WEBVTT

1
00:00.000 --> 00:03.740
So we started off the skill by stating that people and data are the primary

2
00:03.740 --> 00:04.460
focus of our

3
00:04.460 --> 00:06.300
responsibility as customers.

4
00:06.300 --> 00:10.320
Seeing that provider covers the whole different spectrum of everything behind

5
00:10.320 --> 00:11.200
the scenes for

6
00:11.200 --> 00:12.200
us.

7
00:12.200 --> 00:16.270
Now as security specialists, we want to make sure that we're still keeping that

8
00:16.270 --> 00:16.740
people

9
00:16.740 --> 00:22.260
and data focused within the as a service platform taken care of.

10
00:22.260 --> 00:26.880
Now there are a couple of different areas that we really hone in on and yes, it

11
00:26.880 --> 00:27.420
is data

12
00:27.420 --> 00:31.640
and people, but here are a couple of ways that we actually do that.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:27.420 --> 00:31.640
and people, but here are a couple of ways that we actually do that.

13
00:31.640 --> 00:36.520
Starting off with our folks inside the organization, we have user behavior

14
00:36.520 --> 00:37.580
monitoring where we

15
00:37.580 --> 00:42.960
are tracking and analyzing user activities to detect unusual and or suspicious

16
00:42.960 --> 00:43.660
behavior

17
00:43.660 --> 00:47.800
that could indicate compromised accounts or insider threats, you know, like un

18
00:47.800 --> 00:48.380
authorized

19
00:48.380 --> 00:51.460
data access or log in from unusual locations.

20
00:51.460 --> 00:55.550
So even though we don't actually have ownership or responsibility of the

21
00:55.550 --> 00:56.740
applications within

22
00:56.740 --> 01:01.660
our software as a service platform, we still need to make sure that we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

22
00:56.740 --> 01:01.660
our software as a service platform, we still need to make sure that we're

23
01:01.660 --> 01:03.020
holding the CIA

24
01:03.020 --> 01:09.580
triad to its core by making sure that we're monitoring all that user activity.

25
01:09.580 --> 01:12.630
And it goes even further when we're looking at data protection because we're

26
01:12.630 --> 01:13.580
going to monitor

27
01:13.580 --> 01:19.260
data traffic to and from our SaaS applications, detecting any anomalies like

28
01:19.260 --> 01:20.500
data exfiltration

29
01:20.500 --> 01:25.680
or unauthorized access attempts and protecting sensitive information stored in

30
01:25.680 --> 01:26.700
or transmitted

31
01:26.700 --> 01:28.780
inside of our SaaS platforms.

32
01:28.780 --> 01:32.940
Now it may seem like a lot to be able to keep track of in terms of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

32
01:28.780 --> 01:32.940
Now it may seem like a lot to be able to keep track of in terms of the

33
01:32.940 --> 01:34.100
responsibility that

34
01:34.100 --> 01:39.560
we have inside of software as a service and based on the limited availability

35
01:39.560 --> 01:40.100
that we

36
01:40.100 --> 01:44.840
have to applications and beyond, don't get overwhelmed because there are

37
01:44.840 --> 01:45.900
different tools

38
01:45.900 --> 01:50.460
out there to be able to help us do this inside of that Cisco platform.

39
01:50.460 --> 01:55.220
Now what I have here on the screen, as you can see below right there, is the

40
01:55.220 --> 01:56.100
Cisco Secure

41
01:56.100 --> 02:00.630
Network Analytics and this used to be known as "StuffWatch Enterprise" and this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:56.100 --> 02:00.630
Network Analytics and this used to be known as "StuffWatch Enterprise" and this

42
02:00.630 --> 02:01.380
is just one

43
02:01.380 --> 02:05.560
of the tools that I mentioned in the previous skill that's been revamped and re

44
02:05.560 --> 02:06.300
-tooled to

45
02:06.300 --> 02:09.860
focus specifically on software as a service.

46
02:09.860 --> 02:13.980
Now this is just a demonstration from the actual Cisco side of the house and as

47
02:13.980 --> 02:14.540
you can see

48
02:14.540 --> 02:19.420
up on the actual address bar right here and I can put this link in below this

49
02:19.420 --> 02:19.940
actual

50
02:19.940 --> 02:20.940
video.

51
02:20.940 --> 02:25.280
I wanted to point out a couple of different things here as it lines up with

52
02:25.280 --> 02:26.780
securing the people

53
02:26.780 --> 02:31.370
and data that are the responsibility of the software as a service platform in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:26.780 --> 02:31.370
and data that are the responsibility of the software as a service platform in

54
02:31.370 --> 02:32.540
our structure.

55
02:32.540 --> 02:37.840
Now I do want to point out that Cisco Secure Network Analytics is not a seam or

56
02:37.840 --> 02:38.460
a sore.

57
02:38.460 --> 02:43.660
This actually plays into the bigger scope that is Cisco and provides data into

58
02:43.660 --> 02:45.620
Secure X.

59
02:45.620 --> 02:49.910
Now as we start to go through here, we're going to take a look at our dashboard

60
02:49.910 --> 02:50.500
and see

61
02:50.500 --> 02:55.870
that we have alarms based on the actual host themselves and different alarm

62
02:55.870 --> 02:56.620
types.

63
02:56.620 --> 03:01.670
This looks like your standard alert platform if you're familiar inside of that
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:56.620 --> 03:01.670
This looks like your standard alert platform if you're familiar inside of that

64
03:01.670 --> 03:02.740
cybersecurity

65
03:02.740 --> 03:04.100
realm.

66
03:04.100 --> 03:08.920
But as you notice, we have the alarm host set up to be able to identify

67
03:08.920 --> 03:10.540
different concerned

68
03:10.540 --> 03:16.050
areas with ironically concerned indexes our first one and if you notice here we

69
03:16.050 --> 03:16.380
have

70
03:16.380 --> 03:17.620
policy violation.

71
03:17.620 --> 03:22.300
Now I do want to point that out specifically because as a responsibility of us

72
03:22.300 --> 03:22.980
for people

73
03:22.980 --> 03:28.230
and data inside of software as a service, it's policy is going to be driving a

74
03:28.230 --> 03:28.940
lot of what

75
03:28.940 --> 03:35.860
we do inside of our area of focus for security and being able to align a secure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
03:28.940 --> 03:35.860
we do inside of our area of focus for security and being able to align a secure

76
03:35.860 --> 03:36.900
platform,

77
03:36.900 --> 03:42.260
let's say through network analytics to say are these technical controls that we

78
03:42.260 --> 03:42.980
're implementing

79
03:42.980 --> 03:46.620
aligning with our administrative controls is pretty handy.

80
03:46.620 --> 03:50.480
One of the other responsibilities that we have inside of software as a service,

81
03:50.480 --> 03:51.180
especially

82
03:51.180 --> 03:55.950
in our Cisco cloud platform is we're wanting to make sure that we have

83
03:55.950 --> 03:57.820
visibility into actual

84
03:57.820 --> 03:59.420
software usage.

85
03:59.420 --> 04:05.170
And that requires us to hone in on shadow IT or unsection SaaS applications
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
03:59.420 --> 04:05.170
And that requires us to hone in on shadow IT or unsection SaaS applications

86
04:05.170 --> 04:05.780
being used

87
04:05.780 --> 04:10.930
by employees because let's say that we have a policy and effect that tells our

88
04:10.930 --> 04:11.740
employees

89
04:11.740 --> 04:17.580
that they can only use so many types of programs that are on a white list.

90
04:17.580 --> 04:21.490
And for whatever reason, if an application is installed that processes data and

91
04:21.490 --> 04:22.220
appropriately

92
04:22.220 --> 04:26.250
according to our policy, we would be able to use network analytics to be able

93
04:26.250 --> 04:27.060
to configure

94
04:27.060 --> 04:33.670
a policy to go through and check for, let's say like data hoarding, you can see
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
04:27.060 --> 04:33.670
a policy to go through and check for, let's say like data hoarding, you can see

95
04:33.670 --> 04:34.460
that,

96
04:34.460 --> 04:37.260
make sure I can zoom in for you real quick.

97
04:37.260 --> 04:41.220
And part of our policy is making sure that we're only allowing approved SaaS

98
04:41.220 --> 04:42.060
applications

99
04:42.060 --> 04:46.990
that are in line not only with our organization, but also with the provider of

100
04:46.990 --> 04:48.220
our actual cloud

101
04:48.220 --> 04:50.260
platform and infrastructure.

102
04:50.260 --> 04:55.310
Now given that a lot that we do inside of our software as a service platform,

103
04:55.310 --> 04:55.860
there's

104
04:55.860 --> 05:01.110
a lot of API security concerns that take effect because like we mentioned, we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

104
04:55.860 --> 05:01.110
a lot of API security concerns that take effect because like we mentioned, we

105
05:01.110 --> 05:01.860
're not able

106
05:01.860 --> 05:05.440
to control anything past the applications because we're just focused on the

107
05:05.440 --> 05:06.220
actual people

108
05:06.220 --> 05:07.220
in data.

109
05:07.220 --> 05:11.310
And the next portion of the skill, we're actually going to be honing in on API

110
05:11.310 --> 05:11.940
security and

111
05:11.940 --> 05:16.620
making sure how unauthorized access is prevented inside of our SaaS operation.