In order to understand, what are we trying to guard against?
The first thing we really need to know
is, what are we trying to protect?
What are our assets?
And in this particular Nugget, we're
going to talk about what the assets to a different business
may be.
And then we'll jump into later discussions
on how we can protect them.
So let's get going talking about assets.
So the first thing coming right out of the gate
that we need to talk about when we're
talking about our assets and the things that we want to protect
is our people.
Our people are our assets.
HR will obviously tell you that our most valuable asset WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
HR will obviously tell you that our most valuable asset
is our people.
And we need to protect them from cyber criminals.
I mean, that seems kind of silly when you first think about it,
but here's a very, very harsh reality.
This is going to be a tough pill to digest,
but this is the honest truth hackers.
Hackers want to injure people.
There are systems out there right
now in the industrial manufacturing-- maybe
think of a fertilizer plant or something like that.
When a hacker takes over a system that
controls pressure valves in a manufacturing plant, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
controls pressure valves in a manufacturing plant,
that could blow up the plant and kill people.
And that is exactly what some criminals
are trying to do right now.
They're legitimately trying to injure your staff.
But beyond that, they can prey on your staff too.
They can prey on weaknesses and vulnerabilities that
are within the people themselves,
because they just want to be helpful
or they don't recognize that what is happening
in the first place is a threat.
We're going to talk about this a lot more when
we talk about social engineering and phishing
in an upcoming Nugget.
But the first thing, the number one priority WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But the first thing, the number one priority
that you should have as a cybersecurity professional is
focusing on the people and how we can protect people
from harmful actors in the world.
Our next asset that we're going to be talking about
is our data.
Now data seems like a kind of obvious one,
but hackers may want to attack our data
in many different ways.
For instance, maybe we have a product
that we have a trademark or copyright on,
and hackers want to X filter-- they want to get that data so WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and hackers want to X filter-- they want to get that data so
that they can use it to recreate their own product to compete
with us.
This is obviously a common attack vector,
because they're trying to steal our competitive advantage.
But another way that our data is valuable to us
is maybe we have top secret information,
like this is a government act.
Hackers love to attack political institutions trying to steal
top secret information.
The military information and military secrets,
to try and leverage that against the people through propaganda
or leaking.
Outside of the fact that they can steal the data,
they can also corrupt the data, such that we can't even WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
they can also corrupt the data, such that we can't even
use it in the first place, which would cripple our business
and bring it to its knees.
Because data is incredibly important to us.
It's what drives our decisions on how
we should steer our business or organization
in the first place.
And then one of the last assets that we're going to talk about
and then we're going to tie it all together
is going to be our own systems themselves.
This isn't necessarily talking about the data,
which is living on a disk, but how the data moves
or how the data is available in the first place WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or how the data is available in the first place
within our systems.
If an attacker takes down our systems
and we can't access our data, that becomes a huge problem.
Beyond that, once a hacker is within the systems,
they have total visibility into what goes on.
They can see who's doing what and where this is happening.
They can choose to encrypt the data.
Or even at a most basic level, maybe
we have a website where customers log into the website
and make purchases.
If this no longer is available, then all of a sudden
we have no sales and that really hurts our business too.
So before you begin any information security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So before you begin any information security
or cybersecurity journey, you need
to understand what it is that you're truly trying
to protect in the first place.
We're trying to protect our people.
We're trying to protect our data, or information,
or any intellectual property that
may belong to us that gives us a competitive advantage.
And then we're trying to protect the availability and the health
of our systems in the first place.
So once you understand all of these assets
that are going on here--
Let me clear up some screen here for me.
Once you understand these assets that belong to us,
we need to start categorizing them WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we need to start categorizing them
and the associating values with them.
For instance, is this a physical asset
or is it a software asset?
Who is responsible for the asset?
Who's the owner of the asset?
Who maintains the asset?
Those are going to be important things to know.
You may have someone who is ultimately responsible, they
call this an owner, While somebody else maintains
the asset.
This could be something called--
sometimes it's called a custodian.
And in other technologies like, Microsoft Azure, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And in other technologies like, Microsoft Azure,
instead of custodian, they might call it an operator.
And then, of course, you have end users themselves
who might use the tool but aren't responsible for it.
Then you have to classify how important is it
or how sensitive is it.
This could be something in government terms,
like secret or top secret, or is it publicly available?
In private entities they might just
refer to this as public versus confidential.
And the cool thing about assigning these categories
to it like, who is responsible and what
is its level of sensitivity?
This is something that comes out of the gate WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is something that comes out of the gate
with a lot of different software or Cloud providers.
Check this out.
Let me clear the screen and I'll actually bring Microsoft Azure
up into the portal.
You don't need to know this for an exam environment.
This is just a demonstration.
But I wanted you to see it.
You see here, we have administrators,
which are basically the owners in the Azure ecosphere.
And then if we scroll down, we can
see some other things like, readers, which
is going to be an end user.
We can also see things like the operators,
like this security operator.
So you can see kind of right here,
there's the three categories we were just talking about. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there's the three categories we were just talking about.
The administrator would be the owner.
The operator would be who maintains it
during the day to day usage.
And the security reader would be someone
who can view the information but can't really interact with it.
Beyond that, when we deploy resources in Azure,
we have the ability to give them tags
so that we can categorize our data.
So we could deploy an application that
might host sensitive information and we
can tag it with sensitive.
Whereas, we may create an application
that we publish for the entire world
and we could tag that with public. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and we could tag that with public.
So this introduces the main points of what an asset is
and how you can classify it within your organization.
In the next Nugget, we're going to be talking
more about what our vulnerabilities are
then we'll bring it altogether when we talk about threats.
I hope this has been informative for you
and I'd like to thank you for viewing.