One of the most common types of security technologies
is the anti-virus and the anti-malware software that's
running on our computers.
When you're in a work environment,
you usually have many different devices
and all of these devices have to be constantly updated
with the latest antivirus and anti-malware signatures.
If you have a large number of devices,
this can be a scaling issue, especially
if you're pulling those updates across the internet.
That's why in large organizations
you usually have some type of centralized enterprise
management.
That way you can download all of the updates from one source
and then deploy those updates from your internal location.
This also is a little bit of a challenge
for your mobile devices because not only
do those need to be protected with antivirus
and anti-malware, but you also have
to make sure that these mobile devices are updated
in a timely manner as well.
Another popular piece of software
running on our computers is a host-based firewall.
You might also hear this referred to
as a personal firewall.
This is usually something that comes with the operating
system you're using.
So this is something you'll see in Linux,
in Mac OS, and Windows.
And it's designed to stop anybody
from accessing your computer from the outside.
This is a stateful firewall, which
means if you're communicating out to another device,
it knows that you've begun the conversation so it allows
any responses from the outside.
What it prevents is somebody entering your computer
from the outside that you've not previously communicated with.
It also is able, since it's running in your operating
system, to track and allow this traffic based
on the application that's currently in use.
In Windows, you'll commonly see the Windows Firewall
being used for this.
It allows us to filter traffic by port number,
by application, or any combination of those
in and out of your Windows device.
We also commonly rely on network based firewalls,
both at our homes and our businesses,
to prevent somebody from accessing our internal network.
We've traditionally used these firewalls to allow and disallow
traffic based on a TCP or UDP port number,
but these newer, more modern firewalls
can identify applications that may be going over the network
and allow you to set priorities and permissions based
on the application type itself.
You can often use network-based firewalls
to encrypt traffic between two firewalls.
So if you have two locations, you can send data
back and forth between those locations,
but encrypt everything going between one side and the other.
It's also common to see these network-based firewalls use
a proxy function.
So you would make queries to the firewall,
the firewall would then continue the query out to the internet,
receive the response, examine that response,
and if everything looked OK, provide you
with the answer to your query.
You'll also find that most firewalls
are what we call layer 3 devices, which
means they're routers.
This means we're able to put this firewall
on the edge of our network and also use it to route traffic
into and out of our environment.
Another digital technique that we rely on for security
is authentication.
This is when we're adding a username and a password
to gain access to a resource.
It's usually something unique as well.
Only you know your username and password and nobody else
is going to have that information.
In Windows, there's something called a security identifier,
or an SID, and this is what's going to identify you uniquely
in that Windows environment.
You'll generally provide a number
of different credentials: certainly there
will be a username and password, but you might also
be asked for a smart card or personal identification number
as well.
There's usually a profile associated with this username
that you're using and once you authenticate
with the proper username and password,
these credentials then allow you access to just the resources
that are specific for you.
These authentication credentials are very important.
If somebody was to gain access to your username and password,
they would effectively have access
to all of the resources associated with your login.
That's why we want to prevent someone from gaining access
to that information, either indirectly or by performing
some type of brute force attack, either online
or through an offline brute force form.
That's why we want to protect these credentials
by making sure that our password is as complex as possible.
That way if somebody is performing an online or offline
brute force attack, they'll have to go through many more
iterations to ever come across what your password might be.
Not only do our passwords need a level of complexity,
but we also need to make sure that they're updated often.
That way if somebody does come across a set of hashes
or gets access to your password, that information
would only be valid for a certain amount of time.
If you were ever wondering what a bad password might be,
you might want to look at one of the many studies done
by Splash Data.
They examine password files every year.
And here's an example of some of the passwords
that they've been able to find.
The number one password in use: one two three four five six.
The number two password in use is the word password.
And you can see even gets worse from there.
You don't want to use any of these types of passwords
with any of your user credentials.
You need to add complexity and you
want to be sure these are changing all the time.
Another way to add some complexity
to this authentication process is
to ask you for a username, a password, and then something
else.
The something else means that you're using
a multi-factor authentication.
It might be something you are, something you have,
something you know, somewhere you are, or something you do.
It's very common to see this multi-factor authentication
provided through an external key fob that
happens to have a pseudo random number that
changes every 30 seconds or so.
That way when you log in, you're providing
a username, and a password, and then
the latest number that might be identified on that key fob.
You can also do this through applications
on a mobile device.
Here's an example of a mobile authenticator
through battle.net where I log in with a username, a password,
and then I reference this application
to know what the latest code is and in 30 seconds
this code changes to something else.
If I have to log in again, I have
to provide my username and password
and they go back to the authenticator
to get the latest code.
Another form of digital security is
protecting files are stored in a file system.
In Windows, the popular file system NTFS
is a very common way to do this.
This has very granular security permissions
built in as part of the file system itself.
And allows you to really focus and lock down
certain files in certain resources
to particular users in that file system.
We can also provide access to these files
through the username that you happen to be using.
Your username will be associated with particular groups
and those particular groups would have access
to certain files and resources in that file system.
In fact, it's very common for organizations
to constantly audit their list of user permissions.
That way they can be assured that the person logging in
has access to the correct files.
We often have sensitive information
that we keep in our organization,
but a lot of our users work outside the building.
One way to provide secure access for those users
is through a virtual private network.
We often use a virtual private network concentrator
to be able to facilitate this communication.
The VPN concentrator itself is often a piece of hardware that
has specialized encryption technology within it that's
able to quickly encrypt and decrypt the information.
And it becomes a central point for everyone
on the outside to be able to communicate with.
If your requirements are relatively low
and you don't need a dedicated piece of hardware,
there's also software-based VPN concentrators
available as well.
And most client operating systems these days I already
have VPN software built in.
So you may not even need to install additional software
to be able to securely communicate
to this VPN concentrator.
Here's an example of how this VPN concentrator works.
You have all of your corporate data
here on the private corporate network
and there's a VPN concentrator between the corporate network
and the rest of the world.
Well you might be at a coffee shop, you launch VPN software
and it creates an encrypted tunnel from your laptop
to the VPN concentrator.
The VPN concentrator's in charge of decrypting that information
and passing it through to the internal network.
To be able to send information back to you,
that information is sent to the concentrator, which
then encrypts the information, sends it through the tunnel
and back to your laptop.
The obvious benefit here is that everything
that is going across the internet from the coffee shop
to the VPN concentrator at your headquarters
is all going to be encrypted information.
If anybody does gain access to the communication
flow between these two devices, they
won't be able to know what is inside of this information.
All of that data is secure and encrypted.
The type of data that we send in and out of our network
can very often be very sensitive.
It might include social security numbers or credit card numbers.
There might be medical information or other types
of sensitive information that are transferred.
When this type of sensitive information
is communicated over the network,
it is almost always sent in encrypted form.
That way if somebody does see this network traffic,
they won't be able to see this sensitive social security
numbers, credit card numbers, or anything else.
But if somebody is sending this information in the clear,
whether it's accidentally or on purpose,
you could be notified with this through devices that provide
data loss prevention, or DLP.
We usually implement data loss prevention on a network
by using many different types of components:
these might be software components on a server,
it might be a custom built appliance on the network,
or it might be built into the firewall that we're using.
If you walk into an office building,
you may find that there are many places where
you could potentially plug-in and gain access to the network.
Because of that it's a good idea to administratively disable
any interfaces that are not currently in use.
This way you're able to be sure that nobody
can walk into an empty desk plug-in and gain access
to your internal network.
This is obviously going to take some time
to identify what switch interfaces need
to be administratively disabled and then
you might want to perform audits to make sure
that none of these interfaces happen to be re-enabled
in the meantime.
Once you have this initial list of exactly what interfaces
should be enabled and disabled, it
shouldn't take too long to perform these ongoing audits.
An access control list is a very broad term
that describes the permissions that
are associated with an object.
You may hear these referred to as ACLs or "ackles"
and you'll see them used in file systems, network
devices, firewalls operating systems, and much more.
The implementation of the access control list
is different depending on where it happens to be.
If it's in a file system, the access control list
may simply say that Bob can read files;
if it's on a network device it may say that Fred can access
the network; or if you're in a firewall it
may be very specific, it may say the James can access
network 192.168.1.0 slash 24 using TCP port
80, port 443, and port 8088.
If you're communicating to a file server,
through an operating system, or over the network,
then there's probably some device
in each one of those places that has inside of it
an access control list.
One common form of digital security
that requires a physical object is a smart card.
The smart card usually contains a digital certificate
and we usually insert it into a laptop or smart card reader
in order to use it for authentication.
We're often using the smart card with some other factor
of authentication.
So we might be adding a username, a password,
we might put in a personal identification number,
and then also use the smart card.
We rely on email to perform our day to day tasks,
but we're also concerned from a security
perspective, of what may be going through our email
systems.
One of these concerns revolves around unsolicited email
or what we call spam.
There are many ways to filter out this spam.
One way is to stop it at the mail gateway
before it even gets into the organization
and seen by the users.
There are many different solutions for this,
you can either filter out the spam
on the inside of your network, there are also
a number of cloud-based services to do this as well.
Email can also be used to send malicious software so we always
need to have some type of filter in place
that can evaluate everything sent through the email system
and then allow or disallow that information based on what's
inside of that mail message.
We should always be concerned with the applications
that we're installing our computer as these applications
have access to our personal information
and of course have access to the operating system.
In a perfect world, we would be able to read all of the source
code for a particular application, audit it,
and to make sure that it's trustworthy.
But of course we don't always have access to the source code
and even if we did, we don't have enough time
to audit every bit of source code
but we might be installing onto our computer.
Because of that we generally categorized the software
that we're installing as coming from a trusted
source or an untrusted source.
A common trusted source might be an application
you're developing in house, maybe
it's coming from a well-known publisher.
You know, if you're installing an application from Microsoft
then it's an application that you can generally trust.
Or it might be an application that
has been digitally signed by a source that you can also trust.
An example of an untrusted source
might be a third party site that you've never
worked with before, that you're downloading and installing
software from; maybe it's links that you're
following in an email; or a very common untrusted source
is one that is a pop-up or drive-by download that
tries to install software onto your computer.