For example, an organization may combine obfuscation with advanced encryption or deception to implement defenses that are more robust than either could implement independently.

Design Principles of Composite Architectures

Composite architectures are the future of security, as organizations work to defend themselves and their IT assets against sophisticated, multimodal attacks. A composite architecture is built around several key principles.

Zero Single Point of Failure

A single point of failure (SPOF) is an IT asset, piece of software or logic, or process that is critical to a service or workflow. These are common targets for denial of service (DoS) attacks because overwhelming them or bringing them down breaks the system as a whole.

From a security perspective, no single solution or security control should be critical to an organization’s ability to protect itself against cyber threats. Implementing defense in depth within a composite architecture involves identifying critical security assets and ensuring that redundant systems are in place and unlikely to be impacted by the same attack that renders the primary one ineffective.

Layer Diversity

The primary objective of composite architectures and defense in depth is to ensure that an organization isn’t reliant on a single security control for protection. If this is the case, then an attacker who identifies a weakness in this control could exploit it and gain access to sensitive resources.

Implementing multiple instances of the same or similar controls provides limited benefit over a single line of defense. For example, if an attacker has a quantum computer that can break traditional public key cryptography, implementing two classical algorithms instead of one doesn’t protect an organization’s data. The various layers in an organization’s composite architecture should be diverse to maximize the probability that an attack that bypasses one will be blocked by another.

API-First Integration

Composite architectures are made possible by strong integration within an organization’s security architecture. When implementing complementary security controls, a level of coordination and integration is required to ensure that all layers are properly applied without impairing performance.

Application programming interfaces (APIs) are the logical means of implementing this integration. They allow a high degree of control without sacrificing flexibility and adaptability. More custom integrations and workflows can be brittle and may require redesign and reimplementation if a tool is updated or security solutions are added, removed, or updated.

Examples of Composite Patterns

Composite security architectures combine distinct security controls to implement security that is robust against attacks that might defeat one or the other. Some examples of composite patterns that an organization might implement include the following:

Client-Side Obfuscation + Server-Side Detonation

The combination of client-side obfuscation and server-side detonation is designed to protect an organization’s web applications against potential exploits. Both elements of this pattern provide security benefits, including:

• Client-Side Obfuscation: Code obfuscation is a common technique for increasing the difficulty of exploiting a web application. By making the logic of the application more difficult to understand, the obfuscation impairs an attacker’s ability to identify a vulnerability and craft an effective exploit for it.
• Server-Side Detonation: Server-side detonation of suspicious inputs to a web application runs the code in a hardened, sandboxed environment. This protects the organization’s systems against potential attacks and provides the ability to monitor and understand the malicious input.

Client-side obfuscation is not a strong security control since a sufficiently patient and resourced attacker can untangle the code’s logic and potentially identify an exploitable vulnerability. However, combining it with server-side detonation increases the difficulty of exploitation, while server-side detonation identifies and neutralizes various threats.

Encryption-in-Use with Adaptive Access Controls

This composite security pattern is designed to enhance the protection of highly sensitive data. The benefits of each element include:

• Encryption-in-Use: Encryption of data in use via homomorphic encryption or the use of a secure enclave increases the difficulty for an attacker to access sensitive data. Strong encryption prevents data from being read in memory, where it might otherwise be at risk.
• Adaptive Access Controls: Adaptive access controls tailor access policies based on the risk associated with requests. This allows easy access to data under normal conditions but enhanced protection if contextual data, such as location, user behavior, or other factors, points to greater risk.

This combination enhances an organization’s protection against potential data breaches. Encryption of data in use is a strong defense, assuming that an attacker hasn’t compromised a user account with the privileges needed to decrypt the data. Combining this control with adaptive access controls enhances the organization’s ability to identify and neutralize this threat.

Deception Mesh with Predictive Triggers

A deception mesh with predictive triggers implements adaptive deception to protect an organization’s IT assets. Key elements of this strategy include:

• Deception Mesh: A deception mesh implements an array of fake assets that are spread across an organization’s IT environment. Since these assets are fake resources, any interaction with them is a sign of an intrusion within an organization’s environment.
• Predictive Triggers: Predictive triggers monitor user behavior for anomalous or suspicious activities. If these are detected, the organization’s security architecture can respond to the threat.

In combination, these two solutions enhance the effectiveness of deceptive technology. When predictive triggers identify a potential intrusion, deceptive assets are strategically deployed to snare an attacker, confirming the potential threat and providing insight into the attack.

Aligning Composite Security with Preemptive Security Strategy

A preemptive security strategy focuses on identifying and blocking attacks before they happen. This involves using predictive threat intelligence, deception, and other techniques to identify early signs of an attack and allow the organization to respond to neutralize the threat before it can be executed.

An organization can implement preemptive security via a composite security strategy by combining predictive and detective controls with preventative and responsive ones. For example, the use of predictive triggers to inform the deployment of decoys in a deceptive mesh enables an organization to predict an attack and then head it off by strategically deploying deceptive assets.

Implementing Composite Security with IONIX

Composite security involves implementing multiple security controls to address each potential cybersecurity threat to the organization. To accomplish this, an organization needs visibility into its cyber attack surface and the potential threats that it is likely to face.

The IONIX platform offers visibility into an organization’s exposures from the attacker’s perspective via continuous asset discovery and simulated attacks. This provides insight into where additional, composite defenses may be needed where existing controls are inadequate to protect against real-world threats. 
To learn more about how IONIX can help your organization implement composite security, book a free demo.