Now, before we go back into our dashboard for some more simulation overview and
look at it at our sandbox as a whole,
I wanted to point out some API security concerns because our devices are going
to be utilized at API in order to perform different functions, whether it be
for security
or just general maintenance across the network and incorporate different
methods of
quick configs like XMLs or anything like that. And that's where we want to
implement things like OAuth or API keys to be able to add a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
implement things like OAuth or API keys to be able to add a
other layer of security for overall access in making sure that we secure and
limit who it has the permissions to go in and make some of these configurations
.
On top of that, we also want to incorporate something called API rate limiting.
And this is to allow us to prevent any kind of denial of service attack against
our API resources
and abuse against those same API functions restricting the actual flow of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and abuse against those same API functions restricting the actual flow of
traffic to the API calls within our network devices, not just the actual
ability to connect to them as an administrator overall,
ensures that we're able to limit and prevent any as much attacking as possible
to the actual API.
See, we don't want just anybody and everybody on our network to have access to
the under the hood portion of our car.
We want certified mechanics, right? Well, that's where us command at because we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We want certified mechanics, right? Well, that's where us command at because we
are the network technicians and administrators that are going to be doing a lot
of this security implementation.
Beyond that goes into things like securing the actual API with the method of
input validation.
We don't necessarily want just random commands put in and we may decide to even
limit some commands and access to different portions of our API overall.
So it would be wise as a security technician inside of that Cisco environment WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it would be wise as a security technician inside of that Cisco environment
and overall network infrastructure to be able to sit down and plot out whether
it be through policy or actual implementation.
The different types of calls that we make to our API and also maybe how we
limit the access to it to certain permission groups.
Now, that permission group flees me into that multifactor authentication as
well because we can use radius, attack x plus or even incorporate, let's say,
Windows Active Directory into our authentication fields WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Windows Active Directory into our authentication fields
and incorporate a failsafe like texting validation to a cell phone for a code
to enforce that multifactor authentication.
If we just use regular username and passwords on these devices, we potentially
are opening ourselves up to a basic security flaw inside of our network
because it could be that somebody's out there sniffing the wire, which we've
done in other courses here on CBT Nuggets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we want to make sure that we are using the latest and greatest encryption
that we're able to utilize it within our organization.
Each connection to our devices should be wrapped in TLS transport layer
security.
And if we're doing any kind of API work that is utilized in a web interface
like we're using right now, it should be using HTTPS over 4443 as one of our
common ports instead of HTTP.
Now by default, everything does come in HTTPS and TLS in our dash or sandbox WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now by default, everything does come in HTTPS and TLS in our dash or sandbox
dashboard here, but it may be that we're setting this up from scratch inside of
our own organization.
And as we are in a platform as a service model, we have actual hands on with
that application now, since it's one of our responsibilities to take charge and
configure it how we see fit.
In addition to how it aligns up with our organizations, policies, regulations
and any other requirements that we may have based on the jurisdiction that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and any other requirements that we may have based on the jurisdiction that we
're in before we were in software as a service.
And we were just utilizing the services that were provided to us by the
provider.
We would didn't really have too much access into things like we're in right now
.
And we were just making sure that we were able to access over a basic network
connection, a service that was provided for us that was generally through a web
browser like Gmail as we've used as an example before.
Now, if you've been moving through any of my other courses, you know that I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, if you've been moving through any of my other courses, you know that I
like to hammer home the fact that we love our logging and making sure that we
keep track of every change, every event that we can try to keep track of that
helps us be able to problem solve later on.
As that cyber security, excuse me, network technician, see, but we do the same
thing inside of monitoring the logging for our API inside of our platform as a
service and beyond.
We do as much as we can in software as a service, but now that we have the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We do as much as we can in software as a service, but now that we have the
actual applications, we can configure where some of those logs are sent.
And we can also configure later on if we want to utilize an IDS or IPS intr
usion detection system or intrusion prevention system to incorporate inside of
our security monitoring and send logs to maybe a seam inside of our
organization if we are utilizing one.
Just gives us that extra set of eyes in case anybody's doing something they're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Just gives us that extra set of eyes in case anybody's doing something they're
not supposed to make some mistake or we just want to keep in touch and see how
we're doing.