Between 1520 minutes. OK, so we'll get through the
presentation, we'll do some Q&A and then we'll talk
about the master class in Q&A. You guys have after
that, OK.
So tonight we are going to talk about.
The five functions of the cybersecurity framework.
Created by NIST, the National Institute of Science and
Technology.
OK.
Give me one second.
Now the purpose of this this framework well.
Well, it's it's a core.
A set desired cybersecurity activities and outcomes
organized in categories and aligned to informative
references.
OK, so this framework is designed to be intuitive and to
act as a translation layer.
To enable communication between multiple disciplinary teams by
using a simplistic and nontechnical language.
OK.
Now the core of this framework consists of three parts.
You have it's functions.
You have it's.
You have it framed core framework core. You have its
implementation tiers and you have its profiles OK those.
Those three main components are then broken into five functions,
which that's what we'll be mainly focused on tonight.
OK. And those five functions?
Include a identifying protect, detect, respond and recover. OK,
so basically this is a framework used to build your
cybersecurity.
You're cybersecurity.
The program, I'm sorry.
OK, so let's move into the first function here, which the five
functions they're they're the highest level of abstraction in
the core. OK, it represents the five key pillars of a successful
and the holistic cybersecurity program.
It ain't organizations in expressing their their
management of their cybersecurity risks at a high
level.
OK, so the first function is identify OK this function.
It assists us in in developing a in organizational understanding
of managing our cybersecurity risks, and this means to all of
our assets, our systems, our people, our assets, our data,
our capabilities, right.
OK. And the examples we can, we can think of when we're looking
at identity identity or identify function is we can identify our
physical and software assets, right. And we're going to
identify these physical and software assets to do what we're
looking to form an asset management program. So we're
we're forming a baseline here.
We're also going to identify our cybersecurity policies so we can
define our governance programs.
And of course, we need to identify our risk management
strategies, right?
Alright.
So the protect function the protect function supports the
ability to limit or contain impact of a potential
cybersecurity event and outlines the safeguards for delivery of
critical services.
So we would look at establishing data security protection right
to protect the confidentiality, integrity and availability of
our information.
We would also manage our protective technology to ensure
that the security and the resilience of our systems and in
our assets.
And then of course, we want to empower our staff through
awareness and training.
The detect function defines the appropriate activities for
identifying cybersecurity occurrences, events, or, or
incidences in a timely manner, right? So in this case, we want
to implement a security continuous model or monitoring
capabilities. You know, we want to be able to monitor 24/7 365
days a year.
OK, we want to ensure that we can. We can detect anomalies in
events.
And we know their potential impact.
OK. And through all of this, we need to verify that our
protective measures are effective.
The respond function.
This includes appropriate activities to take right
regarding the detected cybersecurity incidence and we
wanna minimize this impact.
OK, we won't ensure that our response plan and our processes
are are expected during and after that.
We want to maintain a communication.
During this event and after it.
And then we want to analyze how we responded.
Analyze our activities and the effectiveness of our response.
And lastly, we're at the recovery function.
OK, this should identify the appropriate activities.
To many, maintain a plan for resilience and to restore
services.
That we're impaired during the cybersecurity incident.
OK.
In doing this, we're going to ensure that the organization
implements recovery plan processes and procedures, right?
And that these implementations.
Are are based on lessons learned?
OK. And they are communicated during the recovery activities?
I know that was pretty short. Any questions, concerns or
issues?
Before we move on.
Now this is an open-ended question. Anybody familiar with
the NIST CSF?
Cybersecurity framework.
Pretty sure we had to download it in the in a couple of our
classes.
OK, have you ever used the tool that will allow you to kind of
look through it like index through it?
By basically putting a query in the tool.
Nope.
OK, OK.
Right.
You see, if we can. So you do have it downloaded.
I did at one point.
OK, because if anybody does have it downloaded, I'd like to show
you how it looks. And so you have your your your functions
right. Your core functions. OK, let me see if I can find
something that that we could use as a visualization here.
OK, alright. So we see our five functions here, right? Our
function unique identifier, right?
We we can't see your screen, I don't think.
And this is how it's.
Oh, sorry. Let me do that again.
Share.
There.
Right. Can you see that?
I've.
Seeing it.
Yep.
I see it now.
Alright, alright, there it is. Sorry about that. Sorry about
that. Now we're only seeing a little bit of this because on
the other side of this this particular, I wonder if they'll
give me the other side of that. So OK.
All right, so we have our function identifiers here,
right? So you're looking through this, this, this framework,
right? And you're you're trying to use it, OK.
And when you look at it, you're like, oh, what's what's all this
mean? What does what? How do I use it?
OK, so you have your function unique identifier. OK, so these
are the basic 5 cores, right? You know you got your
identifying, you got your.
Help me out. You got your protect. You got your detect,
you got your.
Respond and cover right. So if we look at this, the ID, OK.
Is going to be, let's say for instance for identify the
category is gonna be ID is gonna be the category unique
identifier. So you're gonna look under that section. OK, if that
makes sense. Alright.
In that section, right?
You have subcategories OK and these subcategories are fixed.
OK, we're looking at.
Are five functions and then we have, I believe 23 categories.
OK. And then we have 108.
Uh resource or information. Informative references. OK, so
this is gonna point to other frameworks like ISO series,
maybe some other cobit, that kind of thing.
And.
Reference material that you can use to to build or to.
To fix this portion of your cybersecurity program, OK, so if
you cannot identify your assets.
Then your asset management is what?
Exactly.
If you.
Don't understand your business environment then?
How are you gonna communicate this to third parties and and
other partners and stakeholders, right, so.
You're looking forward to identify something, right? And
you need to identify your assets. OK, so how do you do
that? You go to the subcategory. Let me see if I can find that.
And I know those of us in cybersecurity, we've we've
actually seen this. But those of us who have not it, it's
actually a pretty nice framework.
Actually, if you're looking to learn like what you are supposed
to protect.
OK, so here we are. Here we are. So this is basically the full
function of it here. OK, so let's say for instance, that I'm
looking to identify assets. OK. So I'm going to look in this
framework with this IDOK. So under this ID, it's going to
show under identify right and I'm looking for asset management
AM OK. So identify. No, I'm sorry, that's not use that one.
Let's do business and business environment.
OK, so identify.
Business environment be so all of these are gonna have five
subclasses to it or subcategories to it. OK, so if I
wanted to identify my business environment.
I would have to understand the organization's role in the
supply chain.
OK, if I can understand that and communicate that I'm in good
shape.
But if I can't then I can look at.
Are informative references.
Which will break down what I need to find out.
OK. And a checklist form or what have you?
OK, so all of these elements, all of these elements, these
categories right here can be broken down into subcategories
and we can basically understand what we need to do to be
compliant.
Any questions?
No questions.
Now if you are putting it in the chat.
You can make up.
You know, don't worry about.
Yep, on Mike and ask.
I don't see anything in the chat, so I don't think anybody
got a question so far.
OK, OK. So that was pretty quick.
Move on.
2.
Master class.
OK.
The master class. What is it?
And anybody tell me.
I'm sure we've seen that, you know the.
The other company master class where you have all these
athletes and and singers and and all these professionals and all
these industries teaching you.
Right in your living room.
Virtually.
Well, that's kind of what this is.
We want all you subject matter experts.
And whatever subject that you're an expert in, or you feel that
you're comfortable in speaking and teaching us in.
To sign up for a master class where you would.
Lend us your expertise.
In your chosen field.
OK, the idea OK is to.
Well, to get get experience, you know talking and in front of a
group presenting in front of a group and presenting to a a A
leveled audience where you have some of us that you know don't
have any idea what you're talking about.
And then you have others who you know work in the same field you
work in and are pretty adaptive. What you're you're presenting.
So we get to practice a little bit, you know.
We we get the practice. How to you know, to present to a large
audience. OK and practice in the fun way. You know, we get to
pick something that we're pretty comfortable with.
And really share with the you know, share it with the team.
Do you have any questions on that?
So far.
I don't know if you've told everybody already or not, but
uh, I'm pretty sure Marjorie said that, uh, that it was, if
it's not already mandatory that it's going to be mandatory for
people that are in the Masters program.
Yep, so that is true too. So whoever is in the Masters
program, compare yourself to volunteer or be mandated.
For master class.
OK, a good question. Right now would be like, OK, what kind of
subjects can I use? Does it have to be IT or?
Any questions on that?
Really, we would like it to be IT, but if you are comfortable
talking.
About something that's closely related to IT.
That's OK as well. And for the master students that are, you
know, are mandated to do so, maybe bring what you are using
or what your project on your academic side.
Into this, OK and maybe.
Converse with us about that.
Or whatever you're working on here in the internship could
also be used.
OK, so if you're working on a project here like say for
instance SOF Dev, I believe you guys working on the loyalty
project.
Uh, you could talk about that as well.
But pretty much any and everything.
You know that that we could learn from is is on the table.
And it will be, I believe, every Thursday night at this slot.
Which would be, I believe, 9:00 PM Eastern.
And what we would like is a.
We would like to show a few of you guys. OK, so we're looking
at maybe two or three of you guys in a 45 minute window, OK,
so it's a 15 minute presentation.
Maybe slightly less, but you know, let's keep it at the 15
minutes so we can kind of.
You can feel, you know, at least you know something out of it.
OK, so 15 minute windows. At a minimum you can take up the
whole hour if you want to, or if you're gonna do more than that,
we probably can make some sort of arrangements.
But yeah, outside of that master students.
You're going to be mandated, so it'd be good to volunteer.
And.
Uh undergrads?
Mentors Consultants, department leads.
You are welcome as well.
All right.
Any questions?
I have a question.
OK, what do you got?
Are we? Are we supposed to be presenting something weekly?
In the Masters class, when it is your turn, you will be
presenting yes.
Gotcha. So like the sign up sheet?
Are you?
So are you a master student?
Yes.
OK. So then yes, you would need to sign up.
And you would need a topic that you would talk on.
OK, got it. Thank you.
OK. OK. OK.
Katie, if you don't mind me asking you what? What subjects
are you throwing around right now?
There could possibly be something you may present on.
Umm, right now I'm learning about.
How our bi?
Who? I like that one. I like that one, so.
Yeah, it's pretty close so far, so I'm considering, uh,
presenting that.
Business intelligence, huh?
Yeah.
Are you think you will work with your own set data set or are you
gonna do something that's already preinstalled with Power
BI? Just kind of throw it around. Give us some visuals
and.
Make us smile a little bit.
Probably something with the.
Like a base already, yeah.
OK, OK.
Thank you.
And Jason, what, what do you think?
I uh.
If you had to throw down a topic, what what would you go
after?
I was actually thinking Power BI also, it's something that I've
been working hard on this week.
Or giving some attention to this week and something that.
Well, well, I think is really important in the analytics.
Angle.
Umm but.
There's other things, too, if Katie's gonna.
Going to do that.
Yeah, but power BI is a big.
Big program, so maybe there's room for both of us.
Umm, maybe you guys could get together.
And get a data set and maybe model that and you know show us
a little bit of insight.
That's an idea we'll have to we'll have to get in touch,
Katie.
Yeah. And I think it's something to consider.
I do believe.
That power BI can be connected to a few of a other Microsoft
applications link link.
So you would be able to maybe possibly visualize user
behavior.
Ah, haven't thought of that.
Umm.
Hmm.
Just throwing around some ideas there. Uh, Google Analytics, if
you have that application that pairs well too.
So I mean, heck you.
Grab any data set that Google already has formed for you. Just
throw it in there. See how you can modify.
Hmm.
Yeah.
Well, thank you, Jason.
Benjamin. What? What? What are you thinking about, man? What?
What are you thinking about when it comes to, you know, this
master class kind of expertise. You think you'd wanna share?
Honestly, it's really great but.
I I never had any experience or work experience in any IT. So I
mean my PSC just a new entendo.
What? Uh, what's your degree? What? What are you going for?
Cyber security analyst.
Oh, OK. You ever mess with in math or any, you know, security
tools out there? That's a favor to you.
Sure. Of course I have been working on some of those tools.
Like a month.
What? Give me a favor.
Yes.
Give me a favor, you said Maltego.
Is that what you're going to say?
Now MC up.
Oh, in map. OK, OK.
Yes.
Alright, alright. So would you be able to like give us a
demonstration? Would you demonstrate something like that?
You know, like maybe like a.
Well, you can do a.
Like a pink flood or something like that. Just, you know,
demonstrate, like the normal stuff. Like, hey, network
discovery. Hey.
Uh.
Services, open service or services and open ports. Which
ones are they?
You know, or we can get really deep.
And maybe stop Metasploit from working.
Yes, honestly.
I have a walk on in numerous kind of you know on the network
services.
All right, now I I just, you know, come in here to see what?
How it's like a never had any preparation to try, explore,
explain anything right now. So maybe some other time.
No, no, no, no, I'm. I'm not asking you to explain it right
now, but when it's your turn, you know, maybe in that might be
one of those things that you could teach us a little bit
about.
OK.
Yes, absolutely, right.
Today's not the day, though. Yeah, yeah.
Hey, Nate.
Yeah. Yeah, you're absolutely right.
Nate Christopher at a Christopher at a question about
where to find the the sign up sheet. So Christopher if you go
into your Microsoft Teams and you open up teams and you get.
Hey, Ronald, just take him to it. Take him to it. You can. You
can share screen if you like.
I didn't want you, but OK, I can do that.
I'm sorry.
Ohhh, alright.
Alright. Are you seeing it?
Yeah, I see it.
OK. And then it's it's over here. Just click on files, it'll
take you right, right to the master class training sign up
sheet and it's just that easy.
Awesome. Yes. Appreciate it. Thank you.
Plus, it's in the PGIP tech organization announcements and
teams as well.
That sign in sheet there's a link to it right there.
Cool.
So have you shown them the sheet yet?
We have not. We should.
Yeah, we should chill them.
All right, here we go again, alright.
Well, like open it. Show him, Marjorie.
Thank you.
You know.
Yeah, they. Yeah, he's got it.
There it is.
OK, good.
Alright.
OK, so as you can see, we definitely have a lot of people
that have already started adding theirs, which is great. And I
would like you guys to maybe add a little bit more time like
Bree's gonna do 45 minutes, which is great and now the whole
point of master class is for you to be the master for 45 minutes.
You tell us what you are good at. We you know like the master
class where they have Gordon Ramsay and they have Morgan
Freeman and all those people, those are great. Well, we are
masters too.
The things that we know, I'm sure there's plenty of you out
there that know things that some of us don't know and what we
want to do is have you present the same Now some master
students, definitely. It's going to be in your thing. You have to
do it now and they're going to put that within what is expected
from you in your internship and as an outcome that you have to
complete. So what we've done is we've created this and we want
you guys to present.
Now it's not so much it can be the outcome of how you're
feeling about, you know, the outcome of what you've learned
so far, what you've done within the internship, what you've
learned and how things are going to help other new interns.
To understand what you went through, you know what I mean?
Maybe some shortcuts on doing things, maybe some help, just to
identify different things that you've learned in the process,
but.
We wanna see what you're a master of. What do you know
that? You know we're we're working on what we could bring
to the internship as well. You know, I have a whole business
side to me that I can bring to things like this. We had a
student that was a.
He was what do you call it? He was a a writer, one of the.
He was a text writer.
You know, and he was good at it. It was in in unbelievable. And
he did them quick too. He was so good at it. And he had he did a
a training for it, for the students. It's just showing
everybody about it, you know.
Umm, there could be a lot of different things that you might
do. I know that there are things that you can bring to us to let
us know what you know. So it's not just the 15 minute ones. I
think I'm thank you for doing that and we can put three of you
in there at a time for that hour which is great. And then you
have a 15 minute but like this one, Felicia, you'll have to
move yours to another day if you will. And Fallon, you only need
to do one unless you wanna do three of them. You go right
ahead. That's up to you.
Gives you more time to do these things and allows you to build
up some of that time. You know, for those 10 hours that you
need. Plus it gives you that time to to.
Feel out how to present to people. That's the thing to get
you more secure about presenting to people. That's the thing. You
know it it takes some people a long time. The best thing is you
don't have to have your camera on. We do that on purpose
because we know that's the first part of the fear of the whole
thing. It's not just talking to people, but it's, you know,
showing your face to different thing. That's why we say just
put a really great professional picture of yourself and we're
happy with that in your profile.
And that's good enough for us. But you know, other than that,
we want to hear what it is that you know about what can you
bring to us to help us out? And then we might be like, wow,
that's great. We're gonna put that into the internship.
You know. OK. That's great. Thanks, Fallon.
Umm. And like I said, if you wanna make that longer, change
it on there, pick another day, put in a you know we can change
things around. It's great because we're willing to sit
here and listen to you guys and all your smartness. So an
experience so.
That's all I'm gonna say. Cause now I gotta go teach a class.
Ohh.
Yeah. So.
Thank you, Nate. It's back to you.
Alrighty, thank you.
One thing though, you know, I do plan to present again.
OK, but I have a surprise for you cybersecurity guys and
that's surprise is First off, you'll need you'll need an
Android device, OK? And it needs to be Android 6.0 or higher.
And we are going to make a mobile pentesting lab.
Which means that I know a lot of us in cyber already know about
this, but Net Hunter has been around for a little while.
And it's best that we have a copy of our own.
So I'll be doing that here in a few weeks.
And I think that's all I have. Scott, did you have a question?
No, I didn't have a question. I was as happy about having an
Android.
OK. So yeah, you got the Android, so I guess to give
Yes.
everybody a little bit of a heads up.
And no cheaters, OK, because we're actually gonna be walking
through this entire process, OK. And the the demo walkthrough.
OK, so we need term Max. OK, TERMUX. OK, this is a Linux
numerator. OK. It's a little small guy, and it's written in
Linux. OK, some of us may know this already.
OK, the only thing that you need to do now is if you wanna get
you know if you wanna be advanced a little bit, you know,
be ahead of the curve.
You can download it now.
Play Store, Apple Store, whatever you're at.
They have it there.
OK.
We're gonna use this app, OK?
To build our net hunter, OK.
And for you guys that know Android and know Microsoft and
mobile devices, if you root the device, what happens?
It's a brick, right?
No more updates, no more nothing. It's a brick.
OK, so we are not going to root your Android device. This is a
non rooted method.
OK, so you're warranties and your updates are safe.
Any questions?
St ERM UX right?
Yeah.
As crazy, I used to play with a little bit, so I'll.
Failing with.
Ohh you did.
Yeah, just I saw it on Instagram. I thought it was
OK.
interesting and tried to fool around with it. And then I
realized I didn't have enough time taking two classes at a
time.
OK, OK.
We're not playing.
So.
Yes, don't. Don't play with it yet. Don't play with it yet.
I'll.
And any of the the preinstalled you know when you did term X you
got the landing page and it says hey if you want blah blah blah
repository or you want this blah blah blah blah story. None of
those repositories. OK.
Gotcha.
We'll, we'll do, we'll do the app update, we'll do the distro
update when we get ready to do the the net hunter installment.
OK. And make sure you got enough juice on your phone because it
it it will take some time to get net Hunter in there. I believe
it's between.
It may be as big as 40 gigabits. Let me check that to make sure
and I'll put it out there so everybody can kind of find out,
you know, kind of see how big it is and see if they can even do
it. OK, I would prefer.
Cool.
An old Android device.
OK, an old Android device do not use your Pixel 6 or your what
have you and.
Yeah, yeah. Old Android device and then we can. We can get you
guys going. This is a mobile pen testing lab. OK. Net Hunter does
not have the 300 plus applications that you would see
in Kelly Linux, Red Hat or or parrot. OK.
It's not as big as those huge Oasis.
It's a more focused on web application.
Security and mobile security, OK, and especially Wi-Fi.
And for US security analyst out there, we definitely need to be
a little bit sharper on the old Wi-Fi family.
Alright. Any questions?
Feeling you get a question.
OK.
Alrighty. If no questions, concerns or issues, I guess we
can conclude the call for tonight.
But those of us who are going to be giving a presentation soon.
You know, good luck.
And take this, you know, as an experience to you know, really
just be yourself when you when you're presenting and and find
your style.
All right.
So with that said, I guess we will conclude the call.
Everybody have a good night.
God bless.
Goodnight.
Alright. Thanks a lot, Nate.
Goodnight everybody.
OK, my.
Thank you. Goodnight.
Hi.
Goodnight everyone.
Night guys.
Goodnight.
Goodnight guys.
Thank you. Goodnight.
You're welcome. Goodnight.
Don't forget to stop the recording.
Yeah, that would be a good idea.
And UM.