Protective Technology

00:00

Welcome to less than 6.5 protect protective technology.

00:05

So in this video we'll cover the protect function category #5 protective technology and we'll look at how to implement protective technology.

00:15

So in looking at the final category under the protect function, um this is really focusing on technical security solutions um and utilizing them to manage to ensure the security and resilience of systems, products, services and associated data consistent with your related policies, processes, procedures and agreements.

00:35

So as you'll see here, there are four subcategories and what they're really focused on

00:39

is looking at remote removable media um and how that's protected. The principle of least functionality um that your communications and control networks are protected and then mechanisms such as fail safe load balancing and hot swap. Hot swap

00:55

are implemented to achieve resilience requirements and normal and adverse situations.

01:00

So we're going to get into each of these sub categories over the next couple of slides.

01:06

So when we're talking about removable media, how can you constrain this to ensure that you're protecting the network as well as personal data because sometimes the biggest threat can be an insider threat, so you want to make sure that you're locking down removable media or the use of removable media.

01:22

So in some companies um when you plug in a USB device into a laptop or desktop computer, the use of that can be logged

01:30

and so that may be something that you want to implement so that in the event there is an issue later, um whether that's an intellectual property issue you're able to look in those logs to see who may have access to system um in order to get access to that data, um you can also control access to the data stored on them. Um So uh

01:49

employing mechanisms within the removable media device that prevents certain access from being stored there um as well as enforcing encryption requirements for U. S. B. Drive so that in the event it's lost or stolen and there's data on it. Um It may not be a reportable um incidents since the U. S. B. Drive is encrypted

02:13

and then it does ensure as well that you're adhering to the principles of data in transit and data at rest being encrypted.

02:21

Um You can also disable auto run an auto play functions on removable media. And then lastly some companies have chosen to block USB options from working all together on any of their devices. Um So that a laptop or a desktop would prevent you from even utilizing um removable media device.

02:40

Um So just some options to think about when you're trying to think of how to constrain the use of removable media

02:46

um as a protective technology in order to protect um uh data.

02:53

And then we get into the principle of least functionality. And this is really um your applications or devices are configured in such a way that it only provides access for essential capabilities um Maybe for an everyday user and maybe um some of that functionality

03:13

is more available for say privileged users or those that have security roles or responsibilities

03:19

but being able to restrict certain functions, protocols, ports and services um does become important. And we saw an example of one of this in the uh constraining removable media slide is that if you prevent

03:35

um you know removable media from working at all on any devices, you really are restricting certain

03:40

port center services because essentially that USB board wouldn't work for a U. S. B. Drive. Um And then really limiting component functionality to a single function. Um So just some things to think about in ways to continually use um uh protective technology to ensure data protection

04:00

and then there's also a focus on communications and control networks. Um So you really want to restrict external connections and interfaces to from and between specific machines. Um There may be uh machines that have certain sensitive data on it that you may want to protect,

04:18

um that you may um enable this as well as sometimes disabling wireless access.

04:25

Um You can prevent the remote execution of privileged commands, uncertain devices and for certain functionalities as well as allowing continuously monitoring in points to detect and respond to indicators of attack. So making sure that you have um

04:42

uh protective technology in place for your in point. So for those laptops and desktops they're constantly being monitored um against any vulnerabilities or insurance, ensuring that um uh they can't be attacked that way for an attacker to gain entry through your in points.

05:00

Um As well as I ding and preventing the transfer of sensitive information through data loss prevention and protection solutions.

05:05

Um So even encrypting email um you know uh if you use something such as box or dropbox that um you you've set it up where uh

05:17

uh that people within your organization can use it. Um But using something like that does prevent the transfer of sensitive information because someone has to be given access to that box or drive folder.

05:31

Um So using something like that does help prevent it as opposed to sending it through email which can be easily shared with someone else.

05:39

Um and then finally establishing alternate telecommunications channels for business continuity. Um You want to make sure that you have alternate methods to communicate in the event you do have um a disaster or some sort of event um that puts your telecommunication channels down so have alternate lines of communication becomes vital

05:58

um That ensures that your data is still available.

06:01

Um um As we mentioned before, availability is part of the CIA triad. So you always want to make sure um that the data is readily available to um your staff as well as individuals or other organizations or service providers that may need access.

06:18

And then lastly we get into resilience requirements. You always want to make sure that you are able to basically um move on in a in an event or situation that people can continue to access.

06:34

Um The data for instance um When I'll never forget, Adele tickets went on sale a few years ago when she was touring um and ticketmaster went down um you want to make sure that you have a way to prevent that from happening. Um So as you see, we have three options here and this isn't um an exhaustive list but probably the most utilized um a fail safe that you have a design feature, practice that in the event of a specific type of failure kind of like what I was mentioning that

07:05

the system was overloaded and went down um that it responds in a way that will cause no or minimal harm to other equipment to the environment or to people um that uh you know, you're you can easily recover um and it's not going to damage anything. Um

07:25

And probably my Adele example is better suited for load balancing and not necessarily failsafe failsafe is more so looking at in the event of let's say a fire or storm um that you're able to recover um

07:41

from that type of failure without basically causing harm to

07:45

other equipment or the system, the server that this may be an um on or the environment or to people um that it doesn't make the situation worse. Whereas load balancing is the process of distributing network traffic across multiple servers to ensure a single server but uh doesn't bear too much demand. And that's where my uh

08:07

uh story about the Adele tickets does come into play here is because um apparently they didn't do that. Um Now I guess realizing the demand would be so high that it caused the system to crash. Um whereas they sort of had spread the traffic over multiple service, they may not have had that issue. Um, ticketmaster wouldn't have.

08:26

And then finally there's hot swap, which is really the replacement or addition of components to a computer system

08:31

without stopping shutting down or rebooting the system. So sometimes, you know, updates are required, whether that's of our hardware um or uh there's a software component you want to be able to keep the business running, keep things going without having to shut down your systems. Um So that's really why this is necessary, so it doesn't halt business um which could then corrupt data cause it once again to be unavailable or mess with the integrity of it. So you really want to ensure um that that is something that you can do with your hardware or applications um that your you can easily replace or

09:11

um add components without having to shut down the system.

09:16

So like I said, we've gone through the four subcategories now um and before we move on we're going to have a quick quiz.

09:24

So enforcing encryption requirements is used as a way to one constraint removable media to focus on communication and control networks. Or three disabled wireless access.

09:39

So the answer here is constrained removable media. You really want to use encryption as a way to protect data that may be on that removable media device um while it's at rest and even while it's in transit so that in the events um in the event it is stolen or lost um that there is not a reportable event because the data is actually encrypted on that device

10:03

and it protects it from unauthorized access as well.

10:09

So in this video we cover the subcategories of the protect function category number five, we looked at different ways to constrain removable media.

10:16

We looked at ways to implement the principle of least functionality.

10:20

We learned how to protect communications and control and then we looked at mechanisms to achieve resilience requirements