Hi everyone.
I'm Chris.
And welcome back to my.
Course on Enterprise Security fundamentals in this lesson we are going to discuss about what preparations
do organizations need to take in order to improve their security posture.
So first of all let's have an overview of this preparations.
There are several ongoing preparations that an organization needs to take to improve their overall approach
to information security.
And I have selected here four of them which I think are the most important.
So developing a baseline security posture classifying information implementing change tracking and auditing
and monitoring and reporting.
Now let's go through each and one of them and discuss them.
The first one is the baseline security posture a baseline security posture basically represents an organization's
desired or expected security configuration.
Unfortunately many organizations haven't achieved their stated baseline security posture.
For example organizational policy might dictate that information systems be kept patched with any security
updates released by a vendor 30 days or 30 or more days ago.
But many systems within the organizations may not have been updated due to lack of resources.
For example an organization's baseline security posture should be measurable where possible and appropriate.
For example Microsoft provides the security compliance tool kit which can be run against windows based
systems to assess which controls and settings comply with the recommended baselines and which controls
and settings may need to be modified to reach a compliance state.
I have included in this section in this lesson more exactly on the Resources tab a link which goes and
gets you into a very high level of detail in regards to the security and compliance tool kit an organization's
baseline security posture should also include policies around the use of administrative accounts privileged
access workstations as well as technologies such as privileged access management and just enough administration
for example.
It is far more difficult for an attacker to compromise a DNS server if the only way that the DNS server
can be managed is through Gia just enough administration through a GIA endpoint that is accessible only
to privileged access workstation which is in its turn available to a user only after a successful privileged
access management request has been done.
That is again far more difficult.
Let's say that if the DNS server can be managed from any domain join the workstation in the organization
at any point in time and that makes perfect sounds an organization security posture should also involve
policies and configurations that restrict the lateral movement.
This would include deploying code integrity policies on servers to restrict the execution of unauthorized
coding scripts segmenting the networks so that sensitive servers are only accessible to authorized hosts
ensuring that common local accounts and passwords aren't used.
And of course ensuring that software patches and updates are applied in a timely manner.
The challenge is to balance the organization's need to perform work tasks with a minimum of inconvenience
steps with the need for security for example whether it is necessary for users to enter a bit locker
bin each time they start their workstation or whether that requirement only makes sense on a privileged
access workstation used by the administrators of the information systems.
The baseline security posture is a work in progress.
It is an ongoing work in progress.
An organization should always be looking to improve its baseline security posture and should regularly
engage external penetration testers to run red team exercises to assess the current security configuration
for vulnerabilities.
That being said let's talk about the next one on our list and that is classifying information or information
classification as a part of an organization's approach to preparing and maintaining an effective information
security posture.
It is necessary to determine which information needs to be protected and the level of that protection.
Once this determination is made the information can be appropriately classified.
The key to classification.
The key to the classification process is the realization that not all information stored by the organization
is sensitive.
For example how an organization treats the security or information related to the company picnic should
differ substantially to how the organization treats the security of information related to the company's
finances for example classification of information determines which controls will be implemented when
it comes to addressing the pillars of the CIA triad or any other information security framework organizations
are increasingly able to use machine learning technologies to automatically classify and protect information.
For example products such as Asia information protection and by the way I have included a link that
discusses in high level of detail Asia information protection in the Resources tab of the lost of the
previous lesson.
So again products such as Asia information protection allow for the automatic classification and protection
of data based on the evolving properties of the data you face your information protection is implemented
and if a user types a credit card number into an Excel spreadsheet the number is recognized as a credit
card number and an appropriate classification is determined by the user information protection agent
and an information protection template is then applied automatically to the document while it is possible
to manually classify information automatic information classification mechanisms especially those that
utilize machine learning have the advantage have the advantage of being more consistent.
It's also possible to automatically reclassify information should a systematic classification error
be uncovered let's see.
A task that would be as laborious and potentially error prone as manually classifying the information
one of the keys to successfully implementing an information classification schema is to keep the classification
rules relatively simple and to seek feedback from the stakeholders within the organizations who are
deeply familiar with the properties of the information that's being classified as simple classification
scheme is more readily understood let's say classification categories can often easily be extended if
the existing schema is found to be too simplistic classification schemes should also be tested with
a small group of users before being used more widely within the organization.
Once the information is appropriately classified organizations can then apply security controls to that
information based on the classification.
For example information that is labeled unclassified has few security controls applied and information
that is labeled legally sensitive for example has stricter security controls applied going on to the
next on our list that is implementing change tracking and auditing change tracking and auditing allows
you to determine who modified a document when the document was modified and what modifications were
made to the document.
Implementing change tracking is important when addressing the integrity pillar of the CIA.
Try it.
As we discussed in the previous lesson Change tracking also often provides organizations with the ability
to roll back changes right.
For example should and should an authorized person make a non authorized change to a document.
Those changes can be detected and rolled back.
If change tracking is implemented as a security control if change tracking is not implemented as a security
control it may be impossible to determine which unauthorized changes were made unless an in-depth analysis
of the document is performed.
This is assuming of course that the unauthorized changes are detected in the first place something that
can be difficult to do without change tracking unless the changes are bluntly obvious right.
So auditing on the other part auditing is very important as it provides information about which you
the users both authorized and unauthorized may have attempted or gained access to a document or data.
Auditing isn't just limited to data as a part of maintaining an effective security posture.
Organizations should audit all changes to the information system configuration from rolls and features
being added and removed through to changes in security group memberships and specific configuration
settings for example.
Now let's see if auditing of a security group isn't enabled.
It might be impossible to determine whether a user account has been added to a sensitive group by an
authorised administrator or an attacker who is attempting to privilege escalation has added that user
to these sensitive group.
If auditing a firewall configuration isn't enabled it might not be obvious that specific ports have
been opened to allow an external user to gain remote access to a system within the internal network
for example and going on to the last one on our list is monitoring and reporting as I've mentioned in
the previous lessons and sections unless the system is present to record events as they happen.
It is almost impossible to have an accurate picture of what is happening within your organization's
information systems infrastructure collecting System Event telemetry not only allows you to determine
what actions on an external intruder might be taking on the organizational network but what unauthorized
actions an authorized insider might be performing on that organizational network.
Organizations can use ideas and seem systems to collect aggregate and analyze System Event telemetry
as security analytics software becomes more capable it's become possible for these systems to alert
administrators to abnormal activity.
For example let's say systems might notice that an authorized insider might only access specific sensitive
files outside of working office hours an activity that might be worthy of further investigation in terms
of developing a baseline security posture.
Having the ideas and the CRM system that has analyzed event telemetry in enough detail to determine
what constitutes normal activity makes it far more easier for those systems to determine and reason
alert when abnormal.
Opportunity occurs and that being said I will see you guys in the next less where we'll be discussing
about developing and maintaining policies and security policies in our organizations.
I hope this has been informative for you.
And thank you for watching.