WEBVTT 1 00:00.000 --> 00:04.080 Now, since we're still on the topic of shared responsibility, along with that 2 00:04.080 --> 00:08.730 comes the actual security portion of it and patch management is something that 3 00:08.730 --> 00:13.000 you and I have been together on throughout many different skills and courses 4 00:13.000 --> 00:14.500 here on CBT nuggets. 5 00:14.500 --> 00:20.050 But it's imperative inside of the shared responsibility model, especially for 6 00:20.050 --> 00:24.690 the cloud infrastructure that we're dealing with based on whether it's software 7 00:24.690 --> 00:26.000 platform or infrastructure. 8 00:26.000 --> 00:30.960 That we understand the roles responsibilities between the client and the actual WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:26.000 --> 00:30.960 That we understand the roles responsibilities between the client and the actual 9 00:30.960 --> 00:33.000 service provider for that cloud. 10 00:33.000 --> 00:38.000 And we're going to be walking through these as I keep the I think it's this way 11 00:38.000 --> 00:43.340 , but the actual images that we used from the last portion of the skill to keep 12 00:43.340 --> 00:48.190 an eye on what's actually going on because we had the customer and the actual 13 00:48.190 --> 00:53.000 provider listed for who they were responsible for in terms of services. 14 00:53.000 --> 00:57.810 And the same thing applies to the actual patch management and security 15 00:57.810 --> 01:03.230 responsibilities as well because the customer and the software is a service WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 15 00:57.810 --> 01:03.230 responsibilities as well because the customer and the software is a service 16 01:03.230 --> 01:09.000 build is generally responsible for minimal or no patching whatsoever. 17 01:09.000 --> 01:13.000 But there is still stuff that's out there that's required of them. 18 01:13.000 --> 01:17.210 For instance, we want to make sure that our users are always up to date on 19 01:17.210 --> 01:21.810 their security awareness training and the user acceptance policies that our 20 01:21.810 --> 01:26.370 service provider may have instated for us to follow because we don't want our 21 01:26.370 --> 01:31.570 users or data acting up in such a way to where goes against the terms and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 01:26.370 --> 01:31.570 users or data acting up in such a way to where goes against the terms and 22 01:31.570 --> 01:33.000 policies of our cloud provider. 23 01:33.000 --> 01:36.750 Because even though it may be okay for our organization, it might not be 24 01:36.750 --> 01:40.000 acceptable for the cloud provider that we're utilizing. 25 01:40.000 --> 01:44.060 And this can vary in between the different ones that are out there, be it AWS, 26 01:44.060 --> 01:48.000 Azure, whatever the case may be, it's just something to keep in mind. 27 01:48.000 --> 01:53.650 Now on the back end of that, the provider is definitely responsible for patch 28 01:53.650 --> 01:59.000 ing the application software and also the middleware and databases. 29 01:59.000 --> 02:03.320 That includes actual firmware updates on the physical hardware itself and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 29 01:59.000 --> 02:03.320 That includes actual firmware updates on the physical hardware itself and 30 02:03.320 --> 02:07.660 making sure that some of the physical components are within spec and making 31 02:07.660 --> 02:11.250 sure they're still working because as we all know for those of us that have 32 02:11.250 --> 02:14.000 been working in several rooms for long enough things go bad. 33 02:14.000 --> 02:18.550 And we need to make sure that those hard drives that have gone bad inside of 34 02:18.550 --> 02:23.430 the raid or the NAS, whatever the cloud provider is using is maintained well 35 02:23.430 --> 02:27.880 enough that we have spare components and that way we don't lose any kind of 36 02:27.880 --> 02:30.000 service for our customer base. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 02:30.000 --> 02:35.260 And as we move on to the actual platform as a service, we see that along with 38 02:35.260 --> 02:39.600 the responsibility of applications being added so does come the security 39 02:39.600 --> 02:42.000 patches that go with those applications. 40 02:42.000 --> 02:45.550 Because the customer at this point is going to have full control over the 41 02:45.550 --> 02:48.000 applications along with the data and people. 42 02:48.000 --> 02:53.400 So there's just adding to the responsibilities of patch management in this 43 02:53.400 --> 02:59.080 particular instance and that application responsibility goes from the cut, 44 02:59.080 --> 03:01.000 excuse me, from the provider to the actual customer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 02:59.080 --> 03:01.000 excuse me, from the provider to the actual customer. 45 03:01.000 --> 03:05.270 Now the provider is still responsible for a good bit that you see on the actual 46 03:05.270 --> 03:09.280 screen above and everything from the runtime all the way to the physical 47 03:09.280 --> 03:14.000 network and everything in between is going to be that provider's responsibility 48 03:14.000 --> 03:14.000 . 49 03:14.000 --> 03:18.660 And then when we finally go over to infrastructure as a service, you can see 50 03:18.660 --> 03:23.000 that a lot of the patch management falls on us as the actual customer. 51 03:23.000 --> 03:26.280 Everything from the actual virtual network all the way to the people and 52 03:26.280 --> 03:29.680 everything in between is stuff that we're going to have to start keeping in 53 03:29.680 --> 03:33.460 mind and building our actual patch management and security maintenance planning WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 53 03:29.680 --> 03:33.460 mind and building our actual patch management and security maintenance planning 54 03:33.460 --> 03:34.000 around. 55 03:34.000 --> 03:39.570 Because as the provider is only responsible for really the physical hardware at 56 03:39.570 --> 03:44.870 this point, the application, the software applications are going to fall 57 03:44.870 --> 03:48.620 directly on us because everything is virtualized, everything from the actual 58 03:48.620 --> 03:52.000 virtual networks all the way down to the applications and to include. 59 03:52.000 --> 03:57.290 People in data as well, but if anything goes wrong at this point, it could 60 03:57.290 --> 04:02.490 possibly fall on us based on our terms of use and except we use our policies WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 60 03:57.290 --> 04:02.490 possibly fall on us based on our terms of use and except we use our policies 61 04:02.490 --> 04:07.090 with the actual provider because some of those security patches that are out 62 04:07.090 --> 04:11.500 there may not just affect the actual applications and virtual machines that are 63 04:11.500 --> 04:14.000 running inside of our actual cloud environment. 64 04:14.000 --> 04:19.390 But they could affect some of the hardware applications as well, but overall 65 04:19.390 --> 04:25.000 there is a shared responsibility between the customer and the actual provider. 66 04:25.000 --> 04:29.530 And this is to make sure that we have automated patch management tools in place 67 04:29.530 --> 04:33.860 to be able to allow both the actual customer and the cloud provider to be able WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 04:29.530 --> 04:33.860 to be able to allow both the actual customer and the cloud provider to be able 68 04:33.860 --> 04:37.870 to go through and make sure patches are being installed on a regularly 69 04:37.870 --> 04:39.000 scheduled basis. 70 04:39.000 --> 04:44.770 And those that are involved be it the customer or the cloud provider or stay 71 04:44.770 --> 04:47.000 and do to fleet informed. 72 04:47.000 --> 04:52.050 We've kind of covered this in the past and one of the things that we don't want 73 04:52.050 --> 04:57.020 to do is pop and update on somebody during the peak work hours and have those 74 04:57.020 --> 04:59.000 services interrupted. 75 04:59.000 --> 05:03.850 So this is where the actual customer or whoever's maintaining the customer side WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 04:59.000 --> 05:03.850 So this is where the actual customer or whoever's maintaining the customer side 76 05:03.850 --> 05:08.180 be it for admin rights or whatever the case may be has to be working hand in 77 05:08.180 --> 05:12.960 hand with the cloud provider to make sure that everybody's in sync and on the 78 05:12.960 --> 05:17.510 same sheet of music for making sure that patches are installed at a schedule 79 05:17.510 --> 05:20.000 agreed upon by both parties. 80 05:20.000 --> 05:25.040 Now we're also going to touch on vulnerability assessments as well because as 81 05:25.040 --> 05:30.030 that shared responsibility shifts from more of the customer or customer and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 81 05:25.040 --> 05:30.030 that shared responsibility shifts from more of the customer or customer and 82 05:30.030 --> 05:32.000 provider and back and forth. 83 05:32.000 --> 05:35.000 Vulnerability assessment still have to happen. 84 05:35.000 --> 05:40.310 And the roles of the customer dictate how much vulnerability assessment they're 85 05:40.310 --> 05:45.910 going to be able to do. For instance, let's take a look at the actual platform 86 05:45.910 --> 05:51.000 as a service infrastructure and see that we have applications involved. 87 05:51.000 --> 05:55.020 So when we go in and do our vulnerability assessments, we can have a pretty 88 05:55.020 --> 05:58.890 clear field of execution on vulnerability assessments against those 89 05:58.890 --> 06:00.000 applications. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 90 06:00.000 --> 06:04.230 But if we'd start drifting off into some of the middleware and operating 91 06:04.230 --> 06:09.100 systems that may not be something allowed in our terms of agreement with the 92 06:09.100 --> 06:13.000 actual cloud provider because they may look at it as an intrusion. 93 06:13.000 --> 06:16.460 So this would definitely be something that we have to work out between the 94 06:16.460 --> 06:19.890 customer and the actual cloud provider to make sure that vulnerability 95 06:19.890 --> 06:23.000 assessments are done and the same goes the other way around. 96 06:23.000 --> 06:27.790 You don't want your cloud provider dig it around in your applications in the 97 06:27.790 --> 06:32.000 platform as a service model because we may not be expecting it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 97 06:27.790 --> 06:32.000 platform as a service model because we may not be expecting it. 98 06:32.000 --> 06:36.280 But if there's an agreed upon the frequency of vulnerability assessments and 99 06:36.280 --> 06:40.690 the shared responsibility goes back and forth, our security team can be able to 100 06:40.690 --> 06:44.590 pick up on what's actually going on and not call the law enforcement for 101 06:44.590 --> 06:47.000 something like a vulnerability scan. 102 06:47.000 --> 06:51.600 And with those vulnerability scans also comes the roles and responsibilities of 103 06:51.600 --> 06:53.000 compliance and audits. 104 06:53.000 --> 06:56.850 And jurisdiction for some of these cloud infrastructure environments based on 105 06:56.850 --> 07:00.000 where the customer or the actual cloud service provider is at. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 106 07:00.000 --> 07:04.450 And it's imperative to know that based on those jurisdictions, some compliance 107 07:04.450 --> 07:08.000 measures have to be taken as far as like audits are concerned. 108 07:08.000 --> 07:12.940 Some of these audits could be patch management requirements or could be data 109 07:12.940 --> 07:17.860 compliance as well, something like HIPAA for whatever the case may be because 110 07:17.860 --> 07:23.750 we want to make sure that we are within our legal good to go for our clients 111 07:23.750 --> 07:29.000 not only for the customer side, but also for the cloud infrastructure side. 112 07:29.000 --> 07:33.240 And all of this ties in together about making sure that we are communicating WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 112 07:29.000 --> 07:33.240 And all of this ties in together about making sure that we are communicating 113 07:33.240 --> 07:37.600 between the customers, which is us, the folks that are utilizing that cloud 114 07:37.600 --> 07:42.410 service, whether it be software platform or infrastructure as a service and 115 07:42.410 --> 07:47.080 working with that cloud provider to make sure the constant communication is 116 07:47.080 --> 07:51.510 taking place for everything that we've covered throughout the majority of the 117 07:51.510 --> 07:52.000 skill. 118 07:52.000 --> 07:56.430 Because we touched on, you know, security assessments and vulnerability scans 119 07:56.430 --> 08:00.760 running and that is something that definitely has to be communicated along with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 119 07:56.430 --> 08:00.760 running and that is something that definitely has to be communicated along with 120 08:00.760 --> 08:05.080 some of those automatic controls that we've touched on as well, such as storage 121 08:05.080 --> 08:06.000 expansion. 122 08:06.000 --> 08:09.850 What if there is a storage expansion that automatically takes place that 123 08:09.850 --> 08:14.000 increases the cost on the actual customer and we weren't tracking it well. 124 08:14.000 --> 08:18.120 Constantly communication is key to make sure that we don't get surprised with a 125 08:18.120 --> 08:23.000 bill at the end of the month that we weren't expecting.