Software's service applications are often accessible from just about anywhere,
especially if it's something on the internet.
Now, this changes a little bit inside that DOD environment where we have those
private networks that are hosted internally on their own infrastructure.
But basically, if you're on the internet and you have a SaaS operation being
hosted by somebody out there, you could access it from generally anywhere.
And this makes it to where identity and access management is a primary security
concern to make sure that the proper people within our organization have proper WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
concern to make sure that the proper people within our organization have proper
access and privileges to the data being hosted within the applications on the
provider's responsibility side.
And what we get into talking about protecting data and more importantly
protecting those people that the data actually belongs to,
identity and access management can help us safeguard specific pieces of data
that may have statutory requirements tied to them like GDPR and HIPAA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that may have statutory requirements tied to them like GDPR and HIPAA.
Now, this is broken down into two responsibility areas because we're looking at
this from a customer's perspective and also the actual provider's perspective.
So, let's take a look real quick.
Now, for the customer, their responsibility, since we're looking at the actual
people in data here, their responsibility is going to be for configuring the
identity and access management settings, whether that be through the actual
program access that they have sent to them by the actual provider in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
program access that they have sent to them by the actual provider in the
application,
or if it's something that they have on the actual files themselves that's
categorized within that data.
But more importantly, it's the customer's responsibility to define roles and
manage those user permissions for that overall authentication and authorization
.
It's also a part of the customer's responsibility to be able to monitor and
audit that user activity for security compliance.
Because we don't want to just take anybody's word for it, we want to make sure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because we don't want to just take anybody's word for it, we want to make sure
that there's actually a mechanism in place to be able to ensure that the proper
credentials have been submitted for the actual access to the data and the
authorization has been given out as well.
Basically, somebody within our organization allowing user X to be able access
data Y.
Now, the provider's responsibility, we look at managing the underlying
infrastructure, including authentication mechanisms and basic access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
infrastructure, including authentication mechanisms and basic access control
tools.
Now, we don't want to really confuse this with the customer's responsibility
and the fact that it's the customer that's defining the roles and managing the
user permissions.
It's the provider's responsibility to take those definitions and apply them to
the authentication mechanisms and access control tools that are in place at the
application and above level.
Cisco WebEx and Cisco umbrella offer a bunch of built-in identity access
management features like integration with corporate directories and single sign WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
management features like integration with corporate directories and single sign
-on.
And single sign-on is really important because that allows us to be able to
take advantage of things like OAuth 2.0, which we previously discussed.
It allows us to be able to pass that key back and forth instead of sending
those user credentials.
So it's taking out one possible failure point and replacing it with the fact
that we have something that's being sent that's encrypted and also not the user
's credentials.
And when we look deeper in the weeds and take a look at different methods of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And when we look deeper in the weeds and take a look at different methods of
user authentication, we want to also consider that there is still password
based authentication out there, whether it be on an actual file, a folder, or
let's say password for access into a particular site or service.
But more importantly, we want to be able to kind of push in that security world
, single sign-on, multi-factor authentication and OAuth 2 to be able to pass
that token back and forth and not the actual credentials. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that token back and forth and not the actual credentials.
Now since the customer is defining who has what privileges and rights to be
able to access data or create different things inside of that cloud environment
, we have role-based access controls or RVAC.
And this basically allows the administrators within our organization to define
user roles and permissions to limit access based on job responsibilities.
Now for example, let's say inside of Cisco WebEx administrators can control who
can create meetings, access recordings, and manage user settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can create meetings, access recordings, and manage user settings.
It may not be in the organization's best interest to allow just anybody to be
able to report anything inside of WebEx.
We may want to put some actual limitations on that based on who the actual user
is if they're internal or external to our organization.
There's a lot of different factors that surround that.
We can also use federated identity management and this allows organizations to
use external identity providers, for example, Active Directory and LDAP for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
use external identity providers, for example, Active Directory and LDAP for
managing access to those different SAS applications.
So let's say our organization is primarily a Windows Active Directory
environment.
We can incorporate that specific type of login and credentialing to allow
permissions and authentication inside of our Cisco applications and not have to
create different username and passwords for the actual users themselves.
It plays more into that single sign-on environment, but this is just one other
possibility of allowing administrators within our organization to be able to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
possibility of allowing administrators within our organization to be able to
control access and maintain oversight of what's actually going on within our
data.
All right, well let's look at some of the best practices inside of identity
access management for our software as a service.
Now we did talk about multi-factor authentication and we do want to stress the
importance of adding that extra layer of security through MFA to protect
against unauthorized access.
For example, in Cisco Duo MFA solutions are integrated with that actual WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For example, in Cisco Duo MFA solutions are integrated with that actual
software as a service platform because it's ingrained inside of that
application layer and making sure that it's available to the users in our
organizations for management.
We also want to implement some sort of monitor and audit access because
regularly auditing user access and permissions to identify any unusual activity
or overprivileged accounts cuts down on possible security flaws within our
organization.
Let's say we want to consider onboarding and onboarding employees that have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let's say we want to consider onboarding and onboarding employees that have
certain permissions to different types of data within the organization or
access to different meetings inside of Cisco WebEx.
Using our audit controls and being able to monitor user activity allows us to
be able to put in more security on top of that actual data.
And we want to constantly try to keep to the least privilege principle when we
implement least privilege access.
We're ensuring that users only have the minimum necessary provisions to form WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're ensuring that users only have the minimum necessary provisions to form
their task.
And we definitely want to make sure that we're limiting administrative
privileges inside of all of our different applications, whether they be Cisco
or not.
To select your users to prevent misuse of critical features.
Now in a perfect world, it's only going to be our users within our
organizations going to be accessing our services.
But there will be a time in regular world where we have users from external
organizations that are accessing our data and resources. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
organizations that are accessing our data and resources.
And we want to make sure that we're applying the same principles to the
external users that we are applying to internal.
Just because they're an external user doesn't mean they fall outside of our
security controls.
And in terms of software as a service and the customer's responsibility, it's
on us and especially the ones we designate as administrators to go through and
make sure that access inside of our applications on the provider side are releg
ated to users that have a need to know and maintain that least privilege access, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ated to users that have a need to know and maintain that least privilege access,
especially for those external users.