It seems that this last holiday season didn’t bring much cheer or goodwill to corporate security teams. With the public disclosure of remotely exploitable vulnerabilities and backdoors in the products of several well-known security vendors, many corporate security teams spent a great deal of time yanking cables, adding new firewall rules, and monitoring their networks with extra vigilance.

It’s not the first time that products from major security vendors have been found wanting.

It feels as though some vendor’s host-based security defenses fail on a monthly basis, while network defense appliances fail less frequently – maybe twice per year. At least that’s what a general perusal of press coverage may lead you to believe.

> See also: Six network security checks to mitigate the risk of data security breaches

However, the reality is quite different. Most security vendors fix and patch security weaknesses on a monthly basis. Generally, the issues are ones that they themselves have identified (through internal SDL processes or the use of third-party code reviews and assessment) or they are issues identified by customers.

And, every so often, critical security flaws will be 'dropped' on the vendor by an independent researcher or security company that need to be fixed quickly.

Two decades ago, the terms 'bastion host', DMZ, and 'firewall' pretty much summed up the core concepts of network security, and it was a simpler time for most organisations – both for vendors and their customers. The threat spectrum was relatively narrow, the attacks largely manual, and an organisation’s online presence consisted of mostly static material.

Yet, even then, if you picked up a book on network security you were instructed in no short order that you needed to keep your networks separate; one for the Internet, one for your backend applications, one for your backups, and a separate one for managing your security technology.

Since that time, many organisations have either forgotten these basic principles or have intentionally opted for riskier (yet cheaper) architectures and just hoping that their protection technologies are up to the task.

Alas, as the events of December 2015 have shown us, every device added to a network introduces a new set of security challenges and weaknesses.

From a network security perspective, when looking at the architecture of critical defenses, there are four core principles:

Devices capable of monitoring or manipulating network traffic should never have their management interfaces directly connected to the Internet.

If these security devices need to be managed over the Internet it is critical that only encrypted protocols be used, multi-factor authentication be employed, and that approved in-bound management IP addresses be whitelisted at a minimum.

> See also: The 2016 cyber security roadmap

The management and alerting interfaces of security appliances must be on a 'management' network – separated from other corporate and public networks.

It should not be possible for an attacker who may have compromised a security device to leverage the management network to move laterally onto other guest systems or provide a route to the Internet.

Span ports and network taps that observe Internet and internal corporate traffic should by default only operate in 'read-only' mode.

A compromised security monitoring appliance should never be capable of modifying network traffic or communicating with the Internet from such an observation port.