WEBVTT 1 00:00.000 --> 00:04.390 Software's service applications are often accessible from just about anywhere, 2 00:04.390 --> 00:06.720 especially if it's something on the internet. 3 00:06.720 --> 00:10.530 Now, this changes a little bit inside that DOD environment where we have those 4 00:10.530 --> 00:13.960 private networks that are hosted internally on their own infrastructure. 5 00:13.960 --> 00:19.270 But basically, if you're on the internet and you have a SaaS operation being 6 00:19.270 --> 00:23.480 hosted by somebody out there, you could access it from generally anywhere. 7 00:23.480 --> 00:29.210 And this makes it to where identity and access management is a primary security 8 00:29.210 --> 00:33.980 concern to make sure that the proper people within our organization have proper WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:29.210 --> 00:33.980 concern to make sure that the proper people within our organization have proper 9 00:33.980 --> 00:39.320 access and privileges to the data being hosted within the applications on the 10 00:39.320 --> 00:41.240 provider's responsibility side. 11 00:41.240 --> 00:45.720 And what we get into talking about protecting data and more importantly 12 00:45.720 --> 00:49.480 protecting those people that the data actually belongs to, 13 00:49.480 --> 00:55.760 identity and access management can help us safeguard specific pieces of data 14 00:55.760 --> 01:01.760 that may have statutory requirements tied to them like GDPR and HIPAA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 14 00:55.760 --> 01:01.760 that may have statutory requirements tied to them like GDPR and HIPAA. 15 01:01.760 --> 01:07.070 Now, this is broken down into two responsibility areas because we're looking at 16 01:07.070 --> 01:12.640 this from a customer's perspective and also the actual provider's perspective. 17 01:12.640 --> 01:14.480 So, let's take a look real quick. 18 01:14.480 --> 01:19.810 Now, for the customer, their responsibility, since we're looking at the actual 19 01:19.810 --> 01:24.070 people in data here, their responsibility is going to be for configuring the 20 01:24.070 --> 01:28.810 identity and access management settings, whether that be through the actual 21 01:28.810 --> 01:33.620 program access that they have sent to them by the actual provider in the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 01:28.810 --> 01:33.620 program access that they have sent to them by the actual provider in the 22 01:33.620 --> 01:34.480 application, 23 01:34.480 --> 01:39.300 or if it's something that they have on the actual files themselves that's 24 01:39.300 --> 01:41.480 categorized within that data. 25 01:41.480 --> 01:46.670 But more importantly, it's the customer's responsibility to define roles and 26 01:46.670 --> 01:51.230 manage those user permissions for that overall authentication and authorization 27 01:51.230 --> 01:51.480 . 28 01:51.480 --> 01:55.570 It's also a part of the customer's responsibility to be able to monitor and 29 01:55.570 --> 01:58.480 audit that user activity for security compliance. 30 01:58.480 --> 02:02.770 Because we don't want to just take anybody's word for it, we want to make sure WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:58.480 --> 02:02.770 Because we don't want to just take anybody's word for it, we want to make sure 31 02:02.770 --> 02:07.560 that there's actually a mechanism in place to be able to ensure that the proper 32 02:07.560 --> 02:12.800 credentials have been submitted for the actual access to the data and the 33 02:12.800 --> 02:14.480 authorization has been given out as well. 34 02:14.480 --> 02:21.550 Basically, somebody within our organization allowing user X to be able access 35 02:21.550 --> 02:22.480 data Y. 36 02:22.480 --> 02:26.900 Now, the provider's responsibility, we look at managing the underlying 37 02:26.900 --> 02:31.820 infrastructure, including authentication mechanisms and basic access control WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 02:26.900 --> 02:31.820 infrastructure, including authentication mechanisms and basic access control 38 02:31.820 --> 02:32.480 tools. 39 02:32.480 --> 02:36.830 Now, we don't want to really confuse this with the customer's responsibility 40 02:36.830 --> 02:41.110 and the fact that it's the customer that's defining the roles and managing the 41 02:41.110 --> 02:42.480 user permissions. 42 02:42.480 --> 02:47.190 It's the provider's responsibility to take those definitions and apply them to 43 02:47.190 --> 02:51.580 the authentication mechanisms and access control tools that are in place at the 44 02:51.580 --> 02:53.480 application and above level. 45 02:53.480 --> 02:58.440 Cisco WebEx and Cisco umbrella offer a bunch of built-in identity access 46 02:58.440 --> 03:04.120 management features like integration with corporate directories and single sign WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 46 02:58.440 --> 03:04.120 management features like integration with corporate directories and single sign 47 03:04.120 --> 03:04.480 -on. 48 03:04.480 --> 03:08.200 And single sign-on is really important because that allows us to be able to 49 03:08.200 --> 03:12.480 take advantage of things like OAuth 2.0, which we previously discussed. 50 03:12.480 --> 03:16.020 It allows us to be able to pass that key back and forth instead of sending 51 03:16.020 --> 03:17.480 those user credentials. 52 03:17.480 --> 03:21.320 So it's taking out one possible failure point and replacing it with the fact 53 03:21.320 --> 03:25.290 that we have something that's being sent that's encrypted and also not the user 54 03:25.290 --> 03:26.480 's credentials. 55 03:26.480 --> 03:30.360 And when we look deeper in the weeds and take a look at different methods of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 55 03:26.480 --> 03:30.360 And when we look deeper in the weeds and take a look at different methods of 56 03:30.360 --> 03:34.430 user authentication, we want to also consider that there is still password 57 03:34.430 --> 03:39.880 based authentication out there, whether it be on an actual file, a folder, or 58 03:39.880 --> 03:46.480 let's say password for access into a particular site or service. 59 03:46.480 --> 03:51.380 But more importantly, we want to be able to kind of push in that security world 60 03:51.380 --> 03:56.510 , single sign-on, multi-factor authentication and OAuth 2 to be able to pass 61 03:56.510 --> 04:00.480 that token back and forth and not the actual credentials. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 61 03:56.510 --> 04:00.480 that token back and forth and not the actual credentials. 62 04:00.480 --> 04:05.140 Now since the customer is defining who has what privileges and rights to be 63 04:05.140 --> 04:10.180 able to access data or create different things inside of that cloud environment 64 04:10.180 --> 04:13.480 , we have role-based access controls or RVAC. 65 04:13.480 --> 04:19.040 And this basically allows the administrators within our organization to define 66 04:19.040 --> 04:24.480 user roles and permissions to limit access based on job responsibilities. 67 04:24.480 --> 04:29.080 Now for example, let's say inside of Cisco WebEx administrators can control who 68 04:29.080 --> 04:33.480 can create meetings, access recordings, and manage user settings. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 04:29.080 --> 04:33.480 can create meetings, access recordings, and manage user settings. 69 04:33.480 --> 04:38.520 It may not be in the organization's best interest to allow just anybody to be 70 04:38.520 --> 04:41.480 able to report anything inside of WebEx. 71 04:41.480 --> 04:45.960 We may want to put some actual limitations on that based on who the actual user 72 04:45.960 --> 04:49.480 is if they're internal or external to our organization. 73 04:49.480 --> 04:51.480 There's a lot of different factors that surround that. 74 04:51.480 --> 04:56.200 We can also use federated identity management and this allows organizations to 75 04:56.200 --> 05:01.090 use external identity providers, for example, Active Directory and LDAP for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 04:56.200 --> 05:01.090 use external identity providers, for example, Active Directory and LDAP for 76 05:01.090 --> 05:04.480 managing access to those different SAS applications. 77 05:04.480 --> 05:07.630 So let's say our organization is primarily a Windows Active Directory 78 05:07.630 --> 05:08.480 environment. 79 05:08.480 --> 05:13.500 We can incorporate that specific type of login and credentialing to allow 80 05:13.500 --> 05:19.020 permissions and authentication inside of our Cisco applications and not have to 81 05:19.020 --> 05:24.480 create different username and passwords for the actual users themselves. 82 05:24.480 --> 05:29.410 It plays more into that single sign-on environment, but this is just one other 83 05:29.410 --> 05:34.370 possibility of allowing administrators within our organization to be able to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 83 05:29.410 --> 05:34.370 possibility of allowing administrators within our organization to be able to 84 05:34.370 --> 05:38.950 control access and maintain oversight of what's actually going on within our 85 05:38.950 --> 05:39.480 data. 86 05:39.480 --> 05:43.560 All right, well let's look at some of the best practices inside of identity 87 05:43.560 --> 05:46.480 access management for our software as a service. 88 05:46.480 --> 05:50.620 Now we did talk about multi-factor authentication and we do want to stress the 89 05:50.620 --> 05:54.520 importance of adding that extra layer of security through MFA to protect 90 05:54.520 --> 05:56.480 against unauthorized access. 91 05:56.480 --> 06:02.090 For example, in Cisco Duo MFA solutions are integrated with that actual WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 91 05:56.480 --> 06:02.090 For example, in Cisco Duo MFA solutions are integrated with that actual 92 06:02.090 --> 06:06.440 software as a service platform because it's ingrained inside of that 93 06:06.440 --> 06:10.760 application layer and making sure that it's available to the users in our 94 06:10.760 --> 06:12.480 organizations for management. 95 06:12.480 --> 06:16.970 We also want to implement some sort of monitor and audit access because 96 06:16.970 --> 06:22.240 regularly auditing user access and permissions to identify any unusual activity 97 06:22.240 --> 06:27.100 or overprivileged accounts cuts down on possible security flaws within our 98 06:27.100 --> 06:28.480 organization. 99 06:28.480 --> 06:33.000 Let's say we want to consider onboarding and onboarding employees that have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 06:28.480 --> 06:33.000 Let's say we want to consider onboarding and onboarding employees that have 100 06:33.000 --> 06:37.670 certain permissions to different types of data within the organization or 101 06:37.670 --> 06:40.480 access to different meetings inside of Cisco WebEx. 102 06:40.480 --> 06:46.330 Using our audit controls and being able to monitor user activity allows us to 103 06:46.330 --> 06:50.480 be able to put in more security on top of that actual data. 104 06:50.480 --> 06:54.520 And we want to constantly try to keep to the least privilege principle when we 105 06:54.520 --> 06:56.480 implement least privilege access. 106 06:56.480 --> 07:00.830 We're ensuring that users only have the minimum necessary provisions to form WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 106 06:56.480 --> 07:00.830 We're ensuring that users only have the minimum necessary provisions to form 107 07:00.830 --> 07:01.480 their task. 108 07:01.480 --> 07:04.790 And we definitely want to make sure that we're limiting administrative 109 07:04.790 --> 07:08.880 privileges inside of all of our different applications, whether they be Cisco 110 07:08.880 --> 07:09.480 or not. 111 07:09.480 --> 07:13.480 To select your users to prevent misuse of critical features. 112 07:13.480 --> 07:17.260 Now in a perfect world, it's only going to be our users within our 113 07:17.260 --> 07:20.480 organizations going to be accessing our services. 114 07:20.480 --> 07:25.990 But there will be a time in regular world where we have users from external 115 07:25.990 --> 07:30.480 organizations that are accessing our data and resources. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 115 07:25.990 --> 07:30.480 organizations that are accessing our data and resources. 116 07:30.480 --> 07:33.970 And we want to make sure that we're applying the same principles to the 117 07:33.970 --> 07:36.480 external users that we are applying to internal. 118 07:36.480 --> 07:40.260 Just because they're an external user doesn't mean they fall outside of our 119 07:40.260 --> 07:41.480 security controls. 120 07:41.480 --> 07:45.770 And in terms of software as a service and the customer's responsibility, it's 121 07:45.770 --> 07:51.480 on us and especially the ones we designate as administrators to go through and 122 07:51.480 --> 07:57.400 make sure that access inside of our applications on the provider side are releg 123 07:57.400 --> 08:03.190 ated to users that have a need to know and maintain that least privilege access, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 123 07:57.400 --> 08:03.190 ated to users that have a need to know and maintain that least privilege access, 124 08:03.190 --> 08:05.480 especially for those external users.