CCT 210: Data Security Controls and Compliance Requirements for the CISSP (Domain 2.3)

WEBVTT
00:00:00.299 --> 00:00:08.375
Welcome to the CISSP Cyber Training Podcast, where we provide you the training and tools you need to pass the CISSP exam the first time.
00:00:08.375 --> 00:00:13.471
Hi, my name is Sean Gerber and I'm your host for this action-packed, informative podcast.
00:00:13.471 --> 00:00:20.893
Join me each week as I provide the information you need to pass the CISSP exam and grow your cybersecurity knowledge.
00:00:20.893 --> 00:00:22.664
All right, let's get started.
00:00:22.664 --> 00:00:27.821
Let's go cybersecurity knowledge.
00:00:27.841 --> 00:00:28.384
All right, let's get started.
00:00:28.384 --> 00:00:28.846
Good morning everybody.
00:00:28.846 --> 00:00:42.332
This is Sean Gerber with CISSP Cyber Training, and hope you all are having a beautifully blessed day and, as you are driving into work or possibly going home from work, we are going to be talking about Domain 2.3 and that's provisioning resources securely and that's the ultimate goal.
00:00:42.332 --> 00:00:48.453
Right, you want to make sure that you have any resources out there, both from a tangible and intangible, which we'll get into in just a second.
00:00:48.453 --> 00:00:59.338
You want to make sure that you are securing them in the most proper form possible and again, this falls into ISC Square's book in Division 2.3 and provisioning resources securely.
00:00:59.338 --> 00:01:23.364
But before we do, we're going to talk about an article I saw in Wired Magazine, and this is around the third party aspects of the different applications that are out there, and I think this is a really good example of how, even though you may have really good security controls within your organization, the third party that is controlling some of your data or has access to your data could maybe be in a situation where they get hacked.
00:01:23.364 --> 00:01:29.549
So it's important that, as we've talked about this with CISSP Cyber Training, that you all will get yourself.
00:01:29.549 --> 00:01:36.721
You have your critical applications that are working within your organization and you will then reach out to those people.
00:01:36.721 --> 00:01:44.034
If you don't have those in-house within your own company, you need to reach out to them and do a security assessment of what they're doing.
00:01:44.034 --> 00:01:52.826
Now, again, the security assessment can be as very simple as just you're asking them some key questions and they can answer those questions based on how you want to hear them.
00:01:52.826 --> 00:01:59.951
But, that being said, at least you have done it and it does give you potential legal recourse in the event that they would be hacked or compromised.
00:01:59.951 --> 00:02:11.195
Well, in the case of this situation, this is about Gravy Analytics, and they have they're more or less the location services for many of the apps that you've seen out there on the web.
00:02:11.195 --> 00:02:18.693
So if you've got your Candy Crushes, your MyFitnessPal, tinder and so forth, they take all of that location data and they use those analytics.
00:02:18.800 --> 00:02:32.282
And I've seen this in the past where it's a big concern from a privacy standpoint, because now these individuals are turning around and selling off this data to individuals or companies or governments looking for specific information.
00:02:32.282 --> 00:02:37.723
Now the argument they come back to is they don't have timestamps on some of this information.
00:02:37.723 --> 00:02:39.890
But let's be realistic.
00:02:39.890 --> 00:02:44.062
They have the data, the location services, data of where you're doing it, when you're doing it.
00:02:44.062 --> 00:02:48.389
It may not be specifically times of when you're doing it, but based on an individual.
00:02:48.389 --> 00:02:51.414
You know Sean's sleeping from X to Y.
00:02:51.414 --> 00:03:00.199
Well, sean's awake from A to B, so most likely you have a pretty good idea and you can pick up a pattern in which Sean travels to and from locations.
00:03:00.199 --> 00:03:01.706
So therefore you could track me.
00:03:02.801 --> 00:03:05.759
It's not hard, it's very simple to do, and we did this before.
00:03:05.759 --> 00:03:11.100
We even had all these different tools In the red teams, we would do it and it was a little bit harder.
00:03:11.100 --> 00:03:17.245
But with all these tools and now you can go out and countries can go out and buy this information, yeah, it's a bit concerning.
00:03:17.245 --> 00:03:26.540
So this comes back to again you want to educate your employees around the accept all or allow tracking piece of these apps that you put within your organization.
00:03:26.540 --> 00:03:36.991
And I think this is a big factor in that, when you give people maybe mobile devices as well, is that you try to control the device with some sort of mobile device control system.
00:03:36.991 --> 00:03:45.669
Now, if you don't have that ability, then it comes up to you to do the education around that and know that if you don't educate them well, they're just going to do what they're normally used to doing.
00:03:46.954 --> 00:03:57.467
So the part of it is is they say, this is the largest data brokers in the world and they, both from a commercial and government clients, appear to be acquiring data for online advertising.
00:03:57.467 --> 00:04:00.193
Right, that's the goal, but we've used this in the past.
00:04:00.193 --> 00:04:05.633
Any of this online stuff if your data is being shared, it is going into some location.
00:04:05.633 --> 00:04:21.271
Well, according to them, gravy was hacked and then, because it was hacked, these were giving information of data that was in the United States, russia and Europe, and so most of the data that was extracted had app names built into the mentioned apps.
00:04:21.271 --> 00:04:23.535
So they had the names, they had the locations.
00:04:23.535 --> 00:04:31.242
They put a list here of some of the ones that people go to obviously, harry Potter, subway Surfers, temple Run, all those many of those that my kids would use.
00:04:31.242 --> 00:04:37.605
They have access to all of those, so even the Christian yeah, the Muslim Prayer and the Christian Bible apps as well.
00:04:38.005 --> 00:04:49.795
So the point you want to really find out is if educating your people around one, these people, these advertisers, are taking your money or they're taking your data and they're doing stuff with your data that you may or may not approve of.
00:04:49.795 --> 00:04:53.891
Two, you want to really consider if you allow tracking on this data.
00:04:53.891 --> 00:05:17.625
It's one of those aspects I try to tell people that I work with, as well as my kids don't allow any sort of tracking unless it's absolutely required for the app itself, and in many cases that type of app would only be like a GPS monitoring type of app, like your maps or maybe Waze, whatever ones that you're using to specifically monitor your traffic.
00:05:17.625 --> 00:05:28.271
That would make sense, but in reality, a lot of times they have these tracking devices turned on due to the fact that, like when I go into Walmart, and if I walk into Walmart, it knows I'm there.
00:05:28.271 --> 00:05:31.704
Now it may know it because of my IP address and it connects to the Wi-Fi.
00:05:31.704 --> 00:05:38.435
If I've had that or two, it may know just based on my geolocation, but the ultimate goal is it's using this as a way to market and track to you.
00:05:38.456 --> 00:05:57.800
Because, if you've noticed, I just kind of a little tangential digression if, if you notice, like we went to not Bed, bath and Beyond, because they don't exist anymore the candle company, the scent thing but yeah, I don't remember what the name of it is, but something over the Christmas holidays we went to and it's the scent place where they have candles, they have lotions, they have all those different things.
00:05:57.800 --> 00:06:08.004
The moment we walked in, it knew my wife was there and because it knew my wife was there, it started pushing up ads to her saying hey, have you ever thought about this?
00:06:08.004 --> 00:06:09.288
Hey, have you ever thought about that?
00:06:09.288 --> 00:06:16.894
Again, all of that stuff is being fed into situations like gravy and the data is there being stored.
00:06:16.894 --> 00:06:18.184
So, again, good article by Wired.
00:06:18.184 --> 00:06:18.966
I would highly recommend it.
00:06:18.966 --> 00:06:21.802
It's pretty long, so you want to just do it over a lunch thing.
00:06:21.802 --> 00:06:39.413
Sit down and read it, but it will give you some really good ideas on what some of the information that is being funneled through these third parties to include immigration and customs enforcement, customs and border protection, irs and FBI All of these are just data is being purchased and bought by governments as well as advertisers.
00:06:40.079 --> 00:06:43.660
Okay, so let us move on to what we're going to talk about today.
00:06:43.660 --> 00:06:47.752
Okay so, domain 2.3, provisioning resources securely.
00:06:47.752 --> 00:06:51.262
So this is going to get into this aspect we are as we go through.
00:06:51.262 --> 00:07:01.031
The main goal of the CISSP podcast is to provide you content around the various domains and what you can do to be better prepared for the CISSP exam.
00:07:01.031 --> 00:07:03.067
The goal is not to teach you the test.
00:07:03.067 --> 00:07:10.322
The goal is to teach you the thought process around security professionals and senior security professionals in which the CISSP exam is written for.
00:07:10.322 --> 00:07:12.211
So that's the ultimate goal.
00:07:12.211 --> 00:07:19.773
So, as we go down this concept, we're going to get into different topics and then kind of give you a spin based on what a senior leader would consider it.
00:07:20.420 --> 00:07:22.706
So let's get into information and asset ownership.
00:07:22.706 --> 00:07:30.192
So information and asset ownership refers to assigning responsibility for managing and protecting information and IT resources.
00:07:30.192 --> 00:07:31.663
Okay, that's the book answer, right?
00:07:31.663 --> 00:07:36.404
These owners are responsible for the controls, they're responsible for the data.
00:07:36.404 --> 00:07:41.802
They're also responsible to know where the data is stored, and we've talked about this routinely.
00:07:41.802 --> 00:07:53.295
They need to know where the data is stored and I will tell you that when you depend on the organization you go work for, the owner may not know where this data is stored because in many cases, it's spread everywhere.
00:07:53.295 --> 00:07:59.793
So it's important for you, as a security professional, to get with the information owners to help them understand about their data.
00:08:00.940 --> 00:08:05.507
Now, the information owner they're responsible for the data classification that would be public, private and confidential.
00:08:05.507 --> 00:08:11.153
They need to define the level of protection required, based on the sensitivity of the value of the data.
00:08:11.153 --> 00:08:16.052
So now, when you go and you talk to the owner, they're going to need to know what is this data?
00:08:16.052 --> 00:08:17.466
Is this data intellectual property?
00:08:17.466 --> 00:08:20.908
Is this data a super secret sauce of Kentucky Fried Chicken?
00:08:20.908 --> 00:08:21.670
What is it?
00:08:21.670 --> 00:08:23.783
And so they're going to have to know that.
00:08:23.783 --> 00:08:28.232
Now, if they don't know that, you're going to need to ask some questions of going well, then who will know that?
00:08:28.232 --> 00:08:36.292
And that can get very squishy real quick and people can do a little squirming because they're like, wow, bill knows it.
00:08:36.292 --> 00:08:44.208
You'll find out that in many cases, the CEO is the one that actually owns all the data and they're supposed to be the one that knows it, which I've worked with a lot of CEOs and they are very smart people.
00:08:44.208 --> 00:08:49.282
All of them Yep, ladies and guys are all super smart, but they don't know everything about data ownership.
00:08:49.282 --> 00:08:52.173
They rely on people within their organization to do that.
00:08:52.173 --> 00:09:01.745
You need that owner will grant access, permissions, at least privilege, need to know basis and so forth, and then they'll ensure compliance with relevant regulations such as GDPR and HIPAA.
00:09:01.745 --> 00:09:04.311
That's the information owner's responsibilities.
00:09:04.311 --> 00:09:15.432
Now, again, they may have delegated that to an individual, but you need to find out who the owner is and then make sure, coordinate all of that out, and I will tell you that it sometimes can be a very bit.
00:09:15.432 --> 00:09:17.424
It can be a bit of a challenge to work through all that.
00:09:18.868 --> 00:09:22.783
Asset owners now these are they own the physical or virtual systems.
00:09:22.783 --> 00:09:24.326
This would be software and or network.
00:09:24.326 --> 00:09:28.131
So the information owner and the asset owner may be the same person.
00:09:28.131 --> 00:09:31.986
They may not be the same person Depending upon the size of the organization.
00:09:31.986 --> 00:09:37.125
If it's a larger organization, you may have multiple information owners and multiple asset owners.
00:09:37.125 --> 00:09:50.804
But again, the asset owner is someone who owns the physical or virtual systems that are tied to it and they're responsible for maintaining the systems and ensuring that it's required security patches and configurations have been applied as specified.
00:09:50.804 --> 00:09:53.514
They're going to need to, depending upon the organization.
00:09:53.514 --> 00:10:02.770
If it's a regulated environment, they're going to need to have that documented and if they don't have it documented, you need to work with them to get it documented as much as you possibly can.
00:10:03.682 --> 00:10:07.283
Again, the ultimate goal is not to fulfill what the auditors want.
00:10:07.283 --> 00:10:09.690
The auditors are just doing a fact check on you.
00:10:09.690 --> 00:10:18.004
So if you're doing these things in a routine basis and you have a plan for them, your audits are going to be easy peasy, lemon squeezy.
00:10:18.004 --> 00:10:22.493
So I've done audits, numerous audits all the time I was doing them all the time.
00:10:22.493 --> 00:10:29.596
And the thing is is that I learned is that if I did the things the right way, the auditors would not dig as deep.
00:10:29.596 --> 00:10:35.081
And I'm not doing this to placate the auditor, saying, well, just do a good job on the surface so that they don't dig deeper.
00:10:35.081 --> 00:10:39.331
No, you want to make sure that you have a good level of depth with your controls.
00:10:39.331 --> 00:10:41.605
Now, you're not going to be perfect, and the auditors know that.
00:10:41.605 --> 00:10:53.467
But if you have a good plan in which you're in some and then also you're willing to accept risk, either you or the CEO is willing to accept the risk for the organization, that's fine, they're okay with that.
00:10:53.467 --> 00:11:00.111
But they want to make sure that you're meeting the general controls that you have determined and that you are applying within your organization.
00:11:00.111 --> 00:11:05.831
Okay, so that's their ultimate point is security, patches, configurations, all that stuff they're responsible for.
00:11:05.831 --> 00:11:13.153
They also implement asset lifecycle policies, and this was from procurement to the overall secure disposal of the device itself.
00:11:13.801 --> 00:11:20.033
So the key concept around this is that ownership involves accountability, but not necessarily operational responsibility.
00:11:20.033 --> 00:11:20.923
So that's different.
00:11:20.923 --> 00:11:23.264
Potentially Depends on the size of the company.
00:11:23.264 --> 00:11:28.708
You may be doing both, but the operational responsibility is usually in a different bucket.
00:11:28.708 --> 00:11:32.261
Somebody else usually owns that Asset custodians.
00:11:32.261 --> 00:11:38.874
They will handle your daily maintenance while owners define the policy and the appropriate use cases for the controls.
00:11:38.874 --> 00:11:46.700
So again, but I will tell you, you're going to need the custodians your data custodians and your asset custodians to work well with the data owners.
00:11:46.700 --> 00:11:53.173
You're going to have to have this give and take because they only know what they know and the data owners only know what they know.
00:11:53.173 --> 00:12:01.298
They don't know both in many cases, and so it's going to be a symbiotic relationship between the two to make sure that it's done correctly.
00:12:01.518 --> 00:12:05.364
So, as I mentioned earlier, data owner is a person with the ultimate organizational responsibility.
00:12:05.364 --> 00:12:08.335
Senior managers may be responsible, like I mentioned before.
00:12:08.335 --> 00:12:09.778
The CEO could be.
00:12:09.778 --> 00:12:11.062
It could be somebody else in between.
00:12:11.062 --> 00:12:13.575
Again, they may not even know that the data owner.
00:12:13.575 --> 00:12:21.341
Typically IT will own the servers and the workstations, but somebody else will own the actual data itself.
00:12:21.341 --> 00:12:28.996
We talked about IT protecting devices Key point here identify asset owners and they may or may not be within IT.
00:12:29.538 --> 00:12:30.620
I have seen it time and again.
00:12:30.620 --> 00:12:36.701
The original or the true information owner will go.
00:12:36.701 --> 00:12:49.533
Well, it owns it and it's like no, you're going to have to educate them that no, in most cases, the IT should not be owning the data, because IT doesn't understand what the data is and may not understand the sensitivity related to the data.
00:12:49.533 --> 00:12:50.255
I had this.
00:12:50.255 --> 00:12:52.912
I was working with a scientist once and he goes well, it owns it.
00:12:52.912 --> 00:12:57.061
I'm like, sir, we don't know what the heck your data is.
00:12:57.061 --> 00:13:02.500
I don't know if it could be launch codes for ICBMs or it could be how to make algae turn blue.
00:13:02.500 --> 00:13:03.501
I don't know.
00:13:03.501 --> 00:13:04.490
I don't know what that is.
00:13:04.490 --> 00:13:08.803
So therefore, it's really hard for me to be the owner of that data.
00:13:08.803 --> 00:13:11.759
You are going to have to, mr Scientist, be the owner of that data.
00:13:11.759 --> 00:13:13.466
So it took a lot of finagling.
00:13:13.466 --> 00:13:17.215
We finally got it worked out, but at the end of the day, it wasn't IT that owned it.
00:13:17.215 --> 00:13:21.782
Now we own the systems that they were housed in, but we did not own the data specifically itself.
00:13:21.782 --> 00:13:24.571
So again, that's what you got to keep in mind.
00:13:24.571 --> 00:13:26.821
And again, they may delegate it to other people.
00:13:26.821 --> 00:13:32.400
That's okay, but you just got to make sure everybody's aligned and knows who's who in the zoo.
00:13:32.400 --> 00:13:34.748
Okay, asset management Now.
00:13:34.849 --> 00:13:39.682
Asset management is a systematic process of tracking, monitoring and managing your assets within your company.
00:13:39.682 --> 00:13:44.130
This could go down to as small as USB devices or phones or whatever it may be.
00:13:44.130 --> 00:13:45.975
It might not be that low, it may just be.
00:13:45.975 --> 00:13:46.356
You know what.
00:13:46.356 --> 00:13:47.760
I don't really care about those.
00:13:47.760 --> 00:13:51.181
All I care about is servers and workstations.
00:13:51.181 --> 00:13:53.207
Okay, great, that's fine.
00:13:53.207 --> 00:13:55.293
It just comes down to the company and what your needs are.
00:13:55.293 --> 00:14:05.402
But the ultimate goal is to optimize value, manage risk and ensure compliance with what is designed both from an internal policies and external regulatory requirements that you may have.
00:14:05.402 --> 00:14:13.056
So these assets will include both tangible and intangible items, and we'll get into both of those here in just a minute.
00:14:13.056 --> 00:14:14.921
So objectives again.
00:14:14.941 --> 00:14:17.556
The ultimate goal is you want to identify and classify your assets.
00:14:17.556 --> 00:14:22.457
This includes data, hardware and software, which we've talked time and time again through this podcast.
00:14:22.457 --> 00:14:28.000
You want to track the asset lifecycle stages to include acquisition, usage, maintenance and decommissioning.
00:14:28.000 --> 00:14:33.263
This is an important part and it a lot of times gets lost because someone will go hey, I need a new server.
00:14:33.263 --> 00:14:35.216
Oh, we just bought one, we bought two, we bought three.
00:14:35.216 --> 00:14:40.456
Next thing, you know you've got 50 servers and I know it's pretty exaggerated.
00:14:40.597 --> 00:14:44.583
But the point of it is you have all these systems now and you're like, oh, why do we need all these?
00:14:44.583 --> 00:14:46.605
And then you don't know when you bought them.
00:14:46.605 --> 00:14:48.687
And then, if you don't know when you bought them, well, how old are they?
00:14:48.687 --> 00:14:49.447
Should we get rid of them?
00:14:49.447 --> 00:14:50.551
Which one has a hard drive?
00:14:50.551 --> 00:14:51.152
This one doesn't.
00:14:51.152 --> 00:14:52.034
This has an SSD.
00:14:52.034 --> 00:14:55.301
Then it gets to be super complicated and it's like oh, stop the madness.
00:14:55.301 --> 00:15:06.905
So if you can get a plan already, before you purchase so anytime something's purchased it gets added to a list somewhere that people actually go and check then you're in a much better position.
00:15:07.426 --> 00:15:14.355
So you want to track the assets from both their entire life cycle, from acquisition, usage, maintenance and decommissioning, from the beginning to the end.
00:15:14.355 --> 00:15:15.801
You want to track that.
00:15:15.801 --> 00:15:18.870
If you do that, you now are in a much better position.
00:15:18.870 --> 00:15:21.015
One, financially, you're not overbuying.
00:15:21.015 --> 00:15:23.942
Two, you have a good tracking of where your data is going.
00:15:23.942 --> 00:15:28.341
So the auditors are happy and you have better access to what's going on within your company.
00:15:28.341 --> 00:15:40.014
This also prevents asset misuse, which means Bill does the five-finger discount and sees a workstation sitting there or a laptop and goes, aha, nobody's going to miss this, and they walk off with it.
00:15:40.014 --> 00:15:44.971
And then now you're missing equipment and they walk off with it.
00:15:44.971 --> 00:15:45.774
And then now you're missing equipment.
00:15:45.774 --> 00:15:49.164
So, again, those are all types of activities you, by having a good life cycle and tracking, can watch.
00:15:49.164 --> 00:15:50.890
Again, people will steal stuff.
00:15:50.890 --> 00:15:52.715
I guarantee you, I own a business.
00:15:52.715 --> 00:15:59.642
They steal from me the little rascals, and I try to figure out how they do it and I try to stop it, but they still do it.
00:15:59.642 --> 00:16:00.365
I know they do.
00:16:00.365 --> 00:16:02.412
So people will do those things.
00:16:02.412 --> 00:16:04.559
So security professional plan for that.
00:16:05.350 --> 00:16:09.557
Now, examples of asset management activities this would be conducting regular inventory audits.
00:16:09.557 --> 00:16:22.475
Again, auditing, yes, you, and I like to call it more of an assessment right, because internal, it's more of an assessment because I'm not really an auditor and I'm not really using a third party, so I'm kind of just assessing it, but you can word it however you wish to word it.
00:16:22.475 --> 00:16:34.791
Using asset tagging systems again, barcodes, rfids, little tracky things, little Apple AirTags, whatever it is.
00:16:34.791 --> 00:16:36.940
I've seen that happen where people had a problem with equipment leaving the manufacturing site.
00:16:36.940 --> 00:16:37.260
What do they do?
00:16:37.260 --> 00:16:38.385
They put AirTag type things on it.
00:16:38.385 --> 00:16:44.783
Rfd, you know, basically trackers, and the goal was because someone was doing the five-finger discount and lifting this stuff and moving off with it.
00:16:44.783 --> 00:16:46.788
So you've got to plan for that.
00:16:46.908 --> 00:16:52.611
Implementing digital asset management systems to control software licenses and cloud resources, it isn't as big of a deal.
00:16:52.611 --> 00:16:56.102
In the old days they used to have a lot of CD.
00:16:56.102 --> 00:16:59.331
Your office could be on CD and it would be theft for that.
00:16:59.331 --> 00:17:06.962
You could use your keys around, which is more of an intangible asset, but you could use the software keys and you could have multiple versions of your software.
00:17:06.962 --> 00:17:12.886
That's a little bit harder to do nowadays, but it does still happen your software license.
00:17:12.886 --> 00:17:24.643
If you're dealing with cloud resources, though because the cloud is in the air quotes cloud and it's not with you people could gain access to those and use those cloud resources for things outside of what normal day-to-day activities would be.
00:17:24.643 --> 00:17:31.143
Ie crypto mining is one great example of that that I've seen happen in the years, especially now that Bitcoin is up through the roof.
00:17:31.143 --> 00:17:43.839
I don't even know how that's going to work, but again, the ultimate point of it is that there are ways that you have to keep tabs on your resources, both from a hardware and software and virtual environment.
00:17:44.970 --> 00:17:50.973
Some security considerations, protecting sensitive data on decommissioned equipment through secure data wiping or destruction plans.
00:17:50.973 --> 00:18:01.015
You should have a good plan, which we've talked about, on how to wipe destroy your old equipment, because if you don't, again it will leave the premises and be used and sold to other people.
00:18:01.015 --> 00:18:10.797
And again, if you get a lot of stuff that's stolen from your company and maybe it's sold for pennies on the dollar, well it all adds up and people are using your assets for their profit.
00:18:10.797 --> 00:18:16.393
This also helps prevent shadow IT by identifying unauthorized assets on the network.
00:18:16.393 --> 00:18:20.162
So do you have the ability to monitor your network for unauthorized assets?
00:18:20.162 --> 00:18:24.323
Again, that's a point you need to consider.
00:18:24.343 --> 00:18:27.538
I will tell you that doing that is very challenging, super challenging.
00:18:27.538 --> 00:18:35.202
It can be done, but you got to have a really good plan when you get started to make it happen and you got to follow through and you have to continue.
00:18:35.202 --> 00:18:37.674
It's the hospital you never, ever leave.
00:18:37.674 --> 00:18:40.181
So you just have to decide is it worth it?
00:18:40.181 --> 00:18:42.212
Some networks you got to have it right.
00:18:42.212 --> 00:18:46.619
Right, because they have super secret stuff the 11 herbs and spices from kentucky fried chicken.
00:18:46.619 --> 00:18:48.226
You can't let that escape.
00:18:48.226 --> 00:18:49.411
You may have that.
00:18:49.411 --> 00:18:50.874
Other networks it's like.
00:18:50.874 --> 00:18:52.016
This is just the.
00:18:52.016 --> 00:18:54.662
The amount of tension that it causes is too much.
00:18:54.662 --> 00:18:56.576
Therefore, it's just not worth it.
00:18:56.576 --> 00:19:01.653
You have to weigh all that out and again, you, as a security professional, cannot be draconian with this and go.
00:19:01.653 --> 00:19:07.263
Ye must do, because ye will be looking for new employment at some point because they don't like that.
00:19:07.263 --> 00:19:09.036
You need to have that give and take.
00:19:09.036 --> 00:19:09.999
You need to work with them.
00:19:09.999 --> 00:19:14.141
Now there's times you need to pull the bully pulpit out and pull out the hammer and go whack, whack, whack.
00:19:14.141 --> 00:19:17.299
But most cases you don't want to go that direction.
00:19:18.230 --> 00:19:21.582
Okay, configuration management systems, cmss Now CMSs.
00:19:21.582 --> 00:19:29.722
Their structured approach is for managing configuration of IT assets, ensuring consistency and reducing vulnerabilities caused by configuration errors.
00:19:29.722 --> 00:19:37.596
So when someone's configuring the system and they push out a patch, they want to have this so that avoids causing a mass outage.
00:19:37.596 --> 00:19:41.606
There's some core components to this.
00:19:41.606 --> 00:19:43.372
One is the configuration items.
00:19:43.372 --> 00:19:44.416
This is the CIs.
00:19:44.416 --> 00:19:49.221
Now these are what are managed by the CMS, such as servers, applications or network devices.
00:19:49.221 --> 00:19:50.894
So these are the items that can be managed.
00:19:50.894 --> 00:19:52.941
They can be mucked with, they can be changed.
00:19:52.941 --> 00:19:59.002
You have a baseline configuration and this is the approved settings and parameters used as a standard.
00:19:59.002 --> 00:20:01.391
So if you're making a change, this is what happens.
00:20:01.551 --> 00:20:06.934
Okay, now if something bad happens, you have the ability to roll back, and that's where version control comes in.
00:20:06.934 --> 00:20:09.457
Is that you push it out, you roll it back.
00:20:09.457 --> 00:20:13.759
And we've talked on CISP, cyber Training, multiple times about configuration management.
00:20:13.759 --> 00:20:24.827
You want to have the ability that if anything goes sideways, you can roll it back to a previous version that is stable and useful and then from there figure out why it broke Again.
00:20:24.827 --> 00:20:29.961
Configuration management again is another one of those places that you never ever get out of.
00:20:29.961 --> 00:20:37.616
Now, if you have a bad configuration management within your organization, that's bad, because what will happen is now you can't control what's being pushed.
00:20:37.616 --> 00:20:53.679
Bad guys and girls can push packages to your entire organization and real quickly you can go from having a small isolated incident to a massive ransomware incident where you are just wishing that the day would be over and that you were a turnip farmer in Southern California.
00:20:53.679 --> 00:20:55.323
That is what you would wish for.
00:20:56.490 --> 00:21:06.070
So configuration management system again, the security benefits identifying unauthorized changes to again compromised security, which we just kind of talked about, ensuring patch management and updates are an approved process Again.
00:21:06.070 --> 00:21:07.836
They're just not getting pushed out willy-nilly.
00:21:07.836 --> 00:21:24.018
It's so nice I've dealt with this in many years where you had to go test your Microsoft patch, you had to test your Unix patch, you had to test this patch, and you still do I'm not saying you don't but we were able to get agreement with senior leadership, at least from a Microsoft standpoint.
00:21:24.018 --> 00:21:30.746
Within multiple organizations I've worked in to just go with the automatic patching for Microsoft.
00:21:30.746 --> 00:21:43.135
Now you're putting a lot of trust in that Microsoft won't pwn you right, but the ultimate goal is, if Microsoft does that, they got bigger issues that could affect them even larger, so they're going to go above and beyond to make sure that that does not happen.
00:21:43.135 --> 00:21:49.435
The nice part is that's one less thing that you can take off your plate and someone else is actually doing the updates for you and not you.
00:21:50.538 --> 00:21:56.422
You want a supporting incident response by providing historical view of configurations what has actually happened and how have they happened?
00:21:56.422 --> 00:21:57.632
What changes have been made?
00:21:57.632 --> 00:21:59.955
All of those are very important pieces.
00:21:59.955 --> 00:22:09.857
So some tools you could use would be puppet, chef, ansible, microsoft, msc, cc, um or cc sccm.
00:22:09.857 --> 00:22:11.520
I said that was really screwed, that one up.
00:22:11.520 --> 00:22:13.971
Yeah, all I ever knew it would buy was sccm.
00:22:13.971 --> 00:22:17.019
That's their configuration management tool for microsoft.
00:22:17.019 --> 00:22:18.951
It works like a great, great, great, great great.
00:22:18.951 --> 00:22:23.604
I've dealt with puppet a little bit but bit, but mostly with SCCM.
00:22:23.604 --> 00:22:34.559
So those are your configuration management tools and there can be an entire podcast just on CMSs and how they work, which we probably won't do because you won't really.
00:22:34.559 --> 00:22:37.211
You'll be asleep either on the train or driving to work.
00:22:37.211 --> 00:22:38.980
You'll be driving and falling into the ditch.
00:22:38.980 --> 00:22:39.804
That would be bad.
00:22:40.688 --> 00:22:44.694
Okay, virtual assistant assist oh my goodness, virtual asset management.
00:22:44.694 --> 00:22:46.282
What's a virtual asset management?
00:22:46.282 --> 00:22:51.821
Now, this includes the management of non-physical resources, such as virtual machines, containers and cloud-based systems.
00:22:51.821 --> 00:22:57.151
So, as you move to the cloud, as your organization does and I've talked to multiple organizations, they go.
00:22:57.151 --> 00:22:59.115
I hope my stuff is in the cloud, I'm good.
00:22:59.115 --> 00:23:01.461
Yeah, no, your stuff's not good.
00:23:01.461 --> 00:23:06.693
It could be, I don't know, but you're dealing with different types of vernacular now.
00:23:06.693 --> 00:23:18.631
So containers, cloud-based systems right, all of those pieces are different type of words that mean the same thing in many cases, but it also have different connotations to them.
00:23:18.631 --> 00:23:23.009
You need to understand, and this is where you're dealing with the virtual asset piece of this.
00:23:23.490 --> 00:23:24.834
So now virtual sprawl.
00:23:24.834 --> 00:23:28.000
This is something I knew was going to happen, just knew it.
00:23:28.000 --> 00:23:32.758
Just knew it and mentioned it to our senior leaders, going be careful.
00:23:32.758 --> 00:23:34.582
Well, yeah, it happens.
00:23:34.582 --> 00:23:35.330
Why does it happen?
00:23:35.330 --> 00:23:37.234
Because it's so easy to do.
00:23:37.234 --> 00:23:39.298
It's like eating refined sugar.
00:23:39.298 --> 00:23:42.673
It's so good, right, it's so good, but it's addictive.
00:23:42.673 --> 00:23:44.820
Well, the same with virtual sprawl.
00:23:44.820 --> 00:23:45.752
It is addictive.
00:23:45.752 --> 00:23:46.075
Why?
00:23:46.075 --> 00:23:48.605
Because I can provision a system, boom, it's up and running.
00:23:48.605 --> 00:23:50.412
I can provision it, it's going.
00:23:50.653 --> 00:23:52.057
I have no problems with the VMs.
00:23:52.057 --> 00:23:54.311
They're easy peasy, especially when you're in a cloud environment.
00:23:54.311 --> 00:23:56.557
I can run all kinds of scripts with them.
00:23:56.557 --> 00:24:07.039
I can actually have the script run itself without having to send up an actual virtual machine, and then I just get charged a couple little pennies or a half a penny for the script to run.
00:24:07.039 --> 00:24:09.978
Problem is, as the script continues to run, it never goes away.
00:24:09.978 --> 00:24:20.272
And then all of a sudden, the pennies continue to grow and grow and grow and next thing you know you're into real hard cash because you have all these things moving in the background that may or may not be useful to your company.
00:24:20.272 --> 00:24:22.737
So you need to determine the resource visibility.
00:24:22.897 --> 00:24:26.564
Again, it's difficult to track all the virtual instances in a hybrid environment.
00:24:26.564 --> 00:24:27.525
It's very challenging.
00:24:27.525 --> 00:24:33.272
There's software for that that'll help you.
00:24:33.272 --> 00:24:34.317
That being said, the software ain't cheap.
00:24:34.317 --> 00:24:36.565
So as you get into this space of virtual to go, I'm going to save a lot of money.
00:24:36.565 --> 00:24:41.275
And then you get in there and you go oh wait, I'm not saving a lot of money because I'm spending on all kinds of other stuff.
00:24:41.275 --> 00:24:42.876
Yeah, that's how it works.
00:24:42.876 --> 00:24:48.404
But there are benefits, obviously, between the hard on-prem versus the virtual Security risk.
00:24:51.690 --> 00:24:53.234
Again, you're dealing with snapshots of vulnerabilities.
00:24:53.234 --> 00:24:57.070
If a snapshot of a VM is not properly managed, they can contain sensitive data or potentially malware, depending on the situation.
00:24:57.070 --> 00:25:05.565
And so, because it is a VM and it's a snapshot, you could proliferate that VM that is now tainted to other parts of your organization.
00:25:05.565 --> 00:25:08.178
There is shared resource risk in virtual environments.
00:25:08.178 --> 00:25:09.690
Often are you shared resources?
00:25:09.690 --> 00:25:17.324
So, again, you're dealing with something, whether it's a network file share that they're sharing, whether it's a database that they're sharing who knows?
00:25:17.324 --> 00:25:22.102
But again, data leakage or proliferation of malware is a true risk.
00:25:22.529 --> 00:25:24.237
So what are some best practices around this?
00:25:24.237 --> 00:25:30.315
Implementing automated discovery tools, obviously, to identify and manage your virtual assets, and then also using role-based access controls.
00:25:30.315 --> 00:25:32.180
We know that it's important.
00:25:32.180 --> 00:25:34.313
You should have some level of role-based access controls.
00:25:34.313 --> 00:25:36.479
Not everyone has got access.
00:25:36.479 --> 00:25:40.012
That is a role-based access control, but it's not a very good one.
00:25:40.012 --> 00:25:44.563
So, yeah, everybody in the country has the ability to access my servers.
00:25:44.563 --> 00:25:47.297
It's based on role and everybody has the same role.
00:25:47.297 --> 00:25:48.441
Yeah, that's not so good.
00:25:48.441 --> 00:25:53.201
So, yeah, think about that as you're looking at role-based access controls for your organization.
00:25:54.289 --> 00:25:57.220
Cloud-based asset management what is this?
00:25:57.220 --> 00:26:04.019
So this manages the assets in the cloud, involving and dealing with dynamic and distributed resources across multiple cloud service providers.
00:26:04.019 --> 00:26:05.342
Wow, lots of words.
00:26:05.342 --> 00:26:11.643
Um, the ultimate goal is is that how do you deal when you have, maybe, an azure cloud and an aws environment?
00:26:11.643 --> 00:26:15.999
Done, all right, so you have azure and you have aws and how do they talk together?
00:26:15.999 --> 00:26:19.130
Uh, do you have tagging and do you have labeling?
00:26:19.130 --> 00:26:20.111
Does you have?
00:26:20.111 --> 00:26:21.993
How does that work now can?
00:26:21.993 --> 00:26:25.819
There is definitely the cross communication between clouds and it is viable.
00:26:25.961 --> 00:26:33.662
I would recommend, if possible, that you stick with one cloud, and the reason I say that it's not because I'm I cherish one over the other.
00:26:33.662 --> 00:26:34.250
I really don't.
00:26:34.250 --> 00:26:36.498
I mean, azure is easier to configure for individuals.
00:26:36.498 --> 00:26:40.972
Aws is a much more tech savvy type of thing.
00:26:40.972 --> 00:26:46.817
But they all have different pros and cons and I'm not the one to sit there and tell you which one knows better for you and your organization.
00:26:46.817 --> 00:26:50.656
But you want to have a lot of specific cloud considerations as you're dealing with this.
00:26:52.019 --> 00:26:55.174
So the resources again are typically ephemeral.
00:26:55.174 --> 00:26:57.539
That's a big $10 word, but it means short-lived.
00:26:57.539 --> 00:26:58.040
They're very quick.
00:26:58.040 --> 00:27:00.192
They show up, they go away.
00:27:00.192 --> 00:27:02.478
Again, real-time tracking of what's going on.
00:27:02.478 --> 00:27:06.246
We talked about this with the scripts, there's tagging labeling of cloud resources.
00:27:06.246 --> 00:27:09.113
This will help with your visibility and cost management.
00:27:09.113 --> 00:27:12.270
This comes back down to sensitivity labels, like we talked about with data.
00:27:12.270 --> 00:27:23.541
Sensitivity is you need to label and tag these items, this data, because, one, you know what it is and, two, it does help when you're dealing with the AWS or the cloud-based type environments.
00:27:23.541 --> 00:27:30.836
Your resources are all based on activities and it can get very expensive.
00:27:30.836 --> 00:27:35.951
So all of a sudden, you have a service running that was tagged as being I'm just guessing here just saying partial.
00:27:35.951 --> 00:27:40.692
It doesn't go very often, just every once in a while it's supposed to kick off, but it's running all the time.
00:27:40.692 --> 00:27:42.195
Well, that tag could help you go.
00:27:42.195 --> 00:27:50.019
Let's go dig into that and figure out why this thing is only supposed to be running once a week and it's now running consistently, constantly, all the time.
00:27:50.922 --> 00:28:01.074
Data, residency and sovereignty you need to understand where is your data being stored, how is that going to affect your overall data privacy piece of this and also, where is your data footprint?
00:28:01.074 --> 00:28:11.622
If you have data that's stored within the EU and it is also accessing data within China and it's the same type of data, but they're crossing the streams it's usually not a good thing.
00:28:11.622 --> 00:28:14.970
You should have very much data localization, especially when you're dealing with the EU.
00:28:14.970 --> 00:28:18.057
But the China piece of this is starting to kind of roll into.
00:28:18.057 --> 00:28:19.781
They want a data localization as well.
00:28:19.781 --> 00:28:21.970
So those are things you need to really consider.
00:28:22.330 --> 00:28:26.920
Cloud management tools this would be AWS configurations this tracks, and changes to AWS.
00:28:26.920 --> 00:28:30.816
Azure resource manager this would provide tools for managing resource groups.
00:28:30.816 --> 00:28:33.082
And then also Google Cloud Asset Inventory.
00:28:33.082 --> 00:28:35.473
Again, I forgot to even mention the Google Cloud.
00:28:35.473 --> 00:28:42.119
So GCP all of these are different areas that you can use to manage your cloud environment.
00:28:42.119 --> 00:28:44.087
Again, stick with one.
00:28:44.087 --> 00:28:45.511
It's already complicated enough.
00:28:45.511 --> 00:28:48.800
Don't complicate it with two or more, unless you absolutely have to.
00:28:48.800 --> 00:28:51.375
But if you do, guess what, you're going to need to hire more people.
00:28:51.375 --> 00:28:53.961
Oh, and, by the way, they're hard to find.
00:28:53.961 --> 00:29:01.133
And then when you get somebody that says, yes, I know all about the cloud, you'll realize real quick yeah, they probably don't, unless you pay them gobs of money and you get somebody.
00:29:01.133 --> 00:29:15.029
Really, if you're trying to get Billy Bob, who used to be the IT support guy, and now he goes, oh yeah, I can do the cloud, you may want to reconsider that thought process or at least have somebody that understands the cloud a little bit overseeing Billy Bob.
00:29:15.490 --> 00:29:22.267
Just a thought Security challenges data encryption, both at rest and in transit, is an important factor in dealing with cloud.
00:29:22.267 --> 00:29:23.619
We've talked about this before.
00:29:23.619 --> 00:29:25.240
Transit's more of the big factor.
00:29:25.240 --> 00:29:30.096
At rest, the data is on most of these cloud environments.
00:29:30.096 --> 00:29:35.409
I don't even know if they will encrypt it with anything other than RSA to 256.
00:29:35.409 --> 00:29:37.583
And I think they're even now at 1024, whatever it is.
00:29:37.583 --> 00:29:41.797
So I don't I'm not ever a big fan about the data at rest.
00:29:41.797 --> 00:29:44.500
People talk about that a lot and I just struggle with it.
00:29:44.500 --> 00:29:47.445
But I could very well be wrong, because I'm wrong about a lot of things.
00:29:47.445 --> 00:29:51.232
I'm only right about 22.3% of the time, so I could be wrong.
00:29:51.232 --> 00:30:09.297
I just I think the bigger issue is in transit, because that is when it's going from your data location, your warm little house there, and it's being then sent to some other place and it's going through a lot of the no man's land to refer to a World War I battlefield and who knows, it's going to get molested as it goes through there.
00:30:09.980 --> 00:30:16.390
Shared responsibility model understand which security responsibilities lie with a cloud provider and which remain in the organization.
00:30:16.390 --> 00:30:27.086
So you need to understand where do those rely, where do those lie, because again it comes back down to data ownership and who owns it, especially if you're dealing with the shared responsibility model of the cloud.
00:30:27.086 --> 00:30:29.920
You really have to define all this stuff.
00:30:29.920 --> 00:30:38.676
I know it's a lot, it's too much, it truly is but if you're going to be protecting your data, senior leaders are expecting you to know this information.
00:30:38.676 --> 00:30:42.791
Or if you don't know it, which you can't know everything you can't.
00:30:42.791 --> 00:30:51.402
You can't know everything, but you need to surround yourself with people who are as smart or smarter than you, and there's a lot of people way smarter than me.
00:30:51.402 --> 00:30:56.602
So that's why I always put people around me that are that way, maintaining comprehensive hardware and software.
00:30:56.602 --> 00:30:58.362
So we're dealing with software asset inventories.
00:30:58.362 --> 00:31:02.846
You need to have a way to protect that, and that would be hardware asset inventories.
00:31:02.846 --> 00:31:07.698
This would be an example of hardware assets would be servers, routers, switches, mobile devices and IoT devices.
00:31:07.739 --> 00:31:09.460
That's a gotcha there, the IoT.
00:31:09.460 --> 00:31:17.385
They are many cases, kind of forgotten about and if you're dealing with like I used to with manufacturing facilities, they kind of did their own thing.
00:31:17.385 --> 00:31:24.771
They're like their own little mini base or their own little mini business and they just go well, if I need it, I'm going to buy it and that's cool.
00:31:24.771 --> 00:31:31.374
There's nothing wrong with that.
00:31:31.374 --> 00:31:33.769
But they need to let people know that they're buying it, because they go and buy stuff and then you don't know it exists.
00:31:33.769 --> 00:31:35.666
And then now you got shadow IT, and now you got data leaving, and then you got compliance issues.
00:31:35.666 --> 00:31:37.327
Oh my gosh, it never ends.
00:31:37.327 --> 00:31:39.749
So you just want to consider that.
00:31:39.749 --> 00:31:42.290
So IoT devices they will bite you.
00:31:42.290 --> 00:31:43.251
So keep that in mind.
00:31:43.251 --> 00:31:46.874
That's not a test thing, that's a life world thing.
00:31:46.874 --> 00:31:47.534
It will bite you.
00:31:48.134 --> 00:31:50.681
Security benefits Identify rogue devices on a network.
00:31:50.681 --> 00:31:54.017
You want to try to find as many rogue devices as you possibly can.
00:31:54.017 --> 00:31:55.000
You do have them.
00:31:55.000 --> 00:31:56.867
Do not be naive to think you do not.
00:31:56.867 --> 00:32:02.166
You do, unless you have really good port security, and even then they'll find a way around it.
00:32:02.166 --> 00:32:03.813
So identify rogue devices.
00:32:03.813 --> 00:32:09.268
Managing physical security on critical assets, such as locking server rooms, and then ensuring hardware lifecycle management.
00:32:09.268 --> 00:32:11.174
Again, this includes your secure disposal.
00:32:11.174 --> 00:32:20.369
So this is why you want to have a good hardware asset inventory and a process by which it goes from birth to death of all of those different assets.
00:32:20.369 --> 00:32:22.557
Software asset inventory.
00:32:22.577 --> 00:32:27.548
This is an example of operating systems, enterprise applications, middleware.
00:32:27.548 --> 00:32:34.131
Oh, these are like the land of misfit toys, so I'll use a reference to Christmas.
00:32:34.131 --> 00:32:39.757
Yes, the land of misfit toys If you haven't watched it with Rudolph the Red-Nosed Reindeer yes, I did just date myself how old I am.
00:32:39.757 --> 00:32:43.926
It's an awesome little part about the land of misfit toys and that is middleware.
00:32:43.926 --> 00:32:44.915
It is there.
00:32:44.915 --> 00:32:56.550
It is the stuff that everybody forgets about, nobody wants to play with, and you want to be aware of it and you want to find it because it will leave big gaping security holes within your organization if you do not address it.
00:32:56.550 --> 00:33:12.916
Don't have time with it, that's okay, that's totally fine, as long as you know you're aware of it and you have expressed the risk to the senior leaders and they know you're aware of it, that's okay.
00:33:12.916 --> 00:33:19.786
If you say you're going to get to it at some point, but you never will, you at least know it's there and you can address it when it does come up and bite you.
00:33:20.835 --> 00:33:28.385
Key risks of dealing with that is an unlicensed software that leads to compliance violations and then outdated software increases your vulnerability to exploits.
00:33:28.385 --> 00:33:29.567
Again, it hasn't been updated.
00:33:29.567 --> 00:33:30.229
So what happens?
00:33:30.229 --> 00:33:35.243
Yes, the bad boys and girls will take advantage of it and they will make your life painful.
00:33:35.243 --> 00:33:45.046
But you want to have a good plan around your software Unlicensed will get you in trouble from a compliance standpoint, and then outdated software will get you in trouble from a malicious standpoint.
00:33:45.046 --> 00:33:48.578
The unlicensed stuff make sure you get your stuff licensed, I mean it.
00:33:48.578 --> 00:33:54.246
It's expensive if you're found not to be with licensed software, so don't risk it.
00:33:54.566 --> 00:34:07.787
If you're a security person, this will be a very touchy subject, especially if you're dealing with a company that's not very big and they don't see the value in the software or the value in, basically, the application itself.
00:34:07.787 --> 00:34:09.682
And they see value in the application, but they don't want to pay for it.
00:34:09.682 --> 00:34:21.467
This can be a very, very touchy subject, and you're going to have to figure out how to weave that very carefully, because you're going to be telling them hey, by the way, you have about $50,000 in software that you need to buy, and they're like 50?
00:34:21.467 --> 00:34:26.206
I have, my margins are so tight that I made profit of $500,000.
00:34:26.206 --> 00:34:28.965
So you're taking a tenth of my profit.
00:34:28.965 --> 00:34:29.713
Yeah, they will not be happy.
00:34:29.713 --> 00:34:35.161
I just tell you right now, and it all comes down to margins, so you're going to have to work through that with them.
00:34:35.161 --> 00:34:37.922
Again, though, do not do unlicensed software.
00:34:37.922 --> 00:34:38.784
Just don't.
00:34:38.784 --> 00:34:40.201
I'm not a lawyer, but it will bite you.
00:34:40.835 --> 00:34:42.121
Tools, automated systems.
00:34:42.121 --> 00:34:46.905
Obviously, we talked about Microsoft Endpoint Configuration Manager, jmaf, or macOS Management.
00:34:46.905 --> 00:34:53.302
I've seen all of those, not JMaf, but the macOS and Microsoft Endpoint Configuration Manager.
00:34:53.302 --> 00:34:54.105
Yeah, those work great.
00:34:54.105 --> 00:35:03.106
They work really, really well and I would just deploy to those, if you can it does cost a little extra money, but it's worth it Intangible inventories.
00:35:03.574 --> 00:35:08.117
So these are non-physical but critical to an organization's operational and financial health.
00:35:08.117 --> 00:35:12.068
Okay, I thought this was going to be a relatively shorter podcast, but I am wrong.
00:35:12.068 --> 00:35:17.996
So, again, this is these are non-physical, but they deal with the operational and financial health of it.
00:35:17.996 --> 00:35:22.027
You got databases, intellectual property, a bad reputation and goodwill.
00:35:22.027 --> 00:35:24.420
That would be a non-tangible of inventory.
00:35:24.800 --> 00:35:30.905
Your IP is your patents, trademarks and proprietary algorithms One thing to think about when you're dealing with IP and patents.
00:35:30.905 --> 00:35:33.434
So these are valid for about 20 years.
00:35:33.434 --> 00:35:38.347
A patent is and you have to pay a patent fee every year, just like your CISSP.
00:35:38.347 --> 00:35:41.858
You have to do that and if you don't do that, the patent goes away.
00:35:41.858 --> 00:35:43.581
So you don't want that to happen.
00:35:43.581 --> 00:35:50.849
If you depending upon your company, if you have a lot of trademarks, if you have many patents, you're going to have to have a team that will be managing that for you.
00:35:50.849 --> 00:36:01.032
I'll tell you, I was a security professional and I was helping manage these patents and the trademarks with our companies, because we saw them on the IT space and they were asking questions.
00:36:01.032 --> 00:36:04.097
The IT people were asking questions about them, so we had to help them with this.
00:36:04.858 --> 00:36:05.298
It is.
00:36:05.298 --> 00:36:09.163
It's a challenge, and especially when you're dealing with IP.
00:36:09.163 --> 00:36:17.012
Yeah, ip is a big, nasty thing to kind of work through and if you can find yourself a good IP security professional ha-ha, you're looking at one or listening to one.
00:36:17.012 --> 00:36:25.601
If you can find one, then you need to hold on to them because it's very challenging, extremely challenging.
00:36:25.601 --> 00:36:30.378
If you don't have a good IP security professional, go find somebody that can help you with that, especially maybe a consultant or anybody.
00:36:30.378 --> 00:36:34.266
But you definitely need some help there and maybe you're tight.
00:36:34.266 --> 00:36:41.846
You might have it all together, but if you're just coming into an organization and you are not real sure, I would reach out to somebody and try to help them with that.
00:36:43.172 --> 00:36:43.675
Data classification.
00:36:43.675 --> 00:36:49.500
We've talked about public, internal, confidential and top secret important parts of data classification and how they are for your company.
00:36:49.500 --> 00:37:00.980
I highly recommend a data classification schema for any and all organizations, big or small, but the key thing to think about is keep it simple, silly, kiss the KISS principle.
00:37:00.980 --> 00:37:11.871
If you keep it simple, then it's much more useful for your people, because your people are going to have to manage it, and it's much easier for you to try to manage from your point of view as well, because you're trying to keep the data in check.
00:37:11.871 --> 00:37:18.041
So, again, ultimate goal is keep it simple, silly Security controls for intangible assets.
00:37:18.235 --> 00:37:21.945
Obviously, you're dealing with access controls, encryption, and backup and recovery plans.
00:37:21.945 --> 00:37:29.719
Those are all an important part of your security controls for intangible assets, and this would include data labeling systems to ensure proper handling.
00:37:29.719 --> 00:37:34.282
Again, all of those things are an important part of your intangible inventories.
00:37:34.282 --> 00:37:39.958
Okay, so that is all I have for you today at CISSP Cyber Training on this podcast.
00:37:39.958 --> 00:37:41.264
I hope you all enjoyed it.
00:37:41.264 --> 00:37:42.550
I hope you all think it's a lot.
00:37:42.570 --> 00:37:49.407
Again, we're coming back up to domain 2.3, and this is a result of provisioning resources securely.
00:37:49.407 --> 00:37:54.487
You can get this information at cisspcybertrainingcom and you can go and check it out.
00:37:54.487 --> 00:37:55.820
I've got a couple things you can purchase.
00:37:55.820 --> 00:37:57.943
Also, all this content is free.
00:37:57.943 --> 00:38:02.766
The podcasts, the video recordings and all that stuff are there on my blog.
00:38:02.766 --> 00:38:04.797
You can get access to them that way, if you want to go that route.
00:38:04.797 --> 00:38:11.001
I do have a blueprint and I have many other things to help you beyond just the free videos to help you study for the CISSP.
00:38:11.523 --> 00:38:13.704
I know it's important for you to pass the CISSP.
00:38:13.704 --> 00:38:22.052
I get a lot of people reach out to me saying thank you so much for the podcast and they continue to listen to the podcast even after they're done passing the exam.
00:38:22.052 --> 00:38:22.494
Why?
00:38:22.494 --> 00:38:30.614
Because a lot of the things that we're dealing with are taking 23 years of cybersecurity experience that hopefully you can use to help protect your company.
00:38:30.614 --> 00:38:37.208
Because, honestly, I'm just sick and tired of the bad guys and girls winning and you all need to help us protect everything out there.
00:38:37.208 --> 00:38:47.907
Because my water is good and I like to drink my water and I don't want to die, so I need people like you all to help protect my water and everything else that keeps life going here in the United States and around the world.
00:38:47.907 --> 00:38:50.632
Also, go to ReduceCyberRiskcom.
00:38:50.632 --> 00:38:53.257
You can go to ReduceCyberRiskcom if you're looking for a consultant.
00:38:53.518 --> 00:38:55.123
I work with many different partners.
00:38:55.123 --> 00:39:02.347
I have, depending on what your needs are, from pen testing to GRC, to security awareness training, to tabletops I've got it all.
00:39:02.347 --> 00:39:09.068
And if not, I have partners that I partner with that can give you the information you need as well, or can give you the services that you need as well.
00:39:09.068 --> 00:39:10.561
So we're there for you.
00:39:10.561 --> 00:39:16.827
I will tell you that finding a security consultant that's the only reason I'm going to be getting a podcast for New Cyber Risk.
00:39:16.827 --> 00:39:28.610
You'll be seeing some more of those coming out is to help give you some of the more detailed things around business and how to protect your business and how to protect your business, and the reason is coming from this perspective.
00:39:28.630 --> 00:39:37.777
I got tired of these security professionals saying this will work and this will work and this will work and that's great and it's awesome and the tools are awesome, and I'm going to be doing some product reviews of some tools as well.
00:39:37.777 --> 00:39:41.346
But when it comes right down to it, do I need it?
00:39:41.346 --> 00:39:44.500
And if I do utilize it, what should I be concerned about?
00:39:44.500 --> 00:39:51.402
And that's just taking 20 some years of being a CISO, working as a security architect and also as a red team commander.
00:39:51.402 --> 00:39:53.516
I can help you, at least guide you, with that.
00:39:53.516 --> 00:39:55.179
So again, that's reducecyberriskcom.
00:39:55.179 --> 00:39:56.603
Go check it out.
00:39:56.603 --> 00:40:05.538
If you are a IT person that's looking for a potential consultant, I can help you, no question about it, or I have friends that can help you.
00:40:05.538 --> 00:40:06.481
That's the ultimate point.
00:40:06.481 --> 00:40:12.155
Again, surround yourself with people that are smarter than you, and I have done that because there's a lot of people smarter than me.
00:40:12.155 --> 00:40:17.681
Okay, have a wonderful, wonderful day, and we will catch you all on the flip side, see ya.