WEBVTT
00:00:00.299 -->
00:00:08.375Welcome to the CISSP Cyber Training Podcast, where we provide you the training and tools you need to pass the CISSP exam the first time.
00:00:08.375 -->
00:00:13.471Hi, my name is Sean Gerber and I'm your host for this action-packed, informative podcast.
00:00:13.471 -->
00:00:20.893Join me each week as I provide the information you need to pass the CISSP exam and grow your cybersecurity knowledge.
00:00:20.893 -->
00:00:22.664All right, let's get started.
00:00:22.664 -->
00:00:27.821Let's go cybersecurity knowledge.
00:00:27.841 -->
00:00:28.384All right, let's get started.
00:00:28.384 -->
00:00:28.846Good morning everybody.
00:00:28.846 -->
00:00:42.332This is Sean Gerber with CISSP Cyber Training, and hope you all are having a beautifully blessed day and, as you are driving into work or possibly going home from work, we are going to be talking about Domain 2.3 and that's provisioning resources securely and that's the ultimate goal.
00:00:42.332 -->
00:00:48.453Right, you want to make sure that you have any resources out there, both from a tangible and intangible, which we'll get into in just a second.
00:00:48.453 -->
00:00:59.338You want to make sure that you are securing them in the most proper form possible and again, this falls into ISC Square's book in Division 2.3 and provisioning resources securely.
00:00:59.338 -->
00:01:23.364But before we do, we're going to talk about an article I saw in Wired Magazine, and this is around the third party aspects of the different applications that are out there, and I think this is a really good example of how, even though you may have really good security controls within your organization, the third party that is controlling some of your data or has access to your data could maybe be in a situation where they get hacked.
00:01:23.364 -->
00:01:29.549So it's important that, as we've talked about this with CISSP Cyber Training, that you all will get yourself.
00:01:29.549 -->
00:01:36.721You have your critical applications that are working within your organization and you will then reach out to those people.
00:01:36.721 -->
00:01:44.034If you don't have those in-house within your own company, you need to reach out to them and do a security assessment of what they're doing.
00:01:44.034 -->
00:01:52.826Now, again, the security assessment can be as very simple as just you're asking them some key questions and they can answer those questions based on how you want to hear them.
00:01:52.826 -->
00:01:59.951But, that being said, at least you have done it and it does give you potential legal recourse in the event that they would be hacked or compromised.
00:01:59.951 -->
00:02:11.195Well, in the case of this situation, this is about Gravy Analytics, and they have they're more or less the location services for many of the apps that you've seen out there on the web.
00:02:11.195 -->
00:02:18.693So if you've got your Candy Crushes, your MyFitnessPal, tinder and so forth, they take all of that location data and they use those analytics.
00:02:18.800 -->
00:02:32.282And I've seen this in the past where it's a big concern from a privacy standpoint, because now these individuals are turning around and selling off this data to individuals or companies or governments looking for specific information.
00:02:32.282 -->
00:02:37.723Now the argument they come back to is they don't have timestamps on some of this information.
00:02:37.723 -->
00:02:39.890But let's be realistic.
00:02:39.890 -->
00:02:44.062They have the data, the location services, data of where you're doing it, when you're doing it.
00:02:44.062 -->
00:02:48.389It may not be specifically times of when you're doing it, but based on an individual.
00:02:48.389 -->
00:02:51.414You know Sean's sleeping from X to Y.
00:02:51.414 -->
00:03:00.199Well, sean's awake from A to B, so most likely you have a pretty good idea and you can pick up a pattern in which Sean travels to and from locations.
00:03:00.199 -->
00:03:01.706So therefore you could track me.
00:03:02.801 -->
00:03:05.759It's not hard, it's very simple to do, and we did this before.
00:03:05.759 -->
00:03:11.100We even had all these different tools In the red teams, we would do it and it was a little bit harder.
00:03:11.100 -->
00:03:17.245But with all these tools and now you can go out and countries can go out and buy this information, yeah, it's a bit concerning.
00:03:17.245 -->
00:03:26.540So this comes back to again you want to educate your employees around the accept all or allow tracking piece of these apps that you put within your organization.
00:03:26.540 -->
00:03:36.991And I think this is a big factor in that, when you give people maybe mobile devices as well, is that you try to control the device with some sort of mobile device control system.
00:03:36.991 -->
00:03:45.669Now, if you don't have that ability, then it comes up to you to do the education around that and know that if you don't educate them well, they're just going to do what they're normally used to doing.
00:03:46.954 -->
00:03:57.467So the part of it is is they say, this is the largest data brokers in the world and they, both from a commercial and government clients, appear to be acquiring data for online advertising.
00:03:57.467 -->
00:04:00.193Right, that's the goal, but we've used this in the past.
00:04:00.193 -->
00:04:05.633Any of this online stuff if your data is being shared, it is going into some location.
00:04:05.633 -->
00:04:21.271Well, according to them, gravy was hacked and then, because it was hacked, these were giving information of data that was in the United States, russia and Europe, and so most of the data that was extracted had app names built into the mentioned apps.
00:04:21.271 -->
00:04:23.535So they had the names, they had the locations.
00:04:23.535 -->
00:04:31.242They put a list here of some of the ones that people go to obviously, harry Potter, subway Surfers, temple Run, all those many of those that my kids would use.
00:04:31.242 -->
00:04:37.605They have access to all of those, so even the Christian yeah, the Muslim Prayer and the Christian Bible apps as well.
00:04:38.005 -->
00:04:49.795So the point you want to really find out is if educating your people around one, these people, these advertisers, are taking your money or they're taking your data and they're doing stuff with your data that you may or may not approve of.
00:04:49.795 -->
00:04:53.891Two, you want to really consider if you allow tracking on this data.
00:04:53.891 -->
00:05:17.625It's one of those aspects I try to tell people that I work with, as well as my kids don't allow any sort of tracking unless it's absolutely required for the app itself, and in many cases that type of app would only be like a GPS monitoring type of app, like your maps or maybe Waze, whatever ones that you're using to specifically monitor your traffic.
00:05:17.625 -->
00:05:28.271That would make sense, but in reality, a lot of times they have these tracking devices turned on due to the fact that, like when I go into Walmart, and if I walk into Walmart, it knows I'm there.
00:05:28.271 -->
00:05:31.704Now it may know it because of my IP address and it connects to the Wi-Fi.
00:05:31.704 -->
00:05:38.435If I've had that or two, it may know just based on my geolocation, but the ultimate goal is it's using this as a way to market and track to you.
00:05:38.456 -->
00:05:57.800Because, if you've noticed, I just kind of a little tangential digression if, if you notice, like we went to not Bed, bath and Beyond, because they don't exist anymore the candle company, the scent thing but yeah, I don't remember what the name of it is, but something over the Christmas holidays we went to and it's the scent place where they have candles, they have lotions, they have all those different things.
00:05:57.800 -->
00:06:08.004The moment we walked in, it knew my wife was there and because it knew my wife was there, it started pushing up ads to her saying hey, have you ever thought about this?
00:06:08.004 -->
00:06:09.288Hey, have you ever thought about that?
00:06:09.288 -->
00:06:16.894Again, all of that stuff is being fed into situations like gravy and the data is there being stored.
00:06:16.894 -->
00:06:18.184So, again, good article by Wired.
00:06:18.184 -->
00:06:18.966I would highly recommend it.
00:06:18.966 -->
00:06:21.802It's pretty long, so you want to just do it over a lunch thing.
00:06:21.802 -->
00:06:39.413Sit down and read it, but it will give you some really good ideas on what some of the information that is being funneled through these third parties to include immigration and customs enforcement, customs and border protection, irs and FBI All of these are just data is being purchased and bought by governments as well as advertisers.
00:06:40.079 -->
00:06:43.660Okay, so let us move on to what we're going to talk about today.
00:06:43.660 -->
00:06:47.752Okay so, domain 2.3, provisioning resources securely.
00:06:47.752 -->
00:06:51.262So this is going to get into this aspect we are as we go through.
00:06:51.262 -->
00:07:01.031The main goal of the CISSP podcast is to provide you content around the various domains and what you can do to be better prepared for the CISSP exam.
00:07:01.031 -->
00:07:03.067The goal is not to teach you the test.
00:07:03.067 -->
00:07:10.322The goal is to teach you the thought process around security professionals and senior security professionals in which the CISSP exam is written for.
00:07:10.322 -->
00:07:12.211So that's the ultimate goal.
00:07:12.211 -->
00:07:19.773So, as we go down this concept, we're going to get into different topics and then kind of give you a spin based on what a senior leader would consider it.
00:07:20.420 -->
00:07:22.706So let's get into information and asset ownership.
00:07:22.706 -->
00:07:30.192So information and asset ownership refers to assigning responsibility for managing and protecting information and IT resources.
00:07:30.192 -->
00:07:31.663Okay, that's the book answer, right?
00:07:31.663 -->
00:07:36.404These owners are responsible for the controls, they're responsible for the data.
00:07:36.404 -->
00:07:41.802They're also responsible to know where the data is stored, and we've talked about this routinely.
00:07:41.802 -->
00:07:53.295They need to know where the data is stored and I will tell you that when you depend on the organization you go work for, the owner may not know where this data is stored because in many cases, it's spread everywhere.
00:07:53.295 -->
00:07:59.793So it's important for you, as a security professional, to get with the information owners to help them understand about their data.
00:08:00.940 -->
00:08:05.507Now, the information owner they're responsible for the data classification that would be public, private and confidential.
00:08:05.507 -->
00:08:11.153They need to define the level of protection required, based on the sensitivity of the value of the data.
00:08:11.153 -->
00:08:16.052So now, when you go and you talk to the owner, they're going to need to know what is this data?
00:08:16.052 -->
00:08:17.466Is this data intellectual property?
00:08:17.466 -->
00:08:20.908Is this data a super secret sauce of Kentucky Fried Chicken?
00:08:20.908 -->
00:08:21.670What is it?
00:08:21.670 -->
00:08:23.783And so they're going to have to know that.
00:08:23.783 -->
00:08:28.232Now, if they don't know that, you're going to need to ask some questions of going well, then who will know that?
00:08:28.232 -->
00:08:36.292And that can get very squishy real quick and people can do a little squirming because they're like, wow, bill knows it.
00:08:36.292 -->
00:08:44.208You'll find out that in many cases, the CEO is the one that actually owns all the data and they're supposed to be the one that knows it, which I've worked with a lot of CEOs and they are very smart people.
00:08:44.208 -->
00:08:49.282All of them Yep, ladies and guys are all super smart, but they don't know everything about data ownership.
00:08:49.282 -->
00:08:52.173They rely on people within their organization to do that.
00:08:52.173 -->
00:09:01.745You need that owner will grant access, permissions, at least privilege, need to know basis and so forth, and then they'll ensure compliance with relevant regulations such as GDPR and HIPAA.
00:09:01.745 -->
00:09:04.311That's the information owner's responsibilities.
00:09:04.311 -->
00:09:15.432Now, again, they may have delegated that to an individual, but you need to find out who the owner is and then make sure, coordinate all of that out, and I will tell you that it sometimes can be a very bit.
00:09:15.432 -->
00:09:17.424It can be a bit of a challenge to work through all that.
00:09:18.868 -->
00:09:22.783Asset owners now these are they own the physical or virtual systems.
00:09:22.783 -->
00:09:24.326This would be software and or network.
00:09:24.326 -->
00:09:28.131So the information owner and the asset owner may be the same person.
00:09:28.131 -->
00:09:31.986They may not be the same person Depending upon the size of the organization.
00:09:31.986 -->
00:09:37.125If it's a larger organization, you may have multiple information owners and multiple asset owners.
00:09:37.125 -->
00:09:50.804But again, the asset owner is someone who owns the physical or virtual systems that are tied to it and they're responsible for maintaining the systems and ensuring that it's required security patches and configurations have been applied as specified.
00:09:50.804 -->
00:09:53.514They're going to need to, depending upon the organization.
00:09:53.514 -->
00:10:02.770If it's a regulated environment, they're going to need to have that documented and if they don't have it documented, you need to work with them to get it documented as much as you possibly can.
00:10:03.682 -->
00:10:07.283Again, the ultimate goal is not to fulfill what the auditors want.
00:10:07.283 -->
00:10:09.690The auditors are just doing a fact check on you.
00:10:09.690 -->
00:10:18.004So if you're doing these things in a routine basis and you have a plan for them, your audits are going to be easy peasy, lemon squeezy.
00:10:18.004 -->
00:10:22.493So I've done audits, numerous audits all the time I was doing them all the time.
00:10:22.493 -->
00:10:29.596And the thing is is that I learned is that if I did the things the right way, the auditors would not dig as deep.
00:10:29.596 -->
00:10:35.081And I'm not doing this to placate the auditor, saying, well, just do a good job on the surface so that they don't dig deeper.
00:10:35.081 -->
00:10:39.331No, you want to make sure that you have a good level of depth with your controls.
00:10:39.331 -->
00:10:41.605Now, you're not going to be perfect, and the auditors know that.
00:10:41.605 -->
00:10:53.467But if you have a good plan in which you're in some and then also you're willing to accept risk, either you or the CEO is willing to accept the risk for the organization, that's fine, they're okay with that.
00:10:53.467 -->
00:11:00.111But they want to make sure that you're meeting the general controls that you have determined and that you are applying within your organization.
00:11:00.111 -->
00:11:05.831Okay, so that's their ultimate point is security, patches, configurations, all that stuff they're responsible for.
00:11:05.831 -->
00:11:13.153They also implement asset lifecycle policies, and this was from procurement to the overall secure disposal of the device itself.
00:11:13.801 -->
00:11:20.033So the key concept around this is that ownership involves accountability, but not necessarily operational responsibility.
00:11:20.033 -->
00:11:20.923So that's different.
00:11:20.923 -->
00:11:23.264Potentially Depends on the size of the company.
00:11:23.264 -->
00:11:28.708You may be doing both, but the operational responsibility is usually in a different bucket.
00:11:28.708 -->
00:11:32.261Somebody else usually owns that Asset custodians.
00:11:32.261 -->
00:11:38.874They will handle your daily maintenance while owners define the policy and the appropriate use cases for the controls.
00:11:38.874 -->
00:11:46.700So again, but I will tell you, you're going to need the custodians your data custodians and your asset custodians to work well with the data owners.
00:11:46.700 -->
00:11:53.173You're going to have to have this give and take because they only know what they know and the data owners only know what they know.
00:11:53.173 -->
00:12:01.298They don't know both in many cases, and so it's going to be a symbiotic relationship between the two to make sure that it's done correctly.
00:12:01.518 -->
00:12:05.364So, as I mentioned earlier, data owner is a person with the ultimate organizational responsibility.
00:12:05.364 -->
00:12:08.335Senior managers may be responsible, like I mentioned before.
00:12:08.335 -->
00:12:09.778The CEO could be.
00:12:09.778 -->
00:12:11.062It could be somebody else in between.
00:12:11.062 -->
00:12:13.575Again, they may not even know that the data owner.
00:12:13.575 -->
00:12:21.341Typically IT will own the servers and the workstations, but somebody else will own the actual data itself.
00:12:21.341 -->
00:12:28.996We talked about IT protecting devices Key point here identify asset owners and they may or may not be within IT.
00:12:29.538 -->
00:12:30.620I have seen it time and again.
00:12:30.620 -->
00:12:36.701The original or the true information owner will go.
00:12:36.701 -->
00:12:49.533Well, it owns it and it's like no, you're going to have to educate them that no, in most cases, the IT should not be owning the data, because IT doesn't understand what the data is and may not understand the sensitivity related to the data.
00:12:49.533 -->
00:12:50.255I had this.
00:12:50.255 -->
00:12:52.912I was working with a scientist once and he goes well, it owns it.
00:12:52.912 -->
00:12:57.061I'm like, sir, we don't know what the heck your data is.
00:12:57.061 -->
00:13:02.500I don't know if it could be launch codes for ICBMs or it could be how to make algae turn blue.
00:13:02.500 -->
00:13:03.501I don't know.
00:13:03.501 -->
00:13:04.490I don't know what that is.
00:13:04.490 -->
00:13:08.803So therefore, it's really hard for me to be the owner of that data.
00:13:08.803 -->
00:13:11.759You are going to have to, mr Scientist, be the owner of that data.
00:13:11.759 -->
00:13:13.466So it took a lot of finagling.
00:13:13.466 -->
00:13:17.215We finally got it worked out, but at the end of the day, it wasn't IT that owned it.
00:13:17.215 -->
00:13:21.782Now we own the systems that they were housed in, but we did not own the data specifically itself.
00:13:21.782 -->
00:13:24.571So again, that's what you got to keep in mind.
00:13:24.571 -->
00:13:26.821And again, they may delegate it to other people.
00:13:26.821 -->
00:13:32.400That's okay, but you just got to make sure everybody's aligned and knows who's who in the zoo.
00:13:32.400 -->
00:13:34.748Okay, asset management Now.
00:13:34.849 -->
00:13:39.682Asset management is a systematic process of tracking, monitoring and managing your assets within your company.
00:13:39.682 -->
00:13:44.130This could go down to as small as USB devices or phones or whatever it may be.
00:13:44.130 -->
00:13:45.975It might not be that low, it may just be.
00:13:45.975 -->
00:13:46.356You know what.
00:13:46.356 -->
00:13:47.760I don't really care about those.
00:13:47.760 -->
00:13:51.181All I care about is servers and workstations.
00:13:51.181 -->
00:13:53.207Okay, great, that's fine.
00:13:53.207 -->
00:13:55.293It just comes down to the company and what your needs are.
00:13:55.293 -->
00:14:05.402But the ultimate goal is to optimize value, manage risk and ensure compliance with what is designed both from an internal policies and external regulatory requirements that you may have.
00:14:05.402 -->
00:14:13.056So these assets will include both tangible and intangible items, and we'll get into both of those here in just a minute.
00:14:13.056 -->
00:14:14.921So objectives again.
00:14:14.941 -->
00:14:17.556The ultimate goal is you want to identify and classify your assets.
00:14:17.556 -->
00:14:22.457This includes data, hardware and software, which we've talked time and time again through this podcast.
00:14:22.457 -->
00:14:28.000You want to track the asset lifecycle stages to include acquisition, usage, maintenance and decommissioning.
00:14:28.000 -->
00:14:33.263This is an important part and it a lot of times gets lost because someone will go hey, I need a new server.
00:14:33.263 -->
00:14:35.216Oh, we just bought one, we bought two, we bought three.
00:14:35.216 -->
00:14:40.456Next thing, you know you've got 50 servers and I know it's pretty exaggerated.
00:14:40.597 -->
00:14:44.583But the point of it is you have all these systems now and you're like, oh, why do we need all these?
00:14:44.583 -->
00:14:46.605And then you don't know when you bought them.
00:14:46.605 -->
00:14:48.687And then, if you don't know when you bought them, well, how old are they?
00:14:48.687 -->
00:14:49.447Should we get rid of them?
00:14:49.447 -->
00:14:50.551Which one has a hard drive?
00:14:50.551 -->
00:14:51.152This one doesn't.
00:14:51.152 -->
00:14:52.034This has an SSD.
00:14:52.034 -->
00:14:55.301Then it gets to be super complicated and it's like oh, stop the madness.
00:14:55.301 -->
00:15:06.905So if you can get a plan already, before you purchase so anytime something's purchased it gets added to a list somewhere that people actually go and check then you're in a much better position.
00:15:07.426 -->
00:15:14.355So you want to track the assets from both their entire life cycle, from acquisition, usage, maintenance and decommissioning, from the beginning to the end.
00:15:14.355 -->
00:15:15.801You want to track that.
00:15:15.801 -->
00:15:18.870If you do that, you now are in a much better position.
00:15:18.870 -->
00:15:21.015One, financially, you're not overbuying.
00:15:21.015 -->
00:15:23.942Two, you have a good tracking of where your data is going.
00:15:23.942 -->
00:15:28.341So the auditors are happy and you have better access to what's going on within your company.
00:15:28.341 -->
00:15:40.014This also prevents asset misuse, which means Bill does the five-finger discount and sees a workstation sitting there or a laptop and goes, aha, nobody's going to miss this, and they walk off with it.
00:15:40.014 -->
00:15:44.971And then now you're missing equipment and they walk off with it.
00:15:44.971 -->
00:15:45.774And then now you're missing equipment.
00:15:45.774 -->
00:15:49.164So, again, those are all types of activities you, by having a good life cycle and tracking, can watch.
00:15:49.164 -->
00:15:50.890Again, people will steal stuff.
00:15:50.890 -->
00:15:52.715I guarantee you, I own a business.
00:15:52.715 -->
00:15:59.642They steal from me the little rascals, and I try to figure out how they do it and I try to stop it, but they still do it.
00:15:59.642 -->
00:16:00.365I know they do.
00:16:00.365 -->
00:16:02.412So people will do those things.
00:16:02.412 -->
00:16:04.559So security professional plan for that.
00:16:05.350 -->
00:16:09.557Now, examples of asset management activities this would be conducting regular inventory audits.
00:16:09.557 -->
00:16:22.475Again, auditing, yes, you, and I like to call it more of an assessment right, because internal, it's more of an assessment because I'm not really an auditor and I'm not really using a third party, so I'm kind of just assessing it, but you can word it however you wish to word it.
00:16:22.475 -->
00:16:34.791Using asset tagging systems again, barcodes, rfids, little tracky things, little Apple AirTags, whatever it is.
00:16:34.791 -->
00:16:36.940I've seen that happen where people had a problem with equipment leaving the manufacturing site.
00:16:36.940 -->
00:16:37.260What do they do?
00:16:37.260 -->
00:16:38.385They put AirTag type things on it.
00:16:38.385 -->
00:16:44.783Rfd, you know, basically trackers, and the goal was because someone was doing the five-finger discount and lifting this stuff and moving off with it.
00:16:44.783 -->
00:16:46.788So you've got to plan for that.
00:16:46.908 -->
00:16:52.611Implementing digital asset management systems to control software licenses and cloud resources, it isn't as big of a deal.
00:16:52.611 -->
00:16:56.102In the old days they used to have a lot of CD.
00:16:56.102 -->
00:16:59.331Your office could be on CD and it would be theft for that.
00:16:59.331 -->
00:17:06.962You could use your keys around, which is more of an intangible asset, but you could use the software keys and you could have multiple versions of your software.
00:17:06.962 -->
00:17:12.886That's a little bit harder to do nowadays, but it does still happen your software license.
00:17:12.886 -->
00:17:24.643If you're dealing with cloud resources, though because the cloud is in the air quotes cloud and it's not with you people could gain access to those and use those cloud resources for things outside of what normal day-to-day activities would be.
00:17:24.643 -->
00:17:31.143Ie crypto mining is one great example of that that I've seen happen in the years, especially now that Bitcoin is up through the roof.
00:17:31.143 -->
00:17:43.839I don't even know how that's going to work, but again, the ultimate point of it is that there are ways that you have to keep tabs on your resources, both from a hardware and software and virtual environment.
00:17:44.970 -->
00:17:50.973Some security considerations, protecting sensitive data on decommissioned equipment through secure data wiping or destruction plans.
00:17:50.973 -->
00:18:01.015You should have a good plan, which we've talked about, on how to wipe destroy your old equipment, because if you don't, again it will leave the premises and be used and sold to other people.
00:18:01.015 -->
00:18:10.797And again, if you get a lot of stuff that's stolen from your company and maybe it's sold for pennies on the dollar, well it all adds up and people are using your assets for their profit.
00:18:10.797 -->
00:18:16.393This also helps prevent shadow IT by identifying unauthorized assets on the network.
00:18:16.393 -->
00:18:20.162So do you have the ability to monitor your network for unauthorized assets?
00:18:20.162 -->
00:18:24.323Again, that's a point you need to consider.
00:18:24.343 -->
00:18:27.538I will tell you that doing that is very challenging, super challenging.
00:18:27.538 -->
00:18:35.202It can be done, but you got to have a really good plan when you get started to make it happen and you got to follow through and you have to continue.
00:18:35.202 -->
00:18:37.674It's the hospital you never, ever leave.
00:18:37.674 -->
00:18:40.181So you just have to decide is it worth it?
00:18:40.181 -->
00:18:42.212Some networks you got to have it right.
00:18:42.212 -->
00:18:46.619Right, because they have super secret stuff the 11 herbs and spices from kentucky fried chicken.
00:18:46.619 -->
00:18:48.226You can't let that escape.
00:18:48.226 -->
00:18:49.411You may have that.
00:18:49.411 -->
00:18:50.874Other networks it's like.
00:18:50.874 -->
00:18:52.016This is just the.
00:18:52.016 -->
00:18:54.662The amount of tension that it causes is too much.
00:18:54.662 -->
00:18:56.576Therefore, it's just not worth it.
00:18:56.576 -->
00:19:01.653You have to weigh all that out and again, you, as a security professional, cannot be draconian with this and go.
00:19:01.653 -->
00:19:07.263Ye must do, because ye will be looking for new employment at some point because they don't like that.
00:19:07.263 -->
00:19:09.036You need to have that give and take.
00:19:09.036 -->
00:19:09.999You need to work with them.
00:19:09.999 -->
00:19:14.141Now there's times you need to pull the bully pulpit out and pull out the hammer and go whack, whack, whack.
00:19:14.141 -->
00:19:17.299But most cases you don't want to go that direction.
00:19:18.230 -->
00:19:21.582Okay, configuration management systems, cmss Now CMSs.
00:19:21.582 -->
00:19:29.722Their structured approach is for managing configuration of IT assets, ensuring consistency and reducing vulnerabilities caused by configuration errors.
00:19:29.722 -->
00:19:37.596So when someone's configuring the system and they push out a patch, they want to have this so that avoids causing a mass outage.
00:19:37.596 -->
00:19:41.606There's some core components to this.
00:19:41.606 -->
00:19:43.372One is the configuration items.
00:19:43.372 -->
00:19:44.416This is the CIs.
00:19:44.416 -->
00:19:49.221Now these are what are managed by the CMS, such as servers, applications or network devices.
00:19:49.221 -->
00:19:50.894So these are the items that can be managed.
00:19:50.894 -->
00:19:52.941They can be mucked with, they can be changed.
00:19:52.941 -->
00:19:59.002You have a baseline configuration and this is the approved settings and parameters used as a standard.
00:19:59.002 -->
00:20:01.391So if you're making a change, this is what happens.
00:20:01.551 -->
00:20:06.934Okay, now if something bad happens, you have the ability to roll back, and that's where version control comes in.
00:20:06.934 -->
00:20:09.457Is that you push it out, you roll it back.
00:20:09.457 -->
00:20:13.759And we've talked on CISP, cyber Training, multiple times about configuration management.
00:20:13.759 -->
00:20:24.827You want to have the ability that if anything goes sideways, you can roll it back to a previous version that is stable and useful and then from there figure out why it broke Again.
00:20:24.827 -->
00:20:29.961Configuration management again is another one of those places that you never ever get out of.
00:20:29.961 -->
00:20:37.616Now, if you have a bad configuration management within your organization, that's bad, because what will happen is now you can't control what's being pushed.
00:20:37.616 -->
00:20:53.679Bad guys and girls can push packages to your entire organization and real quickly you can go from having a small isolated incident to a massive ransomware incident where you are just wishing that the day would be over and that you were a turnip farmer in Southern California.
00:20:53.679 -->
00:20:55.323That is what you would wish for.
00:20:56.490 -->
00:21:06.070So configuration management system again, the security benefits identifying unauthorized changes to again compromised security, which we just kind of talked about, ensuring patch management and updates are an approved process Again.
00:21:06.070 -->
00:21:07.836They're just not getting pushed out willy-nilly.
00:21:07.836 -->
00:21:24.018It's so nice I've dealt with this in many years where you had to go test your Microsoft patch, you had to test your Unix patch, you had to test this patch, and you still do I'm not saying you don't but we were able to get agreement with senior leadership, at least from a Microsoft standpoint.
00:21:24.018 -->
00:21:30.746Within multiple organizations I've worked in to just go with the automatic patching for Microsoft.
00:21:30.746 -->
00:21:43.135Now you're putting a lot of trust in that Microsoft won't pwn you right, but the ultimate goal is, if Microsoft does that, they got bigger issues that could affect them even larger, so they're going to go above and beyond to make sure that that does not happen.
00:21:43.135 -->
00:21:49.435The nice part is that's one less thing that you can take off your plate and someone else is actually doing the updates for you and not you.
00:21:50.538 -->
00:21:56.422You want a supporting incident response by providing historical view of configurations what has actually happened and how have they happened?
00:21:56.422 -->
00:21:57.632What changes have been made?
00:21:57.632 -->
00:21:59.955All of those are very important pieces.
00:21:59.955 -->
00:22:09.857So some tools you could use would be puppet, chef, ansible, microsoft, msc, cc, um or cc sccm.
00:22:09.857 -->
00:22:11.520I said that was really screwed, that one up.
00:22:11.520 -->
00:22:13.971Yeah, all I ever knew it would buy was sccm.
00:22:13.971 -->
00:22:17.019That's their configuration management tool for microsoft.
00:22:17.019 -->
00:22:18.951It works like a great, great, great, great great.
00:22:18.951 -->
00:22:23.604I've dealt with puppet a little bit but bit, but mostly with SCCM.
00:22:23.604 -->
00:22:34.559So those are your configuration management tools and there can be an entire podcast just on CMSs and how they work, which we probably won't do because you won't really.
00:22:34.559 -->
00:22:37.211You'll be asleep either on the train or driving to work.
00:22:37.211 -->
00:22:38.980You'll be driving and falling into the ditch.
00:22:38.980 -->
00:22:39.804That would be bad.
00:22:40.688 -->
00:22:44.694Okay, virtual assistant assist oh my goodness, virtual asset management.
00:22:44.694 -->
00:22:46.282What's a virtual asset management?
00:22:46.282 -->
00:22:51.821Now, this includes the management of non-physical resources, such as virtual machines, containers and cloud-based systems.
00:22:51.821 -->
00:22:57.151So, as you move to the cloud, as your organization does and I've talked to multiple organizations, they go.
00:22:57.151 -->
00:22:59.115I hope my stuff is in the cloud, I'm good.
00:22:59.115 -->
00:23:01.461Yeah, no, your stuff's not good.
00:23:01.461 -->
00:23:06.693It could be, I don't know, but you're dealing with different types of vernacular now.
00:23:06.693 -->
00:23:18.631So containers, cloud-based systems right, all of those pieces are different type of words that mean the same thing in many cases, but it also have different connotations to them.
00:23:18.631 -->
00:23:23.009You need to understand, and this is where you're dealing with the virtual asset piece of this.
00:23:23.490 -->
00:23:24.834So now virtual sprawl.
00:23:24.834 -->
00:23:28.000This is something I knew was going to happen, just knew it.
00:23:28.000 -->
00:23:32.758Just knew it and mentioned it to our senior leaders, going be careful.
00:23:32.758 -->
00:23:34.582Well, yeah, it happens.
00:23:34.582 -->
00:23:35.330Why does it happen?
00:23:35.330 -->
00:23:37.234Because it's so easy to do.
00:23:37.234 -->
00:23:39.298It's like eating refined sugar.
00:23:39.298 -->
00:23:42.673It's so good, right, it's so good, but it's addictive.
00:23:42.673 -->
00:23:44.820Well, the same with virtual sprawl.
00:23:44.820 -->
00:23:45.752It is addictive.
00:23:45.752 -->
00:23:46.075Why?
00:23:46.075 -->
00:23:48.605Because I can provision a system, boom, it's up and running.
00:23:48.605 -->
00:23:50.412I can provision it, it's going.
00:23:50.653 -->
00:23:52.057I have no problems with the VMs.
00:23:52.057 -->
00:23:54.311They're easy peasy, especially when you're in a cloud environment.
00:23:54.311 -->
00:23:56.557I can run all kinds of scripts with them.
00:23:56.557 -->
00:24:07.039I can actually have the script run itself without having to send up an actual virtual machine, and then I just get charged a couple little pennies or a half a penny for the script to run.
00:24:07.039 -->
00:24:09.978Problem is, as the script continues to run, it never goes away.
00:24:09.978 -->
00:24:20.272And then all of a sudden, the pennies continue to grow and grow and grow and next thing you know you're into real hard cash because you have all these things moving in the background that may or may not be useful to your company.
00:24:20.272 -->
00:24:22.737So you need to determine the resource visibility.
00:24:22.897 -->
00:24:26.564Again, it's difficult to track all the virtual instances in a hybrid environment.
00:24:26.564 -->
00:24:27.525It's very challenging.
00:24:27.525 -->
00:24:33.272There's software for that that'll help you.
00:24:33.272 -->
00:24:34.317That being said, the software ain't cheap.
00:24:34.317 -->
00:24:36.565So as you get into this space of virtual to go, I'm going to save a lot of money.
00:24:36.565 -->
00:24:41.275And then you get in there and you go oh wait, I'm not saving a lot of money because I'm spending on all kinds of other stuff.
00:24:41.275 -->
00:24:42.876Yeah, that's how it works.
00:24:42.876 -->
00:24:48.404But there are benefits, obviously, between the hard on-prem versus the virtual Security risk.
00:24:51.690 -->
00:24:53.234Again, you're dealing with snapshots of vulnerabilities.
00:24:53.234 -->
00:24:57.070If a snapshot of a VM is not properly managed, they can contain sensitive data or potentially malware, depending on the situation.
00:24:57.070 -->
00:25:05.565And so, because it is a VM and it's a snapshot, you could proliferate that VM that is now tainted to other parts of your organization.
00:25:05.565 -->
00:25:08.178There is shared resource risk in virtual environments.
00:25:08.178 -->
00:25:09.690Often are you shared resources?
00:25:09.690 -->
00:25:17.324So, again, you're dealing with something, whether it's a network file share that they're sharing, whether it's a database that they're sharing who knows?
00:25:17.324 -->
00:25:22.102But again, data leakage or proliferation of malware is a true risk.
00:25:22.529 -->
00:25:24.237So what are some best practices around this?
00:25:24.237 -->
00:25:30.315Implementing automated discovery tools, obviously, to identify and manage your virtual assets, and then also using role-based access controls.
00:25:30.315 -->
00:25:32.180We know that it's important.
00:25:32.180 -->
00:25:34.313You should have some level of role-based access controls.
00:25:34.313 -->
00:25:36.479Not everyone has got access.
00:25:36.479 -->
00:25:40.012That is a role-based access control, but it's not a very good one.
00:25:40.012 -->
00:25:44.563So, yeah, everybody in the country has the ability to access my servers.
00:25:44.563 -->
00:25:47.297It's based on role and everybody has the same role.
00:25:47.297 -->
00:25:48.441Yeah, that's not so good.
00:25:48.441 -->
00:25:53.201So, yeah, think about that as you're looking at role-based access controls for your organization.
00:25:54.289 -->
00:25:57.220Cloud-based asset management what is this?
00:25:57.220 -->
00:26:04.019So this manages the assets in the cloud, involving and dealing with dynamic and distributed resources across multiple cloud service providers.
00:26:04.019 -->
00:26:05.342Wow, lots of words.
00:26:05.342 -->
00:26:11.643Um, the ultimate goal is is that how do you deal when you have, maybe, an azure cloud and an aws environment?
00:26:11.643 -->
00:26:15.999Done, all right, so you have azure and you have aws and how do they talk together?
00:26:15.999 -->
00:26:19.130Uh, do you have tagging and do you have labeling?
00:26:19.130 -->
00:26:20.111Does you have?
00:26:20.111 -->
00:26:21.993How does that work now can?
00:26:21.993 -->
00:26:25.819There is definitely the cross communication between clouds and it is viable.
00:26:25.961 -->
00:26:33.662I would recommend, if possible, that you stick with one cloud, and the reason I say that it's not because I'm I cherish one over the other.
00:26:33.662 -->
00:26:34.250I really don't.
00:26:34.250 -->
00:26:36.498I mean, azure is easier to configure for individuals.
00:26:36.498 -->
00:26:40.972Aws is a much more tech savvy type of thing.
00:26:40.972 -->
00:26:46.817But they all have different pros and cons and I'm not the one to sit there and tell you which one knows better for you and your organization.
00:26:46.817 -->
00:26:50.656But you want to have a lot of specific cloud considerations as you're dealing with this.
00:26:52.019 -->
00:26:55.174So the resources again are typically ephemeral.
00:26:55.174 -->
00:26:57.539That's a big $10 word, but it means short-lived.
00:26:57.539 -->
00:26:58.040They're very quick.
00:26:58.040 -->
00:27:00.192They show up, they go away.
00:27:00.192 -->
00:27:02.478Again, real-time tracking of what's going on.
00:27:02.478 -->
00:27:06.246We talked about this with the scripts, there's tagging labeling of cloud resources.
00:27:06.246 -->
00:27:09.113This will help with your visibility and cost management.
00:27:09.113 -->
00:27:12.270This comes back down to sensitivity labels, like we talked about with data.
00:27:12.270 -->
00:27:23.541Sensitivity is you need to label and tag these items, this data, because, one, you know what it is and, two, it does help when you're dealing with the AWS or the cloud-based type environments.
00:27:23.541 -->
00:27:30.836Your resources are all based on activities and it can get very expensive.
00:27:30.836 -->
00:27:35.951So all of a sudden, you have a service running that was tagged as being I'm just guessing here just saying partial.
00:27:35.951 -->
00:27:40.692It doesn't go very often, just every once in a while it's supposed to kick off, but it's running all the time.
00:27:40.692 -->
00:27:42.195Well, that tag could help you go.
00:27:42.195 -->
00:27:50.019Let's go dig into that and figure out why this thing is only supposed to be running once a week and it's now running consistently, constantly, all the time.
00:27:50.922 -->
00:28:01.074Data, residency and sovereignty you need to understand where is your data being stored, how is that going to affect your overall data privacy piece of this and also, where is your data footprint?
00:28:01.074 -->
00:28:11.622If you have data that's stored within the EU and it is also accessing data within China and it's the same type of data, but they're crossing the streams it's usually not a good thing.
00:28:11.622 -->
00:28:14.970You should have very much data localization, especially when you're dealing with the EU.
00:28:14.970 -->
00:28:18.057But the China piece of this is starting to kind of roll into.
00:28:18.057 -->
00:28:19.781They want a data localization as well.
00:28:19.781 -->
00:28:21.970So those are things you need to really consider.
00:28:22.330 -->
00:28:26.920Cloud management tools this would be AWS configurations this tracks, and changes to AWS.
00:28:26.920 -->
00:28:30.816Azure resource manager this would provide tools for managing resource groups.
00:28:30.816 -->
00:28:33.082And then also Google Cloud Asset Inventory.
00:28:33.082 -->
00:28:35.473Again, I forgot to even mention the Google Cloud.
00:28:35.473 -->
00:28:42.119So GCP all of these are different areas that you can use to manage your cloud environment.
00:28:42.119 -->
00:28:44.087Again, stick with one.
00:28:44.087 -->
00:28:45.511It's already complicated enough.
00:28:45.511 -->
00:28:48.800Don't complicate it with two or more, unless you absolutely have to.
00:28:48.800 -->
00:28:51.375But if you do, guess what, you're going to need to hire more people.
00:28:51.375 -->
00:28:53.961Oh, and, by the way, they're hard to find.
00:28:53.961 -->
00:29:01.133And then when you get somebody that says, yes, I know all about the cloud, you'll realize real quick yeah, they probably don't, unless you pay them gobs of money and you get somebody.
00:29:01.133 -->
00:29:15.029Really, if you're trying to get Billy Bob, who used to be the IT support guy, and now he goes, oh yeah, I can do the cloud, you may want to reconsider that thought process or at least have somebody that understands the cloud a little bit overseeing Billy Bob.
00:29:15.490 -->
00:29:22.267Just a thought Security challenges data encryption, both at rest and in transit, is an important factor in dealing with cloud.
00:29:22.267 -->
00:29:23.619We've talked about this before.
00:29:23.619 -->
00:29:25.240Transit's more of the big factor.
00:29:25.240 -->
00:29:30.096At rest, the data is on most of these cloud environments.
00:29:30.096 -->
00:29:35.409I don't even know if they will encrypt it with anything other than RSA to 256.
00:29:35.409 -->
00:29:37.583And I think they're even now at 1024, whatever it is.
00:29:37.583 -->
00:29:41.797So I don't I'm not ever a big fan about the data at rest.
00:29:41.797 -->
00:29:44.500People talk about that a lot and I just struggle with it.
00:29:44.500 -->
00:29:47.445But I could very well be wrong, because I'm wrong about a lot of things.
00:29:47.445 -->
00:29:51.232I'm only right about 22.3% of the time, so I could be wrong.
00:29:51.232 -->
00:30:09.297I just I think the bigger issue is in transit, because that is when it's going from your data location, your warm little house there, and it's being then sent to some other place and it's going through a lot of the no man's land to refer to a World War I battlefield and who knows, it's going to get molested as it goes through there.
00:30:09.980 -->
00:30:16.390Shared responsibility model understand which security responsibilities lie with a cloud provider and which remain in the organization.
00:30:16.390 -->
00:30:27.086So you need to understand where do those rely, where do those lie, because again it comes back down to data ownership and who owns it, especially if you're dealing with the shared responsibility model of the cloud.
00:30:27.086 -->
00:30:29.920You really have to define all this stuff.
00:30:29.920 -->
00:30:38.676I know it's a lot, it's too much, it truly is but if you're going to be protecting your data, senior leaders are expecting you to know this information.
00:30:38.676 -->
00:30:42.791Or if you don't know it, which you can't know everything you can't.
00:30:42.791 -->
00:30:51.402You can't know everything, but you need to surround yourself with people who are as smart or smarter than you, and there's a lot of people way smarter than me.
00:30:51.402 -->
00:30:56.602So that's why I always put people around me that are that way, maintaining comprehensive hardware and software.
00:30:56.602 -->
00:30:58.362So we're dealing with software asset inventories.
00:30:58.362 -->
00:31:02.846You need to have a way to protect that, and that would be hardware asset inventories.
00:31:02.846 -->
00:31:07.698This would be an example of hardware assets would be servers, routers, switches, mobile devices and IoT devices.
00:31:07.739 -->
00:31:09.460That's a gotcha there, the IoT.
00:31:09.460 -->
00:31:17.385They are many cases, kind of forgotten about and if you're dealing with like I used to with manufacturing facilities, they kind of did their own thing.
00:31:17.385 -->
00:31:24.771They're like their own little mini base or their own little mini business and they just go well, if I need it, I'm going to buy it and that's cool.
00:31:24.771 -->
00:31:31.374There's nothing wrong with that.
00:31:31.374 -->
00:31:33.769But they need to let people know that they're buying it, because they go and buy stuff and then you don't know it exists.
00:31:33.769 -->
00:31:35.666And then now you got shadow IT, and now you got data leaving, and then you got compliance issues.
00:31:35.666 -->
00:31:37.327Oh my gosh, it never ends.
00:31:37.327 -->
00:31:39.749So you just want to consider that.
00:31:39.749 -->
00:31:42.290So IoT devices they will bite you.
00:31:42.290 -->
00:31:43.251So keep that in mind.
00:31:43.251 -->
00:31:46.874That's not a test thing, that's a life world thing.
00:31:46.874 -->
00:31:47.534It will bite you.
00:31:48.134 -->
00:31:50.681Security benefits Identify rogue devices on a network.
00:31:50.681 -->
00:31:54.017You want to try to find as many rogue devices as you possibly can.
00:31:54.017 -->
00:31:55.000You do have them.
00:31:55.000 -->
00:31:56.867Do not be naive to think you do not.
00:31:56.867 -->
00:32:02.166You do, unless you have really good port security, and even then they'll find a way around it.
00:32:02.166 -->
00:32:03.813So identify rogue devices.
00:32:03.813 -->
00:32:09.268Managing physical security on critical assets, such as locking server rooms, and then ensuring hardware lifecycle management.
00:32:09.268 -->
00:32:11.174Again, this includes your secure disposal.
00:32:11.174 -->
00:32:20.369So this is why you want to have a good hardware asset inventory and a process by which it goes from birth to death of all of those different assets.
00:32:20.369 -->
00:32:22.557Software asset inventory.
00:32:22.577 -->
00:32:27.548This is an example of operating systems, enterprise applications, middleware.
00:32:27.548 -->
00:32:34.131Oh, these are like the land of misfit toys, so I'll use a reference to Christmas.
00:32:34.131 -->
00:32:39.757Yes, the land of misfit toys If you haven't watched it with Rudolph the Red-Nosed Reindeer yes, I did just date myself how old I am.
00:32:39.757 -->
00:32:43.926It's an awesome little part about the land of misfit toys and that is middleware.
00:32:43.926 -->
00:32:44.915It is there.
00:32:44.915 -->
00:32:56.550It is the stuff that everybody forgets about, nobody wants to play with, and you want to be aware of it and you want to find it because it will leave big gaping security holes within your organization if you do not address it.
00:32:56.550 -->
00:33:12.916Don't have time with it, that's okay, that's totally fine, as long as you know you're aware of it and you have expressed the risk to the senior leaders and they know you're aware of it, that's okay.
00:33:12.916 -->
00:33:19.786If you say you're going to get to it at some point, but you never will, you at least know it's there and you can address it when it does come up and bite you.
00:33:20.835 -->
00:33:28.385Key risks of dealing with that is an unlicensed software that leads to compliance violations and then outdated software increases your vulnerability to exploits.
00:33:28.385 -->
00:33:29.567Again, it hasn't been updated.
00:33:29.567 -->
00:33:30.229So what happens?
00:33:30.229 -->
00:33:35.243Yes, the bad boys and girls will take advantage of it and they will make your life painful.
00:33:35.243 -->
00:33:45.046But you want to have a good plan around your software Unlicensed will get you in trouble from a compliance standpoint, and then outdated software will get you in trouble from a malicious standpoint.
00:33:45.046 -->
00:33:48.578The unlicensed stuff make sure you get your stuff licensed, I mean it.
00:33:48.578 -->
00:33:54.246It's expensive if you're found not to be with licensed software, so don't risk it.
00:33:54.566 -->
00:34:07.787If you're a security person, this will be a very touchy subject, especially if you're dealing with a company that's not very big and they don't see the value in the software or the value in, basically, the application itself.
00:34:07.787 -->
00:34:09.682And they see value in the application, but they don't want to pay for it.
00:34:09.682 -->
00:34:21.467This can be a very, very touchy subject, and you're going to have to figure out how to weave that very carefully, because you're going to be telling them hey, by the way, you have about $50,000 in software that you need to buy, and they're like 50?
00:34:21.467 -->
00:34:26.206I have, my margins are so tight that I made profit of $500,000.
00:34:26.206 -->
00:34:28.965So you're taking a tenth of my profit.
00:34:28.965 -->
00:34:29.713Yeah, they will not be happy.
00:34:29.713 -->
00:34:35.161I just tell you right now, and it all comes down to margins, so you're going to have to work through that with them.
00:34:35.161 -->
00:34:37.922Again, though, do not do unlicensed software.
00:34:37.922 -->
00:34:38.784Just don't.
00:34:38.784 -->
00:34:40.201I'm not a lawyer, but it will bite you.
00:34:40.835 -->
00:34:42.121Tools, automated systems.
00:34:42.121 -->
00:34:46.905Obviously, we talked about Microsoft Endpoint Configuration Manager, jmaf, or macOS Management.
00:34:46.905 -->
00:34:53.302I've seen all of those, not JMaf, but the macOS and Microsoft Endpoint Configuration Manager.
00:34:53.302 -->
00:34:54.105Yeah, those work great.
00:34:54.105 -->
00:35:03.106They work really, really well and I would just deploy to those, if you can it does cost a little extra money, but it's worth it Intangible inventories.
00:35:03.574 -->
00:35:08.117So these are non-physical but critical to an organization's operational and financial health.
00:35:08.117 -->
00:35:12.068Okay, I thought this was going to be a relatively shorter podcast, but I am wrong.
00:35:12.068 -->
00:35:17.996So, again, this is these are non-physical, but they deal with the operational and financial health of it.
00:35:17.996 -->
00:35:22.027You got databases, intellectual property, a bad reputation and goodwill.
00:35:22.027 -->
00:35:24.420That would be a non-tangible of inventory.
00:35:24.800 -->
00:35:30.905Your IP is your patents, trademarks and proprietary algorithms One thing to think about when you're dealing with IP and patents.
00:35:30.905 -->
00:35:33.434So these are valid for about 20 years.
00:35:33.434 -->
00:35:38.347A patent is and you have to pay a patent fee every year, just like your CISSP.
00:35:38.347 -->
00:35:41.858You have to do that and if you don't do that, the patent goes away.
00:35:41.858 -->
00:35:43.581So you don't want that to happen.
00:35:43.581 -->
00:35:50.849If you depending upon your company, if you have a lot of trademarks, if you have many patents, you're going to have to have a team that will be managing that for you.
00:35:50.849 -->
00:36:01.032I'll tell you, I was a security professional and I was helping manage these patents and the trademarks with our companies, because we saw them on the IT space and they were asking questions.
00:36:01.032 -->
00:36:04.097The IT people were asking questions about them, so we had to help them with this.
00:36:04.858 -->
00:36:05.298It is.
00:36:05.298 -->
00:36:09.163It's a challenge, and especially when you're dealing with IP.
00:36:09.163 -->
00:36:17.012Yeah, ip is a big, nasty thing to kind of work through and if you can find yourself a good IP security professional ha-ha, you're looking at one or listening to one.
00:36:17.012 -->
00:36:25.601If you can find one, then you need to hold on to them because it's very challenging, extremely challenging.
00:36:25.601 -->
00:36:30.378If you don't have a good IP security professional, go find somebody that can help you with that, especially maybe a consultant or anybody.
00:36:30.378 -->
00:36:34.266But you definitely need some help there and maybe you're tight.
00:36:34.266 -->
00:36:41.846You might have it all together, but if you're just coming into an organization and you are not real sure, I would reach out to somebody and try to help them with that.
00:36:43.172 -->
00:36:43.675Data classification.
00:36:43.675 -->
00:36:49.500We've talked about public, internal, confidential and top secret important parts of data classification and how they are for your company.
00:36:49.500 -->
00:37:00.980I highly recommend a data classification schema for any and all organizations, big or small, but the key thing to think about is keep it simple, silly, kiss the KISS principle.
00:37:00.980 -->
00:37:11.871If you keep it simple, then it's much more useful for your people, because your people are going to have to manage it, and it's much easier for you to try to manage from your point of view as well, because you're trying to keep the data in check.
00:37:11.871 -->
00:37:18.041So, again, ultimate goal is keep it simple, silly Security controls for intangible assets.
00:37:18.235 -->
00:37:21.945Obviously, you're dealing with access controls, encryption, and backup and recovery plans.
00:37:21.945 -->
00:37:29.719Those are all an important part of your security controls for intangible assets, and this would include data labeling systems to ensure proper handling.
00:37:29.719 -->
00:37:34.282Again, all of those things are an important part of your intangible inventories.
00:37:34.282 -->
00:37:39.958Okay, so that is all I have for you today at CISSP Cyber Training on this podcast.
00:37:39.958 -->
00:37:41.264I hope you all enjoyed it.
00:37:41.264 -->
00:37:42.550I hope you all think it's a lot.
00:37:42.570 -->
00:37:49.407Again, we're coming back up to domain 2.3, and this is a result of provisioning resources securely.
00:37:49.407 -->
00:37:54.487You can get this information at cisspcybertrainingcom and you can go and check it out.
00:37:54.487 -->
00:37:55.820I've got a couple things you can purchase.
00:37:55.820 -->
00:37:57.943Also, all this content is free.
00:37:57.943 -->
00:38:02.766The podcasts, the video recordings and all that stuff are there on my blog.
00:38:02.766 -->
00:38:04.797You can get access to them that way, if you want to go that route.
00:38:04.797 -->
00:38:11.001I do have a blueprint and I have many other things to help you beyond just the free videos to help you study for the CISSP.
00:38:11.523 -->
00:38:13.704I know it's important for you to pass the CISSP.
00:38:13.704 -->
00:38:22.052I get a lot of people reach out to me saying thank you so much for the podcast and they continue to listen to the podcast even after they're done passing the exam.
00:38:22.052 -->
00:38:22.494Why?
00:38:22.494 -->
00:38:30.614Because a lot of the things that we're dealing with are taking 23 years of cybersecurity experience that hopefully you can use to help protect your company.
00:38:30.614 -->
00:38:37.208Because, honestly, I'm just sick and tired of the bad guys and girls winning and you all need to help us protect everything out there.
00:38:37.208 -->
00:38:47.907Because my water is good and I like to drink my water and I don't want to die, so I need people like you all to help protect my water and everything else that keeps life going here in the United States and around the world.
00:38:47.907 -->
00:38:50.632Also, go to ReduceCyberRiskcom.
00:38:50.632 -->
00:38:53.257You can go to ReduceCyberRiskcom if you're looking for a consultant.
00:38:53.518 -->
00:38:55.123I work with many different partners.
00:38:55.123 -->
00:39:02.347I have, depending on what your needs are, from pen testing to GRC, to security awareness training, to tabletops I've got it all.
00:39:02.347 -->
00:39:09.068And if not, I have partners that I partner with that can give you the information you need as well, or can give you the services that you need as well.
00:39:09.068 -->
00:39:10.561So we're there for you.
00:39:10.561 -->
00:39:16.827I will tell you that finding a security consultant that's the only reason I'm going to be getting a podcast for New Cyber Risk.
00:39:16.827 -->
00:39:28.610You'll be seeing some more of those coming out is to help give you some of the more detailed things around business and how to protect your business and how to protect your business, and the reason is coming from this perspective.
00:39:28.630 -->
00:39:37.777I got tired of these security professionals saying this will work and this will work and this will work and that's great and it's awesome and the tools are awesome, and I'm going to be doing some product reviews of some tools as well.
00:39:37.777 -->
00:39:41.346But when it comes right down to it, do I need it?
00:39:41.346 -->
00:39:44.500And if I do utilize it, what should I be concerned about?
00:39:44.500 -->
00:39:51.402And that's just taking 20 some years of being a CISO, working as a security architect and also as a red team commander.
00:39:51.402 -->
00:39:53.516I can help you, at least guide you, with that.
00:39:53.516 -->
00:39:55.179So again, that's reducecyberriskcom.
00:39:55.179 -->
00:39:56.603Go check it out.
00:39:56.603 -->
00:40:05.538If you are a IT person that's looking for a potential consultant, I can help you, no question about it, or I have friends that can help you.
00:40:05.538 -->
00:40:06.481That's the ultimate point.
00:40:06.481 -->
00:40:12.155Again, surround yourself with people that are smarter than you, and I have done that because there's a lot of people smarter than me.
00:40:12.155 -->
00:40:17.681Okay, have a wonderful, wonderful day, and we will catch you all on the flip side, see ya.
