For those of you that have been in my skills or courses before, you know that I
like to hone in on data security and overall cyber security.
And that's because sometimes I do nefarious things on that side of the house in
terms of pin testing, all in the name of security. Am I right?
But here in the cloud infrastructure and especially in software as a service
where we have limited access inside of the main components of the services
being provided,
security is one of the most highlighted concerns that we have as an WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
security is one of the most highlighted concerns that we have as an
administrator, especially in Cisco Cloud environment.
One of the things you may hear me reiterate a good bit inside of the
cybersecurity courses here at CWT Nogins is data classification.
And because this allows us to be able to highlight the importance of protecting
sensitive data such as personally identifiable information or even financial
records.
We want to be able to classify data based on its sensitivity and apply the
appropriate security controls when needed or necessary. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that's especially important inside of software as a service in our cloud,
Cisco Cloud environment.
And that's because remember it's the clients responsibility to maintain
oversight of data and the people, but it's the provider's responsibility to
maintain application and beyond.
So it's really important for us to make sure that the information going in and
out of that actual infrastructure that's being handled by the provider is
maintained and properly classified within not only organizational specs for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
maintained and properly classified within not only organizational specs for
security classifications, but also any kind of jurisdiction requirements as we
've mentioned before, HIPAA, GDR, GDPR, and whatever the like.
Now being that we are using that cloud environment, it goes without saying that
the infrastructure in the applications and even the hardware that we're
utilizing through our web access is not on site at our current location within
the organization.
That means that any data going in and out of our processing for that cloud WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That means that any data going in and out of our processing for that cloud
environment is going to be on the internet or whatever public network that we
used to be able to get there.
And that's why it's also important to make sure that that security layer is
around that data going back and forth.
Now even though it's the provider's responsibility to maintain oversight of the
application and beyond, it's as we mentioned inside identity access management
earlier in the skill.
It's our responsibility as an organization to make sure that let's say we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's our responsibility as an organization to make sure that let's say we have
data encryption either through IP, SAC, TLS, going back and forth, making sure
that we're getting rid of all those plain text lines of communication going
back and forth.
And we want to make sure that we take advantage of every security measure
possible to us within our organization and that cloud infrastructure
environment.
Now we would be using things like the Cisco Secure Network Analytics to be able WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we would be using things like the Cisco Secure Network Analytics to be able
to track that information going back and forth and also keep an alarm going up
anytime that there's a plain text piece of information leaving the organization
or coming back inside.
We could even set up rules to where we can screen for that PIA, PIA, personally
identifiable information or let's say that we have a piece of information that
is classified secret or top secret for those inside the DOD realm.
See that's exactly what we do or what I used to do inside a DOD. I'm recently WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
See that's exactly what we do or what I used to do inside a DOD. I'm recently
retired. Remember that.
But whenever we would process information and we wanted to make sure that it
had the proper classifications on it, not only would we classify it based on
what network it was actually generated on, but the type of information that was
put into it.
Now a lot of this has to do with the actual policy of data classification
within the organization, but it also helps prevent common threats to the people WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
within the organization, but it also helps prevent common threats to the people
in data inside of our cloud.
Now a couple of those common threats may include like fishing and social
engineering because if everyday folks are outside of our organization are able
to get into our information and read what's going on.
As you are able to get let's say one piece of information here, another piece
of information there, another piece of information up there and piece it all
together.
You could potentially piece something together that could damage the our
organization if it's you put in wrong hands. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
organization if it's you put in wrong hands.
Social engineering does just that even if they're using stuff like open source
intelligence or something like fishing sending emails out to the organization.
But where does the threat get those emails from? Well, that's where we have to
figure out as the customer and the administrator within our organization, what
kind of information that we want to protect going in and out.
Because we can have all the scripts and all the different measures of adapt
ability within this software as a service. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ability within this software as a service.
But at the end of it, it still comes down on us security administrators to make
sure that we're maintaining everything within our policy and whatever else is
required of us based on the type of information being handled.
Now like it or not, one of the biggest threats that's always going to be out
there as a potential is going to be an insider threat.
So as a security administrator within the cloud infrastructure, we always have
to maintain oversight as to making sure that insiders are doing everything that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to maintain oversight as to making sure that insiders are doing everything that
they're supposed to be doing and not doing things that they're not supposed to
be doing.
So making sure that we explain that internal users must have legitimate access
to the data and the people within the organization.
But any kind of accident, whether it be on purpose or intentional, could cause
a reprimal damage to the organization.
And you wouldn't want your own personal information getting out there or your
businesses information getting out there, especially if you had something WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
businesses information getting out there, especially if you had something
proprietary.
Regardless of the cloud model that we are utilizing, whether it be software as
a service or some of the others will cover later on.
A lot of everything that we've been discussing inside of this particular area
of our skill falls within data governance.
And it's the tools and the responsibilities combined together that allow us to
be able to govern our data properly within the organization.