1 1 00:00:00,320 --> 00:00:02,020 Security principles. 2 2 00:00:02,020 --> 00:00:03,700 In this lesson, we're going to discuss 3 3 00:00:03,700 --> 00:00:05,410 some of the various security principles 4 4 00:00:05,410 --> 00:00:07,970 that are crucial to securing our networks and systems, 5 5 00:00:07,970 --> 00:00:11,840 including least privilege, access controls, and zero-trust. 6 6 00:00:11,840 --> 00:00:13,650 The first foundational security principle 7 7 00:00:13,650 --> 00:00:16,050 we need to discuss is least privilege. 8 8 00:00:16,050 --> 00:00:17,700 Now, the principle of least privilege 9 9 00:00:17,700 --> 00:00:19,130 is pretty straightforward. 10 10 00:00:19,130 --> 00:00:21,750 It states that whenever the user's performing a job function 11 11 00:00:21,750 --> 00:00:24,090 or an administrative task, they should do that 12 12 00:00:24,090 --> 00:00:26,710 while using the lowest level of permissions or privileges 13 13 00:00:26,710 --> 00:00:29,300 needed in order for them to complete their job. 14 14 00:00:29,300 --> 00:00:31,540 So, as a network or system administrator, 15 15 00:00:31,540 --> 00:00:32,960 if you're going to be able to do a function 16 16 00:00:32,960 --> 00:00:35,150 as a regular user, then you should. 17 17 00:00:35,150 --> 00:00:36,920 Now, if you need to do something as an administrator, 18 18 00:00:36,920 --> 00:00:39,000 then you need to log in as an administrator. 19 19 00:00:39,000 --> 00:00:41,010 Whenever I log into my computer to check my email, 20 20 00:00:41,010 --> 00:00:43,880 for example, I'm going to do that using my user account, 21 21 00:00:43,880 --> 00:00:46,010 which has no administrative permissions 22 22 00:00:46,010 --> 00:00:48,200 but if I need to install a piece of software 23 23 00:00:48,200 --> 00:00:50,180 or change some kind of configuration setting, 24 24 00:00:50,180 --> 00:00:53,250 then I'm going to log in as the root or administrative user, 25 25 00:00:53,250 --> 00:00:55,830 so that I have all the accesses and permissions that I need 26 26 00:00:55,830 --> 00:00:57,470 to make those changes. 27 27 00:00:57,470 --> 00:00:58,970 This principle of least privilege 28 28 00:00:58,970 --> 00:01:01,260 extends past the different types of accounts we use 29 29 00:01:01,260 --> 00:01:02,530 with our giving users. 30 30 00:01:02,530 --> 00:01:03,770 It also applies to things 31 31 00:01:03,770 --> 00:01:05,760 like designing our systems and networks 32 32 00:01:05,760 --> 00:01:07,000 because we need to design them 33 33 00:01:07,000 --> 00:01:09,590 with the concept of least privilege in mind as well. 34 34 00:01:09,590 --> 00:01:11,140 For example, if you're installing 35 35 00:01:11,140 --> 00:01:12,850 some new Internet of Things devices, 36 36 00:01:12,850 --> 00:01:15,110 like led lights that are going to connect to your network 37 37 00:01:15,110 --> 00:01:17,620 and allow them to be remotely controlled through automation, 38 38 00:01:17,620 --> 00:01:19,600 you also need to make sure you're using the principle 39 39 00:01:19,600 --> 00:01:21,530 of least privilege here as well. 40 40 00:01:21,530 --> 00:01:24,180 Should these IoT devices have access to every system 41 41 00:01:24,180 --> 00:01:25,490 or service on your network? 42 42 00:01:25,490 --> 00:01:26,660 Of course not. 43 43 00:01:26,660 --> 00:01:28,550 Instead, these devices likely 44 44 00:01:28,550 --> 00:01:30,590 only need to have one or two ports open, 45 45 00:01:30,590 --> 00:01:31,960 that way they can communicate 46 46 00:01:31,960 --> 00:01:33,880 and they may need to have access to the internet 47 47 00:01:33,880 --> 00:01:35,250 to receive firmware updates. 48 48 00:01:35,250 --> 00:01:36,620 And that's okay too 49 49 00:01:36,620 --> 00:01:39,400 but they shouldn't have access to any of your file servers, 50 50 00:01:39,400 --> 00:01:41,140 your web servers, or your printers. 51 51 00:01:41,140 --> 00:01:43,610 So, using the principle of least privilege, 52 52 00:01:43,610 --> 00:01:45,150 we can isolate these devices 53 53 00:01:45,150 --> 00:01:47,440 into their own screen subnet or VLAN 54 54 00:01:47,440 --> 00:01:49,330 and then we can tightly control access 55 55 00:01:49,330 --> 00:01:51,110 into and out of that VLAN 56 56 00:01:51,110 --> 00:01:53,460 to ensure that only those users and applications 57 57 00:01:53,460 --> 00:01:54,540 that have an absolute need 58 58 00:01:54,540 --> 00:01:57,600 to communicate with these IoT devices, can. 59 59 00:01:57,600 --> 00:01:59,530 Now, the second foundational security principle 60 60 00:01:59,530 --> 00:02:02,720 we need to cover is known as role-based access. 61 61 00:02:02,720 --> 00:02:03,720 There are several methods 62 62 00:02:03,720 --> 00:02:05,640 of conducting access control in the network, 63 63 00:02:05,640 --> 00:02:08,180 such as DAC, MAC, and RBAC. 64 64 00:02:08,180 --> 00:02:10,370 DAC, or discretionary access control, 65 65 00:02:10,370 --> 00:02:11,930 is an access control method 66 66 00:02:11,930 --> 00:02:15,030 where access is determined by the owner of that resource. 67 67 00:02:15,030 --> 00:02:16,530 This is discretionary. 68 68 00:02:16,530 --> 00:02:19,050 So for every file or folder on your ShareDrive, 69 69 00:02:19,050 --> 00:02:21,620 the owner who created it will assign the permission levels 70 70 00:02:21,620 --> 00:02:23,410 to other users on the system. 71 71 00:02:23,410 --> 00:02:25,860 The owner is going to be the one who decides who can read, 72 72 00:02:25,860 --> 00:02:28,100 write, and run these different types of files 73 73 00:02:28,100 --> 00:02:29,760 on that file server. 74 74 00:02:29,760 --> 00:02:32,130 Discretionary access control is commonly used 75 75 00:02:32,130 --> 00:02:34,150 because you have very granular control 76 76 00:02:34,150 --> 00:02:36,260 to be able to decide who has access to things 77 77 00:02:36,260 --> 00:02:37,800 that a user has created. 78 78 00:02:37,800 --> 00:02:40,280 And because the person who created it makes those decisions, 79 79 00:02:40,280 --> 00:02:42,860 they are the most knowledgeable on this area. 80 80 00:02:42,860 --> 00:02:45,640 There are two big challenges though, when you use DAC. 81 81 00:02:45,640 --> 00:02:47,970 The first is that every object on the system 82 82 00:02:47,970 --> 00:02:50,480 has to have an owner, because if there's no owner, 83 83 00:02:50,480 --> 00:02:53,280 then nobody would know who has the right permissions to it 84 84 00:02:53,280 --> 00:02:55,910 because the owner is the one who sets those permissions. 85 85 00:02:55,910 --> 00:02:57,930 The second problem is that you need to make sure 86 86 00:02:57,930 --> 00:03:00,740 that each owner determines the access rights and permissions 87 87 00:03:00,740 --> 00:03:02,360 for each of those objects. 88 88 00:03:02,360 --> 00:03:03,830 So, if I'm the owner of a file 89 89 00:03:03,830 --> 00:03:05,480 and I never set permissions on it, 90 90 00:03:05,480 --> 00:03:07,350 this means that nobody's going to have access 91 91 00:03:07,350 --> 00:03:08,900 to be able to read that file. 92 92 00:03:08,900 --> 00:03:11,170 And if I set those permissions too tightly, 93 93 00:03:11,170 --> 00:03:12,750 then I would be keeping people out 94 94 00:03:12,750 --> 00:03:14,510 who may need to have access 95 95 00:03:14,510 --> 00:03:16,490 or if I set them up too loosely, 96 96 00:03:16,490 --> 00:03:17,760 everyone can now access it 97 97 00:03:17,760 --> 00:03:19,410 and read the contents of that file, 98 98 00:03:19,410 --> 00:03:22,030 eliminating my confidentiality and security. 99 99 00:03:22,030 --> 00:03:24,980 So, the owner here really has a lot of control. 100 100 00:03:24,980 --> 00:03:26,740 In corporate or enterprise systems, 101 101 00:03:26,740 --> 00:03:29,030 this can be really dangerous and you have to think about it 102 102 00:03:29,030 --> 00:03:31,370 if you really want to be using a discretionary model 103 103 00:03:31,370 --> 00:03:33,380 or one of our other choices. 104 104 00:03:33,380 --> 00:03:35,710 Now, our second model is what's known as MAC 105 105 00:03:35,710 --> 00:03:37,710 or mandatory access control. 106 106 00:03:37,710 --> 00:03:39,740 MAC goes to the other extreme. 107 107 00:03:39,740 --> 00:03:42,000 With MAC, or mandatory access control, 108 108 00:03:42,000 --> 00:03:44,740 we have an access control policy where the computer system 109 109 00:03:44,740 --> 00:03:47,760 gets to decide who has access to what objects. 110 110 00:03:47,760 --> 00:03:49,920 So, how does the computer do this? 111 111 00:03:49,920 --> 00:03:51,680 Well, with discretionary access control, 112 112 00:03:51,680 --> 00:03:54,660 you, the owner, were able to choose who got permissions 113 113 00:03:54,660 --> 00:03:56,970 but in MAC, the computer's going to do that for you 114 114 00:03:56,970 --> 00:03:59,640 and it does this through data labels. 115 115 00:03:59,640 --> 00:04:02,220 In MAC, data labels are going to create this trust level 116 116 00:04:02,220 --> 00:04:04,250 for all subjects and all objects, 117 117 00:04:04,250 --> 00:04:06,150 so that every person out there gets a label 118 118 00:04:06,150 --> 00:04:08,090 with their associated trust level. 119 119 00:04:08,090 --> 00:04:10,540 If we have a high trust level, a medium trust level, 120 120 00:04:10,540 --> 00:04:12,030 or a low trust level for them, 121 121 00:04:12,030 --> 00:04:14,270 then each data object gets a label as well 122 122 00:04:14,270 --> 00:04:16,530 as either high, medium, or low trust. 123 123 00:04:16,530 --> 00:04:18,100 And then we just compare the labels 124 124 00:04:18,100 --> 00:04:20,830 to determine if somebody should be granted or denied access 125 125 00:04:20,830 --> 00:04:22,420 to a particular object. 126 126 00:04:22,420 --> 00:04:24,550 So, how does this really work in the real world? 127 127 00:04:24,550 --> 00:04:27,200 Well, the most common use of mandatory access control 128 128 00:04:27,200 --> 00:04:28,290 is in the military 129 129 00:04:28,290 --> 00:04:30,800 and they'd use this with their high security systems. 130 130 00:04:30,800 --> 00:04:32,240 So, if you've ever seen a war movie 131 131 00:04:32,240 --> 00:04:33,440 at any time in your life, 132 132 00:04:33,440 --> 00:04:35,140 you've probably seen the words "Top Secret" 133 133 00:04:35,140 --> 00:04:36,540 on some kind of document. 134 134 00:04:36,540 --> 00:04:38,760 Well, there's really four levels of documentation 135 135 00:04:38,760 --> 00:04:40,550 inside the military context. 136 136 00:04:40,550 --> 00:04:42,570 They have unclassified, confidential, 137 137 00:04:42,570 --> 00:04:44,600 secret, and top secret levels. 138 138 00:04:44,600 --> 00:04:45,920 Now, each person in the military 139 139 00:04:45,920 --> 00:04:47,630 is also assigned a clearance level 140 140 00:04:47,630 --> 00:04:49,500 that tells them what they're allowed to see. 141 141 00:04:49,500 --> 00:04:50,780 So, maybe the private 142 142 00:04:50,780 --> 00:04:52,740 only gets to see confidential information 143 143 00:04:52,740 --> 00:04:55,150 but the Colonel gets to see top secret information 144 144 00:04:55,150 --> 00:04:57,390 and the captain only gets to see secret information. 145 145 00:04:57,390 --> 00:04:58,410 And so on. 146 146 00:04:58,410 --> 00:05:01,180 Now, each person here has a label associated with them. 147 147 00:05:01,180 --> 00:05:02,400 This is their clearance 148 148 00:05:02,400 --> 00:05:04,980 and this also gets associated with their account. 149 149 00:05:04,980 --> 00:05:07,210 Now, all of the documents are also going to be labeled 150 150 00:05:07,210 --> 00:05:08,680 with whatever they're classified as. 151 151 00:05:08,680 --> 00:05:10,650 So they're either unclassified, confidential, 152 152 00:05:10,650 --> 00:05:12,300 secret, or top secret. 153 153 00:05:12,300 --> 00:05:14,520 Now, when a person wants to read a document, 154 154 00:05:14,520 --> 00:05:16,620 their label of their user account 155 155 00:05:16,620 --> 00:05:18,660 is going to be checked against the documents label. 156 156 00:05:18,660 --> 00:05:19,493 If your label 157 157 00:05:19,493 --> 00:05:21,830 is at or above the level of that clearance document, 158 158 00:05:21,830 --> 00:05:23,080 you're going to be able to read it. 159 159 00:05:23,080 --> 00:05:25,380 If not, you're going to be denied access. 160 160 00:05:25,380 --> 00:05:26,650 Now, this makes a lot of sense 161 161 00:05:26,650 --> 00:05:28,610 because if you have a top secret clearance, 162 162 00:05:28,610 --> 00:05:30,530 you should be able to read top secret documents 163 163 00:05:30,530 --> 00:05:33,030 but you should also be able to read secret, confidential, 164 164 00:05:33,030 --> 00:05:34,420 and unclassified documents 165 165 00:05:34,420 --> 00:05:37,580 because top secret is a higher level than these other three. 166 166 00:05:37,580 --> 00:05:39,360 But if you have a confidential clearance, 167 167 00:05:39,360 --> 00:05:42,380 you would be denied access to secret and top secret data 168 168 00:05:42,380 --> 00:05:44,110 because those are higher classifications 169 169 00:05:44,110 --> 00:05:45,690 than the clearance you hold. 170 170 00:05:45,690 --> 00:05:47,690 Now in a MAC system, they're going to add 171 171 00:05:47,690 --> 00:05:49,840 another piece of information though, as well. 172 172 00:05:49,840 --> 00:05:51,880 This is that if you want to access something, 173 173 00:05:51,880 --> 00:05:54,040 you need to not just meet the minimum levels for it 174 174 00:05:54,040 --> 00:05:57,370 but you also need to have what's known as a need-to-know. 175 175 00:05:57,370 --> 00:06:00,130 So, for example, let's say we have two military members. 176 176 00:06:00,130 --> 00:06:02,090 We have an army person and a Navy person, 177 177 00:06:02,090 --> 00:06:04,140 and they both have a top secret clearance. 178 178 00:06:04,140 --> 00:06:05,580 Now, I have this particular document 179 179 00:06:05,580 --> 00:06:07,260 that's about a Navy operation. 180 180 00:06:07,260 --> 00:06:08,860 In this case, the army guy 181 181 00:06:08,860 --> 00:06:10,740 doesn't need to know about what's going on there 182 182 00:06:10,740 --> 00:06:12,060 because he's not in the Navy 183 183 00:06:12,060 --> 00:06:14,160 and doesn't need to have access to this information. 184 184 00:06:14,160 --> 00:06:15,940 He doesn't have a need-to-know. 185 185 00:06:15,940 --> 00:06:18,340 So even though he has the clearance level of top secret, 186 186 00:06:18,340 --> 00:06:19,680 he doesn't have a need-to-know 187 187 00:06:19,680 --> 00:06:21,970 and therefore, he shouldn't have access. 188 188 00:06:21,970 --> 00:06:24,740 Now, with MAC, these labels can be very in-depth 189 189 00:06:24,740 --> 00:06:26,910 and they can get very, very complicated. 190 190 00:06:26,910 --> 00:06:30,100 This is why MAC is not used in most enterprise networks 191 191 00:06:30,100 --> 00:06:32,450 and is reserved only for highly classified information 192 192 00:06:32,450 --> 00:06:34,240 within military systems. 193 193 00:06:34,240 --> 00:06:35,850 Now the third type of access we have 194 194 00:06:35,850 --> 00:06:39,110 is known as RBAC or role-based access control. 195 195 00:06:39,110 --> 00:06:41,760 Now, role-based access control is an access model 196 196 00:06:41,760 --> 00:06:44,100 that's controlled by the system like MAC 197 197 00:06:44,100 --> 00:06:45,890 but instead of using labels, 198 198 00:06:45,890 --> 00:06:47,740 it's going to focus on a set of permissions 199 199 00:06:47,740 --> 00:06:49,840 instead of an individual's permissions. 200 200 00:06:49,840 --> 00:06:51,210 Now, we don't have to actually label 201 201 00:06:51,210 --> 00:06:53,950 each individual person on every single file, 202 202 00:06:53,950 --> 00:06:56,650 instead, we're going to assign roles to these files 203 203 00:06:56,650 --> 00:06:58,810 and then we're going to assign roles to these people. 204 204 00:06:58,810 --> 00:06:59,990 The way I like to think about this 205 205 00:06:59,990 --> 00:07:02,400 is that we create roles for each job function 206 206 00:07:02,400 --> 00:07:05,020 and then we assign roles for each person's permissions 207 207 00:07:05,020 --> 00:07:06,750 to that particular object. 208 208 00:07:06,750 --> 00:07:09,170 For example, let's say you go into your company 209 209 00:07:09,170 --> 00:07:11,660 and there's a sales department, a human resource department, 210 210 00:07:11,660 --> 00:07:12,930 and an IT department. 211 211 00:07:12,930 --> 00:07:15,270 Now, we have these three departments sitting here. 212 212 00:07:15,270 --> 00:07:16,860 Do the salespeople need to have access 213 213 00:07:16,860 --> 00:07:18,850 to the human resources people's files? 214 214 00:07:18,850 --> 00:07:19,890 Probably not. 215 215 00:07:19,890 --> 00:07:21,270 Now, does the human resource people 216 216 00:07:21,270 --> 00:07:23,350 need to have access to the salespeople's files? 217 217 00:07:23,350 --> 00:07:25,020 Probably not again, right? 218 218 00:07:25,020 --> 00:07:27,970 Does the IT person need to have access to everybody's file? 219 219 00:07:27,970 --> 00:07:30,060 Probably, if they're going to be doing all the data backups 220 220 00:07:30,060 --> 00:07:32,020 and maintenance and things like that, right? 221 221 00:07:32,020 --> 00:07:33,700 So, essentially, what we're going to do 222 222 00:07:33,700 --> 00:07:35,170 is create these different groups 223 223 00:07:35,170 --> 00:07:37,570 and then these groups are going to get a set of permissions 224 224 00:07:37,570 --> 00:07:38,740 and those are going to be applied 225 225 00:07:38,740 --> 00:07:40,450 to the different files and folders. 226 226 00:07:40,450 --> 00:07:43,260 When we do this, we add or remove people into the roles, 227 227 00:07:43,260 --> 00:07:45,540 instead of onto those particular files. 228 228 00:07:45,540 --> 00:07:47,570 By using role-based access controls, 229 229 00:07:47,570 --> 00:07:49,340 we are going to be using a best practice 230 230 00:07:49,340 --> 00:07:51,510 inside of the cybersecurity industry. 231 231 00:07:51,510 --> 00:07:53,500 Now, if I have a file on the ShareDrive 232 232 00:07:53,500 --> 00:07:55,930 and you see that Jason was added to it individually, 233 233 00:07:55,930 --> 00:07:57,940 you would flag this as a bad practice 234 234 00:07:57,940 --> 00:08:00,160 because we're not using role-based access 235 235 00:08:00,160 --> 00:08:02,930 and instead, we're using discretionary access control. 236 236 00:08:02,930 --> 00:08:04,760 Now in role-based access control, 237 237 00:08:04,760 --> 00:08:06,450 we're instead going to have an owners group 238 238 00:08:06,450 --> 00:08:08,210 instead of an individual person. 239 239 00:08:08,210 --> 00:08:09,750 We're also going to have an admin group 240 240 00:08:09,750 --> 00:08:11,150 and we're going to have an IT group, 241 241 00:08:11,150 --> 00:08:12,190 and we're going to have a sales group. 242 242 00:08:12,190 --> 00:08:13,130 And we're going to put all the people 243 243 00:08:13,130 --> 00:08:15,710 who have the same type of job in the same functions 244 244 00:08:15,710 --> 00:08:17,340 into the same type of group. 245 245 00:08:17,340 --> 00:08:19,670 This makes it much easier to control our permissions 246 246 00:08:19,670 --> 00:08:21,570 based on the concept of least privilege 247 247 00:08:21,570 --> 00:08:23,630 because we're relating it to the permissions required 248 248 00:08:23,630 --> 00:08:25,580 to actually do your job. 249 249 00:08:25,580 --> 00:08:27,900 Always ask yourself, what is the role of the person 250 250 00:08:27,900 --> 00:08:29,580 that is going to be using this file? 251 251 00:08:29,580 --> 00:08:31,770 Based on that, assign them to the right group 252 252 00:08:31,770 --> 00:08:32,860 with the right permissions 253 253 00:08:32,860 --> 00:08:36,080 that are going to do that thing using those job functions. 254 254 00:08:36,080 --> 00:08:37,770 Let me give you a great example of this. 255 255 00:08:37,770 --> 00:08:40,030 There is a role-based group called power users 256 256 00:08:40,030 --> 00:08:41,800 inside of a Windows system. 257 257 00:08:41,800 --> 00:08:44,360 Now, power users are people who aren't a normal user 258 258 00:08:44,360 --> 00:08:46,830 but they're also not a normal administrator either, 259 259 00:08:46,830 --> 00:08:48,060 they're somewhere in the middle. 260 260 00:08:48,060 --> 00:08:50,310 For example, an administrator might have full access 261 261 00:08:50,310 --> 00:08:51,950 to do whatever they want on a system, 262 262 00:08:51,950 --> 00:08:53,820 whereas a user might only be able to operate 263 263 00:08:53,820 --> 00:08:55,410 the programs that currently exist 264 264 00:08:55,410 --> 00:08:57,240 but they can't make configuration changes, 265 265 00:08:57,240 --> 00:08:59,340 like changing the time or adding a printer. 266 266 00:08:59,340 --> 00:09:01,960 Well, a power user has a little bit more permissions 267 267 00:09:01,960 --> 00:09:02,980 than a regular user 268 268 00:09:02,980 --> 00:09:04,650 and they can do things like changing the time 269 269 00:09:04,650 --> 00:09:06,230 or adding a printer to the network 270 270 00:09:06,230 --> 00:09:08,410 but they don't have full administrative rights, 271 271 00:09:08,410 --> 00:09:09,960 like an administrator would. 272 272 00:09:09,960 --> 00:09:11,510 So, we could put different users 273 273 00:09:11,510 --> 00:09:13,070 into that power users group 274 274 00:09:13,070 --> 00:09:15,050 and they be able to inherit those permissions 275 275 00:09:15,050 --> 00:09:17,420 and be able to do just those functions that are necessary 276 276 00:09:17,420 --> 00:09:18,750 to add things like printers 277 277 00:09:18,750 --> 00:09:21,610 or make minor system changes like the time. 278 278 00:09:21,610 --> 00:09:23,510 Now our third foundational security principle 279 279 00:09:23,510 --> 00:09:26,140 we have to talk about is known as zero-trust. 280 280 00:09:26,140 --> 00:09:29,290 Zero-trust is a security framework that requires all users, 281 281 00:09:29,290 --> 00:09:31,540 whether in or outside of the organization, 282 282 00:09:31,540 --> 00:09:34,670 to be authenticated, authorized, and continuously validated 283 283 00:09:34,670 --> 00:09:36,820 for security configuration and posture 284 284 00:09:36,820 --> 00:09:38,970 before being granted or keeping access 285 285 00:09:38,970 --> 00:09:40,840 to applications and data. 286 286 00:09:40,840 --> 00:09:43,260 As we continue to try to combat threats to our networks 287 287 00:09:43,260 --> 00:09:44,093 and our systems 288 288 00:09:44,093 --> 00:09:46,060 from the de-perimeterization of our networks, 289 289 00:09:46,060 --> 00:09:48,160 zero trust is becoming more widespread 290 290 00:09:48,160 --> 00:09:50,610 and adopted by a ton of organizations. 291 291 00:09:50,610 --> 00:09:52,020 Unlike our traditional networks 292 292 00:09:52,020 --> 00:09:54,030 where we used to have very clearly defined edges, 293 293 00:09:54,030 --> 00:09:56,100 like the border router or the firewall, 294 294 00:09:56,100 --> 00:09:58,870 these days, those edges have become very blurred 295 295 00:09:58,870 --> 00:10:01,620 by the on-premise and cloud-based hybrid architectures 296 296 00:10:01,620 --> 00:10:04,020 and the increased adoption of bring your own devices 297 297 00:10:04,020 --> 00:10:06,500 for mobile device connectivity on the go. 298 298 00:10:06,500 --> 00:10:08,640 Due to this, zero-trust is going to assume 299 299 00:10:08,640 --> 00:10:10,600 that there is no traditional network edge 300 300 00:10:10,600 --> 00:10:12,620 and that workers could be accessing the network 301 301 00:10:12,620 --> 00:10:15,520 from anywhere, at any time, using any device. 302 302 00:10:15,520 --> 00:10:18,340 And therefore, no trust can exist. 303 303 00:10:18,340 --> 00:10:20,630 To apply zero-trust to your networks and systems, 304 304 00:10:20,630 --> 00:10:22,840 you need to follow four key principles. 305 305 00:10:22,840 --> 00:10:25,800 First, re-examine all default access controls. 306 306 00:10:25,800 --> 00:10:27,320 This means that there is no such thing 307 307 00:10:27,320 --> 00:10:29,100 as a trusted device or source 308 308 00:10:29,100 --> 00:10:31,100 because anyone in the network could be a threat 309 309 00:10:31,100 --> 00:10:32,740 and therefore, they have to be validated 310 310 00:10:32,740 --> 00:10:34,860 and re-validated continually. 311 311 00:10:34,860 --> 00:10:37,570 Second, employ a variety of prevention techniques 312 312 00:10:37,570 --> 00:10:38,890 and defense in depth. 313 313 00:10:38,890 --> 00:10:41,390 This includes things like multi-factor authentication, 314 314 00:10:41,390 --> 00:10:43,680 data loss prevention, micro-segmentation, 315 315 00:10:43,680 --> 00:10:45,920 and least access privilege assignment. 316 316 00:10:45,920 --> 00:10:48,510 Third, enable real-time monitoring and controls 317 317 00:10:48,510 --> 00:10:51,280 to identify and stop malicious activity quickly. 318 318 00:10:51,280 --> 00:10:53,240 Since incidents can occur at any time, 319 319 00:10:53,240 --> 00:10:54,870 it's important to ensure that your organization 320 320 00:10:54,870 --> 00:10:56,700 is actively monitoring its security 321 321 00:10:56,700 --> 00:10:59,700 through the use of seams and real-time devices. 322 322 00:10:59,700 --> 00:11:02,590 And forth, ensure your network's zero-trust architecture 323 323 00:11:02,590 --> 00:11:04,950 aligns to your broader security strategy. 324 324 00:11:04,950 --> 00:11:07,150 Your company needs to be continually retiring 325 325 00:11:07,150 --> 00:11:09,580 older technologies that could leave you vulnerable 326 326 00:11:09,580 --> 00:11:12,090 and instead, increase its resilience and reliance 327 327 00:11:12,090 --> 00:11:14,580 on endpoint monitoring, detection and response 328 328 00:11:14,580 --> 00:11:17,323 to quickly identify and respond to future incidents.