WEBVTT 1 00:00.000 --> 00:04.720 Identifying the threats in a software as a service model can sometimes be a 2 00:04.720 --> 00:08.630 little bit difficult and that's due to the fact that we have the separation 3 00:08.630 --> 00:13.000 between the people in data, which is the class responsibility and basically 4 00:13.000 --> 00:18.160 everything else that belongs to the actual provider and is within their 5 00:18.160 --> 00:19.000 oversight. 6 00:19.000 --> 00:23.490 One of the things that we've taken to mind when we deal with stuff like this is 7 00:23.490 --> 00:28.000 basically since the infrastructure is managed by that actual provider, 8 00:28.000 --> 00:33.830 administrators may not have direct access to the logs and auditing that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 8 00:28.000 --> 00:33.830 administrators may not have direct access to the logs and auditing that's 9 00:33.830 --> 00:38.000 required for us as security managers to be able to make. 10 00:38.000 --> 00:41.930 I don't want to say proper decisions, but also at the same time we don't have 11 00:41.930 --> 00:46.190 all the information we need to be able to dive into let's say an incident. And 12 00:46.190 --> 00:50.000 as an example, hold on once I want to show you something real quick. 13 00:50.000 --> 00:53.660 Here we are back to our Cisco Secure Network Analytics and what we're taking a 14 00:53.660 --> 00:56.000 look at here is just the overall dashboard. 15 00:56.000 --> 01:00.510 Now we know that this is only going to be configurable based to the amount of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 15 00:56.000 --> 01:00.510 Now we know that this is only going to be configurable based to the amount of 16 01:00.510 --> 01:04.950 access that we have on the individual systems, the actual users within the 17 01:04.950 --> 01:09.800 organization, the data that's being processed back and forth, and ownership of 18 01:09.800 --> 01:11.000 the actual network that we have. 19 01:11.000 --> 01:15.840 Because even though we are utilizing a software as a service, there's still a 20 01:15.840 --> 01:21.000 good bit of infrastructure within our own organization that is controlled by us 21 01:21.000 --> 01:21.000 . 22 01:21.000 --> 01:25.170 Because on the face of it, we have to have internet access to be able to access 23 01:25.170 --> 01:28.000 stuff that's actually on the internet, right? 24 01:28.000 --> 01:33.080 And this is no different when we're utilizing a software as a service platform, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 24 01:28.000 --> 01:33.080 And this is no different when we're utilizing a software as a service platform, 25 01:33.080 --> 01:37.800 but we want to be able to incorporate security monitoring to be able to 26 01:37.800 --> 01:42.000 identify threats and any kind of response to threat detection. 27 01:42.000 --> 01:45.850 Now our next board is going to be able to allow us to see more than what's 28 01:45.850 --> 01:49.000 actually just on the clients responsibility side. 29 01:49.000 --> 01:53.400 And we'd actually get a tie-in of actual global threats, stuff that would 30 01:53.400 --> 01:57.870 actually affect us directly because we do have to consider things like the 31 01:57.870 --> 02:04.000 operating system or different methods of being able to access the data over the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:57.870 --> 02:04.000 operating system or different methods of being able to access the data over the 32 02:04.000 --> 02:05.000 public network. 33 02:05.000 --> 02:11.480 And the one thing I want to point out is the top applications on the bottom 34 02:11.480 --> 02:15.000 right should be wrapped over here. 35 02:15.000 --> 02:20.450 And we can see here in this example from Cisco that we actually have a 36 02:20.450 --> 02:26.430 collection of HTTPS traffic, NetFlow, SFB, which is more on the windows side of 37 02:26.430 --> 02:27.000 the house. 38 02:27.000 --> 02:31.840 So the proofs right here that even in this example, there's a lot of traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 38 02:27.000 --> 02:31.840 So the proofs right here that even in this example, there's a lot of traffic 39 02:31.840 --> 02:37.500 going internally between the windows systems and less to focus on the actual 40 02:37.500 --> 02:41.000 network over all going back and forth. 41 02:41.000 --> 02:45.450 See that back and forth is going to be traffic that we have that's utilizing 42 02:45.450 --> 02:50.000 those specified programs that are being hosted by the actual provider. 43 02:50.000 --> 02:54.540 Some of the things that we do want to keep track of are basic security features 44 02:54.540 --> 02:59.060 and triggers that we would normally work on if we had an internal network that 45 02:59.060 --> 03:01.000 was completely isolated. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 02:59.060 --> 03:01.000 was completely isolated. 46 03:01.000 --> 03:05.820 You know abnormal login offense machines to be in turn on and off randomly at 47 03:05.820 --> 03:11.020 different time services being enabled when they weren't supposed to be messed 48 03:11.020 --> 03:15.000 with data exfiltration attempts and changes to user permissions. 49 03:15.000 --> 03:21.190 Because we do maintain user permissions and as we get with the actual provider 50 03:21.190 --> 03:25.000 to tell them who it is, we won't have an access to what different programs. 51 03:25.000 --> 03:29.630 False within that identity and access management role, but we do have to 52 03:29.630 --> 03:34.000 monitor what it is that's going in and out of that request for IAM. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 52 03:29.630 --> 03:34.000 monitor what it is that's going in and out of that request for IAM. 53 03:34.000 --> 03:38.980 But what if something does happen at that application level and it's outside 54 03:38.980 --> 03:42.000 the scope of the clients responsibility? 55 03:42.000 --> 03:45.400 Well, I'm glad you asked because there are certain steps that we can take as 56 03:45.400 --> 03:49.600 far as precautions are concerned to prepare ourselves for the eventuality that 57 03:49.600 --> 03:54.250 we are going to have to respond to a threat that takes place across the 58 03:54.250 --> 03:56.000 threshold of responsibility. 59 03:56.000 --> 04:01.680 And one thing that we can do right off the bat is basically adjust user access WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 59 03:56.000 --> 04:01.680 And one thing that we can do right off the bat is basically adjust user access 60 04:01.680 --> 04:08.000 controls across our data and stored resources within that cloud infrastructure. 61 04:08.000 --> 04:12.610 Because if a vulnerability has or a threat has been identified inside of that 62 04:12.610 --> 04:17.090 cloud environment, we want to be able to do everything that we can to truly 63 04:17.090 --> 04:18.000 isolate it. 64 04:18.000 --> 04:22.520 Now, this kind of goes in line with the incidents response process and cycle 65 04:22.520 --> 04:25.000 that we have in our security classes. 66 04:25.000 --> 04:29.360 And this is applied no different here in the cloud environment, just in 67 04:29.360 --> 04:31.000 different locations. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 04:29.360 --> 04:31.000 different locations. 68 04:31.000 --> 04:35.160 Now, we also want to make sure that we are truly enabling multi factor 69 04:35.160 --> 04:39.920 authentication earlier. We discussed where a lot of keys and tokens were being 70 04:39.920 --> 04:42.000 passed back and forth through OAuth. 71 04:42.000 --> 04:46.870 But we may want to make verified that OAuth is not the only measure of success 72 04:46.870 --> 04:52.010 when it comes to verifying access to a particular resource or folder within our 73 04:52.010 --> 04:54.000 cloud infrastructure. 74 04:54.000 --> 04:59.260 We want to have inside of MFA something like send a text with a verification 75 04:59.260 --> 05:04.400 code to make sure that they are truly who they say they are with the devices WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 75 04:59.260 --> 05:04.400 code to make sure that they are truly who they say they are with the devices 76 05:04.400 --> 05:06.000 they say they are. 77 05:06.000 --> 05:10.090 We also have to make sure that we're keeping in constant communication with 78 05:10.090 --> 05:14.310 that actual provider to make sure that they're just as involved as monitoring 79 05:14.310 --> 05:17.000 for incidents and threat detection as we are. 80 05:17.000 --> 05:21.850 And part of that communication involves an agreement for us as security 81 05:21.850 --> 05:25.000 managers to be able to say what can we monitor. 82 05:25.000 --> 05:29.980 Because we know that there's a certain line that if we cross it and do our 83 05:29.980 --> 05:34.350 folder ability scanning, let's say we're doing some sort of vulnerability WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 83 05:29.980 --> 05:34.350 folder ability scanning, let's say we're doing some sort of vulnerability 84 05:34.350 --> 05:39.830 assessment from within our organization to resources that we control by the 85 05:39.830 --> 05:41.000 organization. 86 05:41.000 --> 05:45.130 But those resources are housed in a platform that does not belong to us and it 87 05:45.130 --> 05:49.000 's part of the provider's responsibility to maintain oversight. 88 05:49.000 --> 05:53.790 Well, if we start doing vulnerability assessments on those systems, it may be 89 05:53.790 --> 05:58.000 viewed as a malicious attempt and cause a lot of disruption and paperwork. 90 05:58.000 --> 06:01.560 So one of the best pieces of advice that I can give you as far as how to deal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 90 05:58.000 --> 06:01.560 So one of the best pieces of advice that I can give you as far as how to deal 91 06:01.560 --> 06:05.500 with incident response and threat detection is the same piece of advice that I 92 06:05.500 --> 06:08.000 give everybody else in the cybersecurity realm. 93 06:08.000 --> 06:11.900 Whether it's on an individual system or in a cloud infrastructure environment 94 06:11.900 --> 06:14.000 like the one that we're going over now. 95 06:14.000 --> 06:18.620 It's always to have an agreement and a policy in place on how to respond to 96 06:18.620 --> 06:20.000 said incidents. 97 06:20.000 --> 06:23.790 And whether it's working by yourself inside of the organization or more 98 06:23.790 --> 06:28.380 preferably working with that provider in that handshake agreement or something 99 06:28.380 --> 06:33.140 that's more solidified through let's say a memorandum of understanding or WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 99 06:28.380 --> 06:33.140 that's more solidified through let's say a memorandum of understanding or 100 06:33.140 --> 06:34.000 agreement. 101 06:34.000 --> 06:38.000 It's making sure that we have a plan of action for any and all possibilities. 102 06:38.000 --> 06:42.000 Now we won't know every single thing that's going to happen or could happen. 103 06:42.000 --> 06:47.800 But we can definitely use lessons learned and also move forward with being able 104 06:47.800 --> 06:53.210 to scan and monitor access logs and audit logs as much as possible to be able 105 06:53.210 --> 06:55.000 to prepare ourselves. 106 06:55.000 --> 06:59.310 And by incorporating the security measures that we covered throughout this 107 06:59.310 --> 07:03.690 entire skill so far along with many many more that exist inside the Cisco realm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 107 06:59.310 --> 07:03.690 entire skill so far along with many many more that exist inside the Cisco realm 108 07:03.690 --> 07:04.000 . 109 07:04.000 --> 07:07.960 We can do a better job of making sure that we're prepared for the eventuality 110 07:07.960 --> 07:11.930 of an incident and work together with our provider to make sure that it's rem 111 07:11.930 --> 07:14.000 ediated as quickly as possible. 112 07:14.000 --> 07:14.580 responsible.