Now, even in a cloud environment such as ours, we still have to consider those
security
implementations.
And I wanted to make sure that we go through and highlight some of the areas of
focus
that we'll be covering.
And don't worry, we'll be covering software development, lifecycle, CI/CD,
things like
that in more detail as we go throughout this skill.
But the bullet point list that I have above this video is going to give us a
brief overview
of everything that we have to consider as security technicians. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of everything that we have to consider as security technicians.
Now you may be thinking to yourself, hey wait a minute, we're working on the
network
side of the house and we are working to make sure that our services are
available to the
clients and customers for our organization.
And you would be correct.
But when we get to this point of our actual implementation and development of
our cloud
services, we have to be thinking like a security technician.
And for some of you out there, that's where you may know me from because I do a
lot of
the security stuff here at CBT Nuggets.
Now we do have to start off by defining our security requirements. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we do have to start off by defining our security requirements.
This will tell us if we need to go through and implement anything like an ACL
or restricted
access to make sure that people aren't accessing different pieces of data that
they're not
supposed to be accessing.
The reason for this is because all through this cycle, we have to make sure
that the CIA
triad is maintained confidentiality, integrity, and availability.
And defining those security requirements in accordance to that CIA triad allow WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And defining those security requirements in accordance to that CIA triad allow
us to
be able to go through and do that because the rest of this falls in one of
those three sections
of the CIA triad.
And then we concern ourselves with securing database access.
There's going to be a lot of information going back and forth into our
organization and
especially in that cloud environment.
And database access is going to be critical for not only the services involved,
but also
the actual data that's being stored within them and making sure that the access
is maintained
ensures accessibility, integrity, confidentiality. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ensures accessibility, integrity, confidentiality.
And that's because there could be information pertaining to the actual systems.
Let's say API information is in there.
Let's say configurations that we've stored for implementation of new equipment
is stored
in there because I store backups of basic configs not necessarily with the
passwords
in them or anything like that.
But if an attacker was able to get into our database and I don't want to use
the term database WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the term database
as an overall catch all, I want to say just accessing data within our
organization, whether
it be on a database or in a file server could be on a client's workstation,
whatever the
case may be.
But if that attacker was able to go in there and get that kind of information
concerning
basic configurations for devices within the infrastructure, well, then we got a
problem
because now we know the basics or the attacker knows the basics of how
information is supposed
to flow in and outside of the organization and kind of can build a network map. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to flow in and outside of the organization and kind of can build a network map.
In terms of actual threat hunting and threat analysis, this is the point of the
cycle where
the attacker is going through and doing recon.
But we also want to make sure that we encode the data.
So even if the attacker does get access to that database or wherever the data
is stored,
data is encoded to where we maintained confidentiality.
We have input validation and we've seen where we have other programs within the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We have input validation and we've seen where we have other programs within the
Cisco
environment, such as the Marockie API platform that we did in the last skill.
Input validation would be critical in that area because if we input in commands
that don't
necessarily work with specific devices that we're trying to configure, it could
mess
up access across the network messing with accessibility.
And let's say in the last skill, we're actually trying to go through and do a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's say in the last skill, we're actually trying to go through and do a
show syslog and
that was an incorrect command.
But if I was actually trying to configure something in there that messed up the
syslog monitoring
and flow of where the actual logs go, that might overcrowd the network, send
redundant traffic
and open us up to a possible sniffing of the network because those logs aren't
necessarily
going where they're supposed to be going.
And then we have implement access controls.
Now, one of the reasons that I have implement access controls on here is
because even though
we've already talked about making sure that database access and information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we've already talked about making sure that database access and information
access is secure,
we have to know who does have access and who's not allowed to have access.
These are implemented through techniques like white listing, black listing,
making sure
that we're allowing folks to be able to go in and get the stuff that they're
required
or authorized to have and making sure that folks that aren't authorized to have
it don't
get to it.
This is the difference between authentication and authorization.
While we may have plenty of users within our organization, regardless of the
cloud infrastructure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
cloud infrastructure
that we use, authentication is going to be the intrigate for our users within
the organization
to be able to get onto the actual device or network.
Authorization is going to say, well, you logged in, but now are you able to
utilize this
resource?
You may not have permissions and you may not want to give overall broader
permissions to
the spectrum of the users based on the fact that we have information and
resources within
our cloud infrastructure that may be restricted could be a regulation, could be WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our cloud infrastructure that may be restricted could be a regulation, could be
a jurisdiction
thing, could be an organizational requirement such as like separation of duties
and separation
of departments within our organization.
You see, a lot of these are basing their ideas and techniques off of the basic
security
skills that we get courses like CompTIA Security Plus here on CBT Nuggets.
Now all this is kind of starting to wrap up with logging.
If you've been in my courses before, you know that this is one of my nitpicky WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If you've been in my courses before, you know that this is one of my nitpicky
points because
there's never too much logging.
We have to make sure that what we're doing is actually working.
In order for us to be able to do that, we have to do have a compare and
contrast moment.
If traffic's going in and out based on the actual access control list, input
validation techniques
and everything else that we've covered up to this point, how do we know that it
's doing
what it's supposed to be doing?
And that's where we have security logging because those devices are going to be
able to report
back to us and tell us if things are working as intended or not. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
back to us and tell us if things are working as intended or not.
And then we get the or not from the compare and contrast model and where we
take the results
of what's actually happening and compare it to what's actually supposed to
happen.
Our implementation of access control that we covered previously compared to the
actual
logging.
So we do it with test accounts.
We have a sandbox environment like we practiced on the past few skills, things
like that.
And this also ties hand in hand with continuous monitoring. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this also ties hand in hand with continuous monitoring.
And that's where we're going to start wrapping up on this portion of the skill
before we start
moving in to the software development lifecycle because continuous monitoring
dovetails straight
into SDLC because every portion of the SDLC should be monitored along with all
of our security
techniques that we've implemented up to this point.
Now the reason for this is because just like we talked about in security
logging, we're
trying to see if it works or if it doesn't work or if we wanted to work a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
trying to see if it works or if it doesn't work or if we wanted to work a
different way
monitoring effectively gives us that oversight to make those changes, whether
they be on the
fly or pre planned.
These are just few things to think about as we start going through the rest of
the skill
and as a security technician inside of that Cisco cloud infrastructure, making
sure that
we keep these thoughts in the back of our mind and a checklist of some sort
because there's
never too much logging.
To go through and make sure that we're doing everything as intended for the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
To go through and make sure that we're doing everything as intended for the
organization
and that we're following a certain flow to make sure that even though we're
confident in
what we're implementing as far as let's say net, net comp, we're double
checking and going
back behind ourselves and also with an independent validator because you know,
two sets of values
are better than one and making sure that everything works as intended because
not the primary
You can figure that we may put in may not always be working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
You can figure that we may put in may not always be working.