WEBVTT 1 00:00.000 --> 00:04.950 Now, before we go back into our dashboard for some more simulation overview and 2 00:04.950 --> 00:06.880 look at it at our sandbox as a whole, 3 00:06.880 --> 00:12.720 I wanted to point out some API security concerns because our devices are going 4 00:12.720 --> 00:17.040 to be utilized at API in order to perform different functions, whether it be 5 00:17.040 --> 00:17.840 for security 6 00:17.840 --> 00:23.370 or just general maintenance across the network and incorporate different 7 00:23.370 --> 00:24.000 methods of 8 00:24.960 --> 00:28.910 quick configs like XMLs or anything like that. And that's where we want to 9 00:28.910 --> 00:32.800 implement things like OAuth or API keys to be able to add a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 9 00:28.910 --> 00:32.800 implement things like OAuth or API keys to be able to add a 10 00:32.800 --> 00:39.330 other layer of security for overall access in making sure that we secure and 11 00:39.330 --> 00:43.890 limit who it has the permissions to go in and make some of these configurations 12 00:43.890 --> 00:44.080 . 13 00:44.080 --> 00:48.900 On top of that, we also want to incorporate something called API rate limiting. 14 00:48.900 --> 00:53.120 And this is to allow us to prevent any kind of denial of service attack against 15 00:53.120 --> 00:54.480 our API resources 16 00:54.480 --> 01:00.480 and abuse against those same API functions restricting the actual flow of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 16 00:54.480 --> 01:00.480 and abuse against those same API functions restricting the actual flow of 17 01:00.480 --> 01:04.960 traffic to the API calls within our network devices, not just the actual 18 01:04.960 --> 01:08.320 ability to connect to them as an administrator overall, 19 01:08.320 --> 01:16.660 ensures that we're able to limit and prevent any as much attacking as possible 20 01:16.660 --> 01:18.720 to the actual API. 21 01:19.280 --> 01:23.990 See, we don't want just anybody and everybody on our network to have access to 22 01:23.990 --> 01:26.480 the under the hood portion of our car. 23 01:26.480 --> 01:31.460 We want certified mechanics, right? Well, that's where us command at because we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 23 01:26.480 --> 01:31.460 We want certified mechanics, right? Well, that's where us command at because we 24 01:31.460 --> 01:35.200 are the network technicians and administrators that are going to be doing a lot 25 01:35.200 --> 01:37.120 of this security implementation. 26 01:37.120 --> 01:43.480 Beyond that goes into things like securing the actual API with the method of 27 01:43.480 --> 01:44.720 input validation. 28 01:44.720 --> 01:48.940 We don't necessarily want just random commands put in and we may decide to even 29 01:48.940 --> 01:54.080 limit some commands and access to different portions of our API overall. 30 01:54.080 --> 02:01.750 So it would be wise as a security technician inside of that Cisco environment WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 30 01:54.080 --> 02:01.750 So it would be wise as a security technician inside of that Cisco environment 31 02:01.750 --> 02:06.300 and overall network infrastructure to be able to sit down and plot out whether 32 02:06.300 --> 02:08.800 it be through policy or actual implementation. 33 02:08.880 --> 02:14.110 The different types of calls that we make to our API and also maybe how we 34 02:14.110 --> 02:18.320 limit the access to it to certain permission groups. 35 02:18.320 --> 02:23.270 Now, that permission group flees me into that multifactor authentication as 36 02:23.270 --> 02:29.410 well because we can use radius, attack x plus or even incorporate, let's say, 37 02:29.410 --> 02:32.960 Windows Active Directory into our authentication fields WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 37 02:29.410 --> 02:32.960 Windows Active Directory into our authentication fields 38 02:33.120 --> 02:40.640 and incorporate a failsafe like texting validation to a cell phone for a code 39 02:40.640 --> 02:43.840 to enforce that multifactor authentication. 40 02:43.840 --> 02:48.940 If we just use regular username and passwords on these devices, we potentially 41 02:48.940 --> 02:54.400 are opening ourselves up to a basic security flaw inside of our network 42 02:54.400 --> 02:57.590 because it could be that somebody's out there sniffing the wire, which we've 43 02:57.590 --> 03:00.000 done in other courses here on CBT Nuggets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 44 03:00.240 --> 03:04.400 And we want to make sure that we are using the latest and greatest encryption 45 03:04.400 --> 03:07.520 that we're able to utilize it within our organization. 46 03:07.520 --> 03:12.670 Each connection to our devices should be wrapped in TLS transport layer 47 03:12.670 --> 03:13.440 security. 48 03:13.440 --> 03:18.070 And if we're doing any kind of API work that is utilized in a web interface 49 03:18.070 --> 03:24.640 like we're using right now, it should be using HTTPS over 4443 as one of our 50 03:24.640 --> 03:27.360 common ports instead of HTTP. 51 03:27.680 --> 03:33.510 Now by default, everything does come in HTTPS and TLS in our dash or sandbox WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 03:27.680 --> 03:33.510 Now by default, everything does come in HTTPS and TLS in our dash or sandbox 52 03:33.510 --> 03:38.680 dashboard here, but it may be that we're setting this up from scratch inside of 53 03:38.680 --> 03:40.640 our own organization. 54 03:40.640 --> 03:46.150 And as we are in a platform as a service model, we have actual hands on with 55 03:46.150 --> 03:51.100 that application now, since it's one of our responsibilities to take charge and 56 03:51.100 --> 03:52.640 configure it how we see fit. 57 03:52.880 --> 03:57.640 In addition to how it aligns up with our organizations, policies, regulations 58 03:57.640 --> 04:01.920 and any other requirements that we may have based on the jurisdiction that we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 58 03:57.640 --> 04:01.920 and any other requirements that we may have based on the jurisdiction that we 59 04:01.920 --> 04:05.040 're in before we were in software as a service. 60 04:05.040 --> 04:09.410 And we were just utilizing the services that were provided to us by the 61 04:09.410 --> 04:10.000 provider. 62 04:10.000 --> 04:14.730 We would didn't really have too much access into things like we're in right now 63 04:14.730 --> 04:15.040 . 64 04:15.280 --> 04:19.930 And we were just making sure that we were able to access over a basic network 65 04:19.930 --> 04:24.950 connection, a service that was provided for us that was generally through a web 66 04:24.950 --> 04:28.480 browser like Gmail as we've used as an example before. 67 04:28.480 --> 04:32.280 Now, if you've been moving through any of my other courses, you know that I WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 04:28.480 --> 04:32.280 Now, if you've been moving through any of my other courses, you know that I 68 04:32.280 --> 04:36.010 like to hammer home the fact that we love our logging and making sure that we 69 04:36.010 --> 04:41.110 keep track of every change, every event that we can try to keep track of that 70 04:41.110 --> 04:43.840 helps us be able to problem solve later on. 71 04:44.080 --> 04:50.470 As that cyber security, excuse me, network technician, see, but we do the same 72 04:50.470 --> 04:56.280 thing inside of monitoring the logging for our API inside of our platform as a 73 04:56.280 --> 04:57.920 service and beyond. 74 04:57.920 --> 05:01.450 We do as much as we can in software as a service, but now that we have the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 74 04:57.920 --> 05:01.450 We do as much as we can in software as a service, but now that we have the 75 05:01.450 --> 05:05.600 actual applications, we can configure where some of those logs are sent. 76 05:06.000 --> 05:11.630 And we can also configure later on if we want to utilize an IDS or IPS intr 77 05:11.630 --> 05:17.710 usion detection system or intrusion prevention system to incorporate inside of 78 05:17.710 --> 05:23.730 our security monitoring and send logs to maybe a seam inside of our 79 05:23.730 --> 05:26.400 organization if we are utilizing one. 80 05:26.400 --> 05:30.360 Just gives us that extra set of eyes in case anybody's doing something they're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 80 05:26.400 --> 05:30.360 Just gives us that extra set of eyes in case anybody's doing something they're 81 05:30.360 --> 05:34.030 not supposed to make some mistake or we just want to keep in touch and see how 82 05:34.030 --> 05:34.880 we're doing.