-: Security principles. 2 2
In this lesson, we're going to discuss 3 3
some of the various security principles 4 4
that are crucial to securing our networks and systems, 5 5
including least privilege, access controls, and zero-trust. 6 6
The first foundational security principle 7 7
we need to discuss is least privilege. 8 8
Now, the principle of least privilege 9 9
is pretty straightforward. 10 10
It states that whenever the user's performing a job function 11 11
or an administrative task, they should do that 12 12
while using the lowest level of permissions or privileges 13 13
needed in order for them to complete their job. 14 14
So, as a network or system administrator, 15 15
if you're going to be able to do a function 16 16
as a regular user, then you should. 17 17
Now, if you need to do something as an administrator, 18 18
then you need to log in as an administrator. 19 19
Whenever I log into my computer to check my email, 20 20
for example, I'm going to do that using my user account, 21 21
which has no administrative permissions 22 22
but if I need to install a piece of software 23 23
or change some kind of configuration setting, 24 24
then I'm going to log in as the root or administrative user, 25 25
so that I have all the accesses and permissions that I need 26 26
to make those changes. 27 27
This principle of least privilege 28 28
extends past the different types of accounts we use 29 29
with our giving users. 30 30
It also applies to things 31 31
like designing our systems and networks 32 32
because we need to design them 33 33
with the concept of least privilege in mind as well. 34 34
For example, if you're installing 35 35
some new Internet of Things devices, 36 36
like led lights that are going to connect to your network 37 37
and allow them to be remotely controlled through automation, 38 38
you also need to make sure you're using the principle 39 39
of least privilege here as well. 40 40
Should these IoT devices have access to every system 41 41
or service on your network? 42 42
Of course not. 43 43
Instead, these devices likely 44 44
only need to have one or two ports open, 45 45
that way they can communicate 46 46
and they may need to have access to the internet 47 47
to receive firmware updates. 48 48
And that's okay too 49 49
but they shouldn't have access to any of your file servers, 50 50
your web servers, or your printers. 51 51
So, using the principle of least privilege, 52 52
we can isolate these devices 53 53
into their own screen subnet or VLAN 54 54
and then we can tightly control access 55 55
into and out of that VLAN 56 56
to ensure that only those users and applications 57 57
that have an absolute need 58 58
to communicate with these IoT devices, can. 59 59
Now, the second foundational security principle 60 60
we need to cover is known as role-based access. 61 61
There are several methods 62 62
of conducting access control in the network, 63 63
such as DAC, MAC, and RBAC. 64 64
DAC, or discretionary access control, 65 65
is an access control method 66 66
where access is determined by the owner of that resource. 67 67
This is discretionary. 68 68
So for every file or folder on your ShareDrive, 69 69
the owner who created it will assign the permission levels 70 70
to other users on the system. 71 71
The owner is going to be the one who decides who can read, 72 72
write, and run these different types of files 73 73
on that file server. 74 74
Discretionary access control is commonly used 75 75
because you have very granular control 76 76
to be able to decide who has access to things 77 77
that a user has created. 78 78
And because the person who created it makes those decisions, 79 79
they are the most knowledgeable on this area. 80 80
There are two big challenges though, when you use DAC. 81 81
The first is that every object on the system 82 82
has to have an owner, because if there's no owner, 83 83
then nobody would know who has the right permissions to it 84 84
because the owner is the one who sets those permissions. 85 85
The second problem is that you need to make sure 86 86
that each owner determines the access rights and permissions 87 87
for each of those objects. 88 88
So, if I'm the owner of a file 89 89
and I never set permissions on it, 90 90
this means that nobody's going to have access 91 91
to be able to read that file. 92 92
And if I set those permissions too tightly, 93 93
then I would be keeping people out 94 94
who may need to have access 95 95
or if I set them up too loosely, 96 96
everyone can now access it 97 97
and read the contents of that file, 98 98
eliminating my confidentiality and security. 99 99
So, the owner here really has a lot of control. 100 100
In corporate or enterprise systems, 101 101
this can be really dangerous and you have to think about it 102 102
if you really want to be using a discretionary model 103 103
or one of our other choices. 104 104
Now, our second model is what's known as MAC 105 105
or mandatory access control. 106 106
MAC goes to the other extreme. 107 107
With MAC, or mandatory access control, 108 108
we have an access control policy where the computer system 109 109
gets to decide who has access to what objects. 110 110
So, how does the computer do this? 111 111
Well, with discretionary access control, 112 112
you, the owner, were able to choose who got permissions 113 113
but in MAC, the computer's going to do that for you 114 114
and it does this through data labels. 115 115
In MAC, data labels are going to create this trust level 116 116
for all subjects and all objects, 117 117
so that every person out there gets a label 118 118
with their associated trust level. 119 119
If we have a high trust level, a medium trust level, 120 120
or a low trust level for them, 121 121
then each data object gets a label as well 122 122
as either high, medium, or low trust. 123 123
And then we just compare the labels 124 124
to determine if somebody should be granted or denied access 125 125
to a particular object. 126 126
So, how does this really work in the real world? 127 127
Well, the most common use of mandatory access control 128 128
is in the military 129 129
and they'd use this with their high security systems. 130 130
So, if you've ever seen a war movie 131 131
at any time in your life, 132 132
you've probably seen the words "Top Secret" 133 133
on some kind of document. 134 134
Well, there's really four levels of documentation 135 135
inside the military context. 136 136
They have unclassified, confidential, 137 137
secret, and top secret levels. 138 138
Now, each person in the military 139 139
is also assigned a clearance level 140 140
that tells them what they're allowed to see. 141 141
So, maybe the private 142 142
only gets to see confidential information 143 143
but the Colonel gets to see top secret information 144 144
and the captain only gets to see secret information. 145 145
And so on. 146 146
Now, each person here has a label associated with them. 147 147
This is their clearance 148 148
and this also gets associated with their account. 149 149
Now, all of the documents are also going to be labeled 150 150
with whatever they're classified as. 151 151
So they're either unclassified, confidential, 152 152
secret, or top secret. 153 153
Now, when a person wants to read a document, 154 154
their label of their user account 155 155
is going to be checked against the documents label. 156 156
If your label 157 157
is at or above the level of that clearance document, 158 158
you're going to be able to read it. 159 159
If not, you're going to be denied access. 160 160
Now, this makes a lot of sense 161 161
because if you have a top secret clearance, 162 162
you should be able to read top secret documents 163 163
but you should also be able to read secret, confidential, 164 164
and unclassified documents 165 165
because top secret is a higher level than these other three. 166 166
But if you have a confidential clearance, 167 167
you would be denied access to secret and top secret data 168 168
because those are higher classifications 169 169
than the clearance you hold. 170 170
Now in a MAC system, they're going to add 171 171
another piece of information though, as well. 172 172
This is that if you want to access something, 173 173
you need to not just meet the minimum levels for it 174 174
but you also need to have what's known as a need-to-know. 175 175
So, for example, let's say we have two military members. 176 176
We have an army person and a Navy person, 177 177
and they both have a top secret clearance. 178 178
Now, I have this particular document 179 179
that's about a Navy operation. 180 180
In this case, the army guy 181 181
doesn't need to know about what's going on there 182 182
because he's not in the Navy 183 183
and doesn't need to have access to this information. 184 184
He doesn't have a need-to-know. 185 185
So even though he has the clearance level of top secret, 186 186
he doesn't have a need-to-know 187 187
and therefore, he shouldn't have access. 188 188
Now, with MAC, these labels can be very in-depth 189 189
and they can get very, very complicated. 190 190
This is why MAC is not used in most enterprise networks 191 191
and is reserved only for highly classified information 192 192
within military systems. 193 193
Now the third type of access we have 194 194
is known as RBAC or role-based access control. 195 195
Now, role-based access control is an access model 196 196
that's controlled by the system like MAC 197 197
but instead of using labels, 198 198
it's going to focus on a set of permissions 199 199
instead of an individual's permissions. 200 200
Now, we don't have to actually label 201 201
each individual person on every single file, 202 202
instead, we're going to assign roles to these files 203 203
and then we're going to assign roles to these people. 204 204
The way I like to think about this 205 205
is that we create roles for each job function 206 206
and then we assign roles for each person's permissions 207 207
to that particular object. 208 208
For example, let's say you go into your company 209 209
and there's a sales department, a human resource department, 210 210
and an IT department. 211 211
Now, we have these three departments sitting here. 212 212
Do the salespeople need to have access 213 213
to the human resources people's files? 214 214
Probably not. 215 215
Now, does the human resource people 216 216
need to have access to the salespeople's files? 217 217
Probably not again, right? 218 218
Does the IT person need to have access to everybody's file? 219 219
Probably, if they're going to be doing all the data backups 220 220
and maintenance and things like that, right? 221 221
So, essentially, what we're going to do 222 222
is create these different groups 223 223
and then these groups are going to get a set of permissions 224 224
and those are going to be applied 225 225
to the different files and folders. 226 226
When we do this, we add or remove people into the roles, 227 227
instead of onto those particular files. 228 228
By using role-based access controls, 229 229
we are going to be using a best practice 230 230
inside of the cybersecurity industry. 231 231
Now, if I have a file on the ShareDrive 232 232
and you see that Jason was added to it individually, 233 233
you would flag this as a bad practice 234 234
because we're not using role-based access 235 235
and instead, we're using discretionary access control. 236 236
Now in role-based access control, 237 237
we're instead going to have an owners group 238 238
instead of an individual person. 239 239
We're also going to have an admin group 240 240
and we're going to have an IT group, 241 241
and we're going to have a sales group. 242 242
And we're going to put all the people 243 243
who have the same type of job in the same functions 244 244
into the same type of group. 245 245
This makes it much easier to control our permissions 246 246
based on the concept of least privilege 247 247
because we're relating it to the permissions required 248 248
to actually do your job. 249 249
Always ask yourself, what is the role of the person 250 250
that is going to be using this file? 251 251
Based on that, assign them to the right group 252 252
with the right permissions 253 253
that are going to do that thing using those job functions. 254 254
Let me give you a great example of this. 255 255
There is a role-based group called power users 256 256
inside of a Windows system. 257 257
Now, power users are people who aren't a normal user 258 258
but they're also not a normal administrator either, 259 259
they're somewhere in the middle. 260 260
For example, an administrator might have full access 261 261
to do whatever they want on a system, 262 262
whereas a user might only be able to operate 263 263
the programs that currently exist 264 264
but they can't make configuration changes, 265 265
like changing the time or adding a printer. 266 266
Well, a power user has a little bit more permissions 267 267
than a regular user 268 268
and they can do things like changing the time 269 269
or adding a printer to the network 270 270
but they don't have full administrative rights, 271 271
like an administrator would. 272 272
So, we could put different users 273 273
into that power users group 274 274
and they be able to inherit those permissions 275 275
and be able to do just those functions that are necessary 276 276
to add things like printers 277 277
or make minor system changes like the time. 278 278
Now our third foundational security principle 279 279
we have to talk about is known as zero-trust. 280 280
Zero-trust is a security framework that requires all users, 281 281
whether in or outside of the organization, 282 282
to be authenticated, authorized, and continuously validated 283 283
for security configuration and posture 284 284
before being granted or keeping access 285 285
to applications and data. 286 286
As we continue to try to combat threats to our networks 287 287
and our systems 288 288
from the de-perimeterization of our networks, 289 289
zero trust is becoming more widespread 290 290
and adopted by a ton of organizations. 291 291
Unlike our traditional networks 292 292
where we used to have very clearly defined edges, 293 293
like the border router or the firewall, 294 294
these days, those edges have become very blurred 295 295
by the on-premise and cloud-based hybrid architectures 296 296
and the increased adoption of bring your own devices 297 297
for mobile device connectivity on the go. 298 298
Due to this, zero-trust is going to assume 299 299
that there is no traditional network edge 300 300
and that workers could be accessing the network 301 301
from anywhere, at any time, using any device. 302 302
And therefore, no trust can exist. 303 303
To apply zero-trust to your networks and systems, 304 304
you need to follow four key principles. 305 305
First, re-examine all default access controls. 306 306
This means that there is no such thing 307 307
as a trusted device or source 308 308
because anyone in the network could be a threat 309 309
and therefore, they have to be validated 310 310
and re-validated continually. 311 311
Second, employ a variety of prevention techniques 312 312
and defense in depth. 313 313
This includes things like multi-factor authentication, 314 314
data loss prevention, micro-segmentation, 315 315
and least access privilege assignment. 316 316
Third, enable real-time monitoring and controls 317 317
to identify and stop malicious activity quickly. 318 318
Since incidents can occur at any time, 319 319
it's important to ensure that your organization 320 320
is actively monitoring its security 321 321
through the use of seams and real-time devices. 322 322
And forth, ensure your network's zero-trust architecture 323 323
aligns to your broader security strategy. 324 324
Your company needs to be continually retiring 325 325
older technologies that could leave you vulnerable 326 326
and instead, increase its resilience and reliance 327 327
on endpoint monitoring, detection and response 328 328
to quickly identify and respond to future incidents.