Summarize Security Concepts

0:00Hello and welcome. My name is Keith Barker. And in this set of videos and in the skill you and I get to both discuss and demonstrate several of the core concepts in the world of security today. And the first of those concepts which you and I are going to discuss in the next video are the concepts of confidentiality, data integrity, and availability. So I'll see you in the next video in just a moment.

0:00Oftentimes we use pneumonics and acronyms to help us remember various things. Well, in the world of security, we have several of those that can help us remember. One of those is like a three-legged stool. So imagine we have a stool here and there's one leg and two legs and three legs. I'll make that in perspective so it looks a little more realistic there. So this is the stool with three legs. If we only have two of those legs or if one of those legs has a problem, it's going to cause the stool as a functional place to sit. That's going to cause it to fail. Well, in the world of security, we have one of our acronyms that we use and that is C-I-A, not to be confused with the central intelligence agency of the United States, but C-A and the world of security is a great way of remembering the three core pillars or legs in this example of a stool.

0:44So let's take a moment and chat about what each of those represents. The C represents the word or the concept of confidentiality. And the concept of confidentiality is that only the correct individuals or systems or people can see the data that they need to see. And then those people who are unauthorized should not be able to see or access that data. Now, there are several different ways we can help enforce the idea of confidentiality. And one of those is just to imagine that we want to go ahead and have a bank account somewhere. So let's imagine we have a bank out here. They have a presence on the internet. And let's imagine for our discussion that you and I are sitting right here at this computer and we are going to log into that banking website and access our account. Now, the question is if we're going to be accessing our own account information, do we really want other people who are unauthorized to have access to that? The answer is of course not. We don't want strangers and other third parties to be able to log into our bank account and have access to that data because we want it to be confidential. Meaning we are the authorized individuals. We want to make sure it stays that way. So what is the bank going to do to make sure that you and I, if we're sitting right here at this computer, that we are the only people they 're authorized to go ahead and access that data? Well, one way of implementing confidentiality is to require usernames and passwords before allowing access to that data. So we have the

1:59correct username and password we log in, then they have some level of assurance that that's really us the authorized individual. And then they can provide access to that information. Now sometimes in addition to just using passwords, we use a technique called 2FA. Sometimes that's referred to as MFA. And let me do a brief example of what that is. 2-factor or multi-factor authentication is going to require more than just a password to get access to the data. And although we'll be talking more about 2-factor and MFA later in a separate skill, let me at this point just give you a really good example of it in use. So let's imagine we have different ways that we can use to authent icate or have an individual prove who they are. And let's call these categories regarding how we can have a user prove who they are as category one and category two and category three. So for category one, we could require something that the user, for example, URI, who are trying to log in, something that we know. An example of that would be, for example, a password. However, the bank could also require something else before it allows access to the system. And that's something else could be something that we have. So maybe we have a little code generator that generates a six digit code that we also have to supply along with our password before allows access into the system. So I'm going to call that an OTP short for one time password, this little code that comes up, like on an

3:16authenticator application, or maybe we have a push notification sent over to us on our smart device. And we hit a button that says, yes, it's me, let me in. So we either have a one time password or we have the device that's allowing us to confirm the access that we want to allow it. So the first category here would be something that we know like a password, second category would be something we have like a one time password, or a smartphone that we're going to use to allow access. And then third, an example of a different category altogether would be something that we are. So something that we are would be something like how our eyeball looks, like iris or the retina, or our fingerprint or handprint or some other biological trait. So here I'll just go ahead and put fingerprint. So for access, this probably wouldn't work too well to go to a bank website. But if we are trying to go into a physical facility or somewhere else, and they had set up the fingerprint reader or some other type of scanner for some biological trait, we could use that as part of our authentication. So any time that we're going to require at least two or more categories before we're giving access to some system or to some person to log in or to get access to confidential data, that 's referred to as two FA. So each of these categories, they are referred to as factors. So two factor authentication, the acronym is two FA is using two different categories, for example, a password that the user knows, and maybe a fingerprint, for example, at a reader. And those two

4:34together are required before providing access. Or another example would be the password which a user knows, and also a one time password, which is generated on demand in real time through their authenticator app, or a push notification coming to their phone. That would also be an example of two factor authentication. Because it's using more than just one category or one factor, sometimes it's also referred to as MFA for multi factor authentication. But the whole goal here is that that is one of the ways that we can ensure or help to ensure confidentiality by requiring effective logins to verify that the person or system that's trying to log in and access the data is really who they say they are, and that they're an authorized user. All right, let me clean that up just a little bit. And let's talk also about a few other options that we can use regarding security to help ensure confidentiality that only the right individuals are able to access the data. Another key tool that we can use to implement confidentiality is the concept of encryption. And with the concept of encryption, we take the data, let's go ahead and take this word called test.

5:34And if we run it through an encryption algorithm, and then if we encrypt that data, say the encrypted data looks like this, a L Z a, and then regarding that data, that's how we transmit the data in an encrypted fashion or we're storing on a disk in an encrypted fashion. Any individual that 's not authorized, effectively in the background, they don't have the keys or the secret involved to decrypt that information. They aren't able to make sense of it because they don't have the instructions on how to deassemble it or to decrypt it. However, the authorized system or the authorized party, who does have the secret or the keys to decrypt that can go ahead and use those keys and use the algorithm involved to decrypt that information and come to the final result. So over here, we have the keys that can be used to go ahead and encrypt the data. And we have the key or keys over here on the other side that can be used to go ahead and decrypt the data.

6:20But again, anybody in the middle there who doesn't have the keys involved won't be able to make sense. Now, where could we use that confidentiality? We could use it, for example, on this server, right here, we could take its hard disk or disks, and we could encrypt it. And that way, if that disk is stolen or taken, any individual who has that disk but doesn't have the keys involved to decrypt it, will not be able to make sense of the actual data on that disk, thereby maintaining the confidentiality. We can use that same technique of encryption as we're saying traffic over the network. So let's imagine we have a user right here at this branch office, and they are going to go ahead and send a file, and they're going to put that file over here on this server right here. So the server A and this is server B. So this is our user at their PC.

7:01So if that traffic from this user has to go over the internet, which is a public routed network, and we want to protect that data. So anybody who's eavesdropping or looking at that traffic between this user and that server, if we want to protect that data while it's in motion, we can go ahead and encrypt the packets that are being sent in a very popular way of doing that is by setting up what's known as a virtual private network. So if we have a virtual private network or VPN for short, the big goal of most VPNs is to encrypt the data. So for the VPN, either this user's computer and software running on that computer or on the back end, maybe they have a device dedicated to that purpose of sitting up and using the VPN. Before that data is sent over the internet, it's all encrypted. So if any service providers or anybody else for that matter, collects that data off the network and they try to look at it and see what really is going on, they won't be able to make sense of it because the data is all encrypted.

7:51However, when the data gets to the other side, let's say this firewall over here on the other side is the other end of this VPN, and then the firewall can decrypt that data and then forward that data to its final destination. In this case, it's going to server B. So now as far as the first C in our CIA for confidentiality and security concepts, we have two options to help us implement confidentiality. We have authentication, which is a fancy way for saying making entities prove who they are, whether it's just a password or we're using multi factor authentication or two factor authentication. And another option is do encryption, either encryption of data at rest, for example, sitting on storage, whether it's here on a hard disk or up in the cloud, if it 's encrypted, any individual or entity or system that's trying to access that data, if they don't have the right keys involved to decrypt that data, they won't be able to make sense of it. And another very popular option for doing encryption for the data that's in motion is to use secure protocols.

8:41So for example, if you and I are sitting right here still at this computer and we're going to a banking website behind the scenes, the actual protocol that we're using back and forth is also using encrypted traffic and that's using a method called HTTP S and the background that's leveraging a protocol called TLS transport layer security, which effectively at the end of the day is encrypting the data that goes back and forth between our computer and the server that we're communicating with. Before we leave this option of confidentiality, let me also talk about in the example of secure protocols, some secure protocols that we're very likely to use as we're working with and managing our devices. So let's imagine that you and I are now the administrators of this entire network, including this location and this location. And we want to from our computer be able to go ahead and remotely manage our devices, whether we're managing other devices like printers or servers or networking devices like switches and routers and firewalls, one of the secure protocols we could use is called SSH, which is an acronym for secure shell. So a long, long time ago in a galaxy far away, we often use this like decades ago, we used an application called telnet and the problem with telnet and they go ahead and put a big no sign there. Now the concept of SSH and telnet is they both allow an administrator to remotely connect to

10:00remote systems to get a command line interface. And although SSH can be used for more than that, that's the starting point regarding their similarities. But the big difference is, is that if you and I are sitting here and we're managing devices with telnet, anybody who collects that data off the network, if we're using telnet, they can see everything that we're doing. For example, they can see the usernames and passwords that we're using to log on to devices, they can see the commands that we're issuing and it's absolutely not secure. In fact, let me show you an example of that right now. Let me go ahead and clean this up a little bit. And let's actually talk about and use this router as an example of how using an insecure protocol like telnet can be devastating. So here is router one, its IP address is 192 168 dot 1 dot 140. And let me go ahead and from this computer here, let me go ahead and open up a session using telnet. And then we'll play the role of an attacker or someone who wants to compromise our system and we'll capture the data as it's going back and forth between this computer and this router. And we'll be shocked about what is revealed and disclosed because of the lack of confidentiality and the lack of encryption that telnet brings the table. So this is a terminal emulator that I'm going to be using called secure CRT, but the concept is same regarding the actual program that we run on our local management computer. I've got an entry right

11:17here to connect via telnet over to 192 dot 168 dot 1 dot 140. So we double click on that and we 'll go ahead and log in. I have a username called admin, I'll put in the password. And after supplying that pass, so press enter. And then we'll do a show run, which is short for running config , which will show us the full configuration on this router called router one. So there it is there, then I'll type in exit and finish off that session. Now, unfortunately, anybody who was eavesdropping on that traffic as it went from our management computer over to this router router one now has effectively all that information, including not only the username that I used to log in, but also the password. They now know it because they collected that data and telnet is an example of an insecure protocol. So let me bring in a protocol capture here. There's a little tool called wire shark, which just collects and this is view the data that's been captured directly off the network. And I just put a little filter up here just to show us the telnet traffic. And then I'm going to right click on that. And from the drop down here, I'm going to go ahead and say follow TCP stream and check this out. So here is where I was logging in. So it's there twice because as I typed in the characters, it was being sent.

12:24And then echoed back to my screen. So it shows up here twice. And then this is the password that I'm using. And this is the attacker's perspective as they've just collected all that data. And now they can see the entire output of what we were doing. So they don't only have my username and password, but they also have the full config here of this router. So telnet as an example of an insecure protocol does not do a good job of protecting confidentiality because there's no encryption whatsoever. So of course, the better option if we want remote access to the command lane interface on router one from right here from our workstation is to use a protocol like SSH. And so to compare and contrast the use of secure protocols to help ensure confidentiality, let me demonstrate once again, connecting over to this router. But this time, instead of using telnet, which is not secured, we'll use SSH, which is providing encryption and thereby maintaining confidentiality against anybody who might be eavesdropping or trying to steal those packets off the network. So this time, I'm going to connect to that same router at 192 once state 1.40. But this time using SSH, so I'm going to go ahead and double click in the background. I had it supply my username and password from the secure CRT application here. And now if we do a show run, which is short for show running config and look at the entire configuration, it 's going to show us but all that traffic as it's being sent back and forth between this workstation

13:43that we're currently sitting at and that router, all that traffic is encrypted as that data is being sent over the network and thereby maintaining confidentiality of whatever it is I happen to be doing here on this router, including in this example, doing this command show running config. So for this output here, again, this application called wire shark, which is a protocol analyzer, taking the data that we just collected. I'm just going to grab one of these SSH packets right here, right click and from the menu, click on follow. And then from the sub menu, click here on TCP string. So here, is the TCP stream regarding all the packets in that SSH session. So initially here, I had some negotiations that were going on as they are setting up the encryption. However, once we had the connection, look at this, everything here is just gobbledygook. Now it's gob bledygook to the attacker because it's encrypted. And on each end, on the router side and in my secure CR T software, on the client side, because we are doing the encryption and decryption, and we have the keys involved, both sides can understand the commands, but anybody who's eaves dropping on this traffic in the middle is simply going to be out of luck regarding what the heck any of this really means.

14:48Was the user doing a show running config or were they changing the configuration? Are they bringing up or bringing down interfaces? The attacker, the unauthorized individual who's looking at this data won't have any clue because once again, all that data is encrypted. And that's courtesy of this protocol called SSH. So now that we've taken a look at the concept of confidentiality and how we can implement that either with authentication control or doing encryption, whether it's encryption of a disk or encryption of data in motion or data going over a network, all of those options are going to help ensure the confidentiality as part of our security plan.

15:23So let me clean this up and we'll take a look at the next element here as part of our CAA. The next letter in our acronym is I and that I is to represent data integrity. And here's what data integrity represents. It means that only the authorized individuals and or systems who are allowed to change or manipulate data, we want to make sure that they're the only people that can change that data. So here's another example from a banking instance. Let's say that you and I are seeing this computer. We're logging on to a banking website and we say we'd like to go ahead and transfer 100 units of money. I'll go ahead and put a little dollar sign there because I 'm from the US, but let's say we want to transfer $100 from one area to another. It could be from one account to another or from us to somebody else or that could be a mobile app that we're using on our mobile device.

16:12In either case, if we say we want to move $100 or transfer $100 and then in transit, some of you steps in and they change that say $1,000, that would be a loss of integrity. Another example where integrity is super important would be if we are writing some data to a disk care, we want to make sure that the data that we want to write, whether it's part of a database or a spreadsheet or anything else, we want to make sure that the data we're writing to the disk is actually accurate with what we intended to have written to that disk. And again , that disk could be here on this server here or it could be a server up in the cloud or storage up in the cloud.

16:43The bottom line is we want to make sure we're maintaining data integrity. And one popular option for maintaining data integrity is to use the concept of a hash. For example, let's imagine that you and I are sitting at this little wireless computer right here and we 're going out to the internet and we're going to download a file. So let's say the file that we want to download is file name x y z. In fact, you know what, instead of actually using a fictitious name like that, let's go out to the internet for a moment. And let's go ahead and take a look at downloading a file.

17:14So let's imagine we purchased a Raspberry Pi, a little small computer system and we want to now download the operating system to install on that Raspberry Pi. So we do a Google search, we go to this webpage or one similar to it. And then we go, okay, we're gonna go ahead and download Raspberry Pi. So we'll click there on the hyperlink and that leads us to the download section. And they think, okay, let's go ahead and grab the 64 bit version. And we can click on download right here. Now here's the problem. This website that I'm currently at , how do we know it's not a compromised or hacked website? Where if I click on download and I download the file, how do I know that actual image I'm downloading is not a image that has malware or some other compromising software has part of it put there by an attacker? Well, one way is we can go ahead and verify the hash. And here's how the hash works. The hash is a teeny little string of text that's mathematically calculated based on the actual source file. So here for this Raspberry Pi OS with desktop before we download it, we're gonna click right here on show the shop 256.

18:16That's one of the flavors of hashing that we can use. Show the Shaw 256 file integrity hash. So we'll click on that and there's the actual hash file. So I'm gonna go ahead and take that right click, copy it and I'm gonna put that in notepad. So there is the hash file. I just pasted it over there to make sure I had it. And it is a nice string of text that's all based on the actual source file. And the source file shows here is a little more than one gig. So I'm gonna go ahead and click on download to download the file. So in the background, that download is happening to my downloads folder or wherever on this computer is specified to keep downloads.

18:52So a couple things to play here. Number one, I'd want to make sure I'm going to the correct website to begin with. And then secondly, once I download this file, I'd also want to make sure that when I generate a shop 256 hash against this file, then I come up with that same result that was published here on the website. So the result I should be getting is this value right here. And there's lots of different ways of generating that shot 256 hash. One way is to use an online hash checking tool, which is what I'm going to do right now. So here is one such site. There's multiple out there. I'm going to take this file and simply drag it right here. And that is in the process right now of generating a shot 256 hash on this file. And then when it's done, hopefully that result will match this value right here, which was published by the provider by the website. And sure enough, 5C, 5, 4, etc, etc. And again, 1, 6, 5, 8, e, fantastic. And that is just a way to verify data integrity between the file that I downloaded from the correct source. And also to make sure that once I received it, it is intact. And it's exactly the same file based on the hash matching.

19:57So this is a three prong approach. Number one, make sure we're downloading from an authentic website that is really providing the accurate file. Secondly, checking the hash produced there. And then third, go ahead and generating our own hash on that same file. And then comparing the two hashes together, just to verify that they match. And if they do, that means that we have data integrity, in this case, regarding this specific file, a couple other examples where we can maintain data integrity would be if we have a disk, for example, and we make a copy of that disk. And we want to make sure that we have an exact copy, we can run a hash algorithm against this disk. And then compare that to the hash algorithm generated against this disk. And if they match, once again, that can help us validate that we have data integrity between the replication of one disk to the other. And that concept of hashing can also be used on packets and frames as they're being sent over a network to verify the actual integrity of data as it's being sent over a network. And the third day is availability in our CAA acronym. And the concept of availability is that for the individuals and systems that are supposed to have access to data as another systems, we want to make sure that when they need that access, that it's available. Now, how do we improve availability of our systems for our authorized users? The key element there is the concept

21:15of redundancy. So for example, if we have the server right here, and it has some local storage on it, we may want to make sure that we are fault tolerant with those hard disks so that when we write to one disk, it also writes to the other simultaneously. So if we have a single failure of either of those hard disks, whether they're SSD drives or they're spinning drives, having two of them and having them be redundant helps ensure availability regarding the data that they're storing. And the same concept applies to data up in the cloud. If we have cloud providers who are providing storage, it's extremely likely or desirable, at least, that they have fault tolerance for their storage mechanisms. That way, if there's a single failure of some component in the cloud services for the storage or here locally on the server here, if we have fault tolerance set up, a single component failure shouldn't stop that data from being available. And so that concept is often referred to as FT, which is an acronym for fault tolerance. Think of it like the ability to have a fault and tolerate that fault and not have the whole show stop. Another concept also associated with that is referred to as HA. And that's an acronym for high availability. And both of those fault tolerance and high availability boil down to having redundant systems. So let's say at a service provider or in a data center, they've got racks and racks and racks of servers. So if they

22:33have a single server that fails and they've set up their fault tolerance and high availability correctly, that single server failing should be unnoticeable by the customers and systems using that server. And there's a similar concept for networking as well. So instead of having one router here, we could have router one A and we have router one B. And then together, they could go ahead and support the routing function between this part of the network over here and the rest of the network going out this way. So if one of the devices fails, the other one can pick up and continue forwarding traffic. And we could also have fault tolerance here at our firew alls by having again two firewalls working as an HA pair in conjunction with each other. Once again, so if we have a single firewall that fails, the other firewall can pick up and continue to forward the traffic.

23:16Or in the case of security, while continuing to enforce the policies, controlling what traffic is allowed or not allowed. So when it boils down to security concepts in general, remembering CIA and confidentiality, data integrity and availability, those are going three critical components that we'll want to consider. [BLANK_AUDIO]

0:00For this next security concept, I'd like you to imagine that we have two people . And if these two people are arguing about some detail, for example, this person says, "You did this," and this person says, "No, I didn't. It's a shouting match back and forth." At some point, it'd be super helpful if we could prove, beyond a shadow of a doubt, exactly what happened or, in this case, what was said. And I still remember early in my career, when we had a whole bunch of data off of the server that was deleted, and we couldn't go back and verify exactly who did it.

0:30And that was because of some lack of security policies, a lack of implementation, and, frankly, a little lack of experience back in those early days. Because, ideally, what we want from a security perspective is, we want the ability to prove who did what. And that concept is known as non-repudiation. Penlight, go ahead and draw a little roll of tape here. And let me go ahead and label this as well, so I can make sure we all know what it is. So this is some tape, like electrical tape or duct tape. So the concept of non-repudiation is making it stick.

1:01For example, if this user right here logged onto this server and then deleted a whole bunch of files or modified a whole bunch of files, we want to make sure that we can document and verify that it was really this individual. Or if this is us, sitting at this computer, and we're going to a banking website, or making a change by moving money or changing our information, the bank wants to make sure that before they allow that to happen, that it's really us. And then secondly, they want to have the ability to validate that it really was us doing that transaction. So the concept of non-repudiation is making it stick, meaning being able to prove exactly who did what. Now, there's a lot of different methods that can be used to help in the process of non-repudiation and authentication. We'll be some of that. For example, the bank making us prove who we are by authenticating, possibly doing multi-factor authentication, before it gives us access. Also, they may be recording the location that we're coming in from based on IP address or some cookies on our computer and so forth. However, one of the primary ways of doing non-repudiation is based on the concept of a signature. So if we imagine this person right here who signed an agreement and then later claimed that they didn't, if that person went to court, or they went to arbitration and they showed them that paperwork and they would say, "Is this not your signature?" If that guy says, "No, it isn't." They could actually compare

2:20signatures and say, "Yep, it is your signature." And therefore, you did agree to this and so forth. Well, in the world of security, because everything's digital, we are going to be using a concept called a digital signature for that function. And although we'll have a separate set of skills on public and private encryption keys and digital signatures, for now, as we discuss high-level security concepts, I'd like you just be aware that the concept of a digital signature that can be implemented can be used. And there's many different applications for it. One would be, for example, a user here, this computer sends an email and that email is being sent to a user over here.

2:56Now, if this is user one over here and this is user two over here, if user one sends an email, how does user two validate it's really from user number one? And the answer is we could actually implement a digital signature by user one here. And so if user one applies a digital signature, then when user two gets that email message, it can validate that signature and know that, "Hey, this email really is from user one." So when you think of non-repudiation, think about making it stick, being able to validate who sent something, for example, like this email message that was sent over, or that some other transaction was done. If there's a digital signature that's involved, that's going to assist us with non-repudiation, which is making it stick and being able to validate exactly not only is the data have integrity, but also validating exactly who did it or who sent it because of the digital signature that was used as part of the transaction.

0:00Another fundamental security concept involves another acronym and this one is a pretty fun one to remember is a a Not to be confused with the automobile Association of America AA AAA triple A as a security concept has three specific words involved as well And the first one is who the heck are you and that is all about authentication And more importantly making the individual or entity or system prove who they are So it could be as simple as you and I sitting at this computer logging on to a banking website or you and I at this computer Running a secure protocol like S H connecting to a network device or to a server or it could be us logging on to Microsoft Active Directory for access to resources in our company like access to printers and servers and so forth And we touched earlier about authentication options including using two factor authentication or a multi factor authentication For even more surety regarding who an individual is and it isn't always an individual like a human It also could be a system so if we have a Application running here on this computer that interacts with other systems and they're using something called an API that's an application programming interface Think of that like a computer talking to another computer or one system talking

1:15to another system before those APIs are allowed to interact with the target systems and vice versa We want to make sure that we are authenticating or making them prove who they are and that way We're not leaving ourselves open to some confidentiality breaches by allowing access to the incorrect parties So the a and triple authentication is all about validating who an entity is whether it's a human or a system because we want to validate who they are before we can go to the next logical Step and that is regarding what they can do and that's the second a right here The what we can do part is called authorization and that's all about what you are allowed to do And that's if you are a human so if it was a computer system that's interacting with another system It'd be the authorization regarding what that system is all allowed to do. So here's an example Let's imagine that you and I are logging into Microsoft's active directory Which is in control security wise of all these resources on our network which would include access to the printer What type of traffic we may be allowed to forward through the network and so forth So one of the first things that active directory or any centralized authentication system is going to do is to validate who we are So not only do we sitting at this computer are we gonna log in but also this computer itself in the background is part of that authentication process so active directory knows who the computer is or what

2:33the computer is as well as the user who is logged on to that computer And then secondly based on who we are that is then going to control the authorization Regarding what we are allowed to do for example if we try to go to this server and we aren't authorized for that server We are going to be prevented from getting to that server by some kind of a technical control in place That's restricting our access and so if it's active directory That's used to control access in this network that in this example would be the mechanism that's controlling access to the server So whenever you see the concept of access control, I want you to think first and foremost That is a very vague term because access control is simply controlling You know what an individual entity is allowed to get to and there's lots of different ways of implementing access control active directory B1 option in a networked environment We can have access control lists and firewalls that are all set up to implement the access control and the goal of the access control Regardless of how it's being implemented is that once we identify who an individual is to make sure they can get access to what they need access to But at the same time not get access to those systems and resources that they are not allowed to have access to For example, some users may have access to some parts of a database and other users may have access to all of the database And yet another set of users may have access to absolutely none of a database

3:52Based on the needs of the organization and the access control that's been set up for those users who are members of certain groups All right So let me clean that up a little bit and let's talk about the third A and that third A here is Accounting and we can write that out as what did you do and most of the time that's going to be implemented in some type of a Digital trail regarding what a user did so if a user logged in here first of all They'd have to prove who they are as they log on to the system and then based on their authorization Let's say they could use this printer and they could access a database over here and they could also send some traffic through the network And that would all be controlled by the authorization what they are allowed to do And then they accounting would be about what they did do so the user logged on they use this printer They made changes to this router if they had access to do that or they forwarded traffic out to some website that was risky Etc and our accounting component of triple A would be the element that's doing the logging and details We're getting what occurred so it helps cement this concept of triple a let me give you a couple examples of that One would be let's imagine that you and I are logged into this computer computer to and you and I are in charge of network administration for the infrastructure and also the servers and maybe some printers and other things on the network Well, if you and I are logged into this computer and then we connect to for

5:08example This printer and we have to authenticate there again and then we connect to this router We have to authenticate there again and we access this database. We have to authenticate there again That's a lot of times of having to put passwords in place. So a lot of times we use the concept of s s which is an acronym for single sign-on Think of it like a one-stop shop for logging on so you don't have to log in over and over and over again So a single sign-on we're making it easier for the authentication part and one example of implementing triple A would be in a networked environment using a protocol called takx plus which is a protocol that was originally created by Cisco systems Oftentimes this is referred to as takx spelled like this takk - a Xe so that's how you pronounce takx or another protocol that also does a very similar function is a protocol called radius And here's an example of how that could work So we're still going to log into this computer but this time we are going to use a centralized triple a server And we're going to authenticate so now the triple a server as far as the authentication goes knows exactly who we are And then once we try to start accessing other resources like maybe connecting to manage the switch or to this router or to this firewall Each of those devices is checking with that triple a server to say hey This person is trying to you know make these changes here or accesses devices

6:26Are they authorized and then the triple a server can pass that information to that respective device saying yep This is the user so-and-so and they are definitely authorized to do this or that the other or they're not authorized at which point the firewall or the network device that's checking with the triple a server Could implement the access controls by allowing a change for example to be implemented or not Based on what that user who's already authenticated with the triple a server is allowed to do and then furthermore on those same types of systems They could also do accounting regarding what actually happens. So the user who 's logged in here made these changes this switch These changes this router made a couple additional changes to the firewall and those are all kept in log files as part of the accounting So that way we know exactly who is logged on and regarding the changes that took place We know exactly who did it and exactly what they did because those are all included as part of the accounting function in this logical concept called triple a And using these protocols are not the only way to implement triple a and single sign-on We also have other services that are very popular like Microsoft ad which is an acronym for active directory Which again also offers a way to do single sign-on as well as controlling and authorization and accounting regarding what people did And if we go outside of an active directory environment We also have things like OAuth and LDAP which we'll discuss more in separate

7:45videos But however, just an idea of what those can do Let's imagine that we're logging on to a new site and they say hey do you want to authenticate with your google account And what they're doing in the background is they're leveraging Some single sign-on techniques where we're already logged on to google and we 're simply leveraging that google login To get further access to other systems and so oAuth and LDAP And one other option is called saml Are different methods of implementing that single sign-on type of approach so that a user doesn't have to create separate accounts And have separate passwords and do separate logons For additional resources across the internet that they may want to have access to and that's by leveraging These types of protocols where these guys are then leveraging the existing authentication services Of companies like google or facebook or apple for the authentication [BLANK_AUDIO]

0:00Another important concept in the world of security is the concept of zero. And you might say, Keith, what do you mean zero? And with zero, I'm talking about zero trust. Now, to help appreciate zero trust, let's go back to the old days, a decade or two ago, when an individual, if they were on the corporate network, they might be able to do pretty much anything. For example, let's say we have this computer that's wirelessly connected, so they're connected to an access point, which leads to physical connectivity to the network. And then once they're on the network, they can start running utilities like N map to discover the network, or they could try attack tools. Even that may not be legal to do so.

0:38What is stopping the user from using Nmap to discover the network? Or perhaps this user is setting up their own services like a DHCP server in the attempt to trick other devices or provide incorrect information regarding the DNS server or their default gateway and so forth. Because in the old days, once a user was on the network, especially the internal network at a company, there was full trust. Often times there were not additional controls that controlled exactly what that user was able to do once they were on the network. So zero trust is the exact opposite of that. Zero trust says that we want to do effectively AAA authentication authorization accounting for everything. So is that mean before this printer is allowed to interact, we want to make sure we know it's this printer and verify that it can only communicate with authorized users. The answer is yes. For this access point, do we want to verify that only authorized users can get access to it? And then once they're connected, that they can only do exactly what they're allowed to do based on security controls. The answer is yes. If we have this server that's on the network and it wants to communicate with other devices or have other clients connect to it, do we want to make sure that both of those devices are who we think they are? So the concept is we don't want to just trust anything until we know who it is, who they're connected to, or the case of a system with APIs,

1:55what that system is and who is communicating with. And that's the idea of zero trust. So unlike the old days a decade or two ago, instead of allowing traffic wherever it wants to go inside the network, with zero trust, we're authenticating everything, verifying who they are, controlling what they can do and effectively doing accounting on everything as well to track what happened. So let's take a look at a realistic approach to implementing zero trust is first of all, I'm going to start off with policy, which effectively means managerial types of controls that specify what we want to have happen. And that's going to lead to specific procedures, which within me followed to make sure that policy gets implemented correctly. And so part of implementing zero trust is just to realize the different types of communications that are happening on our systems today. And the concept of zero trust can apply to corporations and service providers and even down to a private network, such as your home. So one way of thinking about or these considering all the different types of access that may be needed is to think about the concept of planes. And I don't mean air planes, although those are pretty cool. But with planes, we have different planes of functions. For example, if we have a user here that's communicating and their traffic is going through the router, through the firewall, out to a service provider out here on the internet, or some website on the

3:11internet, that would be referred to as the data plane. That's user traffic that 's being forwarded through the network. And then go ahead and put end user traffic to be a little more clear there. And then within this company or within the service provider or at this branch office, we also need a way to monitor and manage our network devices and our systems. And that management component, whether it's being done from a computer that we're sitting at, we're managing network devices, where we have systems that are managing our network devices, that management function is referred to as the management plane. So part of the consideration for the management plane would be, okay, what systems need to talk to other systems for the purpose of management and collecting data and making changes. And as part of our management plane, we'd want to make sure we identify exactly which devices and systems and users need to communicate with other systems for the purpose of management. And also as part of that, want to make sure that we 're using secure protocols so that we can avoid the situation we looked at earlier, where an eavesdropper who is capturing data off the network, we absolutely don't want if that does happen.

4:09We don't want that unauthorized individual to be able to see the actual contents of that packet. So we use encryption or encryption protocols to help support the confidentiality there. And then the third component or third plane I'd like to chat about is how does this firewall or this router or this switch? How do they know exactly how to forward? Now from the topology, we can visualize that, oh, if computer two sends a packet going to the server and this router gets it, it should forward it that way to the firewall and this firewall should forward that way. But how exactly do they know? And behind the scenes, there's a lot of control protocols that are being used to educate the networking devices on how to operate. And that process regarding how to operate or how to forward is referred to as the control plane. So the control plane from a networking perspective on a router, it could be dynamic routing protocols on a switch. An example of that would be its Mac address table that it's learning dynamically, which Mac addresses live off which ports. Or if we are dynamically implementing VPNs across our enterprise, it could be instructions regarding what are the end points of those VPN tunnels. So we could actually place a VPN from this firewall here going out, for example, a little router or firewall at the branch office to encrypt all the traffic that's going back and forth as it crosses over the internet. So the instructions regarding where those VPNs

5:28should exist is also part of the control plane. So in a zero trust environment, we want to consider those planes for data plane management plane and control plane, and then put in the controls that are appropriate to enforce our policy. And based on the vendor and what's possible, here would be some desired functions, it'd be desirable to have adaptive identity. And here's what I mean by adaptive identity, let's imagine that we want to allow a user will call it user number one. And in this case, it's called admin number one, we want admin number one to be able to manage and work with the switches, this router, this firewall, these servers that access point, and this printer.

6:05However, they need to be logged in from this computer or from a computer internally to do that. As opposed to them logging in, for example, from home, even if they have a VPN that's coming in, adaptive identity can be aware of the situation regarding, for example, where that user, in this case, admin one is logging in from, and have that influence or inform what they 're allowed to do. So again, adaptive identity is adjusting to not just who the user is, but also things like where they're logging in from or the IP address they're coming in from, or the time of day, another criteria to control the access for the same administrator. And one of the goals of implementing security is to reduce risk. Another way of thinking of that is to reduce loss. And so by implementing the proper controls, for example, with the administrator being able to log in here and do his job or her job, but the same administrator not being able to log on from another location, that's an example of reducing risk, because if that user physically has to be on-prem inside the building at one of these computers, and we're not allowing them to VPN from some other remote location, although that might be a little frustrating for the administrator, if they need to log in remotely, the benefit of doing that is that if we have something who's compromising our system from a remote location or attempting to, by having adaptive identity and controlling where they can log

7:22in from to do their work, we're reducing risk. And the controls that we're putting in place are all intended or should all be intended to enforce the policy. Another way of saying that is policy driven access control. So one example regarding policy based access control would be that for the data plane, we might want to say, you know what, if you're a user on this internal network right here, and you're going out to the internet, we want to go ahead and allow certain types of traffic if it's going from left to right. So from a firewall perspective, we could set up this side of the firewall as green, we'll call it inside. Now it doesn't always mean that we want to allow every single possible protocol to be able to go out to the internet, but we could allow a broad range of common applications like HTTPS and DNS and so forth from the inside to go out to the outside world. And one way of doing that is identifying on the firewall that everything over here is in this zone called inside. And then we could specify at the same firewall that everything out here in this direction is considered outside as in the outside zone. And then for the initial flows of traffic, we could allow specific flows of traffic in this direction. And then for the reply traffic, due to a really cool feature called stateful filtering, the firewall can say, Oh, this traffic started over here. And the traffic coming back is simply the reply traffic coming back. But at the

8:38same time, they have some entity out here on the internet, try to initiate a conversation or initiate packets going into our network, we could have some default rules in place that say, no, sorry, any traffic that's being sourced out here, just trying to come into our network or into our servers, other than specific protocols and specific IP addresses, we could deny that by default. And that would be an example of using the firewall as a policy enforcement point for traffic. In this case, user traffic, that would be going over logically the data plane. So let me clean that up just a little bit. And let's talk about getting from here to there. Let's imagine that we have a zero trust idea in mind. However, when we got the network and we got the systems, that policy that implement zero trust was not currently in place. So over the past weeks and months and years, we've been implementing and getting better and better. And one way of actually getting closer and closer to a zero trust network where everything has to be authenticated and authorized and accounted for, one way of doing that is with a gap analysis. And a gap analysis ideally would be performed by somebody who doesn't have skin in the game. Because a lot of times people who are actually building and supporting the networks, they've got some biases. And so if you need a third party company or a third party entity or a different department in your organization

9:54that can take an unbiased look at it, they could go through and say, okay, so here's your policy, here's your goals regarding zero trust. And they could go through and identify, okay, where are we doing a great job? And where is there room for improvement? So let's imagine there's a gap analysis and they've identified like 15 things that need to be fixed. Now, unfortunately, it's not likely that we can fix all those at the same exact moment. And I added a few lines to make it 15. So the next thing we'd want to do with our gap analysis is once we identified what needs to be improved, we'd want to go ahead and prioritize those. So some of those would be super priority, meaning they have the most risk associated with not fixing them. And we want to work on those first. And then we would follow it up with our next set of priorities, so that we're spending our time attacking and correcting the highest priorities first, which should be based on the highest risk or the most potential for loss as well as the spots that make us the most vulnerable. Also, another thing to consider with a gap analysis is just remember that it's a process. It's not likely that we can rip out the entire infrastructure and put everything brand new in. It's going to take some time. And there's very likely going to be compromises. And that's why it's important first to identify with a gap analysis, where the weaknesses are, and then to approach it systematically, taking care of the high priorities

11:10first. [BLANK_AUDIO]

0:00In a previous skill, we took a look at some categories for security controls, which involve technical controls, managerial controls, operational controls, and physical controls. We also took a look at control types regarding the purpose for those controls. So here in this skill regarding security concepts, I'd like to just discuss for a moment further some additional physical controls. So let's use this service provider right here as an example. Let's do a logical approach regarding a person or an entity who might want to get into that physical facility. First, let's start at the parking area where we could have as barricades and/or ballards that actually come up out of the ground and that would prevent a car from passing and going into the parking lot or further in. If we had those physical barric ades in place and in association with that, we could have a guard check who is in control of those physical barriers that could be checking ID and validating individuals before lowering those and allowing cars to enter.

0:56Or if there's people on foot, that security guard would also be able to see them. Now to control, make sure that's the only place they'd come in. We could also use fencing. So we have a fence around the perimeter and I've got a question for you about a fence. Is a fence regarding the control type, is the fence a deterrent or is the fence preventive? And the answer I suppose would be how tall is that fence? Does it have razor wire on it? Can it be cut? Can it be overcome? So again, depending on the type of fence, that fence may be acting as a deterrent and/or preventive as far as people getting access into the area. Also in this area here, as well as the entire grounds, it'd be ideal if there was proper lighting and that way as it gets dark, under the cover of darkness and attacker won't have an easier time or a much easier time if there's appropriate lighting. We also probably want to have some cameras in place and those cameras could be external in the parking area and looking at the external of the building as well as cameras internal. Now cameras inside, especially cameras that record both audio and video, we'd want to make sure we had signage, physical signs and disclosures saying that recording was going on.

2:06Also for our employees inside the building, we'd want to make sure they signed a document and probably at least once a year indicating that they've taken security awareness training and that they are aware that cameras are involved and that they're recording video and/or audio. So for an individual who wants to get past the guard, there should be some kind of identification. Oftentimes that's a badge, like an access badge that may have digital circuitry in it that can identify who that user is. So that may be required here at the guard area. It also may be required further into the building. So let me go ahead and put a building here and I'll put a little roof on there as well and I'll label this main building. So there could be a reception ist here that could act as a deterrent and then for individuals who want to go further in, their badge may be required again to go in. Now in a sensitive area, there also may be what I used to call a man trap. However, the current term is a vestibule, although I'm going to label it man trap because it's easier to spell.

3:00And this man trap, I guess, could be called a person trap, allows one person to enter. They would then authenticate very likely with their badge or if we want to use multi factor authentication, it could be their badge plus a pin number or something else that they know in combination with their badge, at which point it would allow them to continue through and that would do one person at a time. And then throughout the building, we could also have a series of sensors. So those could be sensors on doors, they could be motion sensors. There's a lot of different types of sensors based on what we're looking for. So there's infrared sensors. There are sensors that can detect pressure changes. There are ultrasonic sensors. There are microwave sensors.

3:38And also what we're talking about sensors, we could also have devices that are doing weight. So for example, here in this vestibule, the man trap, we could have as people go in and authenticate, it could weigh them. And then when they leave, they could be weighed again. So again, people could have a big lunch and things like that. But for looking to detect, you know, a significant weight change between in and out, which would imply something was brought in or left the building that could act as a safety net right there to help identify some of that activity. Also in the building, it'd be a great idea if we had the appropriate locks and notifications if unauthorized people are present.

4:13So I've been in environments where as I was walking down the hall, even with the top secret clearance, if I was in a part of the building where certain things were happening, I'd have to be escorted and carry this little lantern like thing that beeps every 30 seconds. If they heard the beep, they were working on something they needed to close the door for. They could close the door or stop having a conversation etc. To predict the confidentiality of whatever it is they may have been working on. So physical controls as one category are an important aspect in the overall security landscape. (clicking)

0:00Also in the world of security concepts, I'd like to chat with you for a moment about some technology regarding deception and disruption. Now normally we'd think about these concepts of deception, disruption from a perspective of what an attacker or hacker might try to do towards a victim or towards a target. However, for our discussion now, I want to chat about these two techniques or these two concepts from the perspective of trying to trick or identify the details of what the attacker or hacker is attempting to do. Also, I'd like to point out that before you start implementing any kind of hacking or deception or disruption technologies, you'd want to make sure, especially if it's not your own home network that's staying contained in your home network, you'd want to make sure you have authorization on the networks you're going to do it on. Because if you do some of these techniques and you do it without proper authorization at your company or on the public internet, that could be a liability if you do something illegal. All right, so with that warning in place, let's talk about a few of these techniques and one of those is to create a honey pot. Now, when you think of honey, I'd like you to think of the character Winnie the Pooh, who absolutely loves honey. So if we have an attacker somewhere out on the internet, let's think about what they love. If they're trying to compromise us and do it over

1:15the network, as far as the network and systems are concerned, what they love are open and available ports and those sorts are commonly associated with layer four protocols. And then where to the point the attacker is going to love if there's some known vulnerability or if there are some ports and protocols open and available on our network, which are supporting insecure protocols, things like FTP or telnet and many, many others, which if are used are a security vulnerability. So the first question is how would an attacker discover, for example, what open ports there are?

1:47Let's imagine these two servers have been made available to the internet. Now, not just all the ports and protocols, but let's say the firewall is allowing just HTTPS, which at layer four is using the protocol TCP and the well-known port for HTTPS at the server side is TCP port 443. So if an attacker is curious about what ports are open and they start scanning effectively, they're tricking how the TCP/AP protocol stack works by doing a TCP send request in and then seeing what comes back. And so if they do a TCP send request, the synchronization request to TCP port 443 at an IP address that leads to a server and they get the follow-up packet and the follow-up from the server going back to the client would be an acknowledgement and their own send requests and they refer to that as a Synac coming back. So if the attacker simulates a connection request with the send and gets a response back, that that's the attacker. No, hey, that port TCP port 443 is open and the associated well-known services behind that are HTTPS services. So what an attacker may do is do some scanning of, for example, the 100 most likely ports or they can do a scan of 65,000 ports at every single possible IP address trying to determine exactly what services and ports are open.

3:03So how does an attacker doing a scan equate to a honeypot? Well, we could on our own networks place a server that's not a real server, meaning it doesn't have our critical services on it, it may look like our web server, but behind the scenes it just has a ton of open ports. For example, we could open up TCP port 23, which to the attacker would think, oh, they have got a telnet server running there or if we open up TCP port 21, the attacker, if they scan that and got a response back, we think, oh, they have an FTP server open or if TCP port 80 is open and response back, the attacker will think, oh, they've got HTTP services running.

3:43And then furthermore, they can start to try to take advantage of those. So a honeypot would be a dec oy effectively, not a real server, but just something to keep the attacker busy and also for our own purposes to identify that we have an attacker who is looking for open ports so we can be made aware of that. So we could have alarms that are going off. So this system right here will cut server array if it's set up as effectively a decoy, that would be an example of a honeypot. And if we had a whole bunch of servers, for example, server A, server B, and we had some other locations and server C over here and across the internet, that would be an example of a honey net, a network of honeypots. We also may have on some of those honeypots and honeynet servers. We also may have some files that intentionally look like an easy target or intentionally look like desirable information.

4:30For example, on the servers, if we have a file called passwords dot txt, and in that file because we're putting it on our servers as part of a honeypot, the actual content of that passwords dot txt file should not have anything too critical. Or if we had a file that had misinformation or some other intellectual property, which wasn't real or faked, that we wanted to get into the attacker's hands, that'd be another example of a honey file. And while we're talking about terms for deception and disruption that begin with honey, let's also discuss the concept of a honey token. And honey tokens can come in various forms. For example, if one of our sensitive files our fake sensitive files had credit card information in it, perhaps we're using certain strings of credit card numbers, fake ones. If those credit card numbers are attempted to be used, effectively that acts as a signal saying, Hey, you know what, this was attempted to be used . And it came from our file. So in that sense, it could be used as way to detect that the data that was stolen is actually trying to be used. Or maybe we even didn't detect that the attacker got that information. But the moment they start trying to use those credit card numbers in this example, I'll put cn.txt here for credit card numbers. The moment they start using those, that's the indication that that file was retrieved and is now trying to be used by an attacker. So it's primarily a detection method or

5:46a trap that can help us identify what's going on with the attacker and what they have access to. So as a quick example to help reinforce the concept of a honeypot, I'd like to take you on a journey to this computer right here. And here on my home office network, so I'm going to be doing this against just my home office network, nothing out on the internet. I'd like to go ahead and do a quick scan from this computer just to kind of see what other devices are here on this local network. And based on the scan I'm going to be using. What are some open ports and protocols that can be detected? And the tool I'm going to use on this little computer here is called N-Map for network mapper. And I'm going to be telling it to do N-Map space and specify my subnet here. And my office network is the 192.168.1 network with the 24-bit mask. So it'll do a scan of the entire network space, identify which devices are there, and furthermore which ports and protocols are open. And I have one device on this network segment which is set up as a honeypot and from the output. I'd like you to guess which device it is. All right, so here is my command prompt on this machine right here.

6:52This is computer two. And here's the command I'm going to issue N-Map without any other parameters. And then this network segment, the 192.168.1 subnet with the 24-bit mask. And I 'll press enter. And now it is going at it. So I can press enter while it's going and it'll show us the progress. So it's 60% done, 72% done, almost there. And we'll let it finish. All right, and it is done. So here is the first device at 192.168.1.1. And by default, N-Map to the scan of 1000 ports.

7:22And so 995 were filtered. So here it has the port and protocol. And it has the service based on the well-known ports and protocols for those services. And then based on the MAC address, that's the layer to ethernet address on the device itself. It's also making an educated guess based on these first six characters of who the vendor is saying this product based on the MAC address is from Fjordenet. And it is right. That's a Fjordenet 48 firewall. Then we scroll down a little bit. Here's another device at .75. And it has six services that is able to identify based on the ports and protocols.

7:55And it's got some insecure protocols that are open. So HTTP is another example of a insecure protocol. HTTPS is secure, but HTTP isn't. So that might be one the attackers could be interested in. And as we continue to scroll down, here is yet another one. So that's at .100. And this has a whole bunch of services. So this almost looks like a honeypot, but that's a Windows server that I use for a lot of functionality here on my home office network. But there is FTP insecure and open. There's HTTP also insecure and open. There's LDAP. And that is the insecure flavor of LDAP. So if I was an attacker and scanning this network, I would see all those as potential opportunities. So if we scroll down, here's another device. This is an ESXi hypervisor running on a Dell server. And it has these ports and protocols open. Let me scroll down a little bit. So here's another device at .107. And that is a NAS device from Synology, once again, with some open ports and protocols that are insecure. And again, here on my home network, that's not a big deal. But if these were on a network that was publicly available, those would be security issues. Then I've got this device at .111. And this isn't even the honeypot yet.

9:05So let me scroll down and let me take you to the device right here, which is my honeypot. This is an intentionally vulnerable system where there's no critical data behind it. So it has FTP open, telnet open, DNS is open, the insecure flavor, HTTP, and the list of hits goes on and on and on. And it's showing based on the Mac address that this is from VMware. And that's because this little honeypot is a virtual machine running on a hypervisor. And it's going down to the rest of my devices as well here on my little office network. So this device right here at .141 is an example of a honeypot in action. So behind the server, we could go ahead and place honey files that, again, are not really containing sensitive information, but look like they are.

9:51And we can make them available via FTP or telnet or HTTP to make it easier for a potential hacker to get access. Now, one of the concerns also is that if it looks too obvious, like there's too many ports open and a attacker may see that and say, you know what, that looks too good to be true. Probably is. And they may leave it alone because they don't want to be detected , especially if they start using some of the information that they gleaned from the files and other resources available behind some of these open ports and protocols.

0:00In this video, I'd like to give us both an opportunity to help reinforce some of the core concepts that you and I have talked about in this set of videos. And here's what I invite you to do. Before you continue on to the next video, where we'll do a summary of this information together, I'd like you to take just a moment and give it some real thought regarding the CAA triad, those three acronyms, confidentiality, data integrity, and availability. I'd like you to list one way regarding how to implement each of those items. Next, I'd like you to imagine that you and I are sitting in front of a customer and they want some non-repudiation, the ability to go ahead and validate for sure who is responsible for some type of activity.

0:39Maybe it's sending an email message or making a transaction. What I'd like us to do is explain to the customer what can be used to implement non-repudiation. Next, I'd like you to go ahead and describe the concept of AAA. Now, to help bring this home, I'd like you to imagine that you and I are sitting in front of a potential customer that we're going to go in and help them improve their security posture. And we want to have something to talk about. And for a framework, we want to talk about the basic components of AAA. So I'd like you to imagine that we're sitting in front of that customer and take a moment or two.

1:11And you can either do this in your mind or if you have a loved one or some other person who will sit with you for a moment, take a moment, and actually walk through the process of describing the concepts behind AAA. And of course, if you get stuck on any of these, feel free to pop back to those previous videos for a quick refresher. And then I'd like you to think about for a moment the concept of a zero trust network and identify or think about what are the default permissions allowed in a zero trust network. And the keyword there is default and in a zero trust environment.

1:45What are the default permissions? And then last but certainly not least, I'd like you to describe and again, we can imagine doing this in front of a customer, describe the benefit of honeypots, honey nets, honey files and honey tokens. So this entire process, I would encourage you to take somewhere between three and ten minutes to go through it. And then when you've given this some thought, join me in the next video and we can compare notes together. So have some fun with this exercise and I'll see you when you are ready. [BLANK_AUDIO]

0:00So now that you've had a few minutes to consider these on your own, let's tackle them together. So starting off with listing one way of implementing each of the elements of C AA, list for full list CAA, that's confidentiality, data integrity, and availability. So the task is asking us to list one way for each of them. So for confidentiality, we can use encryption, either encrypting disks or encrypting network traffic using, for example, VPN or secure protocols. And another way of helping enforcing confidentiality, of course, is to require logging in so that only those people who have correctly logged in can see the data and have access to the systems that they're entitled to.

0:38Then for the data integrity, the major answer there is going to be some form of hashing. So if we have a file that we downloaded, we download it to our computer, they also have published a hash associated with that file. And so we generate that hash. And if the hash that is published for that file matches exactly the hash that we generate locally for that file, that means that we have data integrity, courtesy of hashing. And then for availability, it means two. And you might say, Keith, what do you mean two? Well, it means redundancy. So instead of having one disk, you'd have two disks.

1:10Instead of having one firewall, you'd have two firewalls. Instead of having one server, you'd have two servers that work in conjunction with each other. And that way, if there's a single point in the network that fails, it's tolerant to that and can still function. So that's also referred to as fault tolerance, sometimes referred to as H.A. for high availability. All right, so that is task number one done, done, done. And then for the second item here, what can we use for non-repudiation? And the answer I'm looking for here, based on our discussion in these sets of videos, is digital signatures. So just like if we went into a bank and we made an agreement for a loan and we signed our names, they will pay it back. They can use that later to show us, yeah, you agreed to this, here's your signature. It's proof that you agreed to it. And in the world of cyber security, a digital signature, for example, on an email or regarding a transaction or on some type of a digital certificate, that can be used as proof and supply non-repudiation.

2:04The person who used that digital signature can't go back later and say, Oh, I didn't really sign this, if indeed they did. Or at least if they said they didn't sign it, the digital signature would be proof to the contrary. All right, then our third step here is describe the concept of AAA and the AAA and the concept of security is all about authentication, meaning who are you or who is the entity to validate the identity. The second A is authorization, what are they authorized to do? And then finally, we have the accounting, which is tracking through logs, usually, what exactly did they do? And then as we continue on, what default permissions are allowed in a zero trust network? And the answer is zero. Hence a zero trust network, everything needs to be identified, everything needs to be authorized, everything needs to be accounted for. And that way, there's not just like a hard shell on the outside, somebody logs in and they can do whatever the heck they want. A zero trust network is going to require effectively AAA every step of the way.

3:03And the tricky part there for the zero trust network is which vendor or vendors are we going to use to implement that across the board? And most of the time is going to be more than just a single vendor using a best of breed approach regarding their technologies to implement a zero trust network. And finally, we're asked to describe a benefit of honeypots , nets, files and tokens. And the answer there is we can help identify or detect the fact that we are being compromised or attempting to be compromised by an attacker. Because we have a honeypot and multiple honeypots, which would be an example of honey nets. And we have some fake files there and also indicators when those files and the contents and those files are being used.

3:40That can help us be aware that not only is there a security threat present, but that security threat is active in trying to get into our stuff. So it's a great detection mechanism to help us identify that attacks are underway. So thanks for joining me in this set of videos and in this skill. And I look forward to seeing you my friend in another set very, very soon. Until then, I hope this has been informative and I'd like to thank you for viewing.