Yes.
With the cybersecurity landscape of today, we have great job security when we enter into the cyber
security profession.
But I realize at this point you may be getting a little maybe even hyperventilating, thinking about
all of these attackers and all of these various attacks that we may fall victim to.
So let's take a moment and describe some of the cutting edge information security controls that we have
today.
The first area is called information assurance.
And this really is the result of a ton of work that will go on inside of your organization.
You will have local policies that are enforcing things like multi-factor authentication and good strong
passwords.
You are going to be developing strong authentication systems.
You're going to have great groups.
You're going to be having great policies about your users and your groups.
And you're going to be doing an incredible amount of training.
I know.
I know when trainers are saying that you got to buy a bunch of training.
It always sounds sketchy.
But I'm here to tell you that training of internal employees is absolutely critical in the area of cyber
security.
Remember all of those social engineering attacks that are typically the first successful step in a much
more sophisticated attack?
Training of those end users in our environment is critical.
The next major area of security controls that I love is defense in depth.
I do a lot with Cisco networking, and because of that, I'm a big defense in-depth person.
You can have a really big firewall at the edge of your corporate network, and then you can have a smaller
firewall dividing portions of the corporate network, and then you can have an even smaller firewall
sitting right inside of the client system.
Cisco has great antivirus and and firewall software.
Now they all install right on the client.
So you have three levels of firewall in building this great defense in depth as attackers are trying
to get in.
They'll probably get hit by the first big firewall.
If that doesn't catch them, I'm sure that second firewall is going to grab it.
If the infection worm, whatever it is, makes it all the way to the end system.
There is an intense host based firewall that's on that system that is being fed the latest security
intelligence.
More on that in a moment.
So this thing is going to be that last line of defense.
This all reminds me of that episode in the final season of Game of Thrones when the Army of the Dead.
Right, all those dead zombies are coming towards into the castle and they have the initial fire that
gets them and the dragons are out there.
And then there's guys that are, you know, doing arrows from the.
All right.
Obviously, I'm a big Game of Thrones fan, but I don't know what the heck I'm talking about.
But you get the idea, those multiple levels of defense in depth.
This is a great strategy that enterprises hopefully are employing.
Now, another great control that we have in our enterprises today is risk and risk management.
You see, we understand that risk really is made up of the chance, the probability of a threat times
the vulnerability that might exist, times the asset value.
So think about it.
We may have some assets that are very, very benign.
It doesn't matter if they fall into the hands of someone because maybe they're public web page content,
they're already being served up to the public for any eyes to, you know, examine.
So that component is going to have a big, big time, different asset value then maybe some secure keying
information for encryption that we're doing of key resources for the enterprise.
So we are going to be building great security controls by constantly thinking of what are the chances
we're going to be attacked.
Are there vulnerabilities in what is the value of the asset?
One of the things I love about Cloud is helping us in this area.
It will do machine learning.
More on that in a moment.
And the cloud will do machine learning to literally look at one of your storage buckets in the case
of AWB and tell you if there is stuff in there you should most likely protect.
Boy, oh boy.
Is that something?
Doing the work for us.
We often assign risk levels, so we might have high risk, medium risk, low risk, and we may even
build a matrix.
I'm going to show you an example and have you work and answer some questions about the example in an
assignment coming up.
So you will get to see and work with a typical risk matrix as you're going to see.
It's going to help you work out the relative risk for some.
Asset and risk management really is the key here.
Enterprises today are going to have teams that are specialized in working on risk and managing those
risks.
You see, this is important too, because we typically don't have unlimited budgets, so we have to
decide where and when we're going to throw money at the cybersecurity problem.
Now the next major area that is very exciting when it comes to us very effectively combating these many
computer criminals is the utilization of cyber threat intelligence.
This has gotten so incredibly sophisticated that we actually categorize it now into several different
categories.
So there are many different vendors out there that are all participating together in the field of networking.
You have like Cisco and Juniper and all the other giants in that industry that are all sharing information
about network attacks so their devices can go off and gain this information.
They can even incorporate the information they're getting in their machine learning and their a AI algorithms.
So these devices are smart and getting smarter all the time.
Think about how this can help us guard against day zero attacks.
Day zero attacks are a nightmare because no one's ever seen the attack before.
It's the first zero day of it.
And things like cyber threat, intelligence and AI and machine learning can really help us.
So we might be using this to make strategic type decisions in our environment.
And the strategic goal of this information is to really help our like C-suite people really determine
things about like where are the biggest threats and where should money be spent?
And, you know, what areas of the network and what areas of the organization are most at risk?
Then there's tactical type of information that we might gain from a cyber threat intelligence repository.
And this really actively helps us protect things.
So this intelligence is going to really let us know exactly what new threats that threat actors are
attempting to carry out.
Now, when it comes time to actually keep our resources safe, there's operational threat intelligence.
This is going to get very specific about things that might be occurring against our organization.
And then there are technical areas of the threat intelligence.
And the technical area really gives information about the exact resources an attacker might use in order
to perform their attack.
So it's going to really delineate for us exactly what types of tools and other resources these attackers
might be using.
Isn't it great to know that we have these most often free repositories of threat intelligence information?
Now I say free, and it's typically included, of course, with the licensing from that vendor that
you're working with.
And again, I have to emphasize, the cloud really is exciting for a lot of this cutting edge security
control work.
Notice there's Amazon Guard duty.
This is intelligent threat protection for the stuff that you've got in use, especially if you're doing
stuff like infrastructure service up there.
And this is going to have that centralized intelligence that is constantly analyzing what you're doing
and figuring out how to protect it.
Better yet, another really exciting area of defense mechanisms today in defense controls when it comes
to cybersecurity is threat modeling.
And yes, as you might guess, this is another area where cloud can really help us with the resources
and the AI algorithms, algorithms and things that we may have access to in the cloud.
So here we're looking to identify relevant threats when we threat model.
And we're also trying to figure out what key vulnerabilities we might have in our systems that these
computer attackers might be going after.
The real goal here is to overall improve your security design.
So you might notice that, oh, my gosh, you have a lot of key vulnerabilities that are, you know,
subject to threats and you can redesign things so that your overall security posture is much improved.
Another big control that we need to spend time with is incident handling and response.
This is typically a specialized team and they will be working in phases when the proverbial poo poo
hits the fan.
So when there is a major security attack and there is always going to be one, it's just a matter of
when.
When there is a major, major thing that happens.
We can't have chaos.
We need well trained phases and, you know, employees enacting well-trained phases like triage, get
the infected systems quarantined, begin reporting and additional detections respond to the attack,
analyze things and incorporate other elements of incident management.
Typically, there's going to be a big documentation system.
And I know, I know we tend to wince when we hear documentation, but this documentation is worth its
weight in gold because it's going to be discussing things like how we were attacked, what we did about
it, and even prompt discussions of, again, improving designs so that things work overall better in
the future.
Something else that we want with incident handling and response is we want vulnerabilities to be properly
handled.
We want any artifacts like virus code and things to be handled properly.
Will train our staff on how to make announcements to the employees involving incidents, and also how
we will alert various employees about incidents that may have occurred or are presently occurring.
Now, as you've heard, I've mentioned artificial intelligence and machine learning several times in
the reference to these other defense controls.
And that is a big time fact.
And that's something that I really want you to take away from this video.
These things are here.
They're supervised in unsupervised machine learning now taking place.
And whether it's supervised or unsupervised deals with the amount of algorithms that are controlling
what it is analyzing.
But these things are here and they're making huge differences in our security landscape.
As a matter of fact, phishing detection, authentication schemes, threat detection, vulnerability
management, they are all benefiting right now today from AI and machine learning.
The cloud is a big part of this because this takes a lot of resources, but those resources are available
with the push of a button in the cloud.
By the way, behavior analytics is big for AI now, as well as network security, air based anti-virus
and even fraud detection getting huge enhancements thanks to artificial intelligence.
So yes, we're being attacked from more people than ever before for a wider variety of reasons and ever
before.
But the great news is we have very powerful information security controls today to attack them with.
So we'll even maybe end up detecting their bots and actually fighting the attackers A.I. with our own
A.I..
Oh, my gosh.
Terminator.
Skynet.
It's happening for sure.
I read an article in the Wall Street Journal, and it was about these drones that the military was thinking
about using A.I. with.
And I'm just like, oh, boy, A.I. powered drones.
Didn't anyone get the memo on what a bad idea this might be?
So, yeah, these this technology is not coming.
It's here.