Zero-Trust, Foundational Elements, and Shared Responsibility

0:05In the first Indiana Jones movie that came out years and years ago, one of my favorite movies, someone told Indiana Jones, don't trust anyone. And that was good advice in the movie. That's something that we have here in IT as well. We all like to be nice people, and we all want to be able to trust people. But when it comes to IT related topics, it's really important that you really don't trust anyone, and that's why it's called a zero-trust methodology. This means that we always assume that everything has not been verified, everything is insecure, and we have to verify that everything gets properly authenticated, and that anybody that's trying to access a resource has to prove that they are who they say they are.

0:47Now I think we generally think of this in terms of the internet, right? I mean, all the bad people are on the internet trying to get into my network, trying to steal stuff, trying to hack in, all of that kind of stuff. Even nation states sometimes might be trying to hack into our networks and steal our data, or compromise us, or something like that. But it doesn't always just apply to the internet. It could also and very often also does apply to internal networks and person. So you might have an internal network where there's file transfers taking place, and when you audit that, you might find out those files should not be transferred between those two locations.

1:24They are in different departments. They don't have anything to do with each other maybe. Or one of those is classified, but it's being transferred to another network that is not a classified network. So this is the kind of thing that we have to look out for. It's not just the internet. Sometimes it's internal. There might be something going on that is insecure. It also might have to do with person. So, for example, this might be your cubicle buddy over here on the right above my head here. And so this might be you and you've got your name badge on with your little picture on it and everything.

1:54And then your buddy should also have probably the same kind of a name badge with his picture on it. In most organizations where we are required to wear those, there's a high security priority there. And they not only identify who you are, some of them will identify which departments or areas of a building you're allowed to be in. And they can also very often open doors or access systems. So these name badges could be pretty important. So if I see that my buddy over here does not have a name badge on and his ID, I have to consider that to be a potential security threat even if this is the guy that's been working in the cubicle next to me for the past 10 years.

2:36You also have to identify where they are. That's what I was kind of saying earlier. Some of these name badges that you'll see, and I've worked in places like this, they will have-- they will identify on there somewhere which buildings, departments, areas that you're allowed to work in. And if you see somebody that's not part of your department walk over and they're in your-- they're physically in the area, then in some organizations you're required to do what they call challenge that person. You're required to challenge them. What are you doing here? You know, what's your business here? Do they have a meeting with somebody that they're authorized to be there?

3:09So, that all has to be looked into sometimes and, again, really just depends upon the level of security that you need for your organization. You may also have to confirm that their device itself is healthy. Some devices may have some kind of malware, or a bug, or a security vulnerability-- security vulnerability, there's supposed to be a V there-- on them. And with everybody bringing their own devices into organizations nowadays, that could potentially be a security threat. In some organizations I've worked at-- a nuclear lab, for example, in particular-- there are departments where people are not even allowed to possess a cell phone in that department.

3:47They cannot walk in to work with a cell phone on their person. If they have one, they'll have to leave it in their car or just not bring-- one of the employees I know, has never owned a cell phone. Can you believe that in this day and age? He'd never own one because he's at work so much, and he can't have a cell phone that it wouldn't make any sense for him to pay for. But in most organizations, we do have devices such as that or tablets or something, and we have to make sure that they're healthy. Many of these devices, of course, we could use these to use the camera on them and snap a photograph of something confidential, and then they're usually connected to the internet as well that could be sent out to our own personal cloud, to anybody else, really the sky's the limit.

4:26It could go anywhere. So we have to be careful that we have a policy in place that manages these devices. Some organizations can even set something up so that if they have a camera, you can disable it. There are certain products that can feature or defeature certain parts of a cellular device, for example. But we have to make sure that it's healthy. That it's properly patched, properly upgraded, that it doesn't have security vulnerabilities. So it's, of course, very important to make sure that the devices are healthy. Now, let's also take a look at another methodology, part of zero-trust methodology, called least privilege.

5:02This is where we try to restrict access to any kind of resource. We generally think of this as something like maybe a database access or accessing files that we don't want people to access if they're security sensitive. And for most organizations, just about everything you have is some level of security sensitive. One of the ways that can be kind of throttled down is to narrow the window of opportunity that someone could use to access that resource. So, for example, this is called just-in-time access.

5:33Number of different ways that this could happen. But it could be that only during a certain period of time between this time and this time, for example, there's the only window of opportunity that even someone with the right credentials can access that application, that data, that resource, whatever kind of a thing it is. You can also only allow someone to access administratively speaking, for example, if they've requested permission for it. So yes, they have the right username and password. Yes, they might be able to put their thumb on a fingerprint scanner and confirm their identity that way, or using a retinal scanner to identify their identity, or face ID.

6:07Like I have a camera. It's just right over there. It's not the one I'm recording with. There's one just to the left of it over here for me that logs me on to my computer every day. So yeah, sure. People can have something that can log them onto a computer or to a device, but there are certain things, especially that are more security sensitive that they're only allowed to log on during certain times of day. For example, even with user accounts, depending on your operating system and configurations, you may have the ability to log on only during certain times of day so that if you're trying to log on or at least your credentials are trying to log on at 3:00 in the morning when you usually start work at 8, then that's not going to be a normal behavior.

6:46That's going to be unexpected behavior, and it's going to be denied if you're only allowing that account to log on during certain hours. Another kind of just-in-time access-- let me bring this over here for you. This is just a Microsoft document here that's just kind of showing you really to this article here for purposes of looking at the screenshot as much as anything. You can Google for this if you want to. But in this example, administrators could have an application that they've uploaded to the Microsoft Store, and they may want people to only use that application during certain times.

7:20That's just-in-time access, JIT. OK? So this just kind of gives administrators instructions on how to do it. They have to code it in. And then once they've done that, we can enable then just-in-time access for whatever this application is that we're trying to make available. So if that gets check marks, then what we can do is to set it up so that if someone wants to access that resource, they have to request access. And you can see down here-- I'm trying to zoom in again here-- we can activate that capability. And then further down here, you'll see that this is where it gets to be where you can identify the specificity of this kind of a log on.

7:56Notice that they can only log on during certain dates and times, and then also for a certain duration as you see down here. Now, why do we want to do this? Why is it significant that we can throttle back the capability of someone to be able to log in? Well, the reason for that is because it narrows the window of time also for a hacker to be able to get in. Let's say that a hacker does have some compromise against our credentials. Well, they would have to actually make this request to log on at a specific period of time, for example.

8:27Could they possibly fake that they are you and do it? Yeah, possibly. But that's another hoop that they would have to go through. And if we can narrow down the scope of opportunity for them, that can be quite significant. And then the next thing we could limit is what we call just-enough-access or JEA. With just-enough-access, that's also kind of known as the principle of least privilege itself, we generally use that for certain types of resources like access to an application. But most of the time, that's going to be to something like files. Files and folders, network shares, where if somebody is supposed to be able to access it, sure, they can do that.

9:03But we don't want them to do more than they're allowed to do. For example, a good example would be if we have let's say some seriously important document here or some text in it, maybe this guy here can access that, but he should be able to only read that document. He should not be able to change anything in that document. This guy over here however, maybe he's a manager, he can have read and write access to that same document. And we can do that kind of thing with NTFS permissions, share permissions, and various things such as that.

9:34The mistake would be if we gave them both read write access when this guy doesn't really need that kind of access. That would be called over permissioning. You also have to assume that there is always a breach somewhere. Right now, there's a lot of conflict going on in the world. I won't date the video by saying what's going on, but it's extremely serious. And there's a lot of talk about nations hacking each other and are we prepared? That's what the headlines are. Are we prepared to defend ourselves against a hack?

10:07Friends, they're probably already in your network. They just have not yet flipped the switch to be able to actually do any damage. They've probably been in there for weeks or months, sometimes years, and it's just up to them whenever they decide to probably do some damage. This is true in probably all nations. Now, I hate to be negative about that. I used to be a Certified Ethical Hacker. I haven't really practiced for a long time. But that basically means that I was kind of licensed to kill, so to speak, in terms of security and everything like that.

10:39With someone's permission, I could access their resources to see if a hacker doing the same things that I'm doing would be able to access those resources. And the reason why that's a factor with assumed breach is because most hackers will know how to plant something called a rootkit, to plant some kind of malware in there that they can just trigger at any time and then be able to take something over. Or just hover there indefinitely spying on what that organization is doing. So that goes into this point even well-protected networks will usually have a continual breach somewhere within their organization.

11:16They just haven't found it yet. Now, again it sounds kind of fatalistic, but when you assume that that's always the case, you also don't get careless. You are always vigilant and you are always circumspect in terms of what's going on instead of just assuming that everything is probably all right. It's a totally different mentality that we have there, and that's why we need to have an assumption that there's a breach that's already taken place to help protect our resources. So the risk of a little bit of overlap, I'll cover these quickly. But in the foundational elements of all of this, one of those would be identity.

11:49We talked about things like name badge, strong authentication, things like this. A lot of these name badges, by the way, will have-- Oh, you've seen it before-- that little kind of gold pattern that appears down there that's for contact. You'll see that on credit cards and things, for example. That's going to be-- that's going to contain a certificate in most cases, which will help to authenticate that person and which is very, very difficult to counterfeit. So that's going to give you some strong authentication there. The magnetic stripe that's on the back of a lot of these, not very good.

12:22That's not a very dependable kind of authentication because a magnetic stripe can be duplicated as you see with skimmers and other things like that that steal credit card numbers. The expected behavior is another significant factor there. In fact, I think I have it over here. I was opening it earlier today. So let me explain what goes on here. When I log on to say a Microsoft system or using my Microsoft account, I have to, of course, know username and password and I answer that in. But in addition, it will send a prompt to my phone that looks a little bit like-- well, that's not what that is.

12:54That's just telling me my laundry is ready. Anyway. And so, usually I'll get a prompt here that will say you're trying to log in, do you want to approve or deny this request? Well, if I'm at dinner with my wife enjoying some Italian food and I'm not anywhere near my computer, it's not likely that that's me. So I will immediately deny that, and that has happened recently many times in February, for example. And I'm going to just bring over-- this is my own login record, but look at all these. These are all log-in attempts, China, China, China, China, seeing a pattern there, right?

13:28Many attempts to log on my account. But anyway, yeah, then here's another one, Lithuania. It tells me it was from wherever that is, even shows me on the map. Anyway, there are two factors here that are immediate red flags. One was the prompt was trying to get me to log on when I wasn't even using my computer, and the second one was the location. I'm not in China. I'm not in Spain or Lithuania. So therefore, that's not expected behavior. I'm not expecting a log on request because I'm not trying to log on, and I'm not in the right location, so that's also unexpected when it's coming in from China.

14:02There's also endpoint health and compliance. We need to make sure that we can monitor our endpoint devices. This would be everything really. Your personal computers that are used at work, your laptop computers, your devices, your mobile phones, tablets. And these days with coronavirus having happened not too long ago, even people's home computers because most companies were requiring people to work at home at least to a certain point. So if they're going to use a home computer to log in to work, we kind of got to make sure that device is particularly healthy, because if it's got some kind of spyware on it and it's going to monitor what they're doing, it can capture their work log on credentials, access to work resources, to files, all that sort of thing.

14:48So that has to be monitored and enforced. So there are ways to do this within Microsoft products, for example, so that if this device here is not healthy, then Microsoft is able to detect that early on and then deny any further access into, for example, Azure. Also your data is for most organizations the most significant value that you have. It's your database, it's all your customers, it's credit cards, social security numbers, top secret information, all kinds of stuff, health information.

15:19So that's going to be highly valued, and you must secure that as I mentioned earlier with the appropriate permissions. All right. That's enough for this Nugget. Stick around for the next Nugget where we will continue our discussion of some of these foundational elements. I hope this has been informative for you, and I'd like to thank you for viewing.

0:06So in our last Nugget we talked about some foundational elements, we'll continue that discussion here. Foundational elements relating to security. Now this is really, again, conceptual broad based, kind of broad stroke discussion of these foundational elements. I'm not going to show you where to click to fix something or where to click to improve your security or anything like that. So it's really going to be a little bit of a broader scope. However, when we get started with this, one of the things that you're going to find in an organization where you run IT is that the applications really get out of control fast.

0:40It's amazing what happens with this. And that's one of the reasons why admins really have to implement something called discovery. And this applies to a lot of different things. But in terms of applications, you kind of wind up with more apps than you think you do. I'll talk about that coming up shortly here. Now one of the reasons why that happens is because of shadow IT. It's like sleeper spies or something, OK. So we have our IT department, that's probably you and me or somebody that you manage, maybe as an IT person. Well, when it comes to shadow IT, these are people who have appointed themselves as IT over areas where they're not really supposed to, or they don't truly have the authority.

1:18Let me give you an example. This is not really relating to apps but similar. So let's say that this is our building here and we all work in this big ice cube. Anyway, In this very back corner is our conference room. And whenever we have people meeting in this conference room, gee, they just cannot reach the Wi-Fi. OK, this is our Wi-Fi right here, all right. It just-- they get a very weak signal, they're constantly dropping things and file transfer just won't happen and their Zoom calls are horrible and kind of embarrassing, but that's the only Wi-Fi that they have.

1:53So somebody goes out and they buy one from the electronic store, Best Buy is what we have here in America, you know, or someplace else you might have something. Anyway, they buy their own Wi-Fi ordered on Amazon, and they set that up. They plug it into a wall jack here, that's an ethernet jack, now they've set up their own kind of ad-hoc unauthorized Wi-Fi connection. That is shadow IT. OK. The problem there is we don't know how they secured that or if they secured it at all. They might have said, let's just make it easy and not set a password on this.

2:24Well, remember it's connected into my corporate it and I might have some hacker out here in their little VW bug. Looks like an anteater, I don't know. But a little VW Bug out here, and they are spying on our Wi-Fi signals because we have an open Wi-Fi out there. So that's the kind of thing that could happen, we want to avoid. When it comes to applications, we have a lot of different vectors where you could wind up with apps you really don't want within your organization. And there's also a balance with this because, remember, a lot of times people are bringing their own devices, BYOD, as we call it.

2:57No, not BYOB, that's more fun. This is BYOD, bring your own devices, that's a B. And so their tablets, you know, everybody's got a cell phone on them, some people have two cell phones, it gets to be kind of out of control. But all of those can get cloud apps, right? The place, what is it? The Google Store, the Google Play store, the Microsoft Store, the App Store for Apple products. And it's supposed to be that products that are up on those sites have already been gone through and they're supposed to all be safe, but we don't know how they're going to interoperate with other products that we have, that we require them to have.

3:34Maybe something about that app that they downloaded, which kind of works fine for anybody else just out in the general public, maybe it collides with one of our apps. Or maybe it has a security vulnerability that is a little bit more acceptable in the general public but in our organization, it's not acceptable at all. So those cloud apps can be an issue. And, again, in Microsoft Azure and some other methods you can use, there are ways to control which apps users can download. You can disable the store altogether or you can control what they can download.

4:04That's going to be, again, the Microsoft Store or the Microsoft Store for Business, that's going to be changing its name soon. But the basic idea here though, is that you can come up with only the apps that you want to make available to your users, maybe a five apps. Well, the Microsoft Store has, I don't know how many they have, they have thousands and thousands of apps but we're only going to allow five of those apps to be available on the Business Store, and maybe even one app we did in house, we made in house. So that's the business. Now, anyway, what else we got?

4:36Oh, ad-hoc devices, already talked about Wi-Fi and tablets and things like that. So those kind of things can get out of control. There was a survey done recently among IT professionals. Most IT pros assumed that there were probably 40 to 50 apps on various devices within their organization that were not truly authorized, something they downloaded on their phone or whatever. Turns out there's usually about 1,000 apps on larger organizations, there's about 1,000 apps that IT doesn't even know about and doesn't manage.

5:06OK, so that gets to be an issue in terms of security. Then there's the infrastructure. And this really has several vectors. The first vector that we have is this really giant diagram of what looks like-- I don't know, it looks like machinery from Willy Wonka's chocolate factory or something. I don't know, anyway, what's going on there. But, anyway, the idea there is it's infrastructure. And we have security configuration that we have to make sure works well with this. So you might see, like here, this is supposed to be a firewall that you can see down here, my pen colors kind of too light for that.

5:36But there's a firewall, we might have other network devices that would be an intrusion prevention system or something like that. I'll give that in a moment. You might have patches that you have. So maybe this is an update server, I'll put a U for an update server there. I don't even know what that's supposed to be but we'll call it an update server right now. And it's supposed to have a list of acceptable patches that you've already tested, then you approve of, and that can then distribute those patches to all of the devices within your organization. So that's another thing you might have in there to help your security.

6:08There's also intrusion detection systems and intrusion prevention systems IDS, IPS. So the ideas is going to be a little less intrusive. What it's doing is it kind of hovers on the edge of your network and it watches, usually it's inbound traffic, could also be within your network but usually inbound traffic like from those evil internet users. And we're trying to see if we're getting suspicious traffic coming in, can even examine things like email messages and things like this. Anyway, if it sees it, usually just logs in. And then what it does is most of the products that are IDS will have some kind of a reporting mechanism that administrators can go to.

6:45And they say it's going to show maybe the top 10 suspicious things that happened this week. Really, there's going to be thousands in a larger room and there's many, many thousands of things in that report so you kind of have to distill it down. An intrusion prevention system does what an IDS does, and it takes it one step further and then it will block anything that seems suspicious. But sometimes they're too aggressive and you might have traffic block that you really intended to receive. So you kind of have to strike a balance with that one. Then there's also the network itself.

7:16This diagram might make a little bit more sense. Anyway, with this we have segmentation and isolation, OK. So we might have all of these computers over here on the left connected to one of my routers, and then I might have a bunch of other-- I'll put it out in the black area so you can see a little better, a bunch of other computers, all these circles are our other computers, connected to another segment in our network. And we may want to carefully control traffic, goes back and forth between them. Now, people that work with a classified networks and things like that, you're probably going to pipe up and scream at me here.

7:52But one thing we don't want to happen is to have traffic or maybe file transfers from a classified network to an unclassified network. Now, there shouldn't be any way for that to even happen in most of those organizations. But regardless, we wouldn't want it to happen. So you want to segment that traffic out, so you are isolating it. And there's even a deeper level of that called micro segmentation where you make really, really smaller segments of networks and VLANs, and things like this. There's also encryption. So in most organizations, when you're transferring traffic between a server and maybe your laptop or something like that at work, it's probably not encrypted in most of those cases but you can add encryption to networks using a number of different methods.

8:34You can use IPsec, you can use other kinds of encryption mechanisms on your network. The thing is it's going to have additional overhead. Whenever you encrypt something, it could potentially also slow down your network performance a little bit. But it might be worth it if you get more security out of it. There's also cloud migration. Maybe we've got servers locally-- I'm going to talk about this coming up probably in the next Nuggets. Maybe we have servers here locally that have got to be very expensive, they're very big, they consume a huge amount of electricity. We're kind of tired of managing them and updating them and everything like that, and caring for them.

9:08We'd like to maybe put that into the cloud. And that can be done with a lot of different things. That's why the cloud is becoming such a big thing these days. Because people are taking things like local web servers, putting those in the cloud. It's very easy to do, you can do it very quickly, and really probably a lot cheaper than what you can do if you host those kinds of things locally. And then there's something else here called threat intelligence. This is a really giant topic on its own, might even be a-- if it's not yet, it probably will be, even an exam from Microsoft, you can probably take on this product called Azure Sentinel.

9:41Here's a little URL off to the side if you want to look at it some more. But it's pretty fascinating product. And the basic idea here is it inplants something called SIEM, S I E M, Security Information and Event Management. Wow, that's a mouthful. Anyway, what this SIEM does is it's not just kind of like an antivirus product. I mean, it's that but it's a lot more than that, it's a lot more analytics and intelligence. It uses machine learning and artificial intelligence. And it kind of has to because there's things called signals.

10:13And a signal is something that can be emitted from a computer and sent to, like say, Microsoft. And then Microsoft can take that signal and determine is that malicious or is that not malicious or is it ordinary file or ordinary network traffic or not. Is there any threat, in other words. Well, guess what, Microsoft actually does receive a lot of those, you wouldn't believe how many. They receive trillions of signals daily. Well, that's why they have to have machine learning and artificial intelligence.

10:44Even if someone as brilliant as me could not go through trillions of signals daily manually, I'd have to-- you'd have to use machine learning or artificial intelligence. And it's really a fascinating engine that they have, Microsoft does. If you want to read on it, there's good stuff there. In this article, in fact, will give you some of that. There are over a million new threats daily, I just learned that last week. A million new threats daily. And because of the morphic nature of them, meaning that they change and things like this, 95% of those one million threats are never seen again.

11:17So they are one time events. That's, again, why you have to have artificial intelligence. So that it can look at something that could be a threat, and even though it's never seen it before and never fingerprinted it before, has to be able to determine that's suspicious, not suspicious, that's a significant threat, whatever. So that's the conclusion of our second part of our foundational elements. I hope this has been informative for you, and I'd like to thank you for viewing.

0:07For a lot of us folks that have been in the IT world for a long time, like me, it's kind of difficult to get your mind around the cloud. What's the cloud? When we set up servers in the old days, we would set them up. We would put hands on them. If they needed to be upgraded, we would open the case and put in more memory or another processor, whatever it is we needed to do. We could put our hands on all of the servers, all of the network equipment, that we would manage. Well, now stuff's in the cloud. Most administrators will never even see the data center where their servers are actually hosted.

0:40I've got some that are hosted, pretty sure it's in Des Moines, Iowa. I'm not even completely sure, because I have a big data center from Microsoft. I've got a lot of machines in Azure that I've run there. And I've never visited that data center. Even if I were to visit that data center, there's no way I could put my finger on which rack my servers were in. But, nevertheless, it's really important to get your mind around the cloud and a lot of the advantages that it does have. So let's take a look at an example here. Let's say that we've got a small toy company.

1:10And, of course, during the holiday season, our sales go up dramatically. This is all on premises. We just usually say on prem. So it's on premises. And these are our servers here. We've got a few servers in here. We've got some-- it looks like some hard drives there. Maybe there's some network equipment in here somewhere. All of this stuff, we put hands on, we installed it. It's all ours, right? Problem is, each year, out toy company's been doing better. And last year, maybe we were running at about 80% capacity for the servers that we have in here and everything.

1:46Well, in IT, that's cutting it close. You never want to, probably, get that high in the utilization because if we have an extremely high period of utilization, or maybe during our busiest hours, that could spike up to 90% or so, or maybe more. And then, people, when they're opening our web page, maybe one of these is our web server, when they open our web page, they're just going to get the spinning circle and say, unavailable or something like that. Well, then they're just going to go to a competitor. People don't have very much patience for that anymore. So what can we do if we kept everything on premises?

2:17Well, we might just install another server, another rack and everything like that. But the expense there, the upfront expense is extremely high there. Just the network equipment alone in one of these things, you can add up $100,000 pretty quick. A Cisco power cable that looks a lot like the one I could get at Home Depot or a home improvement store, it's $400 for a power cable, folks. So this stuff gets really expensive really fast. But if I kept everything on premises, I might have to do that. So now I have two servers. Oops. That's supposed to be a 45.

2:49One's running 45%. Let's say, at 90% now, total for our holiday season. And we're splitting it up between both of these servers and all the network equipment and everything. So now they're both running 45% capacity. I'm more comfortable with that, but that means that about this much of our total capacity on both of these is not being used. But I'm still paying for it. I'm still powering it. I still had to have the upfront costs. I still spent, maybe, $100k or more to do it. I still have to maintain the whole thing. I still have to update my servers.

3:20I still have to make sure that they have the latest patches and everything like that. And I have to make sure that they're all consistent with one another. So sometimes I might want to change that. Maybe I would rather than setting up an entirely new setup here on premises, what if I put that in the cloud instead, maybe Azure? And Azure is not the only game in town. That's Microsoft's solution. There's lots of other ones. Amazon Web Services has some, all kinds of other companies. But, anyway, of course, this is Microsoft. So we're looking at Azure here for this. Now what do we do?

3:50Well, let's say we just needed some more capacity. Maybe with this I don't have to install all of this at once, so to speak. And I'm just using this conceptually. Maybe we only need two or three more servers in Azure that we can stand up, and then, each one of those servers, maybe it runs us $50, $60 a month. That's a whole lot easier to swallow than, say, $100,000 to stand up a new server rack and all the equipment that goes inside of it. And here's the other thing. Let's say that we had an unusually successful season, and it turns out that even these servers were not enough.

4:25You can even automate this so that it can scale up, so that during busiest periods of time, we can set a certain threshold. So we can say, well, when it gets to be 80%, whatever percent we decide, we're going to add more servers onto this. And it can happen automatically and based on demand. Then, when we're not using them, and it's February, and our season's done and everything, we can scale back down easily and save money. And that, ultimately, is where we come up with our concept of shared responsibility because we're still even if we use a lot of stuff on the cloud.

4:58We're still going to be responsible for certain things. We can't say it's Microsoft's fault that they misconfigured our user account because they don't configure it. We configure the user account still. We still have to do a lot of the configuration and management there, even though we might not have all of the hardware. And there are several different stages of this that you can work within. And a lot of companies will implement some form of all of these. We have Software as a Service, Platform as a Service, and Infrastructure as a Service, each of them involving more or less involvement from you as an administrator in terms of where the responsibility lies.

5:34So if you do decide to start implementing cloud services, and just about all of us probably are, then you're going to be using it in some form of Software as a Service, Platform as a Service, or Infrastructure as a Service. I'm going to define those here as we go, the first one being Infrastructure as a Service. And sometimes, the line, by the way, between these, becomes a little bit fuzzy, depending upon what kind of services you're using. But with Infrastructure as a Service, it's kind of the most fundamental level, kind of the starter level of this, if you will.

6:05With this, you're mostly getting the hardware from your cloud service provider. You're getting the storage. In other words, the hard drives or the SSDs, they're in a data somewhere that they have and that you're putting your data on. You're using their network resources to access them yourself, or for your customers to access anything that's necessary there. And you're using their compute power as well. So using, in other words, their CPU. In other words, we're really using their servers and their network services.

6:36Now, how is this typically charged? How do we pay for this stuff? It could be per user, depending upon the kind of service it is. In my case, I'm generally starting up servers that are going to be charged by the-- it could be by the hour, by the week, or by the month. With Azure, most of these are by the month. But it's also incremental. So if you used a server for only two weeks, and then you tore it down and you deleted it, then you're only going to be charged for those two weeks. There's not like a minimum, so to speak. Also, it's sometimes charged by storage.

7:08So I might even have servers that I'm already paying for, and they have some storage there. But maybe it's not enough. I can add storage, and it may or may not cost me very much. A lot of times, the storage really is a very good value for what you get there. Now, if you're using Infrastructure as a Service, which is our current topic here, a lot of common uses for this are something like testing or development, where we just need to have a server that's off prem. It's not something we use here. And we just want to put it in what we call a sandbox, where it's somewhere else, and it's safe.

7:41And if it blows up, it doesn't affect the rest of my organization, for example. Sometimes this could be customer websites or web apps. But, again, you'll also use websites and web apps probably in SaaS and PaaS. By the way, we call this IaaS, PaaS, and SaaS. Now, when you're using Platform as a Service, or PaaS, you're starting off with pretty much the same thing you had with IaaS. So we're going to add to the IaaS infrastructure there, software, and especially for application development.

8:11If you are also interested in working more with Microsoft servers, like Server 2022, Knox and I, Knox Hutchinson and I just finished a series that's the AZ-800. Ben Finkel also added some content to it. One of the things I taught there was Platform as a Service, where you can actually use containers. And that's another example here. You can get something called a container, such as one from Docker, for example. And what this is, normally, when we have a server here, we think about, well, we installed Windows on it-- Windows Server 2022.

8:46And we installed the entire operating system on it. And then we started to install applications on top of it, app 1, or something like that. And then we had app 2. And pretty soon, we got a dozen apps on there. Well, when it comes to containers, just to be real brief about this, we don't really do that. I'll try to summarize this as best I can. We just get pieces of Windows Server 2022, or it could be Linux or something else as well. But we just get core components of the operating system, just enough to make the application run.

9:17That prevents us from having to install an entire operating system. Advantages of this, these containers can start up in mere seconds. Sometimes, it's just two or three seconds that they start up. And they're very, very fast. It's very fast and easy to add additional ones. So if we need more, like we're reaching our capacity, for example, we can just add a dozen of those in mere seconds. It's very quick and easy to do. We can also use this kind of thing for database integration and collaboration, just taking this to another level. For example, Salesforce is a product, which, I don't know if you're familiar with that or not, but many companies use Salesforce.

9:53It's a gigantic organization. It's used for keeping track of your customers and your sales, your whole sales process. We also have Software as a Service. Now, Software as a Service, or SaaS, this is where the software itself is served from a cloud provider. And, again, this is where it gets to be a little bit fuzzy because when we're working with PaaS, Salesforce is in PaaS, but it's also possibly in SaaS. So the line gets a little bit fuzzy there. But this is where we have an independent software vendor that contracts with someone in the cloud.

10:24So we may have a software developer that's put products in Azure, for example. Or the cloud provider itself is also the software vendor. That would be somebody like Microsoft Azure, where we might need to get some servers or a software product, and Microsoft is both the developer of that software, as well as hosting the product. This is typically going to be accessed via web browser. And, of course, again, it's usually a subscription. But then again, so is PaaS and so is IaaS. You can have a single installation on these.

10:55But you might have multiple customers. So in Microsoft land, this might be their server here. And I might install five installations of Windows here on their server. But there's other people that have also installed five installations of Windows on that same hardware. And they may also have other things involved in that. So I don't own that entire rack myself when I do that. It's shared with other people. But rest assured, all of my copies of Windows are segregated from this person's copies of Windows.

11:29And we should not have any spillover here between our data. And it's all protected. So in other words, that data is going to be segregated. Now, what are some examples of SaaS? Well, one of those, we use all the time, Netflix. Yeah, the Netflix engine and whatever it is that streams that video out to us, that's all Software as a Service. That's Netflix. We might be using Microsoft Office. Or I'm using PowerPoint here. This actually can be delivered from the cloud directly. In my case, I have PowerPoint installed locally.

12:00But if I want to, I can run the whole thing from a web browser connected to Microsoft. Google Docs, all of that stuff would be examples of Software as a Service. Now, as we move into the cloud infrastructure, depending upon which level we've chosen to use, we have varying levels of responsibility. So remember, when we were on premises, where I had everything, I had all of it. I had the data locally. I had all the devices, all the servers. I managed all the accounts locally. And all the rest of this was local here as well. And you can read down through the rest of these, clear down to the physical data center, the network, the host, meaning the servers.

12:36All of that stuff, I was in charge of all of it. I put hands on all of it. All my responsibility. However, if we decide to use something like Infrastructure as a Service, and we start to ease our way into the cloud, well, then, the servers might not be on my premises. They might be-- and, by the way, this is borrowed from Microsoft. And there's a link down here at the bottom. You can see there. But this lighter blue color means Microsoft has taken responsibility for that. They've taken responsibility for the server, for the network infrastructure, other than I have to have a network connection. I have an internet connection to be able to reach it because that's usually, again, done through a web browser.

13:11There's the physical data center. Microsoft has all of that. I don't have to install big expensive generators for backup power. I don't have to have a big data center that's worth bazillions of dollars, any of that kind of stuff. I just have to have my $100 a month internet connection. Although, if you're a corporation, you probably have a bigger pipe and more expensive internet than that. But anyway, so that's where we're at with IaaS. I have less responsibility, but I'm still responsible for all of the rest of this stuff right through here.

13:41Now, as we move forward, to Platform as a Service, we see that we relinquish more of our responsibility over to Microsoft. So now, when we have Platform as a Service, the operating system belongs to Microsoft. And I'm borrowing it for purposes of running whatever it is I need to do, my apps or whatever. And then some of these will then be shared. And that's why we have this split box here. All the network equipment is at Microsoft. The physical network equipment is there. But network controls, like Bastion or using something like a firewall, if I want to configure that sort of thing there, then I configure it.

14:20So it's my responsibility. But the physical stuff is still there at Microsoft's responsibility. And then, finally, if I go full out and use Software as a Service, and I give everything that I can over to Microsoft, then they have all of this stuff, like this-- application, the network controls, all the physical aspects of it. And the Identity and directory infrastructure is shared because I might have a server installed in the cloud, but I still have to create the user accounts, for example.

14:51It exists on a Microsoft server. My accounts exist on a Microsoft server. But it's up to me to create the account. It's up to me to have the responsibility to determine what kind of password they have and stuff like that. And that really goes up to this level here as well. And these things up here at the top, I'm always going to be responsible for those. I'm responsible for my own information and data. I can store it on Microsoft servers, but I'm responsible for what that data is. Any of the additional devices that might connect to those cloud services, I'm also responsible for. So if we have mobile devices, company mobile devices, where people can log on and use those services, well, I'm still responsible for those, for my PCs that are still in the building that I own.

15:28We're responsible for that, and for how we create and identify our users. And to illustrate the whole point of using cloud services to offload our responsibilities, the server you're looking at right here, I don't know where that is. It's somewhere in the West. I chose the West region. I don't even know what data center it's in. I installed it during my lunch break. I ate lunch at my desk, and I ate a candy bar for lunch. In the time that it took me to eat that candy bar, I had configured this server, and it was ready to go.

15:59That's how fast you can set this up. And here's even the web page that I used to configure it. This is where it's running right now. If I wanted to stop it, I could stop it. If I needed to restart it, I could restart it. If I'm done with it, I can actually delete it, and it takes about maybe a minute to delete this thing. I'm on a Pay-as-you-go subscription. So I can't remember what it costs. I think it's $50 a month. No, this one's $35 a month to run this one. If it turns out that it's not powerful enough, look, over here on the left, I could go down to Size, and I can upgrade the size to some other version of the server.

16:35I can add processors, memory, hard disk, data disk, which you see right here. I can do whatever I need to to make sure that it meets my needs. So to sum it all up, we start to offload some of our responsibilities as we move further towards the cloud, but we're still responsible for some of those critical pieces of things, such as our accounts and our data itself. I hope this has been informative for you, and I'd like to thank you for viewing.

0:06All right, folks. I thought it'd be a great idea if right here at the end, we would just have a quick little pop quiz. Didn't you just love it when you were in school, and your teacher would announce pop quiz? That's what this is. But I promise you, you should get 100 on this. Or it's not too hard. And I will not send a report card to your parents. OK, first question here is, as long as you are not aware of an active breach, you can assume that your network is safe and uncompromised. No, you can't.

0:37Remember, that's one of the things we always assume. Assume breach. That's the words we used, I think. Assume breach. We always must be vigilant and assume that there's very likely possibility that somebody's already in our network, or has already compromised our systems, or that we already have some computers that probably have viruses or spyware or some kind of malware on them, right? So we never assume that everything is safe. Question two-- an example of "Shadow IT" might be a person who is not in the IT department setting a Wi-Fi access point.

1:09Setting up. I should say, "setting up" a Wi-Fi access point or installing unauthorized software. Yes. Remember, that's what Shadow IT is, someone that's doing IT duties or responsibilities without really the authorization. And I might also add to that, that this could be somebody who does work in IT, but they're not doing something in the area of their expertise. So, for example, if somebody is an Active Directory expert, and they're really good with working with Microsoft accounts, resetting user's passwords, setting up group policies, some of the deeper things in Windows Server, but they're setting up networking that really our Cisco folks should be doing, or setting up a Wi-Fi that really our Cisco experts should be handling, that might also be considered Shadow IT.

1:58So question three-- as you move your IT resources into the cloud, you begin to transfer some responsibility to your cloud provider. And that might be somebody like Microsoft Azure, of course. And that also is a big yes. If we're starting to move into the cloud, then the servers that we want to use are no longer on-prem. They're not in our rack anymore. You can't put hands on them. You can't do any of that kind of stuff. They belong to Microsoft.

2:28And we're pretty much, more or less, leasing those servers. All right, so that's our first pop quiz. Hope you enjoyed it. More fun than the ones that we used to have in school, right? All right, I hope this has been informative for you, and I'd like to thank you for viewing.