WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:03.067 align:middle line:90%
In order to understand, what
are we trying to guard against?

3
00:03.067 --> 00:04.650 align:middle line:90%
The first thing we
really need to know

4
00:04.650 --> 00:06.390 align:middle line:90%
is, what are we
trying to protect?

5
00:06.390 --> 00:07.950 align:middle line:84%
What are our assets?

6
00:07.950 --> 00:09.450 align:middle line:90%
And in this particular
Nugget, we're

7
00:09.450 --> 00:12.270 align:middle line:90%
going to talk about what the
assets to a different business

8
00:12.270 --> 00:13.170 align:middle line:84%
may be.

9
00:13.170 --> 00:15.120 align:middle line:90%
And then we'll jump
into later discussions

10
00:15.120 --> 00:16.660 align:middle line:84%
on how we can protect them.

11
00:16.660 --> 00:18.780 align:middle line:90%
So let's get going
talking about assets.

12
00:18.780 --> 00:20.760 align:middle line:90%
So the first thing coming
right out of the gate

13
00:20.760 --> 00:22.410 align:middle line:90%
that we need to talk
about when we're

14
00:22.410 --> 00:25.410 align:middle line:90%
talking about our assets and the
things that we want to protect

15
00:25.410 --> 00:27.300 align:middle line:84%
is our people.

16
00:27.300 --> 00:29.130 align:middle line:84%
Our people are our assets.

17
00:29.130 --> 00:32.220 align:middle line:90%
HR will obviously tell you
that our most valuable asset
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

17
00:29.130 --> 00:32.220 align:middle line:90%
HR will obviously tell you
that our most valuable asset

18
00:32.220 --> 00:33.000 align:middle line:84%
is our people.

19
00:33.000 --> 00:35.970 align:middle line:90%
And we need to protect
them from cyber criminals.

20
00:35.970 --> 00:39.420 align:middle line:90%
I mean, that seems kind of silly
when you first think about it,

21
00:39.420 --> 00:42.128 align:middle line:90%
but here's a very,
very harsh reality.

22
00:42.128 --> 00:43.920 align:middle line:90%
This is going to be a
tough pill to digest,

23
00:43.920 --> 00:46.650 align:middle line:90%
but this is the
honest truth hackers.

24
00:46.650 --> 00:48.060 align:middle line:84%
Hackers want to injure people.

25
00:48.060 --> 00:49.740 align:middle line:90%
There are systems
out there right

26
00:49.740 --> 00:52.170 align:middle line:90%
now in the industrial
manufacturing-- maybe

27
00:52.170 --> 00:54.750 align:middle line:90%
think of a fertilizer plant
or something like that.

28
00:54.750 --> 00:57.120 align:middle line:90%
When a hacker takes
over a system that

29
00:57.120 --> 01:00.510 align:middle line:90%
controls pressure valves
in a manufacturing plant,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:57.120 --> 01:00.510 align:middle line:90%
controls pressure valves
in a manufacturing plant,

30
01:00.510 --> 01:03.480 align:middle line:90%
that could blow up the
plant and kill people.

31
01:03.480 --> 01:05.760 align:middle line:90%
And that is exactly
what some criminals

32
01:05.760 --> 01:06.930 align:middle line:84%
are trying to do right now.

33
01:06.930 --> 01:10.020 align:middle line:90%
They're legitimately trying
to injure your staff.

34
01:10.020 --> 01:12.450 align:middle line:90%
But beyond that, they can
prey on your staff too.

35
01:12.450 --> 01:15.395 align:middle line:90%
They can prey on weaknesses
and vulnerabilities that

36
01:15.395 --> 01:16.770 align:middle line:90%
are within the
people themselves,

37
01:16.770 --> 01:18.660 align:middle line:90%
because they just
want to be helpful

38
01:18.660 --> 01:21.390 align:middle line:90%
or they don't recognize
that what is happening

39
01:21.390 --> 01:22.833 align:middle line:84%
in the first place is a threat.

40
01:22.833 --> 01:24.750 align:middle line:90%
We're going to talk about
this a lot more when

41
01:24.750 --> 01:27.270 align:middle line:90%
we talk about social
engineering and phishing

42
01:27.270 --> 01:28.590 align:middle line:84%
in an upcoming Nugget.

43
01:28.590 --> 01:30.630 align:middle line:90%
But the first thing,
the number one priority
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:28.590 --> 01:30.630 align:middle line:90%
But the first thing,
the number one priority

44
01:30.630 --> 01:34.110 align:middle line:90%
that you should have as a
cybersecurity professional is

45
01:34.110 --> 01:37.680 align:middle line:90%
focusing on the people and
how we can protect people

46
01:37.680 --> 01:40.295 align:middle line:90%
from harmful actors
in the world.

47
01:40.295 --> 01:42.420 align:middle line:90%
Our next asset that we're
going to be talking about

48
01:42.420 --> 01:43.870 align:middle line:84%
is our data.

49
01:43.870 --> 01:46.350 align:middle line:90%
Now data seems like a
kind of obvious one,

50
01:46.350 --> 01:49.050 align:middle line:90%
but hackers may want
to attack our data

51
01:49.050 --> 01:50.740 align:middle line:84%
in many different ways.

52
01:50.740 --> 01:53.370 align:middle line:90%
For instance, maybe
we have a product

53
01:53.370 --> 01:56.250 align:middle line:90%
that we have a trademark
or copyright on,

54
01:56.250 --> 02:00.030 align:middle line:90%
and hackers want to X filter--
they want to get that data so
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:56.250 --> 02:00.030 align:middle line:90%
and hackers want to X filter--
they want to get that data so

55
02:00.030 --> 02:03.180 align:middle line:90%
that they can use it to recreate
their own product to compete

56
02:03.180 --> 02:03.900 align:middle line:84%
with us.

57
02:03.900 --> 02:05.880 align:middle line:90%
This is obviously a
common attack vector,

58
02:05.880 --> 02:08.820 align:middle line:90%
because they're trying to steal
our competitive advantage.

59
02:08.820 --> 02:10.949 align:middle line:90%
But another way that our
data is valuable to us

60
02:10.949 --> 02:13.350 align:middle line:90%
is maybe we have top
secret information,

61
02:13.350 --> 02:14.880 align:middle line:84%
like this is a government act.

62
02:14.880 --> 02:18.630 align:middle line:90%
Hackers love to attack political
institutions trying to steal

63
02:18.630 --> 02:20.200 align:middle line:84%
top secret information.

64
02:20.200 --> 02:22.920 align:middle line:90%
The military information
and military secrets,

65
02:22.920 --> 02:26.580 align:middle line:90%
to try and leverage that against
the people through propaganda

66
02:26.580 --> 02:27.510 align:middle line:84%
or leaking.

67
02:27.510 --> 02:29.910 align:middle line:90%
Outside of the fact that
they can steal the data,

68
02:29.910 --> 02:32.730 align:middle line:90%
they can also corrupt the
data, such that we can't even
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:29.910 --> 02:32.730 align:middle line:90%
they can also corrupt the
data, such that we can't even

69
02:32.730 --> 02:35.610 align:middle line:90%
use it in the first place,
which would cripple our business

70
02:35.610 --> 02:36.930 align:middle line:84%
and bring it to its knees.

71
02:36.930 --> 02:39.180 align:middle line:90%
Because data is incredibly
important to us.

72
02:39.180 --> 02:41.820 align:middle line:90%
It's what drives
our decisions on how

73
02:41.820 --> 02:43.920 align:middle line:90%
we should steer our
business or organization

74
02:43.920 --> 02:44.737 align:middle line:84%
in the first place.

75
02:44.737 --> 02:47.320 align:middle line:90%
And then one of the last assets
that we're going to talk about

76
02:47.320 --> 02:49.112 align:middle line:90%
and then we're going
to tie it all together

77
02:49.112 --> 02:51.510 align:middle line:90%
is going to be our own
systems themselves.

78
02:51.510 --> 02:54.040 align:middle line:90%
This isn't necessarily
talking about the data,

79
02:54.040 --> 02:57.030 align:middle line:90%
which is living on a disk,
but how the data moves

80
02:57.030 --> 03:00.060 align:middle line:90%
or how the data is
available in the first place
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:57.030 --> 03:00.060 align:middle line:90%
or how the data is
available in the first place

81
03:00.060 --> 03:01.290 align:middle line:84%
within our systems.

82
03:01.290 --> 03:03.030 align:middle line:90%
If an attacker takes
down our systems

83
03:03.030 --> 03:06.660 align:middle line:90%
and we can't access our data,
that becomes a huge problem.

84
03:06.660 --> 03:09.390 align:middle line:90%
Beyond that, once a hacker
is within the systems,

85
03:09.390 --> 03:12.360 align:middle line:90%
they have total visibility
into what goes on.

86
03:12.360 --> 03:15.300 align:middle line:90%
They can see who's doing what
and where this is happening.

87
03:15.300 --> 03:17.130 align:middle line:90%
They can choose to
encrypt the data.

88
03:17.130 --> 03:19.200 align:middle line:90%
Or even at a most
basic level, maybe

89
03:19.200 --> 03:22.920 align:middle line:90%
we have a website where
customers log into the website

90
03:22.920 --> 03:23.910 align:middle line:84%
and make purchases.

91
03:23.910 --> 03:26.610 align:middle line:90%
If this no longer is
available, then all of a sudden

92
03:26.610 --> 03:29.370 align:middle line:90%
we have no sales and that
really hurts our business too.

93
03:29.370 --> 03:32.070 align:middle line:90%
So before you begin any
information security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:29.370 --> 03:32.070 align:middle line:90%
So before you begin any
information security

94
03:32.070 --> 03:33.960 align:middle line:90%
or cybersecurity
journey, you need

95
03:33.960 --> 03:36.270 align:middle line:90%
to understand what it is
that you're truly trying

96
03:36.270 --> 03:37.890 align:middle line:84%
to protect in the first place.

97
03:37.890 --> 03:39.720 align:middle line:90%
We're trying to
protect our people.

98
03:39.720 --> 03:42.330 align:middle line:90%
We're trying to protect
our data, or information,

99
03:42.330 --> 03:44.310 align:middle line:90%
or any intellectual
property that

100
03:44.310 --> 03:47.193 align:middle line:90%
may belong to us that gives
us a competitive advantage.

101
03:47.193 --> 03:49.860 align:middle line:90%
And then we're trying to protect
the availability and the health

102
03:49.860 --> 03:51.790 align:middle line:90%
of our systems in
the first place.

103
03:51.790 --> 03:54.180 align:middle line:90%
So once you understand
all of these assets

104
03:54.180 --> 03:55.180 align:middle line:84%
that are going on here--

105
03:55.180 --> 03:57.090 align:middle line:90%
Let me clear up some
screen here for me.

106
03:57.090 --> 03:59.730 align:middle line:90%
Once you understand these
assets that belong to us,

107
03:59.730 --> 04:01.410 align:middle line:90%
we need to start
categorizing them
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.730 --> 04:01.410 align:middle line:90%
we need to start
categorizing them

108
04:01.410 --> 04:03.550 align:middle line:90%
and the associating
values with them.

109
04:03.550 --> 04:06.180 align:middle line:90%
For instance, is
this a physical asset

110
04:06.180 --> 04:08.760 align:middle line:84%
or is it a software asset?

111
04:08.760 --> 04:11.110 align:middle line:90%
Who is responsible
for the asset?

112
04:11.110 --> 04:13.020 align:middle line:84%
Who's the owner of the asset?

113
04:13.020 --> 04:14.811 align:middle line:84%
Who maintains the asset?

114
04:14.811 --> 04:16.769 align:middle line:90%
Those are going to be
important things to know.

115
04:16.769 --> 04:19.350 align:middle line:90%
You may have someone who is
ultimately responsible, they

116
04:19.350 --> 04:22.440 align:middle line:90%
call this an owner, While
somebody else maintains

117
04:22.440 --> 04:23.010 align:middle line:84%
the asset.

118
04:23.010 --> 04:24.390 align:middle line:84%
This could be something called--

119
04:24.390 --> 04:26.490 align:middle line:90%
sometimes it's
called a custodian.

120
04:26.490 --> 04:30.060 align:middle line:90%
And in other technologies
like, Microsoft Azure,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
04:26.490 --> 04:30.060 align:middle line:90%
And in other technologies
like, Microsoft Azure,

121
04:30.060 --> 04:33.060 align:middle line:90%
instead of custodian, they
might call it an operator.

122
04:33.060 --> 04:35.520 align:middle line:90%
And then, of course, you
have end users themselves

123
04:35.520 --> 04:38.350 align:middle line:90%
who might use the tool but
aren't responsible for it.

124
04:38.350 --> 04:40.890 align:middle line:90%
Then you have to classify
how important is it

125
04:40.890 --> 04:42.447 align:middle line:84%
or how sensitive is it.

126
04:42.447 --> 04:44.280 align:middle line:90%
This could be something
in government terms,

127
04:44.280 --> 04:47.202 align:middle line:90%
like secret or top secret,
or is it publicly available?

128
04:47.202 --> 04:48.660 align:middle line:90%
In private entities
they might just

129
04:48.660 --> 04:51.690 align:middle line:90%
refer to this as public
versus confidential.

130
04:51.690 --> 04:54.540 align:middle line:90%
And the cool thing about
assigning these categories

131
04:54.540 --> 04:57.060 align:middle line:90%
to it like, who is
responsible and what

132
04:57.060 --> 04:58.890 align:middle line:84%
is its level of sensitivity?

133
04:58.890 --> 05:01.100 align:middle line:90%
This is something that
comes out of the gate
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
04:58.890 --> 05:01.100 align:middle line:90%
This is something that
comes out of the gate

134
05:01.100 --> 05:03.595 align:middle line:90%
with a lot of different
software or Cloud providers.

135
05:03.595 --> 05:04.220 align:middle line:84%
Check this out.

136
05:04.220 --> 05:07.400 align:middle line:90%
Let me clear the screen and I'll
actually bring Microsoft Azure

137
05:07.400 --> 05:08.260 align:middle line:84%
up into the portal.

138
05:08.260 --> 05:10.427 align:middle line:90%
You don't need to know this
for an exam environment.

139
05:10.427 --> 05:12.260 align:middle line:84%
This is just a demonstration.

140
05:12.260 --> 05:13.490 align:middle line:84%
But I wanted you to see it.

141
05:13.490 --> 05:15.810 align:middle line:90%
You see here, we
have administrators,

142
05:15.810 --> 05:18.643 align:middle line:90%
which are basically the
owners in the Azure ecosphere.

143
05:18.643 --> 05:20.060 align:middle line:90%
And then if we
scroll down, we can

144
05:20.060 --> 05:22.010 align:middle line:90%
see some other things
like, readers, which

145
05:22.010 --> 05:23.630 align:middle line:84%
is going to be an end user.

146
05:23.630 --> 05:25.700 align:middle line:90%
We can also see things
like the operators,

147
05:25.700 --> 05:27.500 align:middle line:84%
like this security operator.

148
05:27.500 --> 05:28.947 align:middle line:90%
So you can see
kind of right here,

149
05:28.947 --> 05:31.280 align:middle line:90%
there's the three categories
we were just talking about.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:28.947 --> 05:31.280 align:middle line:90%
there's the three categories
we were just talking about.

150
05:31.280 --> 05:33.560 align:middle line:90%
The administrator
would be the owner.

151
05:33.560 --> 05:35.630 align:middle line:90%
The operator would
be who maintains it

152
05:35.630 --> 05:37.640 align:middle line:84%
during the day to day usage.

153
05:37.640 --> 05:39.380 align:middle line:90%
And the security
reader would be someone

154
05:39.380 --> 05:42.260 align:middle line:90%
who can view the information but
can't really interact with it.

155
05:42.260 --> 05:45.170 align:middle line:90%
Beyond that, when we
deploy resources in Azure,

156
05:45.170 --> 05:47.240 align:middle line:90%
we have the ability
to give them tags

157
05:47.240 --> 05:48.995 align:middle line:90%
so that we can
categorize our data.

158
05:48.995 --> 05:51.620 align:middle line:90%
So we could deploy
an application that

159
05:51.620 --> 05:53.780 align:middle line:90%
might host sensitive
information and we

160
05:53.780 --> 05:55.340 align:middle line:84%
can tag it with sensitive.

161
05:55.340 --> 05:57.590 align:middle line:90%
Whereas, we may
create an application

162
05:57.590 --> 05:59.400 align:middle line:90%
that we publish for
the entire world

163
05:59.400 --> 06:01.430 align:middle line:90%
and we could tag
that with public.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
05:59.400 --> 06:01.430 align:middle line:90%
and we could tag
that with public.

164
06:01.430 --> 06:05.360 align:middle line:90%
So this introduces the main
points of what an asset is

165
06:05.360 --> 06:07.865 align:middle line:90%
and how you can classify it
within your organization.

166
06:07.865 --> 06:09.740 align:middle line:90%
In the next Nugget,
we're going to be talking

167
06:09.740 --> 06:11.900 align:middle line:90%
more about what our
vulnerabilities are

168
06:11.900 --> 06:14.523 align:middle line:90%
then we'll bring it altogether
when we talk about threats.

169
06:14.523 --> 06:16.190 align:middle line:90%
I hope this has been
informative for you

170
06:16.190 --> 06:18.850 align:middle line:90%
and I'd like to thank
you for viewing.