1 1 00:00:00,360 --> 00:00:02,130 Service models. 2 2 00:00:02,130 --> 00:00:04,770 In this lesson, we're going to dig into the different type 3 3 00:00:04,770 --> 00:00:06,300 of cloud service models. 4 4 00:00:06,300 --> 00:00:08,130 When I'm talking about cloud service models, 5 5 00:00:08,130 --> 00:00:09,870 I'm talking about classifying the provision 6 6 00:00:09,870 --> 00:00:11,580 of cloud services and the limit 7 7 00:00:11,580 --> 00:00:13,830 of the cloud service provider's responsibility 8 8 00:00:13,830 --> 00:00:16,620 as either software, platform, infrastructure, 9 9 00:00:16,620 --> 00:00:18,060 or some other thing. 10 10 00:00:18,060 --> 00:00:21,300 Essentially, when we talk about something as a service, 11 11 00:00:21,300 --> 00:00:22,800 this is what we're talking about. 12 12 00:00:22,800 --> 00:00:24,900 What type of cloud service model are you using? 13 13 00:00:24,900 --> 00:00:26,910 Usually when we talk about cloud services, 14 14 00:00:26,910 --> 00:00:29,910 we talk about them as software as a service, 15 15 00:00:29,910 --> 00:00:34,140 platform as a service, infrastructure as a service, 16 16 00:00:34,140 --> 00:00:35,340 and so we need to understand 17 17 00:00:35,340 --> 00:00:38,190 what each of these are and what they do for us 18 18 00:00:38,190 --> 00:00:40,260 and what kind of security risks they have. 19 19 00:00:40,260 --> 00:00:41,430 The first one we're going to talk 20 20 00:00:41,430 --> 00:00:45,180 about is software as a service, also known as SaaS. 21 21 00:00:45,180 --> 00:00:47,520 Now, SaaS is going to provide all the hardware, 22 22 00:00:47,520 --> 00:00:50,700 the operating systems, the software, the applications, 23 23 00:00:50,700 --> 00:00:53,730 everything you need for a complete application service 24 24 00:00:53,730 --> 00:00:55,770 to be delivered to your end user. 25 25 00:00:55,770 --> 00:00:59,460 For example, if you use something like Slack or Freshdesk 26 26 00:00:59,460 --> 00:01:03,360 or QuickBooks Online, these are all software as a service. 27 27 00:01:03,360 --> 00:01:05,370 This happens when the cloud service provider 28 28 00:01:05,370 --> 00:01:07,710 is responsible for the security of the platform 29 29 00:01:07,710 --> 00:01:08,543 and the infrastructure 30 30 00:01:08,543 --> 00:01:10,350 because they're providing you everything 31 31 00:01:10,350 --> 00:01:13,080 from the application layer all the way down. 32 32 00:01:13,080 --> 00:01:15,570 What are you responsible for as a consumer? 33 33 00:01:15,570 --> 00:01:17,250 Well, as a consumer, 34 34 00:01:17,250 --> 00:01:19,590 you're responsible for application security, 35 35 00:01:19,590 --> 00:01:21,930 account provisioning and authorizations. 36 36 00:01:21,930 --> 00:01:24,750 So in my company, for instance, we use G Suite. 37 37 00:01:24,750 --> 00:01:26,790 When we use G Suite and I hire a new employee, 38 38 00:01:26,790 --> 00:01:28,890 I'm responsible for creating their account. 39 39 00:01:28,890 --> 00:01:30,330 That also gives them authorizations 40 40 00:01:30,330 --> 00:01:32,880 to what they're able to access within our portfolio 41 41 00:01:32,880 --> 00:01:35,670 and we control the application security that way. 42 42 00:01:35,670 --> 00:01:37,920 Now, if you think about Office 365, 43 43 00:01:37,920 --> 00:01:40,560 this is another great example of a SaaS product. 44 44 00:01:40,560 --> 00:01:42,450 Who is responsible for what? 45 45 00:01:42,450 --> 00:01:44,070 Well, if someone's able to perform 46 46 00:01:44,070 --> 00:01:47,010 a cross-site scripting attack or an SQL injection 47 47 00:01:47,010 --> 00:01:49,110 or something like that on the application, 48 48 00:01:49,110 --> 00:01:50,640 this would be Microsoft's fault 49 49 00:01:50,640 --> 00:01:52,260 because they wrote the application, 50 50 00:01:52,260 --> 00:01:53,370 they host the application, 51 51 00:01:53,370 --> 00:01:56,280 they do everything with the code on down. 52 52 00:01:56,280 --> 00:01:58,350 They as the SaaS provider are responsible 53 53 00:01:58,350 --> 00:01:59,880 for securing the infrastructure 54 54 00:01:59,880 --> 00:02:01,890 and the platform and the code. 55 55 00:02:01,890 --> 00:02:05,250 Now, if somebody in my organization lost their username 56 56 00:02:05,250 --> 00:02:06,900 and password and somebody else logged in 57 57 00:02:06,900 --> 00:02:09,780 to exfiltrate that data, whose fault is this? 58 58 00:02:09,780 --> 00:02:12,690 It's not Microsoft's, it's not the service provider's, 59 59 00:02:12,690 --> 00:02:15,300 it's ours, the consumer of the application 60 60 00:02:15,300 --> 00:02:17,130 because it happened either on our client computer 61 61 00:02:17,130 --> 00:02:19,380 because they had malware or a key logger, 62 62 00:02:19,380 --> 00:02:21,150 or our employee was just negligent 63 63 00:02:21,150 --> 00:02:23,310 and wrote down their username and password. 64 64 00:02:23,310 --> 00:02:25,470 This is the idea when you're dealing with SaaS. 65 65 00:02:25,470 --> 00:02:27,210 Who's responsible for what? 66 66 00:02:27,210 --> 00:02:30,720 The responsibility for the data and for the authorization 67 67 00:02:30,720 --> 00:02:32,580 is that of the consumer. 68 68 00:02:32,580 --> 00:02:34,440 Everything else from the software on down 69 69 00:02:34,440 --> 00:02:36,840 is the problem of the service provider. 70 70 00:02:36,840 --> 00:02:37,673 The next one we're going to talk 71 71 00:02:37,673 --> 00:02:40,773 about is infrastructure as a service or IaaS. 72 72 00:02:40,773 --> 00:02:43,020 When we talk about infrastructure as a service, 73 73 00:02:43,020 --> 00:02:44,670 this is going to provide all the hardware, 74 74 00:02:44,670 --> 00:02:47,100 the operating system, and the backend software 75 75 00:02:47,100 --> 00:02:49,770 needed to develop software or services. 76 76 00:02:49,770 --> 00:02:51,120 Now, notice the difference here. 77 77 00:02:51,120 --> 00:02:53,460 I talked about the backend software 78 78 00:02:53,460 --> 00:02:56,310 and you're using this to develop your own software services. 79 79 00:02:56,310 --> 00:02:58,350 So when you go to my website, for instance, 80 80 00:02:58,350 --> 00:02:59,310 that's actually running 81 81 00:02:59,310 --> 00:03:01,410 on an infrastructure as a service product. 82 82 00:03:01,410 --> 00:03:03,300 The reason is that service provider is giving me 83 83 00:03:03,300 --> 00:03:06,360 the load balancers, the servers, the storage area networks, 84 84 00:03:06,360 --> 00:03:09,810 the database servers, all of that stuff they give us, 85 85 00:03:09,810 --> 00:03:12,420 and they give us the basic operating system. 86 86 00:03:12,420 --> 00:03:14,130 Now, once they do that, 87 87 00:03:14,130 --> 00:03:16,560 we have to end up doing everything on top of that. 88 88 00:03:16,560 --> 00:03:19,260 We made the website, we made the exams, 89 89 00:03:19,260 --> 00:03:21,840 we made all that software that provides you access 90 90 00:03:21,840 --> 00:03:24,600 to what you see when you go to our website. 91 91 00:03:24,600 --> 00:03:25,500 Now, this allows me, 92 92 00:03:25,500 --> 00:03:27,000 instead of having to buy all the hardware, 93 93 00:03:27,000 --> 00:03:29,520 I can just call up my IaaS provider, 94 94 00:03:29,520 --> 00:03:32,670 somebody like Amazon Web Services, Microsoft Azure, 95 95 00:03:32,670 --> 00:03:35,137 Google Cloud, or somebody like that, and I say, 96 96 00:03:35,137 --> 00:03:36,960 "Hey, I need a new website." 97 97 00:03:36,960 --> 00:03:39,120 Go ahead and spin me up a new virtual machine 98 98 00:03:39,120 --> 00:03:42,270 and now I can build on top of that what I exactly want. 99 99 00:03:42,270 --> 00:03:45,000 They give me everything from the hardware down 100 100 00:03:45,000 --> 00:03:47,010 and they will give me the basic operating system, 101 101 00:03:47,010 --> 00:03:48,360 but then I take it over from there 102 102 00:03:48,360 --> 00:03:51,150 and I'm responsible from the operating system up. 103 103 00:03:51,150 --> 00:03:52,620 Now, infrastructure as a service 104 104 00:03:52,620 --> 00:03:55,320 is going to place the responsibility on the consumer, 105 105 00:03:55,320 --> 00:03:56,430 in this case me, 106 106 00:03:56,430 --> 00:03:59,043 for the security of the platform and the applications. 107 107 00:03:59,043 --> 00:04:00,930 When I talk about the platform, 108 108 00:04:00,930 --> 00:04:04,200 I'm talking about things like the operating system and up. 109 109 00:04:04,200 --> 00:04:06,750 Now, when we talk about cloud service providers, 110 110 00:04:06,750 --> 00:04:09,990 their job here is to make sure they have confidentiality, 111 111 00:04:09,990 --> 00:04:12,630 integrity, and availability of the hardware 112 112 00:04:12,630 --> 00:04:14,490 within the resource pool. 113 113 00:04:14,490 --> 00:04:15,570 What does that mean? 114 114 00:04:15,570 --> 00:04:16,920 When we talk about the resource pool, 115 115 00:04:16,920 --> 00:04:19,050 let's say I'm using Amazon Web services. 116 116 00:04:19,050 --> 00:04:20,340 That's their servers. 117 117 00:04:20,340 --> 00:04:22,890 When I say I want to spin up a new virtual machine, 118 118 00:04:22,890 --> 00:04:25,230 they're going to go ahead and figure out where in their pool 119 119 00:04:25,230 --> 00:04:27,150 of all of their servers they're going to install 120 120 00:04:27,150 --> 00:04:28,590 my virtual machine on. 121 121 00:04:28,590 --> 00:04:30,090 Now, for that hardware pool, 122 122 00:04:30,090 --> 00:04:31,740 they're going to provide confidentiality, 123 123 00:04:31,740 --> 00:04:33,540 integrity, and availability. 124 124 00:04:33,540 --> 00:04:35,790 For my instance, my virtual machine, 125 125 00:04:35,790 --> 00:04:37,470 they're not going to do anything inside of that. 126 126 00:04:37,470 --> 00:04:39,870 That's on me as the service consumer. 127 127 00:04:39,870 --> 00:04:42,210 That's where that line in differentiation is. 128 128 00:04:42,210 --> 00:04:44,400 Now, when we talk about infrastructure as a service, 129 129 00:04:44,400 --> 00:04:46,290 one of the things you have to keep in mind 130 130 00:04:46,290 --> 00:04:48,720 is you have to have good organizational governance 131 131 00:04:48,720 --> 00:04:51,000 to control how those VMs and those containers 132 132 00:04:51,000 --> 00:04:53,100 are being provisioned and deprovisioned. 133 133 00:04:53,100 --> 00:04:55,530 If you don't have good organizational governance on this, 134 134 00:04:55,530 --> 00:04:59,760 you can have problems like VM sprawl and huge cost overruns. 135 135 00:04:59,760 --> 00:05:02,730 If anyone can spin up a VM and anyone can set it 136 136 00:05:02,730 --> 00:05:04,140 to whatever limit they want, 137 137 00:05:04,140 --> 00:05:06,000 they can use up tons of resources 138 138 00:05:06,000 --> 00:05:08,430 and you can get a huge bill, so keep that in mind 139 139 00:05:08,430 --> 00:05:10,470 when you're using infrastructure as a service. 140 140 00:05:10,470 --> 00:05:11,550 The third one we're going to talk 141 141 00:05:11,550 --> 00:05:13,590 about is platform as a service. 142 142 00:05:13,590 --> 00:05:15,810 Now, platform as a service or PaaS 143 143 00:05:15,810 --> 00:05:17,490 is where it provides your organization 144 144 00:05:17,490 --> 00:05:19,500 with the hardware and the software needed 145 145 00:05:19,500 --> 00:05:21,660 for a specific service to operate. 146 146 00:05:21,660 --> 00:05:23,850 Now, this one often gets students confused 147 147 00:05:23,850 --> 00:05:26,100 because it sounds kind of like software as a service 148 148 00:05:26,100 --> 00:05:28,200 and kind of like infrastructure as a service 149 149 00:05:28,200 --> 00:05:29,880 and the reason for that is it kind of sits 150 150 00:05:29,880 --> 00:05:31,350 right between the two of them. 151 151 00:05:31,350 --> 00:05:34,200 So the best way I know to explain platform as a service 152 152 00:05:34,200 --> 00:05:36,300 to you is by doing it graphically. 153 153 00:05:36,300 --> 00:05:38,580 Let's say I have infrastructure as a service. 154 154 00:05:38,580 --> 00:05:40,020 Now, infrastructure as a service 155 155 00:05:40,020 --> 00:05:42,120 is the lowest of these three. 156 156 00:05:42,120 --> 00:05:43,890 When I look at infrastructure as a service, 157 157 00:05:43,890 --> 00:05:45,810 I'm going to get the networking from the vendor. 158 158 00:05:45,810 --> 00:05:47,340 I'm going to get the storage from the vendor. 159 159 00:05:47,340 --> 00:05:49,080 I'm going to get the server from the vendor. 160 160 00:05:49,080 --> 00:05:50,790 I'm going to get the virtualization from the vendor 161 161 00:05:50,790 --> 00:05:53,700 and I'm even going to get the operating system installed 162 162 00:05:53,700 --> 00:05:56,550 by the vendor, but then I have to support it from there. 163 163 00:05:56,550 --> 00:05:58,320 Now, any kind of middleware I need, 164 164 00:05:58,320 --> 00:06:00,780 any kind of runtime I need, any kind of data I need, 165 165 00:06:00,780 --> 00:06:02,430 any kind of applications I need, 166 166 00:06:02,430 --> 00:06:04,650 that's all on me as the consumer. 167 167 00:06:04,650 --> 00:06:05,910 That's where that dividing line is. 168 168 00:06:05,910 --> 00:06:08,190 It's from the operating system and you could see it there 169 169 00:06:08,190 --> 00:06:11,040 as it's split between the vendor and the customer. 170 170 00:06:11,040 --> 00:06:12,900 Now, if you go to PaaS, 171 171 00:06:12,900 --> 00:06:14,790 you're going to go a little bit higher. 172 172 00:06:14,790 --> 00:06:16,200 With PaaS, they're going to provide you 173 173 00:06:16,200 --> 00:06:18,030 with the operating system and they're going to patch it 174 174 00:06:18,030 --> 00:06:19,710 and maintain it and do the security of it. 175 175 00:06:19,710 --> 00:06:22,080 They're going to provide the middleware and the runtime, 176 176 00:06:22,080 --> 00:06:24,000 but they're not going to provide the data 177 177 00:06:24,000 --> 00:06:25,770 and they're not going to provide the application. 178 178 00:06:25,770 --> 00:06:27,630 That's for you to develop. 179 179 00:06:27,630 --> 00:06:29,790 Then when we go to software as a service, 180 180 00:06:29,790 --> 00:06:32,190 the vendor is going to give you everything all the way up 181 181 00:06:32,190 --> 00:06:34,200 from the application on down. 182 182 00:06:34,200 --> 00:06:36,660 So, let's take an example like QuickBooks, 183 183 00:06:36,660 --> 00:06:38,610 which is a piece of accounting software. 184 184 00:06:38,610 --> 00:06:41,340 There is QuickBooks Online, which is a SaaS product. 185 185 00:06:41,340 --> 00:06:43,530 When you use it, they provide you everything. 186 186 00:06:43,530 --> 00:06:44,850 They built the application, 187 187 00:06:44,850 --> 00:06:47,700 all you have to do is log in and do your own data entry. 188 188 00:06:47,700 --> 00:06:50,280 You're going to put in what you spent and what you took in 189 189 00:06:50,280 --> 00:06:52,380 and you'll be able to run through that program that way. 190 190 00:06:52,380 --> 00:06:54,600 Now, if I wanted to make my own QuickBooks, 191 191 00:06:54,600 --> 00:06:56,280 I wouldn't do a SaaS solution. 192 192 00:06:56,280 --> 00:06:58,770 I might use a platform as a service solution instead. 193 193 00:06:58,770 --> 00:07:01,267 In this case, I can go to somebody like Amazon and say, 194 194 00:07:01,267 --> 00:07:04,110 "Hey, I'm going to make a web application. 195 195 00:07:04,110 --> 00:07:05,970 I need you to give me a Linux server 196 196 00:07:05,970 --> 00:07:07,620 that's updated and patched and running 197 197 00:07:07,620 --> 00:07:08,760 and everything's perfect 198 198 00:07:08,760 --> 00:07:10,860 and it has these programming languages that are supported." 199 199 00:07:10,860 --> 00:07:14,310 Maybe I'm going to write it in Python or PHP or whatever it is 200 200 00:07:14,310 --> 00:07:15,780 and I need these type of databases 201 201 00:07:15,780 --> 00:07:18,840 and all these things I need, they can give me that platform. 202 202 00:07:18,840 --> 00:07:21,570 All I would do is actually code my application. 203 203 00:07:21,570 --> 00:07:23,880 That's the application and data piece. 204 204 00:07:23,880 --> 00:07:27,270 Now, on the other hand, if I go all the way down to IaaS, 205 205 00:07:27,270 --> 00:07:29,827 infrastructure as a service, I would go to Amazon and say, 206 206 00:07:29,827 --> 00:07:32,730 "Hey, I need a server that has this much memory 207 207 00:07:32,730 --> 00:07:33,990 and this much storage 208 208 00:07:33,990 --> 00:07:36,210 and I want you to install it with Windows or Linux." 209 209 00:07:36,210 --> 00:07:37,920 They would do that and hand it over to me 210 210 00:07:37,920 --> 00:07:39,330 and then I would install 211 211 00:07:39,330 --> 00:07:40,830 whatever programming languages I need. 212 212 00:07:40,830 --> 00:07:42,300 I would install the databases. 213 213 00:07:42,300 --> 00:07:45,210 I would install an Apache server or an IIS server 214 214 00:07:45,210 --> 00:07:48,060 and then I can code and develop my application. 215 215 00:07:48,060 --> 00:07:49,380 So that's the difference here. 216 216 00:07:49,380 --> 00:07:52,140 When you go to SaaS, it's a completely done product. 217 217 00:07:52,140 --> 00:07:55,260 When you go to IaaS, it's pretty much just the vehicle 218 218 00:07:55,260 --> 00:07:57,030 and you have to do everything yourself. 219 219 00:07:57,030 --> 00:07:59,040 With PaaS, it's somewhere in between. 220 220 00:07:59,040 --> 00:08:01,020 Essentially, you have an operating system 221 221 00:08:01,020 --> 00:08:02,400 that's well maintained for you. 222 222 00:08:02,400 --> 00:08:04,200 They do the security patches and everything, 223 223 00:08:04,200 --> 00:08:06,210 but everything on top of the operating system 224 224 00:08:06,210 --> 00:08:07,950 and on top of the programming languages, 225 225 00:08:07,950 --> 00:08:11,250 that's going to be on you to code your specific application. 226 226 00:08:11,250 --> 00:08:13,680 So when you're dealing with platform as a service, 227 227 00:08:13,680 --> 00:08:16,320 what kind of things do you need to consider from security? 228 228 00:08:16,320 --> 00:08:18,660 Well, you need to think about access control. 229 229 00:08:18,660 --> 00:08:20,370 You need to think about load balancing. 230 230 00:08:20,370 --> 00:08:22,800 You need to think about failover and privacy 231 231 00:08:22,800 --> 00:08:24,330 and protection of your data. 232 232 00:08:24,330 --> 00:08:26,490 All of these things are things you have to think about 233 233 00:08:26,490 --> 00:08:28,770 because you're designing the application. 234 234 00:08:28,770 --> 00:08:31,200 And so if you're going to have redundancy and failover, 235 235 00:08:31,200 --> 00:08:33,300 you're going to program that into your application 236 236 00:08:33,300 --> 00:08:35,190 so it knows which servers to point to. 237 237 00:08:35,190 --> 00:08:36,720 That's the idea with PaaS. 238 238 00:08:36,720 --> 00:08:38,370 There is some of that that you're responsible for. 239 239 00:08:38,370 --> 00:08:40,170 The hardware underneath it, you're not, 240 240 00:08:40,170 --> 00:08:41,490 but you do have to do the coding 241 241 00:08:41,490 --> 00:08:43,740 to make sure it knows which hardware to go to. 242 242 00:08:43,740 --> 00:08:45,120 Now, another thing to think about when you're dealing 243 243 00:08:45,120 --> 00:08:47,640 with PaaS, is you should always encrypt your data. 244 244 00:08:47,640 --> 00:08:50,130 A lot of PaaS solutions are third party. 245 245 00:08:50,130 --> 00:08:52,110 So for instance, if you're going to make a website 246 246 00:08:52,110 --> 00:08:54,600 and you decide you're going to run it on WordPress, 247 247 00:08:54,600 --> 00:08:57,030 you can go to a managed WordPress solution. 248 248 00:08:57,030 --> 00:08:58,770 That means you can go to a provider, 249 249 00:08:58,770 --> 00:09:00,300 third-party PaaS solution 250 250 00:09:00,300 --> 00:09:01,530 and they're going to give you a server 251 251 00:09:01,530 --> 00:09:03,750 with WordPress installed and configured 252 252 00:09:03,750 --> 00:09:05,700 and they'll make sure it's always up to date, 253 253 00:09:05,700 --> 00:09:07,320 but then you can put your system 254 254 00:09:07,320 --> 00:09:10,290 on top of that WordPress by designing your own web apps. 255 255 00:09:10,290 --> 00:09:11,190 When you do that, 256 256 00:09:11,190 --> 00:09:13,350 always encrypt that data because it's being stored 257 257 00:09:13,350 --> 00:09:15,150 in this third-party PaaS solution 258 258 00:09:15,150 --> 00:09:17,130 that may be in a database that they're not encrypting 259 259 00:09:17,130 --> 00:09:17,963 'cause you don't have control 260 260 00:09:17,963 --> 00:09:20,340 of the underlying operating system. 261 261 00:09:20,340 --> 00:09:21,570 Now the last thing I want to talk 262 262 00:09:21,570 --> 00:09:24,660 about is the fact that there are many other as a services. 263 263 00:09:24,660 --> 00:09:26,580 Now for the CySA+ exam, 264 264 00:09:26,580 --> 00:09:28,980 you only need to know the three we just talked about, 265 265 00:09:28,980 --> 00:09:30,570 but I think it's also important to talk 266 266 00:09:30,570 --> 00:09:32,610 about security as a service. 267 267 00:09:32,610 --> 00:09:34,020 This provides your organization 268 268 00:09:34,020 --> 00:09:35,940 with various types of security services 269 269 00:09:35,940 --> 00:09:38,550 without the need to maintain a cybersecurity staff. 270 270 00:09:38,550 --> 00:09:41,550 Now, why is it that I'm bringing up security as a service? 271 271 00:09:41,550 --> 00:09:43,380 Well, you're getting certified 272 272 00:09:43,380 --> 00:09:45,180 to be a cybersecurity analyst. 273 273 00:09:45,180 --> 00:09:46,860 Where might you work one day? 274 274 00:09:46,860 --> 00:09:49,290 You might work for security as a service. 275 275 00:09:49,290 --> 00:09:50,430 Now, security as a service 276 276 00:09:50,430 --> 00:09:52,770 can cover a lot of different things. 277 277 00:09:52,770 --> 00:09:55,020 It can do anything that really protects the network. 278 278 00:09:55,020 --> 00:09:56,640 It can include encryption services, 279 279 00:09:56,640 --> 00:09:59,790 incident response services, anti-spam services, 280 280 00:09:59,790 --> 00:10:02,670 anti-malware services, and many other things. 281 281 00:10:02,670 --> 00:10:04,350 When we talk about security as a service, 282 282 00:10:04,350 --> 00:10:06,150 one of the first places it was used 283 283 00:10:06,150 --> 00:10:07,890 was really with anti-malware solutions. 284 284 00:10:07,890 --> 00:10:10,650 They were one of the first security as a service products. 285 285 00:10:10,650 --> 00:10:13,470 Now, as somebody who's going to be in this field, 286 286 00:10:13,470 --> 00:10:14,730 it's important for you to understand 287 287 00:10:14,730 --> 00:10:17,550 what providers do security as a service. 288 288 00:10:17,550 --> 00:10:18,383 Why? 289 289 00:10:18,383 --> 00:10:20,310 Because if you look around and find the different providers 290 290 00:10:20,310 --> 00:10:21,870 who are doing security as a service, 291 291 00:10:21,870 --> 00:10:24,360 that's good places to check if they have job openings 292 292 00:10:24,360 --> 00:10:25,860 and see if you can get a position there 293 293 00:10:25,860 --> 00:10:28,290 because they're always looking for cybersecurity analysts. 294 294 00:10:28,290 --> 00:10:30,900 There's a lot of places do instant response as a service. 295 295 00:10:30,900 --> 00:10:33,330 They do monitoring as a service, logging as a service, 296 296 00:10:33,330 --> 00:10:35,850 and all of this falls under security as a service, 297 297 00:10:35,850 --> 00:10:37,470 so if you work for one of these companies, 298 298 00:10:37,470 --> 00:10:40,470 you can use your newfound skills as a cybersecurity analyst.