1.31 - Intro To Ethical Hacking - Security Controls

1
00:00:06,912 --> 00:00:09,472

You're watching
2
00:00:12,032 --> 00:00:16,384
Why do they give watching IP Pro TV and powering the world to
engaging learning
3
00:00:16,640 --> 00:00:19,456
I mean hozak Meadows for this episode of ceh v10
4
00:00:19,712 --> 00:00:23,808
This episode Internet Security controls
5
00:00:24,064 --> 00:00:26,624
Let me say that again just so we get the full gist of
it
6
00:00:27,392 --> 00:00:33,536
Intruder ethical hacking security controls and bring us
information we need your expert in the field and Studios and everywhere
7
00:00:34,304 --> 00:00:40,448
Daniel Lowery Daniel
8
00:00:41,472 --> 00:00:41,984
Joining us
9
00:00:42,240 --> 00:00:45,568
Hopefully you are ready to digest a large chunk
10
00:00:45,824 --> 00:00:49,920
Of the intro to ethical hacking because it is a large portion
of that
11
00:00:50,176 --> 00:00:51,712
Domain for the exam
12
00:00:52,224 --> 00:00:54,272
So this will be a multi-part or it's going to fix
13
00:00:55,040 --> 00:00:56,576
Get through all the nuance
14
00:00:56,832 --> 00:00:58,112
Book a baby ciss
15
00:00:59,136 --> 00:01:02,720
Right at the beginning of seeing a sandwich should be aware
of a lot of
16
00:01:02,976 --> 00:01:03,488
Security
17
00:01:03,744 --> 00:01:06,304
Angie and things that nature so we got to laugh
18
00:01:09,632 --> 00:01:12,448
These terms definitions we need to be aware of when it
comes
19
00:01:12,704 --> 00:01:18,848
Security control that's a great question because there are
plenty of them we're going to start off with information assurance
20
00:01:21,920 --> 00:01:22,688
Security or infosec
21
00:01:23,456 --> 00:01:23,968
Properly
22
00:01:26,528 --> 00:01:27,040
Is
23
00:01:27,552 --> 00:01:30,112
Actually Beyond sweets extremely similar to infosec
24
00:01:30,624 --> 00:01:32,160
So similar that it's
25
00:01:32,416 --> 00:01:33,952
That's actually kind of a nuance
26
00:01:36,000 --> 00:01:37,792
When I was looking this up
27
00:01:38,816 --> 00:01:41,120
Do the same thing what is it that differentiates
28
00:01:41,376 --> 00:01:43,680
These two things and that's the key that's the thing
29
00:01:43,936 --> 00:01:45,472
The big takeaway you need to take
30
00:01:45,728 --> 00:01:47,520
From this episode
31
00:01:47,776 --> 00:01:51,104
Which is the difference list for the similarity so you get
the idea okay
32
00:01:52,384 --> 00:01:54,432
They are concerned with things like risk assessment
33
00:01:55,200 --> 00:01:56,480
I'm trying to figure out what are the risks
34
00:01:56,736 --> 00:01:58,016
To our companies or systems
35
00:01:58,272 --> 00:01:59,296
Organization
36
00:01:59,808 --> 00:02:01,344
And you know someone so far
37
00:02:01,856 --> 00:02:03,392
Security policy developer
38
00:02:03,904 --> 00:02:05,952
We have to develop okay now we know the risks are
39
00:02:06,208 --> 00:02:09,024
What's developer policy to try to help ourselves
40
00:02:09,280 --> 00:02:10,816
Stay away from those things are or
41
00:02:11,072 --> 00:02:12,096
Divert them away
42
00:02:12,608 --> 00:02:15,936
Then it is also is concerned with implementation of
43
00:02:16,192 --> 00:02:17,728
Security controls
44
00:02:17,984 --> 00:02:19,776
Security controls are anything that we implement
45
00:02:20,288 --> 00:02:22,592
To that that increases the security of our
46
00:02:23,872 --> 00:02:25,152
That's really easy
47
00:02:26,688 --> 00:02:28,224
I use these terms security
48
00:02:29,248 --> 00:02:30,528
Makes everybody who has a
49
00:02:30,784 --> 00:02:31,552
The PHD sound
50
00:02:33,088 --> 00:02:35,136
Really that's what it boils down to is just the
51
00:02:35,904 --> 00:02:36,416
Security measures
52
00:02:39,232 --> 00:02:43,840
So what are some of the differences Dave right now we got to
move the difference now we see how they're the similar
53
00:02:44,352 --> 00:02:48,448
What makes them one of those nuances that really sets one
apart from the other
54
00:02:48,704 --> 00:02:50,752
Let's start off with
55
00:02:53,568 --> 00:02:56,640
On the risk assessment side and mitigation
56
00:02:57,408 --> 00:03:00,736
Then infosecurity.
57
00:03:00,992 --> 00:03:04,832
Is more concerned with the implementation of security
controls actual
58
00:03:06,624 --> 00:03:08,160
Okay well they both do that
59
00:03:08,928 --> 00:03:12,000
One is more focused on one thing or the other
60
00:03:12,256 --> 00:03:14,048
Okay so I is focus more on
61
00:03:14,304 --> 00:03:15,328
The risk assessment
62
00:03:15,840 --> 00:03:16,864
Mitigation side of things
63
00:03:17,120 --> 00:03:18,144
Infosec
64
00:03:19,424 --> 00:03:19,936
InFocus
65
00:03:20,192 --> 00:03:21,728
On actually implementing
66
00:03:24,288 --> 00:03:24,800
System
67
00:03:25,056 --> 00:03:26,592
Let's see here also
68
00:03:26,848 --> 00:03:30,176
Because I ate heavily influences a Security Management
program
69
00:03:30,432 --> 00:03:33,248
Because of its being very risk assessment Orient
70
00:03:33,760 --> 00:03:36,064
Myself once we start to develop
71
00:03:36,320 --> 00:03:37,088
Our security manager
72
00:03:37,344 --> 00:03:37,856
Program
73
00:03:38,368 --> 00:03:39,392
And how that's going to look
74
00:03:39,648 --> 00:03:43,488
And this is the overarching framework of which will be the
guideline
75
00:03:43,744 --> 00:03:45,280
How we Implement security
76
00:03:47,584 --> 00:03:48,864
Or what have you
77
00:03:49,120 --> 00:03:50,144
Inside of our system
78
00:03:50,656 --> 00:03:52,704
I am so this is going to be our guiding star
79
00:03:52,960 --> 00:03:57,312
Keep us on the straight and narrow to follow the objectives
that we've deemed worthy because
80
00:03:57,568 --> 00:03:58,080
Other risks
81
00:03:58,592 --> 00:03:59,104
That we found
82
00:04:01,920 --> 00:04:05,248
Let's see here in this will Encompass things like
compliance
83
00:04:05,504 --> 00:04:07,296
End-user security awareness
84
00:04:07,552 --> 00:04:09,600
Security policies
85
00:04:10,112 --> 00:04:14,464
For saying in general I also bcdr business continuity and
disaster recovery
86
00:04:14,720 --> 00:04:17,791
All these things will be a part of our Security Management
program
87
00:04:18,559 --> 00:04:24,703
Now I have done this for us I found an example of a current
mostly current Security Management framework
88
00:04:24,959 --> 00:04:27,263
That's been developed by the Australian government
89
00:04:27,519 --> 00:04:30,847
Like I'm going to look up and see if I can find a good
example one pop right away
90
00:04:31,103 --> 00:04:35,967
And we got it right here we can take a look at it in just to
see what they have done so here it is the ismf
91
00:04:36,479 --> 00:04:38,271
Information Security Management framework
92
00:04:38,783 --> 00:04:40,063
The government framework on Severus
93
00:04:40,319 --> 00:04:41,599
Security for the government of South
94
00:04:43,135 --> 00:04:47,231
So and then don't worry that this is like this isn't part of
the exam I just wanted to give you guys
95
00:04:47,743 --> 00:04:49,279
A good example that you can fall
96
00:04:49,535 --> 00:04:51,071
Link to this in the show notes
97
00:04:51,327 --> 00:04:54,143
Follow along and approves this document your Ledger
98
00:04:54,399 --> 00:04:55,423
Start to see
99
00:04:55,935 --> 00:05:02,079
What's going on here first aid coming to find the coverage
here south Australian public authorities required to adhere to this Frame
100
00:05:02,847 --> 00:05:04,383
ISO becomes a regulatory
101
00:05:05,151 --> 00:05:08,479
In the framework of the policies and standards contained
herein are intended for use by
102
00:05:10,783 --> 00:05:12,319
If you move on you start seeing
103
00:05:13,087 --> 00:05:13,599
Terminology
104
00:05:13,855 --> 00:05:17,439
Convention so if you see the words must must not show it
should not or May
105
00:05:17,695 --> 00:05:19,743
Define for you so they're not ambiguous
106
00:05:19,999 --> 00:05:21,279
You don't have any room to move
107
00:05:21,791 --> 00:05:23,583
If they say you should not do this
108
00:05:23,839 --> 00:05:28,191
And you do it once in awhile you are doing it and it doesn't
count right
109
00:05:28,447 --> 00:05:31,263
So should not not recommended
110
00:05:31,519 --> 00:05:36,639
Not recommended means that there may exist valid reasons in
particular circumstances
111
00:05:36,895 --> 00:05:38,687
What's behavior is acceptable or even useful
112
00:05:39,455 --> 00:05:39,967
But
113
00:05:41,247 --> 00:05:43,039
Implement implications
114
00:05:43,295 --> 00:05:44,575
Should be understood
115
00:05:44,831 --> 00:05:46,623
And the case carefully weighed before Apple
116
00:05:47,391 --> 00:05:47,903
Behave yourself
117
00:05:48,927 --> 00:05:49,695
Approval before
118
00:05:51,487 --> 00:05:55,583
So that kind of stuff what's we want to hear this is always
nice when I give you a table console. See what's going on
119
00:05:56,095 --> 00:05:57,375
High-level View
120
00:05:57,887 --> 00:06:00,191
Terms and definitions the scope of the icmf
121
00:06:00,703 --> 00:06:04,287
Accountability and information security management agencies
nomenclature more
122
00:06:05,567 --> 00:06:06,079
Creekland first
123
00:06:06,591 --> 00:06:07,359
Requirements
124
00:06:07,615 --> 00:06:09,407
Executive overview introduction
125
00:06:09,663 --> 00:06:11,199
And then getting into the risk
126
00:06:12,991 --> 00:06:14,783
Ears are actual security policy on
127
00:06:15,295 --> 00:06:15,807
41
128
00:06:16,063 --> 00:06:17,343
And is that a clickable link
129
00:06:17,855 --> 00:06:18,367
It is
130
00:06:18,623 --> 00:06:19,135
Gotta love that
131
00:06:20,415 --> 00:06:22,975
Here's where it really the metal meets the meats
132
00:06:23,231 --> 00:06:26,047
Each agency must establish and maintain an information
133
00:06:26,303 --> 00:06:27,839
Security policy will we know that
134
00:06:28,095 --> 00:06:30,143
I want to know what you want us to do
135
00:06:30,655 --> 00:06:33,983
Are we go policy should have a minimum incorporate the
implementation guidance
136
00:06:34,239 --> 00:06:35,519
I love when they reference other guy
137
00:06:35,775 --> 00:06:37,055
Material culture
138
00:06:37,567 --> 00:06:38,335
That will go read that if you
139
00:06:38,591 --> 00:06:39,103
You want to know what's up
140
00:06:39,615 --> 00:06:42,431
So you will find that a lot of times if you are looking up
other
141
00:06:42,687 --> 00:06:43,967
A-frame or should not building one from
142
00:06:45,503 --> 00:06:47,807
Bill will probably be looking at other
143
00:06:50,879 --> 00:06:52,415
You may not reference them but you might
144
00:06:52,671 --> 00:06:54,719
Using them as a reference to build your own
145
00:06:54,975 --> 00:06:55,743
If you are starting from
146
00:06:55,999 --> 00:07:02,143
The ground-up give you this so you can take a look at it it
is quite extensive this says that it's what is it
147
00:07:03,167 --> 00:07:05,215
226 pages long
148
00:07:05,471 --> 00:07:11,615
So in typical governmental form at this will take you a
minute it's probably full of red tape bureaucracy
149
00:07:14,431 --> 00:07:18,783
If you do work your way through good for you you will
understand and have a practical idea
150
00:07:19,039 --> 00:07:20,319
What these things look like
151
00:07:20,575 --> 00:07:21,855
It's not the only game in town
152
00:07:22,367 --> 00:07:23,391
Well if you don't like this
153
00:07:23,647 --> 00:07:24,159
That's totally fine
154
00:07:25,695 --> 00:07:26,463
Again
155
00:07:27,231 --> 00:07:27,743
Look at
156
00:07:28,255 --> 00:07:30,559
Practical reference for that security man
157
00:07:31,327 --> 00:07:37,471
Focuses more on technical control implementation is that
right that's what I was saying earlier right
158
00:07:37,727 --> 00:07:39,519
That just means they're getting your hands dirty kind
of
159
00:07:39,775 --> 00:07:45,919
They're the ones that so infosec versus IA is going to
actually come in they're going to say okay well
160
00:07:46,175 --> 00:07:49,503
The Security Management program tells us we have to have a
password policy
161
00:07:49,759 --> 00:07:51,295
And it contains these attributes
162
00:07:52,063 --> 00:07:54,111
Passwords must be at least 12 characters long enough
163
00:07:56,927 --> 00:07:57,439
So
164
00:07:57,695 --> 00:07:58,975
Infosec those are the
165
00:07:59,231 --> 00:08:01,791
Guys and girls are actually implementing the
166
00:08:02,815 --> 00:08:05,119
They're going into the server software
167
00:08:05,375 --> 00:08:07,935
And configuring that to be the case
168
00:08:08,959 --> 00:08:10,495
A2B comply with password policy
169
00:08:13,311 --> 00:08:17,151
So that's the real difference hopefully I've made that
abundantly clear at this point
170
00:08:17,407 --> 00:08:22,783
Between Ina and infosec giving you a really good way to find
andymark
171
00:08:23,039 --> 00:08:24,063
Out who is who
172
00:08:24,319 --> 00:08:24,831
In the game
173
00:08:26,879 --> 00:08:30,975
So that's about all I have is far as information assurance
and infosec
174
00:08:31,231 --> 00:08:32,511
As far as definitional terms
175
00:08:32,767 --> 00:08:33,535
Helping you understand
176
00:08:34,047 --> 00:08:34,815
Between the two
177
00:08:35,071 --> 00:08:35,583
And August
178
00:08:36,607 --> 00:08:38,655
Network segmentation dough Zone
179
00:08:38,911 --> 00:08:45,055
What what exactly is that about security control is very
common one this is just the idea that we
180
00:08:45,311 --> 00:08:47,359
Reset Mentor Network in our networks out
181
00:08:47,871 --> 00:08:48,639
Into
182
00:08:48,895 --> 00:08:52,479
Pipes and I say types I mean maybe by roll
183
00:08:52,735 --> 00:08:54,015
Or
184
00:08:55,039 --> 00:08:59,647
What else could I say basically I want to say danger
zones
185
00:08:59,903 --> 00:09:01,695
Rise and I guess that's a good way to put it
186
00:09:01,951 --> 00:09:03,231
Where I have
187
00:09:03,743 --> 00:09:04,511
Like my DMZ
188
00:09:04,767 --> 00:09:09,119
Hey my DMZ is expected to be in a bit of a higher danger
zone
189
00:09:09,375 --> 00:09:10,911
Then my production server
190
00:09:12,191 --> 00:09:15,519
So I don't want those things together I don't want them on
the same network
191
00:09:15,775 --> 00:09:17,311
Because I don't want the traffic
192
00:09:17,567 --> 00:09:18,591
Death comes from
193
00:09:18,847 --> 00:09:20,383
Untrusted zones like the internet
194
00:09:20,895 --> 00:09:23,711
To be able to access her be on the same network
195
00:09:24,223 --> 00:09:24,735
As
196
00:09:24,991 --> 00:09:29,855
Secure service things that are sent in DMZ is demilitarized
zone
197
00:09:30,111 --> 00:09:33,183
So DMZ hopefully you guys are aware of what a DMZ is it
is
198
00:09:34,207 --> 00:09:34,975
If you're not
199
00:09:35,487 --> 00:09:35,999
Probably read
200
00:09:36,255 --> 00:09:42,143
I just said that to my grandpa and grandma
201
00:09:42,399 --> 00:09:45,215
Put on her you can do it grandma
202
00:09:46,495 --> 00:09:52,639
But that's that's what's up so we segment our networks out
and this isn't anything uncommon I mean I don't want
203
00:09:52,895 --> 00:09:55,199
1hr traffic to be on sales traffic either
204
00:09:55,711 --> 00:09:57,247
There's no purpose in it.
205
00:09:57,759 --> 00:10:02,367
I I do need to make a way for them to be able to talk to each
other and we do that but for the most part they're
206
00:10:02,623 --> 00:10:03,903
Broadcast traffic or
207
00:10:04,159 --> 00:10:05,439
Their Collision domains
208
00:10:05,695 --> 00:10:07,487
It's separated out because they're unnecessary
209
00:10:07,743 --> 00:10:08,767
I don't need ARP sitting
210
00:10:09,279 --> 00:10:10,559
Over here and in going on go
211
00:10:10,815 --> 00:10:12,351
So we just use things like lands
212
00:10:12,863 --> 00:10:15,679
These firewalls and use firewall rules
213
00:10:16,191 --> 00:10:17,471
To implement segmentation
214
00:10:17,727 --> 00:10:23,359
You can use both could use a router to do it as well and I
use a combination of all three and start creating these different
215
00:10:23,615 --> 00:10:24,127
Network zones
216
00:10:24,383 --> 00:10:29,247
I'll give you a couple of examples like uncontrolled zones
would be something like the internet
217
00:10:29,503 --> 00:10:31,551
Then you have your DMZ where you have
218
00:10:32,063 --> 00:10:33,855
Devices that need access
219
00:10:34,111 --> 00:10:35,135
To internal
220
00:10:35,391 --> 00:10:36,159
Resources
221
00:10:36,415 --> 00:10:38,207
As well as be accessible from
222
00:10:38,719 --> 00:10:40,511
External untrusted zones
223
00:10:40,767 --> 00:10:45,375
Rights over your DMZ administrative zones would also be
something you probably want to build
224
00:10:45,631 --> 00:10:49,215
You take your administrators their administrative
workstations
225
00:10:49,471 --> 00:10:51,263
And you will put them in that admit
226
00:10:51,775 --> 00:10:52,287
Zone
227
00:10:52,543 --> 00:10:53,311
If you have jump boxes
228
00:10:53,567 --> 00:10:54,847
Their sauce things of that nature
229
00:10:55,359 --> 00:10:56,127
It's a great place to put
230
00:10:57,407 --> 00:10:58,431
Standard
231
00:10:58,687 --> 00:10:59,455
Zone soap
232
00:10:59,711 --> 00:11:02,527
Where you put your every average everyday production
user
233
00:11:03,039 --> 00:11:03,807
And their energy
234
00:11:04,063 --> 00:11:07,903
You're fine if some access to the internet but they still are
firewalled often somewhere shapes
235
00:11:08,159 --> 00:11:10,975
Where is your your administrative zones probably going to be
much more can
236
00:11:19,167 --> 00:11:22,239
And I just kind of give you an idea networks on here we
go
237
00:11:22,751 --> 00:11:24,799
Of what this would look like diagram.
238
00:11:25,311 --> 00:11:31,455
So here we have our different networking devices I got a ride
or switching out a firewall your untrusted Zone which would be
239
00:11:31,711 --> 00:11:37,599
Be the internet's and over here I've even gone as far as to
label the zones for East once I've got corporate
240
00:11:37,855 --> 00:11:39,903
Desktop users and I just called his own user
241
00:11:41,183 --> 00:11:44,511
Over here at the sysadmins I'll call this Zone
sysadmin
242
00:11:44,767 --> 00:11:45,535
And servers
243
00:11:47,071 --> 00:11:51,423
So each one of them will have their own capabilities of
network connectivity
244
00:11:51,679 --> 00:11:53,471
On who they can and cannot talk to
245
00:11:53,983 --> 00:11:55,007
For security reasons
246
00:11:56,287 --> 00:11:58,079
It's all about remember this is all about security
247
00:11:58,847 --> 00:12:00,639
How do I keep my networks
248
00:12:00,895 --> 00:12:01,919
How do I keep my end-user
249
00:12:02,943 --> 00:12:03,967
My device is secure
250
00:12:04,223 --> 00:12:07,295
This is definitely something that if you're not already
doing
251
00:12:07,551 --> 00:12:09,599
I highly recommended
252
00:12:09,855 --> 00:12:11,647
Because he's very very helpful in this
253
00:12:11,903 --> 00:12:13,695
Security of your system self
254
00:12:13,951 --> 00:12:17,279
Get in there and start creating vlans use a firewall
to
255
00:12:17,535 --> 00:12:19,839
Control who can and cannot pass through what
256
00:12:20,607 --> 00:12:21,375
Use router as well as
257
00:12:27,263 --> 00:12:33,407
Definitely want to take a look at security
258
00:12:35,455 --> 00:12:38,527
Where am I at A- oh yes what are the goals of security
policy
259
00:12:38,783 --> 00:12:40,319
That's things we need to know right
260
00:12:40,575 --> 00:12:42,623
What else do we need to know about this
261
00:12:42,879 --> 00:12:46,207
Exile give me some examples animal look at security
262
00:12:47,487 --> 00:12:52,351
The flow that I want to go through what is the goal
263
00:12:52,607 --> 00:12:54,399
Of a security policy
264
00:12:54,911 --> 00:12:56,447
I remember a security policy
265
00:12:56,959 --> 00:12:58,751
Is a formalized
266
00:13:01,055 --> 00:13:02,591
Not Justa everybody knows
267
00:13:04,895 --> 00:13:06,431
You want to write these things down
268
00:13:06,687 --> 00:13:07,967
Management is involved
269
00:13:08,223 --> 00:13:10,271
HR disseminates all that other good stuff right
270
00:13:11,039 --> 00:13:13,343
It is that formalized
271
00:13:15,647 --> 00:13:16,927
That comes down from on high
272
00:13:17,439 --> 00:13:19,487
And tells you what you can and cannot do
273
00:13:20,255 --> 00:13:20,767
As far as
274
00:13:24,351 --> 00:13:24,863
275
00:13:25,119 --> 00:13:27,167
This is to maintain
276
00:13:27,423 --> 00:13:28,959
CIA confidentiality
277
00:13:29,727 --> 00:13:30,495
An availability
278
00:13:31,007 --> 00:13:32,287
Without those three things
279
00:13:33,311 --> 00:13:34,335
You're not going to do well as an
280
00:13:35,359 --> 00:13:37,407
And you want to safeguard
281
00:13:39,199 --> 00:13:41,759
We also want to reduce again this is at these are the
goals
282
00:13:42,015 --> 00:13:45,343
To maintain CIA we want to reduce
283
00:13:47,647 --> 00:13:48,415
Resource
284
00:13:49,439 --> 00:13:50,463
That's always a good thing
285
00:13:50,719 --> 00:13:56,095
So it's kind of like that loss prevention guy
286
00:13:56,351 --> 00:13:58,399
He's picking up Fritos and out
287
00:13:59,167 --> 00:14:05,055
Members only jacket
288
00:14:05,311 --> 00:14:07,871
Nevada guys away from our data we're trying to keep
289
00:14:08,127 --> 00:14:10,687
Resources from being lost or stolen
290
00:14:10,943 --> 00:14:12,991
That's that's what we're looking at here so
291
00:14:13,503 --> 00:14:14,271
Waste
292
00:14:14,783 --> 00:14:15,551
Los
293
00:14:15,807 --> 00:14:18,367
Destruction or even modification
294
00:14:18,623 --> 00:14:19,391
Because that is a
295
00:14:19,647 --> 00:14:20,927
As a form of the
296
00:14:22,463 --> 00:14:25,535
So that is what we're trying to reduce or prevent
297
00:14:25,791 --> 00:14:26,815
We want to lower
298
00:14:27,071 --> 00:14:28,095
The overall risk
299
00:14:28,607 --> 00:14:29,631
To our organization
300
00:14:30,143 --> 00:14:30,911
That's our goal
301
00:14:31,679 --> 00:14:34,751
Liability of employees and third-party is also
something
302
00:14:36,031 --> 00:14:36,799
As a goal
303
00:14:37,055 --> 00:14:37,823
Or are secure
304
00:14:38,079 --> 00:14:38,591
Security policy
305
00:14:38,847 --> 00:14:39,359
306
00:14:40,127 --> 00:14:40,895
I have
307
00:14:41,151 --> 00:14:42,943
Maybe Phi right private healthcare
308
00:14:44,479 --> 00:14:46,271
I don't want to let packet out
309
00:14:50,367 --> 00:14:50,879
For that
310
00:14:51,135 --> 00:14:52,671
We would have to face the man
311
00:14:53,439 --> 00:14:55,231
For doing that and sanction
312
00:14:55,999 --> 00:14:56,767
Maybe fines
313
00:14:57,279 --> 00:14:58,815
Who knows even worse
314
00:14:59,071 --> 00:15:01,375
Depends on what type of business you're in or what
315
00:15:02,911 --> 00:15:04,703
So that is also the goal of us
316
00:15:04,959 --> 00:15:05,471
317
00:15:05,727 --> 00:15:07,775
Keep us out of hot water legally
318
00:15:08,799 --> 00:15:10,335
So we don't get tan today
319
00:15:10,591 --> 00:15:14,943
Thompson would be a good day at the beach
320
00:15:15,199 --> 00:15:20,831
Getting slapped with a couple of bracelets that would be the
worst-case scenario
321
00:15:21,343 --> 00:15:25,183
What else do we need to do all Define access rights
for
322
00:15:25,439 --> 00:15:26,463
Our users at Large
323
00:15:27,231 --> 00:15:29,791
That's what I would be another great goal of your
secure
324
00:15:31,583 --> 00:15:33,887
So if our security policy
325
00:15:34,143 --> 00:15:35,423
Does not say
326
00:15:35,679 --> 00:15:37,727
That I can't look at HR records
327
00:15:38,495 --> 00:15:40,543
And who's to say it was wrong for me to do it
328
00:15:41,311 --> 00:15:44,127
So we need to make sure that we go in and Define what
329
00:15:44,383 --> 00:15:47,711
Resources are available and who they are and are not
available to
330
00:15:48,479 --> 00:15:50,015
Thanks so very important part
331
00:15:50,527 --> 00:15:51,551
A building out that's
332
00:15:53,855 --> 00:15:56,159
Let's talk about some examples of normal security
333
00:15:56,415 --> 00:15:57,951
She said she would probably encounter
334
00:15:58,463 --> 00:15:58,975
Enter average
335
00:16:00,767 --> 00:16:01,535
One we've already mentioned
336
00:16:01,791 --> 00:16:02,303
Pastor Paul
337
00:16:02,559 --> 00:16:04,351
That is a security policy
338
00:16:05,119 --> 00:16:06,143
It tells you
339
00:16:07,423 --> 00:16:09,215
Your password is meant to be
340
00:16:09,727 --> 00:16:12,799
You somehow is meant to be created
341
00:16:14,335 --> 00:16:14,847
Right
342
00:16:15,103 --> 00:16:16,383
How long can I keep the space
343
00:16:17,151 --> 00:16:18,943
How long is my password have to be
344
00:16:19,199 --> 00:16:22,271
How long before I can reuse an old password what's the
password history
345
00:16:23,039 --> 00:16:27,135
All those wonderful things that wrap up and then your average
everyday password policy
346
00:16:27,391 --> 00:16:28,671
Is a security control
347
00:16:29,695 --> 00:16:30,463
To help
348
00:16:31,743 --> 00:16:32,511
Out of trouble because
349
00:16:32,767 --> 00:16:33,535
If I make my path
350
00:16:33,791 --> 00:16:34,559
Easy to
351
00:16:34,815 --> 00:16:35,327
Yes
352
00:16:35,839 --> 00:16:37,119
Or Brute Force
353
00:16:37,631 --> 00:16:38,143
Then
354
00:16:38,655 --> 00:16:41,983
I'm not really doing myself any favor I think it is
like
355
00:16:42,751 --> 00:16:43,775
For wireless right
356
00:16:44,287 --> 00:16:45,567
Really doesn't do a whole lot
357
00:16:46,591 --> 00:16:47,871
Two protection of a wireless network
358
00:16:48,639 --> 00:16:50,175
So that might be part of my
359
00:16:50,431 --> 00:16:50,943
360
00:16:51,199 --> 00:16:52,223
Do not use wet
361
00:16:52,479 --> 00:16:54,527
So here wireless security policy
362
00:16:54,783 --> 00:16:57,087
Weapons not allowed you must use w p a w
363
00:16:57,855 --> 00:17:01,439
Now we live in a world where wpa3 is out so maybe we need to
go and revised
364
00:17:01,951 --> 00:17:02,975
Our security policy on
365
00:17:04,255 --> 00:17:05,791
So that could be a policy as well
366
00:17:06,047 --> 00:17:08,095
Acceptable use policy again what
367
00:17:08,351 --> 00:17:09,887
Can people access and what
368
00:17:10,143 --> 00:17:10,655
Can't they access
369
00:17:10,911 --> 00:17:13,215
And who has the access if they can access it
370
00:17:13,983 --> 00:17:17,311
So things like the internet coming to mind when you hear
acceptable
371
00:17:18,591 --> 00:17:19,359
That is a
372
00:17:19,615 --> 00:17:22,687
Probably the first thing that has people's brains me
373
00:17:22,943 --> 00:17:23,711
When you say those were
374
00:17:23,967 --> 00:17:26,015
Wild Wild West that's right because
375
00:17:26,271 --> 00:17:30,879
Internet is a wonderful resource and necessary for many of
our jobs if not all of them
376
00:17:32,927 --> 00:17:33,439
Can
377
00:17:33,951 --> 00:17:36,767
They have some darken CD places that you don't want your
user
378
00:17:37,791 --> 00:17:39,071
Maybe cuz you pick up malware
379
00:17:39,327 --> 00:17:40,607
Right it's not a great place
380
00:17:42,399 --> 00:17:44,447
To be perusing cuz you don't want our and your systems
381
00:17:44,959 --> 00:17:46,239
And it's just
382
00:17:47,007 --> 00:17:47,775
In general
383
00:17:48,031 --> 00:17:49,055
A taboo
384
00:17:49,311 --> 00:17:51,615
Things that used to gambling monographie these things
385
00:17:52,127 --> 00:17:54,687
While maybe that's fine behind closed doors
386
00:17:58,783 --> 00:18:00,831
That is not the time and place for these things
387
00:18:01,087 --> 00:18:04,159
So I need to tell you the acceptable use or your
computer
388
00:18:04,671 --> 00:18:06,975
Just not yours it is ours is a company resource
389
00:18:07,231 --> 00:18:08,255
We get the dick tape
390
00:18:08,511 --> 00:18:10,559
What you can and cannot do with it we're saying
391
00:18:10,815 --> 00:18:12,351
Do not engage in these activities
392
00:18:12,863 --> 00:18:17,727
That is not acceptable you so you're going to be framing
things that you can do anything you can't do
393
00:18:18,239 --> 00:18:18,751
Inside of that
394
00:18:20,543 --> 00:18:24,639
All right what else we intimidate a retention
395
00:18:25,407 --> 00:18:30,271
And and this does go back to legalities in a lot of ways
depending on the industry that you're into
396
00:18:30,527 --> 00:18:32,831
You could be subpoenaed for data
397
00:18:33,087 --> 00:18:34,111
If you don't have a date or attend
398
00:18:34,367 --> 00:18:34,879
Policy
399
00:18:35,903 --> 00:18:36,671
They will expect you
400
00:18:39,231 --> 00:18:39,743
So if
401
00:18:39,999 --> 00:18:41,023
If you don't have it why don't you
402
00:18:42,815 --> 00:18:43,327
We deleted it
403
00:18:44,095 --> 00:18:45,887
Policy said that you should leave now
404
00:18:46,399 --> 00:18:47,679
Well then you should have
405
00:18:48,703 --> 00:18:52,287
You don't want to get in those water so you need to set a
date a retention policy
406
00:18:52,543 --> 00:18:54,847
We keep archived data for three years
407
00:18:55,359 --> 00:18:57,663
We keep financial data for 7 years
408
00:18:58,175 --> 00:18:58,687
And
409
00:18:59,455 --> 00:19:00,991
After that we will destroy
410
00:19:01,759 --> 00:19:04,831
And we used these types of means for destruction of
411
00:19:05,343 --> 00:19:06,111
Older than
412
00:19:06,367 --> 00:19:06,879
Archived
413
00:19:07,647 --> 00:19:10,719
I need to set all those things out that's what a Security
pay
414
00:19:11,743 --> 00:19:14,047
You're going to be very fine detail
415
00:19:14,303 --> 00:19:15,071
Control
416
00:19:15,327 --> 00:19:17,631
About what you're putting in was far as a verb is
ghost
417
00:19:18,911 --> 00:19:21,215
Easily lie and say what a policy says
418
00:19:21,471 --> 00:19:21,983
This
419
00:19:22,495 --> 00:19:23,263
And that's what we
420
00:19:24,031 --> 00:19:25,055
That's so that's what we need
421
00:19:25,823 --> 00:19:30,687
Access Control policies well yeah it's another great one that
comes up Access Control policies
422
00:19:30,943 --> 00:19:34,015
Again what resources can someone access
423
00:19:34,271 --> 00:19:35,551
Unnecessarily Maybe
424
00:19:36,575 --> 00:19:37,855
The files and folders in
425
00:19:38,111 --> 00:19:39,647
I think that the actual data
426
00:19:39,903 --> 00:19:42,719
But the thing that holds the date are you allowed to access
the server
427
00:19:42,975 --> 00:19:45,023
Can't log into this server or can I not
428
00:19:45,535 --> 00:19:47,071
Am I allowed to access the switch
429
00:19:47,327 --> 00:19:48,351
To the router and a firewall
430
00:19:48,863 --> 00:19:50,143
Is that okay is that acceptable
431
00:19:50,911 --> 00:19:51,679
I don't know well
432
00:19:51,935 --> 00:19:53,983
This is where we want to put in an access policy
433
00:19:55,519 --> 00:19:57,311
You can also be thinking of things like firewall rule
434
00:19:58,591 --> 00:19:59,359
.
435
00:19:59,615 --> 00:20:00,639
People from
436
00:20:00,895 --> 00:20:03,711
Doing from one area of the network into another
because
437
00:20:03,967 --> 00:20:05,759
The rules will dictate who cannock
438
00:20:08,063 --> 00:20:09,343
But if you don't have them
439
00:20:09,855 --> 00:20:12,671
And again it goes back to the blues to say I can't do
that
440
00:20:13,183 --> 00:20:14,207
There's nothing that says I couldn't
441
00:20:14,463 --> 00:20:15,743
So not breaking any rules
442
00:20:16,255 --> 00:20:17,279
End-user get
443
00:20:17,791 --> 00:20:18,815
They get a little Dino
444
00:20:19,327 --> 00:20:19,839
Serious
445
00:20:20,095 --> 00:20:21,887
From time to time
446
00:20:22,143 --> 00:20:23,935
I didn't know you could do this they learn something
from
447
00:20:24,191 --> 00:20:26,751
Somebody they know who's intact and they got more try
that
448
00:20:27,263 --> 00:20:28,287
Nothing says they can't
449
00:20:29,055 --> 00:20:29,567
So they will
450
00:20:29,823 --> 00:20:31,103
And if they're accessing resources
451
00:20:31,359 --> 00:20:33,151
Really shouldn't be kicking their feet around
452
00:20:33,663 --> 00:20:35,967
Things could happen data could get destroyed
453
00:20:36,223 --> 00:20:36,991
Modified
454
00:20:37,247 --> 00:20:38,015
Who knows
455
00:20:38,527 --> 00:20:41,087
And we just it's just easier to go ahead put the kibosh on
that
456
00:20:44,671 --> 00:20:46,463
You're in this area therefore you don't need Acts
457
00:20:47,231 --> 00:20:48,255
August back to the
458
00:20:48,511 --> 00:20:50,559
Principle of least privilege
459
00:20:51,327 --> 00:20:53,119
You only get access to the things that you need
460
00:20:53,887 --> 00:20:54,399
Okay
461
00:20:54,655 --> 00:20:57,983
Now that I'm looking at our clock and I know we're still
getting into security policy
462
00:20:58,239 --> 00:21:02,079
What is a really good stopping spot for us and we'll pick
back up
463
00:21:02,335 --> 00:21:04,127
With looking at security policy
464
00:21:05,151 --> 00:21:11,295
Intravesical hacking security controls part 1 make sure you
see part 2 and make sure you see everything and chb
465
00:21:12,063 --> 00:21:14,367
Daniel's doing a great job putting this together for
you
466
00:21:14,623 --> 00:21:15,903
Getting you the information you need
467
00:21:16,416 --> 00:21:18,464
For that test that exam that's
468
00:21:18,720 --> 00:21:24,864
The looming around the corner and by the way you'll be inside
the course Library there's thousands and thousands of hours of complementary
information dr2
469
00:21:25,120 --> 00:21:26,144
Designed to do one thing
470
00:21:26,400 --> 00:21:28,448
I'll be more successful check that out as well
471
00:21:28,704 --> 00:21:33,568
I thought about you know what itpro TV TV is binge-
worthy
472
00:21:33,824 --> 00:21:35,360
We will see you again soon
473
00:21:42,528 --> 00:21:43,296
Thank you for watching

1.31 - Intro To Ethical Hacking - Security Controls

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

1.31 - Intro To Ethical Hacking - Security Controls

Uploaded by

Copyright:

Available Formats

1

00:00:06,912 --> 00:00:09,472

You might also like