Verdean the Federal Reserve was hit with more than 50 successful
cyber attacks and a five year span.
Which cost them 21 million background check records being
stolen.
And while it may be common for attackers to go for a low risk,
high reward target.
In the same article, the Cyber team tasked with protecting the
Federal Reserve stated that they were targeted by attackers just
as often as other financial institutions.
And these are just two examples of roughly 443 agencies which
help keep our country functioning to the capacity that
we utilize daily.
Next is the local system, so our local systems could include
emergency services colleges. Uh, utilities like sewer and water,
and more.
One example of cyber threats affecting these areas have
actually experienced first hand. So a college which I applied to
over 13 years ago my and you had a data breach.
I applied to the college I never attended, but they still had all
of my information on file in a database somewhere which was
compromised by an attacker.
So while this incident is relatively mild compared to
incidents that could occur to hospitals or emergency services.
It's important to understand that information should be
guarded and managed properly, because this can affect.
Individuals far beyond in the future, like me, 13 years, who
would who would have thought?
And this brings us into businesses. So when I first
started it, Purdue, I was working for an organization.
Which touts itself as the happiest place on Earth.
And looking around at their systems and networks.
Which they use for rides and operations.
There were actually multiple network SSID's which were left
visible to the public.
These networks controlled systems that operate live shows
and even some new and automated attractions.
Now it might not seem like a big deal, and some people might say
what's the worst you could do, run a kids day by taking down a
show or a ride.
But the reality is that these systems could cause serious
injury or worse to those on the ride or nearby. Some of these
networks control automated systems, which move large and
heavy objects and scenic pieces, safety mechanisms which monitor
for faults that would otherwise prevent an accident from
occurring. And yes, it probably would ruin that kid's day and
his parents after they spend $150 per ticket.
But on a little bit of a lighter note and to ease your minds when
you do go to the park, the SSID's that were visible to the
public are very hardened and they monitor those networks very
closely. I can assure you that.
But just thinking about the implications of these networks
being compromised made me realize something, which is that
in a place where happiness is the motto, threats and
vulnerabilities exist and need to be managed accordingly.
But what about individuals?
After coming to the realization how this field, the
cybersecurity, is critical even in what may seemingly be the
most innocent place on Earth, I decided to look inward at myself
and what my cyber posture was and how I could better protect
myself from being the victim of an attack.
The first step was gaining the knowledge about the various
types of attack attacks used to steal information.
These attacks range from phishing campaigns, social
engineering, viruses, malware and many, many more. Purdue
Global and the program, especially the internship
program, have helped me.
Prevent. Well, me and my wife actually from being or falling
victim to suspicious content.
We actually got a letter which stated that it was from the IRS
that we were subject to get money back. It turns out it was
a fraud. I looked up the address that was on the e-mail and it
was in the middle of nowhere, somewhere.
So it's important to ensure authenticity with everything you
do.
Uh security alerts with individuals and oops, sorry.
I lost my place here.
Ohh. Security starts with individuals and the more someone
knows about an adversary, whether it's federal, local
business or just to protect themselves, the better the odds
they have it actually not falling victim to an attack.
So who is cybersecurity for? I think the best answer for this
question is actually that cybersecurity is for everyone.
We live in an age of technology where there's no going back and
only forward so.
The better way the better we can prepare ourselves for the risks
involved in that, the better off roll be.
And that's it for me.
Alright, thank you. And yes, I do have questions and hopefully
you'll stick around till the end because.
I will be here.
Oh, great. Thank you.
And so Next up we have don't want dark mood.
Shane folkerts.
Are you ready, Shane?
Yeah.
All right, take it away.
Can you see my screen alright and hear me?
Yep.
Alright, so my presentation is on how far well works and I have
a little demo. After I talk about.
Umm how firewalls work? And then we'll go into two different
types of firewalls.
So the main functions of firewalls.
Are mainly to block unauthorized traffic. This acts as like a
24/7 filter that blocks anything suspicious.
You want to allow anything.
That, Umm, as a business need and block anything else?
You know, stuff that could be suspicious as like scanning like
end map. I know on the cybersecurity chat, Sean asked
the question about how do we bypass firewalls with nmap
scanning. And so, you know, that's just another, you know,
deterrent or way to mitigate some attacks by having a
firewall in place so that, you know, there's makes it harder
for attackers to see what's on the network.
Firewalls can also route traffic on they can do a layer three
routing such as like static routes, some dynamic routing
protocols like OSPF.
And BGP.
They can also do network access translation or Nat, which takes
private IP space.
And.
Can change it into a different IP, such as a public IP for
Internet access.
One of the ways that this can be utilized, uh, today is like
changing from IP V4 address to IP V6. If you only have a couple
I PV 6 or you know, sometimes I've seen in the networking
field it's hard to migrate to IP V6 so this is a good way of
doing so.
Firewalls also.
Are good at utilizing VPN's, for example, at work I use.
Say to say VPNs which primarily we use Ipsec and client VPN's
for users to connect from remotely to connect to resources
they need.
I'm at the company and then also.
Almost all firewalls can detect the state of connections that
are going outbound and inbound. This is called a stateful
firewall.
It has a.
State table that.
Watchers, all the connections going in and out of the firewall
and if they are established.
But I trusted source. Then they allow that traffic coming back
in.
Umm and the non stateful.
Firewall. You would have to allow that traffic.
Back in as like another rule on the firewall.
So stay full can be helpful so you don't have twice as many
access controls.
Umm, before we go into much more kind of wanna touch on the OSI
model so everyone's on the same page about what I'm talking
about like.
The first layer is like your mode of connection, like fiber
or Ethernet. Kind of how the data flows. Second layers like
your Mac address that you get.
Most of this is just local traffic on the network, and then
layer three is where you get your IP address and you can.
Umm, go across different networks layer 4.
Is where the TCP and UDP come into play.
And then session five and six.
Session 5 is responsible for maintaining ports and sessions
on the host and server side.
And then the main one.
Umm.
And then the last layers layer 7, which is what you know kind
of human.
Computer interaction.
We're kind of always see like the web page pop up, things like
that.
So.
Umm, that will kind of help.
And what I'm about to talk to talk about next, so.
Today I'm we're gonna be looking at two different firewalls.
There are many different brands.
But today I have a Cisco ASA and Apolito firewall with me and so
we're gonna do a little demo. So I just wanted to talk about the
differences and.
How they come into play?
So is this going ASAP? Umm is mostly layer three and layer
four. It looks at the source and destination address.
And also the ports.
And can also do TCP inspection so.
You can see I kind of have a a layout of different things that.
Uh, they say, can inspect.
Ohh DNS FTP.
Umm. And that bias and some others?
And this can.
And in my opinion, this kind of hurts more than helps because if
you are not falling, that application's not following the
same rules as what the firewall is looking for. It's gonna drop
the traffic.
And then moving on to the Palo Alto, this is called a A next
Gen firewall. You probably heard that term next Gen Firewall
means that you know it takes the IT can do application.
Inspection.
And do some like threat protection stuff as well.
So this can look at layer 7.
As the traffic's flowing through the firewall, it can detect what
application the user and server negotiating on.
And.
You know, last time I looked at this, there is post 1000
different applications at the Palo Alto has and they have like
a whole.
Umm. Kind of like Wiki on they're different applications
to decide which one you want to use.
OK. Can I show you that in the demo later but and then also can
do threat protection stuff like on preventing D Dos attacks.
Umm flooding, which is pretty much the same. But you just send
a bunch of packets to the network to try and kind of take
it down or crash the system.
And then it can also do SSL decryption which you utilize
Certs on the host to basically use the power tells kind of like
SSL proxy so that it can decrypt the.
Web traffic.
Umm.
So that the Palo Alto can.
Do some Deepak and inspection on HTTPS traffic as well.
Umm, so here's kind of of the flow diagram of how packets come
in so.
Kind of shows how firewalls kind of wash the traffic as it flows
through the.
Umm. Interfaces. So there's kind of an example so you have like a
internal user trying to connect to like a a web web server and
so it the packet comes into an interface it looks for existing
connection in the state table.
Umm, if that doesn't exist, then it looks at the the routing
table and says. Does this do I have this destination?
No. Then I'll drop it. If it does have a destination, then
does it have a an access rule that will allow it through?
Yes. Then keep going and then that rules, you know, is this
translated to a different IP address?
And then moves on to layer 7 inspection.
And if it meets all those requirements, it will allow it
through the firewall.
If any of those fail.
Umm. Then I will drop the packet.
Umm, so here's here's our kind of diagram that I'm gonna be
working through in the demo. So I just have a simple like.
And internal client network and they need to reach the DMZ where
the web web server is hosted.
They need to have.
Umm. OK. So for access rules they need to have web access to
the web server and then also management over RDP so that they
can manage the web server.
Umm.
The difference between Palo Alto and ASA is the Palo Alto uses
zones to determine kind of the source and destination. So.
Palo Alto will have.
You can.
So there's different interfaces and then you can tag them with
security zones. Is what they call it.
And so our different networks are gonna be the DMZ internal
and then the.
Untrusted outside source.
They say mostly uses interfaces. You can use zones, but you'll
see later how the access lists are actually tied to the
interface.
Umm so.
I'm gonna go into our Palo Alto and we can start our little demo
here.
So the Palo Alto, I'm gonna be using the GUI. I found that this
is the best way to manage Palo Alto. And then Cisco is say
there is a a GUI tool to use. But I found that because it's
kind of Java based.
It can be a little buggy at times, so see you I is best for
that one.
So I'm gonna start off.
With our network tab and take a look at our interfaces here. So
I have our our DMZ network.
Umm.
And then our outside untrusted source and our internal.
I just kind of have some.
Random networks that I made.
That matches our diagram.
And then Umm, so as we can see the DMZ source.
DMZ interface has a security zone of DMZ and so this is how.
You can create a zone to.
Drop these interfaces in and I'll show you how we apply these
in a minute here. So then if we come into.
Umm.
Arizona protection. Here we can.
Tie these kind of threat protection into our zones.
So we can do flood protection with UDP send attacks, you know
ICMP. You know just ways that attackers can attack your
network.
You know, like uh, host sweeps or port scans, we can alert on
those and take action.
Umm, based on the thresholds that we.
Umm have here which is.
Interval of two seconds.
And things like that. So now moving in.
So then, uh, layer three routing.
Kind of on the show you that too. So we can have OSPF, BGP,
Rep and then we have like our static routes.
I'm not. We can determine the interface to go out and.
Configure that four layer three routing.
And now?
So I'm just going to walk you through like, if we were gonna
allow our come back to here quick so we can see the diagram
again.
So we're going to allow from our internal.
To our DMZ.
Zones for these different ports.
I kind of had this setup so I we kinda walked through it. So if
we wanted to.
Umm.
Take a look at like our Web browsing.
Is this big enough for everyone? Can see it's a little small but
my screen.
It's pretty small, but I can kind of see it.
That little bit easier.
Oh yeah, that's easier.
OK.
So they come in our source zone and we'll be from our internal
client source and then our source network of 1010 ten zero.
Umm, so they choose our zone. That's where our zone plays in.
And then if we go to our destination, we would choose our
DMZ zone.
For the web traffic.
Which is on the 10:20 twenty network.
And then our application rules are here so that we can add.
Umm.
So where you looked this up, if we didn't know what applications
to use?
Uh.
So again, here I had it.
Umm, we can look up.
Like TCP?
That's really small. Sorry, just bear with me.
Maybe let me just try this.
So we were type in SSL and then come down here.
Umm, we can see that SSL means port 443.
And so this is the kind of the application wiki that I was
talking about. How you can type in like ports and it will come
back with the application that you want to filter on.
So based on that, we would come back here and put in SSL and
then I know from.
My work that it's web browsing for port 80.
So once we've put that in, you can also do services as well.
You could do TCP port 80 here and it will, but for most
things.
The application default like we saw back here is on port 443, so
it already applies.
On the port side of things. So as long as you have the
application in, it'll match the port in most cases.
Umm, there's a few things where that.
Does not apply, but for most part you can leave this as
default.
And then the same thing with like our RDP session. So we have
source internal from our client side network to our destination
DMZ.
And then application if we didn't know what that that was,
let's just say yeah, we want RDP.
And then we come down here and.
We're like ohh it's a Microsoft server, so we need Ms RDP.
And so that allows our TCP 3389 and UDP 3389.
And.
Umm, that will allow it there.
Umm.
Another thing, if you're like, I really don't know the
application, I have one for my management how I'm getting to
the Palo Alto right now.
And it has a cool feature and you can look and see the
application scene. So on this rule.
It's gotten three different applications.
And there's SSL, which is our 443. Our Web browsing which is
port 80 and I also.
Was pinging this appliance earlier, so you can tell here
that's using these applications where I can go ahead and add
this to the rule and it will apply the applications right
there.
And so sometimes if you don't know.
What to allow through the firewall you can.
At a blank rule, lots of traffic for a little bit, and then it'll
tell you what applications you know this web servers using and
you can add them manually.
Home to go into some other things.
I had.
Some rules here, so like the client VPN side of things, Palo
Alto has what's called global protect and this is kind of what
it looks like.
So you have like authentication server and authorization server
and once you connect with the username, password and hopefully
MFA you get connected to the network.
Umm.
There's also IP sections that you can create and have enough
time to set that up, but I'll show you in the.
Other firewall when we have a moment and then the cool thing
about Palo Alto is the Monitor tab.
You can see.
All the traffic that goes through the firewall and you can
see.
What zone it's coming from, where it's going to the
application that's using is allowed or not. So it's just the
state of the.
Umm session and so it tells you a lot of information and you can
dive deeper into it.
With the packet capture and you can download that and view it in
Wireshark later if need be.
Umm.
And that's pretty much all I wanted to touch on with the Palo
Alto and I'll show you the AC now.
Umm, let me make this a little bigger.
And everyone see the text.
Pretty small.
If not, I can make it a little bit bigger.
No, I'm on my laptop, so that might be why.
OK so.
I'm going to show you kind of the same thing. So we have our
different interfaces built out.
And the thing with.
Cisco ASA is that they have these security levels which kind
of act as a kind of access control.
Umm, so the higher the security level is, the higher the.
Kind of access control that you want so it blocks everything
from a lower.
Security level. So our untrusted source will have zero and that
means they can't go anywhere into our network. It can't go
any higher than 0.
Anything above that, like our internal?
By default, can get to the DMZ because it's a lower level and
it can go to the untrusted environment.
But you can.
Bypass this role by making access control lists, which, uh.
Show you right now one second.
So.
Umm are same rules but in text form that we saw earlier and
kind of not as fancy what the applications?
So we have our internal rules, so we have.
Our internal network.
We're permitting our TCP connection from our internal
network to our DMZ network. What for? For Edu, which is
classified as WWW. For Cisco they change it and HTTPS which
is port 443.
And then our.
RDP session for 3389.
And then so that's tied to the internal interface. And then we
also have to have a DMZ interface with the same rules,
because that will apply to our our DMZ interface.
Umm.
It gets kind of confusing depending on you know how you
look at your interfaces and stuff.
Especially in a large environment, when you may have
multiple Vlans connected to a multiple networks connected to
your firewalls and there's a ton of roles and so you kind of have
to be aware of, you know, how the how it lives on the network
and.
And that's kind of where the routing table comes in because
you can really.
Umm. Take a look at the routing table, see which interface what
routes go where and you can kind of track it that way as well. On
there's a cool.
You can just do show IP and it will show each interface and
what you know what's the name, what I what subnets associated
with and then.
Umm.
The tie that access.
A list to.
Uh.
An interface you.
It's called access group and that access group ties it to the
interface so.
You have your DMZ out and it's going outbound from the firewall
perspective to the web server on interface DMZ and then we tie
our internal.
Uh. Access group to.
Uh.
Inward bound traffic from our client network to the firewall.
So you're gonna have to.
Think about how the firewall sits on network too, so it gets
confusing.
And tie that to the interface internal.
And so that's why I kinda wanna show you the power to side of
things first. So you kind of get a grasp of how it works because
the USA is a lot less user friendly to jump in and kind of
see what's going on.
So then from there.
You know you don't have your gooey, you're looking at all the
traffic, so you have to do like a capture.
Umm you can pull a capture on any data that you want to look
at. So here I have a capture on.
Any.
IP protocol from our internal Victory External Network and
that will do a.
Packet capture and you can download that and look that and
Wireshark and analyze it further.
Umm.
I I had uh, some naturals.
Set up but I know.
Unless you work with firewalls, you won't get it.
Just, you know, just taking from the internal to untrust so they
can get out to the Internet.
And then also I had.
Hey, IP SEC tunnel kind of built out with AES 256 and SHA 256 as
well.
And then you have phase one which is 8/2 and has their
encryption integrity.
And.
And kind of how it builds the tunnel and then it takes that
and uses that to make an IP SEC tunnel with these encryption
standards.
Then you have like a what you want the flow or a tunnel with a
access list and the pier and stuff.
Umm.
I just kind of want to touch a high level on the two firewalls.
I don't wanna go too deep with, you know, it gets confusing real
fast even for me sometimes is doing this for five years.
Umm.
But.
Ah yeah, if you have questions at the end, we can. I can pull
these back up when we can look at it.
But that was all I had for now. Thank you.
Thanks Shane. That was great. Wow, I learned a lot and I do
have questions.
Alright, who do we have next? Steven, are you?
Ready to go?
Yep, I'm here.
All right, go ahead and take it away.
Alright, so I kind of deviated from networking and all that
stuff and uh.
When a different route to something that's new to me
within the last 30 days because of my new job.
Uh, so I deal with the intermodal transportation
industry. Now after being in a tech support role for a GPS
tracking company for the past 18 years.
Umm, so this kind of peaked my interest and just wanted to
explore it a little bit. A little background information.
On intermodal and it refers to the movement of freight by two
or more modes of transportation, and it falls into two different
categories, either international and domestic, where domestic is
just in the.
That North America.
And the international intermodal shipments is usually.
On a container that is 20 feet or 40 feet and length while
domestic containers are 53 foot, just like a 53 foot trailer on
the expressways.
Umm, in the US and the reason for them being 20 or 40 foot
containers for intermodal, is that 20 and 40, they go into
what's called a.
A 20 foot equivalent.
Unit that is used by.
The steamship carriers that haul the cargo from overseas to the
US, and it's just fits on them.
Uh, better.
For shipment visibility in the intermodal.
Industry.
They really don't provide visibility to see where.
The chassis and containers are and that's where the technology
part comes into play.
Uh, I found out that they use.
And EDI, which is electronic data interchange, to send that
information from the depos.
Umm to the carriers and it's a standardized format for the
interchange.
Of that data.
And then my wheelhouse is GPS tracking and that is one portion
of technology that they use heavily. Now they're becoming
more dependent on it.
And instead of seeing it like a luxury item that's kind of like
a business necessity.
So the electronic data interchange, like I said, it is
the exchange of information from one computer system to another
using the standardized business communication.
Umm, just kind of like all the other standardized information
in IT.
Some of the.
GPS technology that's used, it helps them to know the locations
of the containers in the chassis.
Umm, when they start and stop and then when they also open the
door or close the door.
And then the the other important piece of information is to know
when.
A container is loaded on or off what's called the chassis.
And the importance of that is to help them know where the
shipment is and the journey, and then also understand how the
fleet is being utilized.
And then any inventory that is hanging out in the storage
yards?
And then a big item is the recovery of.
Chassis are containers in case of theft.
UM, as you can imagine, there's hundreds of thousands of chassis
throughout the US.
This and they go missing in action and someone needs to find
them and it's really hard to find them when you don't have
GPS on them.
Ah, so that's really about all I have.
I found this very interesting. My husband's a truck driver, so
yeah, GPS.
Tracking. Yep, we use that.
That's right.
But.
Thank you very much.
Yep.
I'm nick. I is should be up next, but I'm not seeing him in.
I'm. I'm here.
Oh, you're here.
I'm here. I must be hidden. I I don't know how I'm gonna follow
Oh, OK.
Ohh, Nicholas. OK. It's Nick on the other thing.
those three. I mean, not nuts.
They didn't set the stage easy for me guys but ohh I'll give it
Do you prefer Nick or Nicholas?
to work, Nick.
OK.
Alright, thanks. Go ahead and take it away.
Alright so.
Ah.
Uh, I presentations gonna be on NIST compliance and audit
basics.
Uh, who and what is NIST? NIST National Institute of Standards
and Technology. I've got a link there. They found it in 1901.
Their government entity, government entity under the US
Department of Commerce. They're actually one of the oldest
science laboratories in the United States.
Ohh, and other than cybersecurity framework that I'm
going to go over, they also set standards and critical
measurement solutions help work promote equitable standards for
many different industries.
Little more about than a syber security framework cybersecurity
framework is considered the NIST 800 dash 171 cybersecurity
standard.
Uh, it's noted by the ISO ISO, ISO E 2700.
Colon 2018 standards being the standard and cybersecurity
frameworks.
It's not required for government contracts or anything like that
per se, but I have learned through working with a lot of my
clients that being this compliant is not only great to
show stakeholders, help, get potential partners, help attain
government contracts. I actually have work with one of my
clients.
Uh, they worked with the Coast Guard and the Coast Guard
basically was like, we want to continue working with you guys.
Uh, but we're gonna give you basically three years to come to
this compliant.
We're going to do our own, you know, audit on you guys in three
years. We understand, you know, grown up. So they actually came
to us. We're doing their third party in this thought it.
Uh, because apparently that's the way a lot of the government
needs to go in and they are wanting it, but they understand
a lot of companies don't have it from the get go, but it does
help.
Ohh and another thing is it does long term stress relief. Now
you'll notice that I go through.
The organization and the information that I show as those
going through cybersecurity program that if you look at
this, you go ohh. As my company has all this laid out, we have
all this in order or like you know knowing what to have in
order. This really helps your job and helps along the way to
make sure that your company not only compliant.
But helps keep the cybersecurity and the company in general in
good standing.
Uh, just a good cyber security posture in general.
So starting off the basics of the framework starts with the
function identify, protect, detect, respond and recover.
Those are the five main functions and then that goes
down into subcategories from there. So then identify your
asset management.
Business environment, governance. I won't go through
all these and and bore you guys with all this.
Uh, but as you can tell, they all have their own ID. The ID is
used, obviously it's just shorthand for identify
governance IDB as you're going through, and again, I'll go into
the subcategories and things like that.
Uh. And as you know, policies and everything are going in
place. This really helps to identify because there is a lot
of crossover between a lot of these items, a lot of policies,
procedures, things like that might cover something that in
governance might also cover part of the response planning and the
communications is all might lay into one policy so.
How having those short hand items there made it a lot easier
to keep track of everything. So for the branching into it as we
dig in so each one of these has a subcategory as well. So you go
into the business environment and you'll it'll dig even
deeper. So as you're going through an audit.
Whether it's your company again or auditing another company. So
in order to go through the business environment, you'll go
into the subcategories.
Uh again, organizations role in supply chain is identified and
communicated, so that's just going to be one subcategory. And
I will actually, I'm gonna put in the cyber wiki. I don't
believe I saw it there. I actually have a full spreadsheet
of basically a framework for the audit with the information that
has all of this.
Basically dug all the way down on the next slide, you'll see a
little bit of it.
Uh, because of the way it digs down, it really helps to kind of
go through and check stuff off. It's a basic, but we're does
work hand in hand. Nest works hand in hand with Cobit 5 and
again with ISO IEC. This shows 2013, 2018 is the newest, but a
lot of times you'll see 2013 on a lot of the documentation you
can find and then it goes through the SP-53 revisions as
well. So you can actually go and reference all of these.
To connect with these and give you more information. So say
you, you you know, you kind of don't like the way this is kind
of go well could correlate to or say you working with a client,
they go well, we've been we've been doing COVID or we've been
trying to go off the 53 standard. You can go back and go
through all that and go well. This is what correlates to that
in there. So you can pull that over, pull it out of what they
have currently in their binder for their cobit and say OK, you
do have that in place.
So when you're testing, testing, and verifying each control,
you'll go through those so again, and I'm gonna put this in
the cyber wiki for everybody. So you have your control, which you
can with the physical devices and systems on organization or
inventory. So that's asset management. And then it goes
down and control objective for that down to your controls and
then so this actually gives you the testing steps. So as you're
going through this tells you how you can verify that this control
where they're at. And this control as far as
implementation.
I obtain a copy of the devices and system different story
review the inventory considering the following, give through the
scope of the devices and again I'm I'm not gonna read through
all this in before you guys I can.
I almost thought about going through the whole thing, but I I
didn't wanna take up an entire hour.
But as you can see, as you go through these, a lot of these
and again you have software platforms and applications in
the organization are inventoried and there's just digs down
deeper. It gives a lot of times, of course, that you'll go
through these and you'll wanna figure out a way to organize all
this. So the way I actually organized this is I use Monday
boards.
Ah, if you don't use Monday boards you haven't used Monday
boards.
I love them. Phenomenal. So again, you look back and you go
with that physical devices and systems and we're in the
organization or inventory not implemented, partially
implemented.
So as you're looking at this, you you wanna go through the
assessed state and the target state for your client or your
company. So the assess state is going to be where are they in
this. So there's and this really has four levels and you can they
depending on where you look at and this themselves throughout
their website kind of has different ways of.
So.
Basically putting it so there's not implemented partially
invented, largely implemented, fully implemented. So it's
whether how far along. So if they have an as you can tell
from the slide before, there's a lot of items for each one. So
say they have one or two of these, they might be partially
implemented. So let's say they have three of the four items to
for this category largely implemented and then if they
have all of it completed and they have all the documentation
and evidence for it fully completed.
Uh. And then there's also target state, so a lot of companies.
Uh, again, there's a lot of items as you go through all of
these. Not every company will actually have correlation to it.
Not all of them will have.
Actually have that item to go. It'll be no, it's not
implemented, so you might have something that's not implemented
at all. That's not going to be implemented because they don't
use, you know. Well, we can do it here, but supply chain risk
management so.
You know, they say the a lot of places everywhere should have
supply chain risk manager. If you dig down deep enough. But if
a company didn't have any supply chain then.
You they'd be not implemented and they wouldn't need to be in
their target state.
Uh, based on it on the company. Again, you don't have to be
completely compliant for everything to be considered just
compliant. It just has to be what's compliant for your
business. They understand that they're it's a huge compliance.
They're not gonna dig down and have individual for each
individual company to say your organization needs to be this to
be in this compliant. It's really up to the auditors to
understand, to go through that which is why of course there are
certifications for this kind of thing.
I'm not certified.
But I'm definitely looking to go through get a quite a few of my
compliant certifications again on Monday boards as you go
through and you put that have these partially inflated large
number, you can put the evidence in the slot, make sure there's
always evidence and then notes to take as far as where they
could be, where they go, how I tend to work mine. So then once
you go through those.
You go to the policies and procedures organizing the
auditing process. So again, here's all of those.
Ah.
Prefixes and stuff for the.
For all their numbering lettering, so you know what they
apply to. So the cyber incident response standard the company
may need to have applies to each one of these buckets.
So when you go back into the audience, say, OK, you know it
applies cause the biggest thing you'll look as you, it's
redundancy. It looks like you have a million things to to do.
Really you only have about half a million because of all the
stuff that goes through.
What I like to do is again I I've used the Monday boards and
I'll put in a policy template.
Again, a lot of the uh, with my I second membership, you can
find a lot of policy templates and stuff like that. I know a
lot of the organizations that you can be a part of and join.
Also will have those for free policy templates, things like
that, or if you pay for any sort of the NIST audit programs,
there's a lot of programs out there to help kind of organize
and automate this process.
Monday boards just a much cheaper option.
And I like to organize things and create them my way.
Uh, so as you're looking at this, you put your policy in
here, the client will go through the policy and edit the template
so that it fits their company. And then.
Wow, what myself and my company likes to do is we go through
their edits and look at it and kind of go over with them and
say, OK, we see you made this change, this and change. We also
think that you should implement this or maybe you wanna add in
something else to go with it that way it gets compliant. And
then at the end of the day, all of these get put back into their
evidence bucket. The target state gets changed.
And again, that goes all the way down through all the sub items
and items and then.
Uh, once they have all this completed in the where they need
to be.
All that goes into again, we always, you know, have people
have hard copies. You won't have some sort of binder with your
compliance in it. And then of course, you have your hard
copies and that gives you the goals. Of course, what you want
to look into, what you want me to go towards. And then you set
a timeline of saying, OK, we need to take care of this. We
need to get these policies taken care of. And once you know what
you need, your team knows what needs to be done, what to focus
on. And then once you're actually compliant, it's just a
matter of maintaining that, maintaining your logs,
maintaining.
Uh, making sure that you have all of your standards in place,
that you have your communication and response, you know, stuff
updated as your company grows, things like that. So it really
is a great, I'm gonna say a great starting point, but it's a
great midway point to go from where you start to where you
need to be and then maintaining that as a company. So again, I
I've done quite a few of these missed audits through a lot of
clients and.
Honestly, I I wish we learned more about it within our classes
and things like that as far as.
Uh, the auditing phases, things like that. And just how easy
being this compliant or even COVID compliant, but having the
compliance standards in place can make it for a company.
And that's all I have.
Thanks. That was great. Wow, that was very in depth.
I I just tried to skim over the top as much as possible to be
honest with you. I I could have made that an hour or two, but I.
I below novice level when it comes to this stuff so.
So thank you, that was great.
Umm Jason, Are you ready? Jason Anderson.
Right can see your screen.
Yep, Yep. Alright.
All right, take it away.
Someone go over launching a Windows Server 22 elastic queue
compute coloured instance.
My screen back there we go.
So first you know what is an Amazon Elastic Compute Cloud.
Amazon EC2 is a web service that provides.
Secure resizable compute capacity in the cloud. The
service provides a reliable, scalable infrastructure on
demand and a variety of operating systems such as
Windows or Linux or.
I mean, there's there's a whole Amazon Web service marketplace
full of different Amis won't get into that little bit later.
Basically, Edu supposed around the security of being built with
the foundation of the EC2 with the AWS Nitro system. It's
flexible operations allow clients to make decisions and
performance and costs and mind all while optimizing the
performance.
Why choose any T2 instance? Excuse me.
Why choose an EC2 instance? Amazon EC2 offers a low cost
ability to host a variety of web apps, gaming, researching,
entertainment, and marketing services.
One of the more common uses for an easy two instances for
hosting anything from applications and software and
websites. The best part is that the compute capacity is entirely
scalable so that it can grow with the needs of the
applications. Scalability is providing ability and quality
service.
For all end users at all times, companies like Netflix and
Reddit are proof of this concept.
These this also means that companies can spin out large
testing environments relatively easy. This is made possible are
moving the upfront costs for hardware. EC2 can be used as a
medium for performing disaster recovery. The Elastic Compute
cloud can be spun up in a very short time, allowing businesses
to have faster failover for and minimize the downtime. High
Performance computing is on the rise in EC2 is equipped to
provide specialized virtualized servers that.
Provide both high performance networking and compute power.
This is useful for big data analytics tasks such as like
Pfizer and NASA are both using ET 2 for the High performance
computing capacities.
So when logging easy to instance, I start with
initiating the instance launch by going to the.
John blank. It's a dashboard and then you go to services and then
ECT within instance launch.
So if that, you're gonna choose an AMI which are procured for
the AWS marketplace. This is an online store where you can
essentially just buy software to run on EC2 instances.
Next, you're gonna choose that an instance type. This is
usually referred to as the tier one of the free tiers, as Tier 2
micro.
If any instance is labeled free tier, obviously it's free.
Make changes to the settings if necessary. Number of businesses,
optional scaling, group network settings. Next would be adding
the storage, which is pretty straightforward. Amis allow you
to select what storage, whether you want one or more storage
volumes.
Next would be adding tags for security groups.
And then you're going to configure the security group to
define firewall rules for the incense and other security
settings, and then last to review the launch settings.
And then law for the key pair.
So I am going to go through that now.
And this is for those of you haven't seen it. All the
services that 80 of us offers and initially you would want to
look for VPC, this is the virtual private cloud and to.
Review your networking configurations.
In here and there you can see your subnets gateways.
Anything routing related that you would need for.
Setting up your instances.
There, it's already been here.
One easy too.
We're gonna launch instance and you can have a long term plan
where we're going to where you can launch an instance from a
template that you have created.
So if you're a launch instance.
We're a name this.
PGIP tests cervone.
And like I said, we're going to choose a Windows Server. This is
where you can go into or more different Avi aid MI's and
choose Linux Mac. The wide variety of different types of
whatever. But for this is something you say Windows Free
tier.
And we're in choose a free tier instance type.
So I have a key pair login made, but I'm gonna go ahead and make
one with for this purpose.
KP and.
Download that.
Next, again, you'll hear network settings. Choose a security
group. I'm going to choose one's already preexisting, and that
should be this launch wizard.
And kind of figure your storage 130 gigabytes will be fine for
this.
And one instance is set up there, you get launch, you will
instances and our PGIP test server is currently spinning up.
We'll wait a few minutes and let that load.
All right, it is up now.
Connect so Windows so I can use RDP.
And.
I have the password.
In a moment when you get the password.
Create global.
Key pair.
Open slack, that keeper, don't decrypt it and give me the
password to log in.
Our KP.
No, no.
Let's pass.
Word.
There we go.
And.
This is our brand new.
When the server 22 EC two instance.
And you've ever use Windows before. You don't take some
moment where to set up.
And from here you can.
You can do anything you could do on a physical.
Legal server.
Discount.
That's all I have.
All right. Thank you.
OK, I will open up the floor to questions.
Umm, Felicia, you have your hand raised. Did you wanna ask the
first question?
We can't hear you, Felicia. Are you double muted.
Umm. Does anybody else have questions?
If I do.
We'll start with Brett.
When you were talking about personal.
Security on your own system.
Have you ever used the USB authentication key?
You know, I've looked at USB authentication keys like UB Key,
UM, but I haven't really gotten that far. I've been I've been
hardening my own system with firewalls, actually have two
firewalls in my home network right now.
As well as subnetting it, but UB key is something I've definitely
been interested in. I just haven't. I haven't delved into
that part yet.
That it's my understanding that it's more secure than MFA's.
Yeah. Yeah, mine too. And I know it's a lot of. It's a. It's a
big standard for a lot of federal organizations to use
authentication keys like that.
Umm.
Yeah.
So it it, it has peaked my interest very much so.
Yeah, that makes sense, yeah.
Yeah.
Great. Thank you.
Absolutely.
Umm Shane.
I've heard a lot about Nord VPN, but I've never used it.
Have you ever heard about Nord VPN or which? Which VPN do you
recommend?
In your experience.
Umm, I don't really use VPN for personal stuff. I've found that.
You know you only need it really if you wanna get different
content from different.
You know, if you're trying to get a certain show on Netflix
and use a VPN to say you're in Australia or something, but.
You know, really ohg the only time to use a VPN is really if
you're on like a a network that you don't trust, like Hotel
Wi-Fi or something like crypt your traffic so that you, you
know, they can't spy on you, but.
Really.
I haven't found a reason to pay for VPN servers just for at
home, but some others might have a different view on that.
Yeah, I haven't ever gotten one, but I've I've heard that they're
great for if, like you said, you wanna watch Netflix in a
different country or something like that?
So Angela, on that note.
One thing that a lot of the antivirus suites come with like
I use.
Uh, I have a a bit different armor firewall and my system, so
I actually had the bit defender total security that comes with a
VPN.
That you can use. I know a lot of them. A lot of the companies
depending on the game, what antivirus use, they have VPN you
where you can get so much data for free and then if you will of
course we're using it all the time.
Uh, again, if you if you take your laptop and you go and you
wanna work from like, like, chanted said. If you're going to
Panera, something like that where you wanna work from a
public, you're not using your own hotspots, things like that.
And even when you're on your own hotspot, I always use it
anyways.
But again, there's I would just check if you used an antivirus
and see if it has the VPN attached to it. That gives you
at least a limited amount.
OK. Thanks.
Yeah, I'm. I'm gonna be taking a trip to Germany to visit family
over Christmas, so.
I I think I want one by then.
Yeah. And and again, even if it gives you a limited amount, I
know most of them, no, you can just pay. You know you can use
an upgrade, you know directly with theirs and it works
directly with the with the antivirus switch when it's it
seems to be a crapshoot. I think there's been three or four of
the different VPN systems that have had their own troubles over
the last few years, so.
It it's they are what they are, but it's gonna be a lot better
than not having one. But yeah, not being on the public networks
is always the safest way to go. But of course, you can't always
help that.
And don't use a free one.
Exactly. Yeah. Yeah. Don't. Yeah. Don't use a free one.
Oh yeah, no.
That's what I'm saying. If you're paying for an antivirus
software, the free one on there, it's not free. You're paying for
that minimal amount. Yeah. The free ones are.
Yeah.
You could always like someone said in chat you could use like
open source and create your own. I have I have a firewall at home
that can have limited VPN connection so I use that if I'm
going anywhere too. So you could do your homegrown one.
And looks like Carrie has a question.
For me.
I was just piggybacking off of the VPN. I'm my husband's Navy,
and we lived in Japan for four years and we had to have a VPN
to watch Hulu and Netflix of everything, and we used it
express VPN. I think it was like 495 a month or something like
that and it never failed us one time.
Nice. I'll I'll look into that.
Yeah, I watched a lot of YouTube tutorials and they always have.
Express was one of them or Nord VPN ads and there's some.
Yeah, that was the the express, one of the one that we used on
base.
Into that bakes. I also had a question about the TLS.
Shane.
Because Umm Marjorie tasked Nate tonight to update.
Yeah.
PGIP's.
TLS.
Which version do you use to use 1.3 and above?
Uh, I don't really manage servers that often, but I think.
Umm, I'm not really sure on the standards actually, sorry.
OK.
That's alright. It it was something new to me in that just
caught my eye.
Because I I never done it before either.
Yeah, I'm just a network guy.
And it.
It was interesting to learn that SSL is the old way of saying
TLS.
Yep, I knew that.
Yeah, and.
They're the same thing.
And Angela. Yeah, Angela, I think 1.3 and later or it might
SLV 3. Sorry.
be 1.4 of four TLS.
Right, I think we ended up doing 1.3 and then a wild card. You
know, at least one one point 3.
In terms of SSL to TLS.
What happened was.
You have to do a little handshake.
Umm, you know, with what you're connecting to, so on and so
forth. And so there was a vulnerability in that handshake.
In SSL, that took a really really, really. I mean it was
there for a really long time, but it was found. So they
changed the handshaking and then they renamed it to TLS for I
don't know what reason.
Ohh.
Yeah, it's trans sport layer protocol, security, security.
Yeah. Security protocol. Yeah. So it's just the handshaking
Yeah.
that changed not anything else, so you know.
That's the difference.
Yeah. And 1.4 is the most secure, but most.
Use 1.3 and above because if you have version 1 to 1.2.
It's hard to have that handshake occur if somebody you know the
client side has a lesser.
Version is my understanding.
And Steven?
I was so interested in yours because like I said, my husband,
he's an owner operator in an over the road truck driver.
So.
I can see a lot of the GPS things being used.
In other transfer domestic transfer places and I hope that
the dot or even the company he's leased to don't learn that you
guys can track container doors when they're open and shut
because then that'll be just a nightmare. Ohh, his trailer
doors open.
He must be at the place.
You can see your unmuted, but I don't. I don't hear you.
Now, can you hear me?
Yeah. There you go. I can hear you now.
This stupid button on my headset.
Yeah.
So so you you deal with the container, the GPS on the
containers, right? That's what you say?
Yeah, it just started dealing with the containers and the
chassis. UM coming from.
The ports on.
Mainly from California and.
Umm.
Up in New Jersey.
Umm, I'm dealing with 40,000 GPS units.
OK.
And then the whole fleet is 100,000 trailers and chassis and
containers together, which is.
Wow.
It's, uh, 95,000 more devices than I've ever touched on my
life, so.
Wow. Yeah, I bet. Wow, that's a lot.
So that's all.
So yeah, that's that's very interesting. I like that.
Thanks for sharing that.
Yep.
Absolutely.
In doctor, or did you have any questions for Nick?
He.
I'm sorry, Jason, go ahead.
I was just gonna ask Steven, I deal with a few GPSS and my my
job. But how do you keep them from being tampered with?
Because I know they have to be on the outside of whatever
you're using.
Is that an?
That is something that will probably never be solved.
OK, huh.
I I've always said dealing with GPS tracking for the past 18
years, you can't really hide a GPS unit on something that is
outside, like it's easy to hide it. Yeah, if you want it to
Yeah, if you want it to work.
work, it's easy to hide it inside a vehicle under a
dashboard.
But a trailer and a chassis, it's outside in the elements and
Hmm.
it's metal, so in metal blocks the signal so.
And a thief with the sledgehammer can smash it off a
trailer.
In two minutes.
Yeah. Umm.
Trying to think of how to fix that problem, we'll take some
There's a will. There's a way.
noodling.
Let's say at that point it's just a matter having a having an
Exactly.
alert when when it goes offline that says hey, this is where
when offline, when and you have, you have to do a miles and time
correlation as far as where it could possibly be from there.
Pretty much.
Yeah, look at all the the Wi-Fi scooters out there that you can
rent. They all have trackers on them too.
Yep, exactly.
Somebody get your protractors out.
That's right. And get your little your compass.
Your compass. We're we're just gonna make a little circle here.
We're going to drop circle.
They gotta be within this radius.
We're gonna do a little CSI.
Everybody here knows what a map is, right?
Nick.
Yeah, right. Not Google Maps.
Yeah. Do we know how to read them anymore?
Like like piece paper, we lay out, OK.
Uh, nick?
We're.
You said you worked a lot with compliance with those audits.
Yeah.
Yes.
Have you in Fallon gotten together, or have you kind of
taken her under your wing?
I have not, mainly because I have not really had a whole lot
of extra time.
OK. Yeah, understandable.
I she's a lot further along than like the jersey stuff than I am
OK. Yeah.
because I'm working compliance. I'm also working on.
Uh, a few different company, somewhere with Sophos. I'm going
through the Palo Alto certified Network engineer training as
well.
Umm.
So doing both of those is kind of put a little bit hindrance on
my compliance training. But yeah, actually I'm, I'm.
Right.
So maybe she should take you under her wing.
Yeah, maybe that's what I told her I was like, maybe when
you're done, I'll have to get with you and you can. You can
give me a study guide. Run through on the GC stuff because.
Ohh, I'd like to know that I'm I'm kind of looking at a focus
towards the engineering side, but I definitely enjoy the
Running.
compliance side so.
Right. It was interesting to me. I I had to do a little research
on it to try and give her a task when she was in our department.
And yeah, it's interesting. I like it.
Yeah, I did. I did have a conversation. her and I went
back and forth for, I think about an hour or so for a while,
just kind of choose, let me know where she was at and kind of
discuss. Now it's kinda giving him some ideas. And of course
the.
Ohh.
Some of the paths to take, but yeah, I think she's probably
gonna be a lot further along than than I am as far as, you
know, GRC compliance by the time we're done. So, yeah, I'll
definitely have to hit her up on that. She seems to be flying
Right.
through that pretty quick.
Yeah, yeah.
That's great. It's it's interesting. I like it.
Like it's, Umm. Does anybody else have any questions for
anybody?
No.
Doctor. Or did you wanna talk about a little bit about the
presentation that you're?
For next, for next Tuesday.
Yeah, for next Tuesday.
Ohh sure.
OK.
So I I teach the.
Capstone for the Masters of Science in cybersecurity.
And so I have two students that are going to present live.
And that will be next Tuesday night between 7:00 and 8:00 PM
and I'll. I'll be getting that information to Marjorie or you,
Angela.
And we'd love for our interns to come listen to the live
presentations. This will be the first time that we've done this.
Usually what I do in place of this is they do a presentation
that is not audio narrated.
And so that kind of simulates a a live presentation. But yeah,
so you guys are invited and I hope you come.
Yeah, if you get me the link and UM, some of the specifications,
Yep.
I can put it in the announcements or announcements
Very.
chat where everybody can see it.
Very good. I should have that tomorrow. I'm. I'm waiting.
For a one student tossing around different titles, first
presentation, so I should have everything ready tomorrow.
OK. Yeah.
Thank you.
Just shoot me the link and it was at 7:00 PM.
8:00 PM.
88 PM, OK.
Next Tuesday night. Yep. Thank you.
Alright, Umm.
And good job everybody.
Yeah, you guys did great. I I really enjoyed it.
So if there aren't any.
I agree. Thanks everyone. I I just wanted to say great job,
everyone too. I was here listening to all of that. I
always learn a lot from this group.
Because it's scary.
But thanks to everyone.
Yeah, because all did a great job. I I really enjoyed it.
So thank you to Brett, Shane, Steven, Nick and Jason. And if
that is all known further questions, I'll let you guys.
All. Enjoy the rest of your evening.
Thanks.
But.
Goodnight.
Thank you. Have a good one.
You know, everyone's like guys.