Identifying the threats in a software as a service model can sometimes be a
little bit difficult and that's due to the fact that we have the separation
between the people in data, which is the class responsibility and basically
everything else that belongs to the actual provider and is within their
oversight.
One of the things that we've taken to mind when we deal with stuff like this is
basically since the infrastructure is managed by that actual provider,
administrators may not have direct access to the logs and auditing that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
administrators may not have direct access to the logs and auditing that's
required for us as security managers to be able to make.
I don't want to say proper decisions, but also at the same time we don't have
all the information we need to be able to dive into let's say an incident. And
as an example, hold on once I want to show you something real quick.
Here we are back to our Cisco Secure Network Analytics and what we're taking a
look at here is just the overall dashboard.
Now we know that this is only going to be configurable based to the amount of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we know that this is only going to be configurable based to the amount of
access that we have on the individual systems, the actual users within the
organization, the data that's being processed back and forth, and ownership of
the actual network that we have.
Because even though we are utilizing a software as a service, there's still a
good bit of infrastructure within our own organization that is controlled by us
.
Because on the face of it, we have to have internet access to be able to access
stuff that's actually on the internet, right?
And this is no different when we're utilizing a software as a service platform, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is no different when we're utilizing a software as a service platform,
but we want to be able to incorporate security monitoring to be able to
identify threats and any kind of response to threat detection.
Now our next board is going to be able to allow us to see more than what's
actually just on the clients responsibility side.
And we'd actually get a tie-in of actual global threats, stuff that would
actually affect us directly because we do have to consider things like the
operating system or different methods of being able to access the data over the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
operating system or different methods of being able to access the data over the
public network.
And the one thing I want to point out is the top applications on the bottom
right should be wrapped over here.
And we can see here in this example from Cisco that we actually have a
collection of HTTPS traffic, NetFlow, SFB, which is more on the windows side of
the house.
So the proofs right here that even in this example, there's a lot of traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the proofs right here that even in this example, there's a lot of traffic
going internally between the windows systems and less to focus on the actual
network over all going back and forth.
See that back and forth is going to be traffic that we have that's utilizing
those specified programs that are being hosted by the actual provider.
Some of the things that we do want to keep track of are basic security features
and triggers that we would normally work on if we had an internal network that
was completely isolated. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
was completely isolated.
You know abnormal login offense machines to be in turn on and off randomly at
different time services being enabled when they weren't supposed to be messed
with data exfiltration attempts and changes to user permissions.
Because we do maintain user permissions and as we get with the actual provider
to tell them who it is, we won't have an access to what different programs.
False within that identity and access management role, but we do have to
monitor what it is that's going in and out of that request for IAM. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
monitor what it is that's going in and out of that request for IAM.
But what if something does happen at that application level and it's outside
the scope of the clients responsibility?
Well, I'm glad you asked because there are certain steps that we can take as
far as precautions are concerned to prepare ourselves for the eventuality that
we are going to have to respond to a threat that takes place across the
threshold of responsibility.
And one thing that we can do right off the bat is basically adjust user access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And one thing that we can do right off the bat is basically adjust user access
controls across our data and stored resources within that cloud infrastructure.
Because if a vulnerability has or a threat has been identified inside of that
cloud environment, we want to be able to do everything that we can to truly
isolate it.
Now, this kind of goes in line with the incidents response process and cycle
that we have in our security classes.
And this is applied no different here in the cloud environment, just in
different locations. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
different locations.
Now, we also want to make sure that we are truly enabling multi factor
authentication earlier. We discussed where a lot of keys and tokens were being
passed back and forth through OAuth.
But we may want to make verified that OAuth is not the only measure of success
when it comes to verifying access to a particular resource or folder within our
cloud infrastructure.
We want to have inside of MFA something like send a text with a verification
code to make sure that they are truly who they say they are with the devices WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
code to make sure that they are truly who they say they are with the devices
they say they are.
We also have to make sure that we're keeping in constant communication with
that actual provider to make sure that they're just as involved as monitoring
for incidents and threat detection as we are.
And part of that communication involves an agreement for us as security
managers to be able to say what can we monitor.
Because we know that there's a certain line that if we cross it and do our
folder ability scanning, let's say we're doing some sort of vulnerability WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
folder ability scanning, let's say we're doing some sort of vulnerability
assessment from within our organization to resources that we control by the
organization.
But those resources are housed in a platform that does not belong to us and it
's part of the provider's responsibility to maintain oversight.
Well, if we start doing vulnerability assessments on those systems, it may be
viewed as a malicious attempt and cause a lot of disruption and paperwork.
So one of the best pieces of advice that I can give you as far as how to deal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So one of the best pieces of advice that I can give you as far as how to deal
with incident response and threat detection is the same piece of advice that I
give everybody else in the cybersecurity realm.
Whether it's on an individual system or in a cloud infrastructure environment
like the one that we're going over now.
It's always to have an agreement and a policy in place on how to respond to
said incidents.
And whether it's working by yourself inside of the organization or more
preferably working with that provider in that handshake agreement or something
that's more solidified through let's say a memorandum of understanding or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that's more solidified through let's say a memorandum of understanding or
agreement.
It's making sure that we have a plan of action for any and all possibilities.
Now we won't know every single thing that's going to happen or could happen.
But we can definitely use lessons learned and also move forward with being able
to scan and monitor access logs and audit logs as much as possible to be able
to prepare ourselves.
And by incorporating the security measures that we covered throughout this
entire skill so far along with many many more that exist inside the Cisco realm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
entire skill so far along with many many more that exist inside the Cisco realm
.
We can do a better job of making sure that we're prepared for the eventuality
of an incident and work together with our provider to make sure that it's rem
ediated as quickly as possible.
responsible.