Welcome to another great master master class.
Carlena you wanna go first?
I'm glad you asked. Let me see if I can share my screen.
Alright.
Bear with me, everyone I know I'm in tech, but this part
always gets me. So give me one second.
OK. And everyone see my screen.
Yes, we can.
Ohh wonderful. Actually did this right. Great.
Umm.
This is not what I wanted, so sorry this is very very same. I
apologize everyone, I am still adjusting to this and I don't
even know what happened to my slides.
Give me.
That's odd. There we go. That's not what I want.
Look.
OK, don't I have, are we starting the recording?
Now.
Yes, you started.
I started, yeah, I started it already.
OK, I'm gonna put up the agenda. Yours was 88 compliant form, OK.
OK, alright. So hi everyone. Today I will be talking about
how to make a ADA compliant form. Basically just to give you
a brief overview of this, what should we see in my presentation
today is one, I created a form that will be 88 compliant and I
will also as well go over a compliance.
So what is 88 compliance? Is the American Disability Act is a
compliance, are a specific guidelines for public
organizations. So follow to make devices such as computers and
smart devices accessible to individuals with disabilities?
Since, so why is 88 compliance important for websites? Well, in
short, you can be sued under U.S. law. Anyone can sue for
website is inaccessible. This can cost the website owner
hundreds and thousands of dollars.
And how to make your website ADA compliant? You can enable
keyboard navigation. May Internet users are unable to
navigate through a website via mouse, making them rely on a
keyboard and input devices. You can also include descriptions
for images. This conveys information to the users, for
example, that may be blind will be the description of what that
image is.
Test all forms on the website. Labels must be clearly defined
in fields must be used visual cues.
In addition an.
To make your website 80 comply, you must avoid content that
could trigger seizures or other physical reactions, since some
users may suffer from epilepsy and or other medical conditions,
no element on the page should flash more than three times per
second.
Next, I have the tools that I actually typically use for when
just testing for 80 compliance. So the tools that will typically
use even though there's others are out there, is wave, web
accessibility and lighthouse.
You can use this checking to see if your website ADA compliant.
To go into further detail about what these tools are.
So wave web accessibility is an evaluation tool that helps
authors make their web content accessible with people with the
disabilities. Wave can identify many web content accessibility
guidelines, which is also known as WC AG errors. The screenshot
that I actually able that actually took that's on your
right hand side. It was just a website that I found and it's
just showing what they look for, errors, contrast, errors,
alerts, features, structural elements and Aria.
I will get into that shortly of the moment, actually show you
how this store is using actual website.
Next, this is lighthouse. This is used to improve the quality
of web pages. It audits for performance, accessibility,
progressive web pages, search engine optimization and so on.
So what you see here are the scores that do come up when
Lighthouse is used, when it goes over testing a website. This
small piece here that looks like an icon. This is the actual
website that I actually use lighthouse on to test its web
accessibility.
So next, now how do we make your Form 88 compliant?
So the tags that you can typically use, and I'll also
speak for myself what I normally use is an Aria label. So this
defines a string value that labels an interactive element.
You'll use the label tag just to find the label of the element,
and Alt. Well, Altrip is typically used for images to
convey what the image is.
So now I would like to show you how web accessibility is used.
What I will first like to go over with everyone is voiceover.
So I actually created a form.
So the former was created was just.
Cover an overview of what everything is. So as you see I
have an Aria label used label use things that you would
normally use in your form when you wanna make your website
accessible. So when we run in debug it.
So this is the form.
Now the main feature that I want you to see here and I please
everyone if you could.
Uh here, it that'll be wonderful. I'm just gonna enable
the voiceover so you can hear how web accessibility is
actually utilized.
I don't hear anything. I don't know if you're tabbing through
yet.
Speak. I'm so sorry. No one can hear anything.
Did you share with audio?
No, I'm actually playing it live, so you're not able to hear
it.
You. Yeah, you need to share. I thought you had to share with
audio. Even if you're.
Yeah, you'll so stop. Yeah, you click the stop sharing.
Playing it live.
And then go to your share trade.
And then before you click the screen, there's a toggle that
says share computer sound.
Ohh I see.
Makes sense. OK, I will do that right now once again to
everyone. I do apologize. So I will do this over, OK.
So let me share.
All right, so everyone should be able to see my screen again, is
that correct?
Yep.
OK, great. So I'm gonna run and debug it.
Yes.
Yeah.
And like you guys already did before, please feel free to
interrupt if you do not hear anything. OK, thank you.
Yeah, I don't hear it.
Yeah, we're not hearing anything.
OK.
OK. I do apologize. You're still not hear anything, but I shared
it with audio.
Right.
OK.
If you want, I can actually just move on and I can try to fix
this later and we could just come back to me, if that's OK
with everyone.
Sure.
Yeah, that's fine.
OK.
OK, wonderful. Thank you.
So.
Max.
Umm, just to go over?
Web access, sorry web accessibility. I was showing
what the passing grades will look like, so it'll have a level
of either a showing basic web accessibility.
A two ways which is strong accessibility and three
excellent accessibility on the website that I will actually be
using the wave tool on specifically is just gonna show
you exactly what's being graded to the team. So give me one
second.
Yeah, I think I can do this on any website. It doesn't mean you
have to be that.
So this is the website that actually ended up using.
So here I have the Google Chrome extension on how to use wave.
When you click this.
It actually marks where everything is, where they say
suggestions really of what will need to be fixed. So just to get
an overview what everything is, you will go to details and
actually explain to you what's missing. It will say here you're
missing a form label, button links. They could show you where
your contrast errors here are and these are also just alerts
if you actually want to get more details of what each section
explains.
This little I icon will actually tell you everything of what's
missing, what's being looked for as far as going over.
Basically your how everything's ordered structure, showing all
your headers, and then your contrast with this goes into if
it actually pass. If this is actually web accessible as you
see, it gives you a score for this entire website as a pass.
So.
Umm, that's what I have for now.
So at this time.
I guess just to let everyone know that I will be graduating,
we'll do for graduation, February 21st, 2023. I still
wanna work on the.
Voice over a slide. So I'll be working on that for the time
being, so everyone can hear what that is like.
And that's my presentation for today. Thank you everyone for
being here and listening.
Per job.
Nice job I am. Is that something that you've done before,
carleena or?
I.
Ohh for 88 compliance, yes I I have actually worked on it
Umm.
before I tested it out.
On a website before that I created. So unfortunate I
actually wanted you all to hear how Voiceover works and the
importance of why you should always put labels on your forms
using Aria labels and everything so.
What the whole voiceover was showing and that point it was
that any time that a user, if they were just operating on
their keyboard, if they went to a text box, I made it clear
where it's like, enter your name first and last name. And I also
have instructions saying that this is a required field, that
they cannot leave it blank. And when as far as radio buttons, I
use a slider or.
Basically, if someone was visually impaired, there will be
able to understand exactly what they're doing on the form.
So this is probably the most indepth I got with it. So I had
I did a lot more research and I think this was a lot more
rewarding than my last one because I got a much much better
understanding of how to use a A8 ohm understanding 88 compliance
as well as Aria labels.
Yep, that's neat. Also, semantic HTML helps with screen readers.
Yeah.
Ohh OK awesome.
Great job. Thank you for that.
Thank you. Thank you so much.
And who is up next? And I have trouble with your name every
time is it?
I can do it this Kenny.
OK, Kenny, Kenny wants to jump in.
OK, Katie, you're up.
Already so.
Say 1.
Over one second.
Is everybody seeing my screen?
Yes, we can.
Uh, it's us tonight. I'll be talking about why? Shock. I just
recently alone.
About why shop like due to my during my class.
What the Purdue. So his go up. So so as you can see the several
things that you can do with Wireshark does package
capturing, filtering and visualization.
And as you can see on the slide and then here's some more
information.
SO4 package capturing. They capture a live package data from
a network interface and they save the package data captured
and then they also export all the packaging. The number of
capture file format.
Next thing they can do is the future package on many criteria,
so you can actually filter by the on how the way how do you
want to filter, and then the third thing that can do is call
call lice package display basket on the filter display back
package was very detailed pro call information and create
various the statistic.
Now the purpose of using WYSHAK is to triple dumb network like
people who worked on a network administrator can use to travel
trouble, shoot network problems.
For security engineering, they can use exam like examining
security problems.
QA can use like QA, engineering can use it to verify network.
Application developer can use it for to deploy debug Pro calls at
the Mentation and we all can use it to learn network protocols
internal.
Here's us, uh, the vanishing of using why shark and why shark is
not open source software project that is is released under the
GNU which is the general public license.
Umm you can fairly use. Why shark on many numbers of
computer you like without worrying about license keys?
I'll see. I'll such as. In addition, the source code is
freely available under the GPL.
And you can use it for either window or Linux or Unix and also
Linux too.
Which I will show you how to install it on Windows and Linux
later.
Now it says additional advantage of using when you're using. Why
shock Washnock is in a institution detection system, so
it will not warn you if someone like do something strange on
your network.
It will not like.
Basically, measure things like like. It's only measure things
format.
It doesn't. It doesn't stand package on a network.
As you can see that.
Umm.
On next slide, so the common use for.
Why shock so?
Umm, so yeah, she will look at this picture. There's some.
In the picture, showing that there's the IPC and IP V6
Internet message control portal call traffic.
And then you can also see that the drill down to identify the
identified a network problem.
In there. So that's the in the screenshot which I can show you
later too.
That's a more information in regards to common use. Now, why
show is often used?
I I too identify more complex network issue. For example if a
network experience too many retransmission congestion can
occur.
By using Weishaupt you can identify identify specific
retransmission issue as shown in the picture to the right.
Now for window all you have to do is just go into this link
watch shark.org.
And then you can just download depends on the versioning hat.
If you have a 64 bit then I would recommend you to download
for the the 64 bit Now full Linux.
This is the step to download from Linux system. All you have
to do is just run the pseudo.
Apps get installed. Why shock and then it will.
Did a rest for you.
Now the package capturing once you have installed the
Wireshark, you can start grab like the package. No network
traffic.
So once you open up, why shop? It will give you the options to
select which network you want to do the package capturing.
As you can see on the right hand side that is the option that you
can select.
That's the option.
Here's some more information regards to package capturing.
This window list are available in the face and this case why
shop provides several to choose from.
And for this example you selected Ethernet 3 interface
which will mostly.
Active in the face while shock visual.
The traffic by showing the moving line.
Which results represent the package on the network. Once the
network interface is select, you can do simply click the stop
button to begin your capture. As the capture begin as possible to
build the package that appears on the screen which is showing
that figure.
Now, why should capture all the package that you want? You can
simply click the red scramble at the top. That's mean that you
can stop the package from capturing.
Now, if there's some carrying rules in the one way you using
the Y shock. If you look at the charge to the right, if you see
a light purple, that's meaning, that's a TCP.
Have you see a light blue is the UDP and if it's black then
that's mean. That's the package does narrow with the package.
Light green means there's HTTP traffic, yellow light yellow.
Meaning does window Pacific traffic including server message
block.
And not BIOS. Dark yellow mean routing and then dark green mean
a TCP sink, thin and ACK traffic.
The as you will see them figure these are the color-coded.
Now figure to the right, show the default curing rule. You
can't even change the default or apply a custom rule if you don't
want any calling at all, you can go to view and then call life
packet list and just jungle.
Don't go to that if you want the color calling back, simply quick
go back and click on.
The curl lies packets list again. It's possible even to
collide some specific conversation between computers.
And this big you can see that the UDP, the standard UDP and
the light blue.
Which is this right here?
And the TPA is light yellow. I'll get light purple TCP and
shake and and dark Gray, and then the routing traffics in
yellow.
Which I can show I can run the washuk later to show you.
And this is a 5 minute video on.
To run the white shark. So once you open the Y shock application
you will see the screen right here and watch the this is I
basically run this on a Wi-Fi. The once you select Wi-Fi.
You can see that it's run.
So double click on it and you should see it runs.
So it's actually capturing the package right now.
Which I always thought the veto here and I'm actually gonna pull
up white shark. So that way you got can see.
The way you pull up white shock, you will see the screen right
here.
And then what I do is I just double click on the Wi-Fi since
I'm running Wi-Fi right now. I double click on it and it will
show you all the information. So let's say for example that light
blue is.
And the light blue it was show as let's see one second.
A standard UDP. So if you know this, it's actually if you go
under pro call, it will show that the light Blues UDP.
So right now it's running right now and I'm capturing the
package right now.
And if you know this as at the bottom, it said life capture in
progress.
And that's all I have for my presentation.
Very nice, Kenny.
I enjoy wire shark.
And so actually fun.
It is.
It truly is.
Have you just been started using it or is it something you've
used in the past?
I I was you using during my classes on the class side. I was
like training through it and went through some training with
it and then I realized that I enjoy with it. So that's the
reason why the presentation on it.
Hey, awesome. Good job. Good job.
All right.
Like I said, I'm I don't want to mess up your name. It's hard.
Hard to lemish.
Yes, Bart. Bart. Like The Simpsons.
OK. All right. I'll call you. Bart, you ready to go?
Yeah.
Yep.
All right.
Yes, the same screen.
Yes, we can.
OK, great. Alright. So today I'll be presenting to you guys
the Wi-Fi pineapple Mark 7.
OK, so here's a general overview of how the Wi-Fi Pan pool looks
like on your left side you have the Mark 7 basic, then you have
in the middle the Wi-Fi.
Adapter.
And on the right is them together, size wise, they're
probably as big as your hand. I don't know. Say like 8 inches, 9
inches maybe.
Uh from the left. This will cost you around.
$120.00, it's just for the basic the adapter is $80.
Together they have a package on hack5.com for $200.00. You also
get a carrying tote, which is pretty cute as well.
Ah, some general features. Do I have a pool from Hack 5 is a
versatile tool that can be used to perform network security
audits. It is a small portable device that has the ability to
create an access point and act as an attack platform. It
includes advanced features such as multiple ssids, rogue DNS
servers equal to an access point, the Wi-Fi pan. Apple can
also be used to perform man in the middle attacks denial
service attacks and social engineering attacks.
Uh, just a few little specs here. Without the adapter, you
do only get 2.4 gigahertz, something that's pretty
interesting about this is these are really high gain antennas,
so people having reporting, they'll get up to the 20th
story, let's say in like a downtown, for example, Chicago
area, you will get up to the 20th story of Wi-Fi access,
which is pretty interesting.
There is three ways you could actually connect to this.
One is through USB C.
The second one is SSH and the third one is by connecting it
through a web browser.
So this is the adapter itself.
It is mainly used for five gigahertz channels.
Uh.
And it's not really that necessary to have. But if if you
could buy it, I guess it's it's worth having.
OK, so now let's do the login.
So here is the login screen after you set up the Wi-Fi panel
pool, which takes around out-of-the-box. I don't know,
maybe like 15 minutes. It's really easy to set up.
Uh, they give you a really, really nice guide that I could
show you in a second. Let me just sign in.
OK, so I've been using this already so it won't come
out-of-the-box looking like this so.
They are obviously give you a nice guide to go through, very
informed informative goes through a bunch of things, even
helps you understand what Wi-Fi is.
And a bunch of other stuff like that. So let's start on the GUI.
OK, so we have a notifications type here which I already have
some things popping up. The notification isn't notifications
tab will have.
Things like info, warning, error, successes.
Or unknown things that enter your pineapple.
Also will give you, uh, informational messages such as
misconfigurations, and it will tell you potential ways to fix
them.
Then we have the web terminal.
To open up here.
It is a best show on on the Wi-Fi panels out needing to use
as a SH.
You can use it to manage the device, run tools, install
packages and do pretty much anything else you can do on a
Linux computer.
Umm it's it's pretty basic on the right most the three dots.
Umm.
Gives you more more of a help and settings.
You could check it Internet connection. There's also three
ways you can connect to the Internet so wireless mode.
Connection sharing through USBC and then adapter from our an
RJ45 Ethernet adapter as well.
No, let's go back.
To the main dashboard.
This is the landing page.
And it provides a glance insights to the system and its
services. So you have the system status disk usage. Right now
it's only 2% since I don't really have anything running.
I've I've made campaigns already so I already have a few clients
that I had connected before.
As as ID's Wi-Fi SSID.
No current connected clients. Ohh I shouldn't have any.
Notification then campaigned, so let's move on to campaigns.
Campaigns are are pretty interesting.
They they let you do a lot of things. See what man? Right
spot.
OK, here and then we have our pine AP suite.
Uh, there's a few modes in the Pine AP, which is a passive.
Uh, yeah. Identify as client devices as up the bullet to
basic rogue access points or evil twin attacks.
And MX access points only upon direct request and depending on
filter configuration, client devices may be allowed to
associate with the Wi-Fi pineapple.
Then you have the active, which really only is a significant
difference of SSID, bulb, pull, podcasting.
And then advanced mode, where you can impersonate all the
networks that you see around you.
Umm, there's also. You could log in advance client, connect
notifications, disconnect notifications.
You could advertise back all of the SSID that you see around
you. So let's say your neighbors SSID is Mark Wi-Fi.
Uh, you could capture that Wi-Fi and and and.
Advertise it back out to make people think that you are his
Wi-Fi.
And they'll connect to you.
Uh, you could also capture handshakes, or you could see on
the top.
And you could reconfigure some some specific filters that you'd
like.
So let's move on to the open AP.
This is the access point that you will create for most people
or for everyone that you want to be connecting to your access
point from the pineapple. It more than likely will not have a
password, it will just.
Be the name.
And you could pick three channels for them to connect
through depending on how populated of SSID's your area is
and how strong you want the connection to be.
Then we have the evil WPA.
Uh, which we won't get into either. It's little bit
complicated to explain as well as the enterprise enterprise
version. It's very hard to set up as you must have a.
A specific kind of account, and it does take a lot of.
Umm.
Disk usage and and CPU and memory.
Uh, so last thing we could show you is the impersonation. So I'm
gonna refresh this.
Oh, I guess not.
OK, so and filtering what else I could show you. Ohh so filtering
you could have a denial list. Allow list for dumb. What type
of people you want to connect.
Your AP.
I might want this if you know that someone has already
connected and they they look suspicious or if they look like
some. I don't know government agency because this stuff isn't
really the most.
Uh, if a call, if you're gonna do it in in malpractice. But if
you're gonna be testing that works, you should more than
likely be fine.
Let's go to Recon.
In the Recon tab, we can run a scan.
Run the quick scan of 30 seconds.
Soon we'll be populating some SSID's in the area.
1.
There you go.
As you can see, we have the SSID, the Mac address, the OOUI
which is the producer.
Uh, the clients that are connected to them, which I
don't, I don't really find to be true.
The type of security that they're using.
Uh, MFP?
So IMP is actually quite important. It actually provides
secured between handshakes so.
When we do handshakes later.
I won't. You won't be able to capture handshakes from people
that have MFP on because it'll.
Provides a certain type of encryption during the handshake
process so.
If you are at home and you do have a upgraded router and not
something simple that you get from Comcast, AT&T or
whatever your ISP is.
I'd recommend to have MFP turned on so people can't capture your
handshakes. What else, WPS.
I really didn't pour in here. You can see the type of signal
that we have and and.
I don't really live in the heavily populated area, but as.
As of 30 seconds I did generate 44.
SSID's, which is quite significant significant amount
compared to when you trying to connect to Wi-Fi on your phone.
You only get 10 or 15.
Another thing that we can do is, which is interesting.
We can deactivate clients on a certain SSID, which I won't do
because that's very mean to my neighbors.
But.
Also really interesting. So something else that we can do
here is connect our collect handshakes where? Where?
I already have here opened from few seconds ago.
Uh, I think Captain hatchings for a few days I just leave my
AP on. It automatically captures handshakes from.
Other SSID's in their area or Wi-Fi access points in the area.
You can then use the.
It gives you the type.
Of peak cap or a hash cap file that you could then download it
onto your computer.
You can use hash hash cat.
Or airmon Ng to.
To crack the passwords.
Uh.
Passwords cracking may take between.
Couple minutes to couple hours depending on how how much of a
quality of a password that they use or the AP is using.
Then we could go on to Umm. So this is just logging everything
that I do on the system.
It's nice to know so that if you didn't mess up something
earlier, you can see where you went wrong.
Umm, we also have.
On modules and packages that you could install onto your Wi-Fi
panicle, there's two that I have installed, but I only show you
some other ones, so you have Mac info, locate Cabinet MDK 4
unmap, Tcpdump and MTR. So this one. These are ones that are.
Mostly used by most people that do by these Wi-Fi pineapples.
You could also get other packages from like GitHub. They
automatically give you a nice UGY here you can automatically
download, but a few that I have downloaded is the evil portal
and the HTTP. So first I'd like to show you the HTTP pic.
I'll connect.
The pineapple.
On my second computer.
I'm connected. I've I'm one of the clients.
This neighborhood enable HDPE, Ki will go to a website called
CERN, which is actually one of the first ever websites.
Made. I just want to generate some traffic so that you could
you guys could see.
So this is some stuff that I just browsed on my second
computer. The only disappointing part about this is not allowed
to.
Websites to use only HTTP. Most do really use HPS and so getting
a lot of data from this.
Isn't so useful.
So now let's go to evil portal.
So the evil kept the portal.
Is a portal when you are just like when you enter a hotel or
restaurant like McDonald's and you have to agree to the terms
and service.
Usually they tell you to put in your e-mail or or something of
what room that you're using, just as they get some data when
you are connected. So if you portals that are really
interesting that I really like is like say the Starbucks one.
So I'm I'm gonna activate it. So this is one over someone
connects that's new.
So we could preview it here. So this is what it looks like when
they go on their phone or on their laptop, and they they type
in or they type in the SSID and they want to connect to it to
get Internet, they'll get something like this.
So I'm actually going to connect on my phone.
With the Wi-Fi.
And I'll type something in.
In here so that you guys will see what it looks like for the
user.
OK, so I've connected to my phone.
And let's see if we get a log file. Ohh we do and so I've
connected. I use the e-mail which is actually my personal
e-mail. I wrote the password and which is not so secret anymore.
Wrong, but it still captures things which is really nice.
In the evil way. That's why it's called evil Portal.
That's pretty much all for this presentation. Thank you so much.
Any questions, feel free to ask.
Nice job.
Thank you.
Kind of scary, though.
OK.
Yeah, it it does give you some interesting options.
Absolutely.
To play around with.
Anybody have any questions for the presenters? That was all we
have, right the three.
Ohh no.
Oh.
We we I think we have 7 actually.
We have. So nobody else spoke up at the beginning. Who? Who else
has presenting?
Me, my Michael. Yeah, I I was just. I was just kinda because
Oh, OK.
Yeah.
it looked like that there were a lot on the on the notification
And me?
Yes, yes, we have.
it looked like there were. Yeah. Yeah.
On the sheet right, full, full, right, Marjorie.
Yeah, we have, Michael, after this and then we have, I'm
Yeah.
looking through here Braeden. And then Isaac.
OK.
And then packs.
So they're all listed in the chat.
OK.
OK. Yeah. So Michael, you are next.
Alright so.
My presentation's on a governance risk and compliance.
It's not the most exciting subject. It has some tech in it
a little bit, but you know, and so basically I I pre recorded my
not as a video but I did pre record the audio because I was
trying to keep my time and I wanted to make sure I didn't go
over and because I can get long winded a little bit and so we
don't want to do that and so but I'm still controlling the slides
one by one and so if anything happens I can you know answer
questions or stop.
So alright, let's get this going.
And if you can't hear me, I've did rehearse. This was a little
bit. And so if you can, if you can't hear me, just let me know.
Alright.
OK.
It can everybody see the screen.
Yes.
Alright, alright, so we'll get this going.
Welcome to my presentation covering governance, risk and
compliance, or GRC. The other side of cybersecurity after this
presentation, you will know what GRC is, what the role of a GRC
analyst consists of, and a few more details about that career.
I have quite a few slides, so let's get going.
Everybody heard that, right?
Yep, we can hear.
OK. I just wanted to be sure that's why I did the first slide
Yes.
a little bit.
So what is GRC? GRC is a strategy to manage an
organization's governance and compliance with regulations.
But let's break it down a little further while we're here. Also,
take a look at Figure 1.
The term GRC first started making its appearance in early
2000, when corporate financial scandals such as Enron and
Worldcom were taking place. Laws like surveying and Oxley were
put into place to help prevent these acts in the future.
There are always a lot of audits and controls required for
compliance with these laws, so groups that perform GRC are
usually quite busy. The idea of governance is easy, it is
ensuring that information technology operations are not
just managed but are also remain in alignment with the goals of
the organization.
The term risk refers to the use of risk management processes to
identify risks and address those risks in a manner that does not
compromise the goals of the organization.
It is far too easy for one to identify risks and just say turn
it off. What if the organization needs the software hardware?
Managing the risk should be done by proposing a solution that can
mitigate the risk without sacrificing business continuity.
Don't use. It is not always an option.
Compliance, maintaining compliance never ends.
Existing regulations change and new ones are created as often as
needed, ensuring that organizational activities are
conducted in ways that are legal and meet existing regulations is
one of the primary functions of the GRC team.
Now that you know a little about GRC, let's discuss the
connection between GRC and cybersecurity outside of the
workplace. Every time I've been in a conversation about
cybersecurity, it's always about the IT side of things.
Can you configure this? How well is the firewall doing? Is the
proxy blocking that social media website?
While these are things that protect systems and networks,
ask yourself why are they configuring things that way?
This question is why I created this presentation. Why are we
configuring the firewall, proxy server, DLP, network device, and
other credential policies the way we do? What drives these
decisions? There was once a time when a network administrator may
have made this decision based on some Beth snow methods or
experience. However, that is not the case anymore.
In my organization, GRC and cybersecurity are integrated and
the side that pushes all the buttons is system monitoring and
incident response or smear. GRC is the other side of
cybersecurity, and we support cybersecurity by standardizing
best practices, implementing new policies and procedures,
supporting auditing and control monitoring, and ensuring that
all government and industry standards and regulations are
met. Today. It is all about compliance.
And that is all about GRC.
The whole existence of GRC is a great concept. While
cybersecurity, or in my case the smear group, is configuring
networks and servers, GRC is free to make sure all those
things are done securely and meet regulations. GRC provides
cyber security with many technical benefits. For example,
when selecting system network and software vendors, GRC is
tasked with providing vendor assessment to ensure that only
reputable candidates are used.
Through the use of assessments, GRC can also document the
current strengths and weaknesses of existing security controls
and suggests what changes are needed for improvement. GRC
supports compliance by creating, managing, and maintaining any
organizational policies that are required to meet or maintain
regulatory compliance.
Information security audits are tedious, come often and require
a lot of manpower to get done. That's where GRC comes in. GRC
supports these audits by ensuring that all policies,
methods of operation, and other required documents exist and are
up to date and available.
It is the responsibility of GRC to ensure that the appropriate
protection, logging, storage, etcetera are in place to defend
all data collected, stored and processed by the organization.
Also being part of the security audit system, assessments and
other cyber security related events allows GRC to provide
management and personnel with the security related visibility
needed to make good decisions for the organization.
The tasks of a GRC cybersecurity analyst on any given day would
be insurmountable without a team of quality coworkers to support
them. This all sounds pretty busy, but what is all this work?
While not every GRC analyst does every task, it takes them all to
get the job done. A big part of the job is doing assessments,
whether it be approving a new vendor that needs system access
or doing an assessment of every single server, computer and
application used by the organization.
Before it can be installed on the organization's network.
Assessments take a lot of time and also have to be renewed by
annually or even more often. If a risk is present. Not all
business areas know the rules and regulations surrounding
cybersecurity, so GRC works with those units to evaluate where
the security risks exist and offers acceptable security
controls for identified risks. Once the controls are
implemented, GRC is also responsible for ensuring that
these controls are used. Maintaining compliance often
requires security awareness training.
As a team, GRC plans, creates and executes security awareness
programs, including periodic user education and anti phishing
campaigns. Maintaining documentation is my favorite
task. I'm currently in charge of maintaining the documents that
contain the security standard, procedures, processes and
guidelines for my organization. GRC also compiles weekly,
monthly and annual performance metrics for upper management to
show cybersecurity effectiveness.
This last one is what everyone right out of college wants, and
that is to keep up to date on different regulatory compliance
standards. This is pretty much continual regulatory training
and obtaining those wonderful certifications specific to your
job role and cybersecurity.
What is authorization to operate the term authorization to
operate or Ato refers to permission for a product to be
used in an existing system. ATO's are commonly used in
government information technology. However, the same
concept is used by many private organizations.
Both new and revised software applications require Ato before
they are allowed to connect to and function on an organizations
network. My current organization requires that ATO's be issued
for every server and application on the network, whether it is
off the shelf or developed in house. They don't access the
network without an Ato. ATO's keep me very busy.
ATO's are needed for various reasons in my organization. A
few different situations can start the Ato process. The most
common reasons for needing ATO's are new software development or
purchase, updated or modified software. Renewing an existing
Ato. The Ato process can be very tedious. It consumes time and
the typical Ato that I work on require renewal every few years
depending on the vulnerabilities found.
I would estimate that 1/4 of our cybersecurity workload is Ato
related. Additionally, malicious actors are always looking for
new vulnerabilities, so requiring Ato to be renewed at
least biannually is essential to keep things secure.
Following the official NIST Risk management framework, there are
a lot of things that go into an Ato, but many of these things
are accomplished during product development or acquisition.
Before the Ato is officially requested. Once the system has
been categorized based on its importance to the organization,
security controls are selected and implemented based on the
systems importance.
When security controls are in place, the assessment,
authorization and monitoring processes can occur.
For me, the assessment stage is where my job usually begins.
That is, when the Ato is typically formally requested.
Now that we know the official NIST Ato steps, let's take a
look at the workflow I follow when doing an Ato immediately
following the Ato request of Vulnerability Assessment
Questionnaire is sent to the requester.
The assessment questionnaire usually contains all the
information needed for me to continue the Ato process.
Depending on the type of system, a vulnerability scan or
penetration test is scheduled. If the system is externally
facing or an Internet application, a third party
penetration test is always required.
If the application is internal and deals with tax information
or personal information, a third party penetration test is also
required. All other systems and applications can usually be
assessed with an internally originated vulnerability scan or
a less invasive and costly internal penetration test.
What would an Ato be without a vulnerability scan? Well, it
would be too easy. Let's take a look at a real vulnerability
scan that I performed on February 8th of this year. While
I could not perform this scan on one of my organization systems,
I pulled out an old system from my closet. The system was
originally an externally facing web server based on Windows
Server 2003. I used it as my test system because I was sure
it would be a vulnerability cesspool.
I scan the system using the Nessus essentials application
and the scan took approximately 24 minutes. And guess what? I
was right. The system is so vulnerable it should not have
been even been turned on.
Figure 3 is the actual computer that is running the operating
system and the laptop is my personal one that I perform the
scan with. Of course, the scan was conducted within my home
network, but I showed a direct connection for easy visuals.
Look at the vulnerability scan results summary and Figure 4.
You can see that Nessus found five critical vulnerabilities
and four medium ones. My organization also considers the
low risk vulnerabilities, but they do not usually affect the
approval of the Ato.
On this slide, figure 5 just shows a bit more detail about
the vulnerabilities that Necess found.
Going a bit further, you can see in Figure 6 that the critical
vulnerability is due to Web DAV being enabled on the system.
This vulnerability could result in an unauthenticated attacker
causing a denial of service condition.
Normally there would be a solution or workaround for most
critical findings, but in this case Windows Server 2003 and
Internet Information Services 6.0 are no longer being
maintained, so the system in my closet is effectively trash.
However, for this Ato process we are going to assume it can be
fixed.
Once the scan results are received, they are evaluated to
determine a low, medium or high risk. The findings are submitted
to the Ato requester and the remediation plan is agreed on.
If the remediation plan is accepted, the completed Ato form
is submitted to all involved parties for approval in my
organization. If critical vulnerabilities are found that
cannot be fixed, the Ato can still be approved, but it has to
go to the highest level.
The CEO or executive director, etcetera. This does not happen
very often since the lower employees do not want to lose
their jobs if the vulnerability is exploited.
Now that we know a little about GRC and Ato, let's look at a
growing trend separating IT from cybersecurity. Why should IT and
cybersecurity be separated? Personally, I believe that
integrating IT and cybersecurity is no longer an effective method
to do either.
It is easy to think that since IT deals with where data is
stored and what type of data is being stored, that IT is the
best choice for security too. It is also not uncommon to see the
merge of these two teams or jobs into one. However, there are
good reasons why this should no longer be the case.
Separation helps to optimize each department. Cybersecurity
can focus on all aspects of information security, leaving IT
more focused on its tasks.
Accessibility interferes less with security and compliance
since cyber security can measure a company's entire level of risk
and implement measures to protect the company without IT.
Projects or schedules getting in the way.
If they were together, the priorities of IT may negatively
impact those of information security, resulting in reduced
security measures being in place.
Despite their similarities, cybersecurity and information
technology are not the same things. These differences create
quite a few reasons why they are better separated.
Auditing is my big concern on the issue. IT will take a blind
eye to a security issue if it impacts the project schedule too
much. This may seem counterproductive, but it
happens every day.
The fox guarding the Hen House is not a good idea and for my
experience, many auditors and regulations frown on this
practice. Also, the bigger the budget, the more resources are
available, and this holds true in this situation with separate
budgets. Cybersecurity funding will not suffer due to IT and
cybersecurity priorities not being well aligned.
Also, separating finances usually means bigger employed
budgets, allowing each group to expand and hire more well
qualified people.
Don't forget there are tons of cybersecurity GRC positions out
there. If you can't find them and just add GRC to whatever
cybersecurity job search you were doing. Also, search for
cybersecurity analyst one positions and stick GRC on
there. These may not all be entry level, but you can do it.
I would like to thank everyone for viewing my master class
presentation. I'd be happy to answer any questions you may
have.
Alright, nice job Michael.
Yeah, it was. It was fun.
I like the pic.
I like your picture.
Yeah, there there's a big story behind that. We won't even. We
won't even go there. But let me let me kill this.
Alright.
OK.
Great job, great job.
All right, I'm learning so much today. I learned so much on on
Thursday nights.
I'm Brayden. You ready?
Hey, I'm ready. Can you hear me?
Yes, we can.
Alright, let me get this going.
Alright. Can you see my screen there?
Churkin.
OK, so this is uh, I'm going to cover like a basic guide to
building your own computer and kind of why you would want to do
this. The pros and cons of doing this. And I wanna emphasize the
word basic here because if I were to go into full detail
about all this stuff, this thing would be like hours long. So
it's kind of just for people who've never done this before.
You know, if you built your own PC or, you know, a bit about PC
hardware, there may be nothing new in here for you. But.
Anyways, let's get started.
All right, so the reasons why you would want to do your own PC
build is because.
It allows you to get the most amount of performance for the
lowest cost and you can kind of prioritize performance based on
what you need so.
You know, if you're someone that does a lot of multitasking, you
know you can upgrade certain parts, and it's it's always easy
to upgrade later. You know, you can start with a more basic
system that doesn't cost as much. And, you know, if you find
yourself needing any kind of extra storage, memory processing
power, you just need to buy that part and install it in your
system.
Some of the things, some of the cons that building are on PC is
there, there are certain aspects of assembling everything that
can be kind of difficult and it's really only on you if
something goes wrong. You know you break apart while you're
trying to install it.
But you know, there's there's no, there's no warranty for the
whole entire computer, but in a lot of cases, the warranties for
the individual parts are gonna be a little bit better than if
you buy a pre built system. They cover more things. And last a
little bit longer. So you know pros and cons there.
So.
Kind of want to think about what you use your computer for. The
type of programs you run and the type of tasks you do when you're
thinking about.
Umm, the parts you're gonna choose, which arguably is the
hardest part of building a computer is just picking what
you're which parts you're gonna buy because there's millions of
parts and there's only compatible with certain other
parts. And I could go on.
Umm so that that little bullet there pcpartpicker.com if this
is something you're interested in doing, I would really
recommend using that website. It allows you to go through and
kind of assemble your computer and it'll automatically check
for compatibility.
Umm, you know you need. You need a power supply to power your
computer and once you pick out all of your parts PC part picker
will tell you the estimated power output of your computer.
So you can buy the exact power supply that you need. It's just
a really great tool to kind of help you in your building
process.
Alright, so you should you should start by picking which.
Uh processing units and for processing unit or CPU that
you're gonna use.
And.
AMD and Intel are really the two that you're going to be choosing
from.
So.
The most recent generation of CPU's came out some time last
year and.
It kind of makes more sense now based on my research. If you're
gonna go with the newer generation ship to go Intel. But
in, I don't know, four or five years before that AMD kind of
held the top spot for just general price for performance
and workstation use.
Umm, so I'm just going to kind of what what I'm gonna do is
compare the newest generation Intel chips with the last
generation AMD chips because it kind of makes for the most
useful cost comparison in my opinion.
One of the things you want to look at is your clock speed or
gigahertz is kind of going to be the speed of the processor, the
amount of cores is important.
But you know, I mean, if you if you're just using your computer
for word processing, Internet use and things like that, it it
really is not gonna make that much of a difference, I mean.
You know, do do your own research about UM, the chips
that you're gonna get. But for general use, there's not really
that big of a difference.
So we'll start with AMD and the reason why I said the last
generation chips might be a little bit better to look at is
because the current generation chips that just came out.
Are only compatible with the AM 5 socket motherboards, which are
more expensive and the new DDR5 memory which is faster and it's
going to perform better, but it's pretty costly right now
because it's so new. So the 5000 series Ryzen chips are or. What
I would recommend if you're going to go AMD because you can
use an AM/4 socket motherboard which is quite a bit less
expensive. They've been around forever and you can find pretty
good deals on them, and those will also let you use DDR4
memory.
Which also has been around for a while and is quite a bit
cheaper.
Umm, so I have two chip recommendations here. The rise
in five 5600 G is A6 core processor and pretty much all
AMD chips come with a pretty good CPU cooler. Like unless
you're going to be doing like overclocking or something, those
stock CPU coolers are really all you're going to need and it's
included so.
You'll see there's the G at the end of the 5600. There is means
that it has an IGPU or integrated graphics, meaning
that you won't need a dedicated graphics card if you have one of
these and that can save you a lot of money because GPUs are
generally usually the GPU and the CPU are the two most
expensive parts of your system. So that chip there 6 cores. I
mean, if you're coming from a laptop, the performance of this
thing's gonna be really great, and so only $139.
The other one I recommended.
Is the rise in seven 5700 also has integrated graphics, so you
won't need a graphics card and you get an 8 core CPU.
4199 so a little bit more and.
You know, if you right now, six cores is is really great. I mean
perhaps in a couple of years. You know if when programs get
more expensive, uh, more intensive, you may need a little
bit more. So if you have the extra money to spend and want to
look forward a little bit, maybe look into the acore option but.
So for Intel.
So kind of back to MD traditionally have been better
workstation chips, but Intel is always edged them out a little
bit. Not always, but over that past four to five year period, I
was talking about when it comes to gaming like frame rates and
things a towards the higher end of the chips and you know
running intensive programs like gaming or 3D modeling, photo and
video editing while having 10 Chrome tabs open or whatever you
wanna do.
Umm.
Usually the cooler that comes with Intel isn't quite as high
performing as AMD, but again, if you're just doing, you know,
basic stuff, it's it's gonna be fine.
Umm so.
For Intel, the reason why I'm recommending the newest
generation of Intel chips is because I mean the the newest
manufacturing processor that are used on manufacturing processes
that are used on the Intel CPUs is gonna kind of give it a
inherent a little bit of an edge.
You don't need to use DDR5 with the newest Gen. Intel CPUs and
so.
These are two options that are similarly priced to the AMD ones
that I just discussed they core I3.
UM is A4 core uh CPU, so a little bit less than the uh AMD
option, but that doesn't always.
Mean that it's not gonna perform as well. Plus it's a newer
generation, so you know, look at look, do some research on
benchmarks and different programs and kind of see what's
best for you.
Umm, the next one, the Core i5 is A6 core UM also integrated
graphics on both of these. So if you want to you can save with
that by not using a graphics card.
Umm. Now from what I've seen the the non the ones that don't have
integrated graphics really aren't.
That much.
Uh. Cheaper. So Umm, you know, it's it's kind of just makes
sense to go with uh with an integrated GPU. I mean there's a
little bit of performance upgrade without having the the
IGPU, but again this is kind of a basic guide. So we'll just
leave it at that.
Now the motherboard that you choose is that's. That's where
you're gonna connect all of the components that you're
purchasing for the computer. You're your CPU, GPU, ram.
Umm, your hard drives are gonna be plugged into that your case,
so this is.
Pretty important part but like I like I said here at the second
bullet point.
Umm, there's kind of a sweet spot that you know you you wanna
get a quality board. But the ones that are like super
expensive and have all this extra stuff and tons of you know
heat sinks and everything aren't always really gonna provide that
much of a benefit for how much more you're going to be paying
for them. So kind of look at what's available and I think I
think mine was like 100 and 3000 and $40 or so. So something.
Kind of around there is going to be perfect. So for the AMD
options I listed, you'll want to look for motherboards that have
an AM/4 socket for the Intel it's the new generation has the
LGA 1700 socket.
Umm.
So in in my computer and kind of what I recommend I would, I
would say look for something with integrated Wi-Fi.
They're not that much more expensive, and it we're not.
When I was kind of building out my computer, buying one without
integrated Wi-Fi means you need a network adapter if you're
gonna be needing Wi-Fi and you don't have access to a direct
connection.
It's more expensive than just buying a board that already has
it. Plus, it's easier and a cool thing with the integrated Wi-Fi
on a lot of these boards you also get that includes
Bluetooth. So like you have Bluetooth headphones or any
other Bluetooth devices you can kind of just connect them right
to the computer. It's pretty pretty nice.
So.
I'm gonna recommend the a TX midtower size. It's kind of in
the middle.
Umm. Through the easiest to build they have the most, uh
amount of parts available and usually are are a little bit
less expensive. You know some of the the full towers can be huge
and the the small ATX form factors are pretty hard to work
in and you have to do a lot of research to make sure that the
parts you bought are going to fit properly. So it's kind of in
my opinion a good.
Place to start if this is your first piece of the build, you
know. Of course it's nice to have a smaller system you can.
It doesn't take up as much room, but the mid tower cases are not
that big. It's just slightly bigger than a normal like HP
prebuilt system you would buy.
So here I have a.
This is the the different sizes of motherboards that you can
get.
Umm. I'm gonna say so for the mid tower cases. Usually they'll
have uh mounting points for either the micro ATX or the ATX.
HX, I mean, there's really not a huge price difference between
them, and ATX is going to offer you a little bit more
functionality and more ports, more places to plug things in.
So that kind of is what makes sense to me.
Umm.
There's bigger ones and smaller ones, but these are kind of the
main ones.
So as far as the cases that I was just talking about, this is
kind of a general sizing guide for the most common one, like
with the motherboards, there's a lot more sizes than this, but
this is just the most common ones. And that mid tower there
in the middle is the one that I'm going to be recommending
just because you know it's you have enough and you're going to
have enough space to to use pretty much any.
Any parts you want, you're not going to worry about space. Umm,
there are in some cases you can even get you can fit the regular
ATX size, motherboard and many towers. If you need to keep
space down. But again, it's just going to require you to do a
little bit more research to make sure that everything is gonna
fit.
So, you know, pick out those two parts and.
Umm.
Some things to consider.
You know, do do research on all the parts you're buying. Like,
like I was saying, this is probably the most difficult part
of building a computer is picking, picking the parts and
knowing what you need, but.
Look at the amount of USB connections it has on the rear
and on the front. Uh IO, and you know if you need USBC or some
come with like SD card readers and things like that you know
there should be plenty of information when you're looking
at these online.
Umm, if you're trying to keep costs down, this is a pretty
good place to do it because.
Umm, you know, cases. If they're kind of just there to hold
everything and to cool them down so there's not a ton of places
where you can have like catastrophic failure in a case.
Corsair has tons of options. Uh cheap ones, expensive ones, and
they are generally pretty good about air flow, but there's tons
of companies and you know you can have some fun with this.
Some of them are pretty cool looking, you know. You know, go
look at them and you know, if you wanna pick one with a nice
style or color or whatever, you can.
Uh, a lot of cases you're going to find will come with
preinstalled fans, which is nice.
If they don't, you'll need to purchase fans separately, and
typically that's going to be 120 millimeter fan, you're going to
use some use 80, but most of the new ones are 120 millimeter.
So here's a couple pictures of kind of you know, if you are, if
you're, if you're case comes with preinstalled fans. It's
kinda kinda already be set up like this, but just in case they
don't. If you're gonna be installing your own fans.
I have this little diagram here on the left showing the
direction of air flow for the fans. Usually the air comes out
towards where the label is, but any fan you buy is probably
gonna provide you with a similar diagram so you can see kind of
exactly what you're getting. But the picture on the right is kind
of how you want to have it set up.
Umm, I mean it can be flipped. It's really, really. You just
wanna have an equal amount of fans pulling air in as you do,
pushing air out so you have air consistently flowing through the
system because the parts can get pretty hot, especially if you're
doing intensive tasks like photo video editing, 3D modeling,
gaming, things like that.
Alright, so Ram is a pretty important part of the system.
And so I have some kind of some options. Uh, listed here. And
The thing is, RAM super easy to upgrade. So you can you know, if
you're really trying to keep the cost down, you can go with just
a four GB single single channel is probably what 4 gigabyte will
be. But I mean, this is all of the options I provided for CPUs
are compatible with DDR4 RAM, which is pretty inexpensive like
you can get 16 gigabytes for $50.00 or sometimes less and.
You know, unless you're doing multiple like intensive programs
and having 20 Chrome tabs open all the time, that's really all
that you're going to need.
Uh, so that's pretty much it for memory.
Storage so.
You know you're you're drives. What kind of drives you're going
to use? Uh, makes a difference in performance. And obviously if
you have, you know, if your use case needs tons of storage,
there's a few different ways to do that so.
I can't recommend enough. I did this with my system and it's
performance has been awesome using an Nvme 2 SSD drive, so
you have to make sure you get a motherboard that has
compatibility for these, but they transfer files and load
programs like blazing fast and.
What you can do is just buy, you know the I think 256 gigabytes
is I think is the smallest size you can buy. Maybe you can go
lower than that, but those aren't that expensive and you
know all you need to do is put your Windows installation and
like, you know, if there's some some programs you use all the
time, you know, maybe put those programs on there and then when
it comes to like storing stuff that you don't really use too
often, you can put it on some some slower storage like I mean
say to SSD if you want to kind of do a similar thing with you.
Having a A say to SSD like boot drive, those are still no
slouch. Those are gonna be pretty fast and.
Again, coming from like a laptop or prebuilt system, you're
probably gonna be pretty happy with the performance of one of
those. And then the old HDD or hard disks or the one that have
the the spinning disks.
You know great for if you're gonna, you know, storing large
amounts of data because you can get terabytes of that stuff for
really not that much money.
Alright. And so you'll need to power everything that you've
bought. And again, I mean really the best way to do this is go to
PC part picker and put in everything you have and it'll
automatically calculate the what kind of wattage you're going to
need out of your power supply.
Umm, but this is a part. You know, if you're, if you're
trying to save as much money as you can, I would. I would
recommend doing that in other places.
Because you know, power supply failures and faulty power
supplies can cause issues with other components of your system,
and it's just you know this. This is what's providing power
to everything and it's.
You know it. It can the most can kind of go wrong with one of
these. Not that they usually do. I mean typically they're pretty
reliable, but.
Yeah, that's for the power supply.
And so you don't necessarily need a graphics card for this.
For the options that I have outlined because your CPUs would
have integrated graphics, some reasons why you would want to is
if you do like video and photo editing, things will run a lot
faster and 3D modeling like blender, CAD, you can, you know,
have a lot higher Poly stuff in your viewport and rendering is
gonna be a lot faster.
And then gaming feel like to play games, you know, if the
graphic quality of the game Oregon frame rates are
important, then you know maybe maybe consider getting a GPU
that if the GPU markets kind of calmed down a little bit now
that cryptocurrency isn't as crazy.
As it used to be, so you can get them for a pretty reasonable
price like I do some gaming on mine and I came from an Xbox One
to like a really.
Cheap graphics card and I was like blown away by the
performance. You don't need to go crazy with these to to see a
real increase in in graphics performance.
Alright so.
You can sometimes. Sometimes it makes sense. You know, again, if
you're trying to keep the cost down as much as you can, there
are some places where it's OK to buy used parts, some are safer
than others. So.
One ram UM. Most of the times gonna be OK to purchase second
hand, but you know right now the RAM is so cheap. Anyway, there
may be better places to do it.
The thing is, so CPUs sometimes can be a bit fragile if you
don't handle them properly, but they're actually like the
performance themselves. They're pretty reliable, and they can
that you can save a good amount of money there. But you know, if
you're gonna go eBay, make sure it's like a a seller with a
really good rating and.
All that stuff.
I bought uh. I have CPU and one of my computers from eBay, some
RAM from eBay, my GPUs from eBay and none of those parts have had
any problems. But you know with use stuff you never really know.
Cases or another good one? Uh, there's not too much that can go
wrong.
With those so you can buy those used if you find a good deal.
Then of course your peripherals, mouse, keyboard, speakers,
monitors pretty much always going to be fine.
Umm riskiest of those is monitors. Like I've said there
if you know. If possible, look into local sales so you can test
the product out before you buy it. Make sure doesn't have any
dead pixels or anything.
All right. So we're kind of getting into, uh, assembling the
computer.
And so you'll want.
You don't. I guess you don't really need something like this,
but I bought. I think this exact kit on Amazon for like 20 bucks
and I've just used it for so many more things than I ever
thought that I would. It's just having all those little random
bits comes in handy a lot with just any kind of electronics so
you know, good to have something like this. It's super cheap.
It'll make installation a little bit easier and then some zip
ties, cable ties. You want to keep your your wires organized
and.
And tidy.
Alright. So we'll start with sembly of installing the CPU so.
In my opinion, the best way to do it is to put everything you
can onto your motherboard first before putting them on the board
in the system. Make sure you you don't set it on anything that's
gonna damage the back of it. A really good way to do it is use
the box that your motherboard came in and will already be
pretty much the perfect size. Just set the motherboard on top
of that and install everything onto it.
Umm. And putting your CPU in.
It's probably uh, I say difficult here. It may be the
not difficult, but riskiest because it's an expensive
component and like I said before, they're a bit fragile.
So up here, the top right is the AM/4 socket.
And with these, the CPU itself is going to fit right on top of
there, and the CPU has pins that stick down into all those little
holes you see.
The proper way to align it, kind of it's it varies a little bit,
but if you can see in the bottom left corner of that socket,
there's like that little triangle.
And you that will usually correspond with another triangle
on your chip, so you you can't just insert it anyway. It needs
to be going in a certain way.
And another thing is if you see that little metal bar on the
right that needs to be up before you put the computer in or
before you put the CPU chip in. So pull that up, make sure it's
aligned properly, put it in, and then push that thing back down
and the CPU should be pretty much locked in place.
Umm. And then down here is the LG a 1700 socket that's gonna be
for the Intel chips, and those work in kind of the opposite
way. So the pins up out of the socket and the CPU itself is
just going to have those contact points and part of the reason
why it's so fragile, as you can see, there's hundreds if not
thousands of them. So you know, if one of those gets bent.
Umm, you know with the AM/4 socket your CPU is screwed with
the Intel socket, your motherboard is screwed. So you
just want to make sure you're very careful with this part of
it. Look at your specific parts and you know, make sure you're
doing it properly.
Umm, if you're buying a new CPU, I'm pretty sure all the ones I
listed will come with thermal compound pre applied. That's
gonna be like a it's a thermal paste that sits on top of your
CPU and then makes contact with the heat sync on the back of
your cooler.
One second, I'm sorry.
OK.
So yeah, the UM, I actually haven't installed an Intel chip
before, but it works in a similar way. There will be some
sort of indicator or marketing that tells you which direction
to install it. I think it may be easier with Intel because it
looks like it's a little bit more of a rectangle than a
square.
Alright. And then so next is you've got your CPU down there
on the board and you're gonna put the cooling fan right over
top of it. So they the AMD and Intel ones work pretty much the
same way. You're gonna look for those little screws on the
bottom. And again, there's a proper direction to align it.
Screw that in you. Don't you wanna make sure it's firm but
you don't wanna screw it all the way down into the board. So
just, you know, make sure it's on there good and tight, but you
don't need to.
To over tighten it, and then you'll have a wire running off
of the cooler and then just look for something like the right
picture on your motherboard and you'll plug it right into. There
should be labeled CPU fan, but anything that connects to it
should work. It'll look something like that with the
four pins.
Alright. And then the next you'll put in your RAM sticks.
So there is a proper way to do this. There's most motherboards
will have four slots for you to put your RAM into, and then if
you see where that little red circle is there, it's labeled.
As 1234. So if you're only using one ram stick, you want to put
it in one. If you're using 2 ram sticks, you want to put it in
one and two, and then of course you're using four. Just put them
all in. But that does make a difference with performance.
They're gonna run a little bit faster if you put them in the
correct slots like that.
Alright. And if you choose to use an envy me drive, it says
those fast little SSD's that I talked about, you'll wanna put
this on the board before you put it into your computer.
So.
You're going to have a little slot like what you see towards
the right of that picture, and it's going to kind of stick out
like that and then you're going to have you see kind of under
it. You have those 3 silver things. Usually this is the
size, but sometimes they can be smaller. So you just screw it
down and whichever size fits your your drive, if you're using
a hard disk or a SATA SSD, it kind of makes more sense to
install those after you already have everything in the case.
Alright, now you have everything on your board. You'll want to
look for the mounting points, so kind of be a range. Something
like this. What's in the red? You'll just screw those down
into your case again. Make sure they're tight, but you don't
want to over tighten anything. And a build like this, and if
you went with a board that has integrated Wi-Fi, like I said,
you probably won't have to do what is pictured on the right,
but that's your IO shield. So if you have your, it should come in
the box with your motherboard. Do you want to put that?
In the back of the computer 1st and then install the motherboard
to make sure that everything's.
Like protected from from the outside.
Alright. And so this that picture on the right is probably
the most frustrating part of plugging things into your
motherboard because those connectors are tiny like those
LED switches are literally just one pin. So for this, I'm just
going to say look at your motherboard manual, it's usually
in the bottom right hand side of the board, but they're all
different. And those letters on the motherboard can be so tiny
and really hard to read. So you know, look at the manual and
make sure that.
You're plugging everything in. It should have similar labels to
this, so you'll know where to put it, and then that picture on
the left is another fan output. So if your case came with fans
or you've already installed the fans, you'll need to plug them
into the motherboard and to ensure that they're powered on.
All right. And so if you went with the GPU, UM.
What you're going to want to do is install it into. You know you
should have yours, you know, depending on the motherboard,
they're gonna look a little different, but the port will be
the same. If you see those, those 3 silver ports kind of on
the bottom are PCIe slots you'll want to plug it into the very
top one. It's gonna offer the best performance and then just
screw it in. Kind of where this guy has the screwdriver.
Your your GPU will have some mounting points there as well,
and then you wanna make sure the look at this this right picture
here that you plug in your display to the HDMI port powered
by the dedicated GPU and not the one up top. So the one up top.
If you don't have a GPU, that's gonna be your integrated GPU. If
you if you buy a CPU that has that feature.
All right. And so it's pretty much all assembled now. You just
need to plug the power supply into everything.
On the left is what the ports gonna look like. You may have
more or less of those ports depending on which GPU you get,
but the motherboard typically is just gonna be those two.
Another time, just look at the manual. Uh, you may have. Like,
if you're if you're.
But the board has like integrated audio or anything
like that. There's gonna be other things you need to plug
in, but that's those are kind of the main things that your GPU
needs to be or I'm sorry, your power supply needs to be plugged
into.
Alright, so it's pretty much all set up now. You just need to
connect antenna. If you're using, you know Wi-Fi. So that
will either be to your integrated Wi-Fi with the board,
or if you have a network card monitor mouse typical stuffs
pretty easy.
And the way to actually get it up and running is you want to go
on another computer can be just like a laptop or whatever. Get a
USB drive that's at least 8 gigabytes, and if you just
Google Windows installation media, it'll have either Windows
10 or Windows 11. Then it should be the 1st result and then I
recommend.
Having this be the only thing on that USB drive typically makes
for a smoother experience, so just install that on the USB
drive and once it's in there you can insert it into the computer
you just built.
And you'll go into when you turn on your computer. It won't have
any windows.
It won't have windows on it, so you'll need to go into the BIOS
and they all look a little bit different, but if you just kind
of.
Click around them with either your mouse or on some of them.
You can only use your keyboard. Just look for boot options and
if you if you named your drive something or you know if you
know that your USB drive is like F colon or E colon or whatever
then just identify that where you installed your your
installation media and then just click on it.
And it'll ask you where you want to install Windows. So if you
did that thing I mentioned earlier, like Umm, you know you
got a smaller SSD drive that you're gonna use to boot. Make
sure you're choosing that and not like a hard drive or
anything that you have a secondary storage.
Another thing is I mean.
I've been using a non activated copy of Windows for like almost
two years now without paying for it and the only thing is you
can't change your background and you have a little activate
Windows watermark in the bottom. So another way to save money.
And that's it for putting it together.
UM, next couple slides. I have some PCs that I've built.
And so this is one that my grandfather gave me, actually
that was like used for some cat stuff like 20 years ago. And it
was this really cool like aluminum case. So I took it out
of his like attic. It was filthy, kind of like took
everything apart. And that right picture I had to use that's
like.
The part of a door I had to get kind of get creative with that
to make the power button work cause none of that stuff work
from the old computers, but I took everything apart, cleaned
it all up, got it working, put some some modern stuff in it and
so that was a pretty fun little project. And then there is my
current one that I used that I kind of had some fun with and
went with some like cool colors and some just asthetic stuff
that I wanted to put in there. So that's gonna be everything
for me.
Wow, that was so cool.
Thank you.
Now I know, I know you're gonna share that that slide deck with
us, right?
What's that?
Because that was a lot of really good information. I I took a
Thank you.
bunch of screen, I took a bunch of screenshots but.
Ohh yeah, I can I can share the presentation, sure.
Yeah, that would be really great.
Hmm.
Great job, great job.
Thank you.
Alright, I think Isaac is up next.
Hello everyone, can you hear me alright?
Sure can.
Perfect. Let me share the screen real quick.
Let's see.
Alright. Can you see my PowerPoint?
So we can.
Alright, babe. So my name's Isaac. I've been working as a
network administrator for U.S. Army for a little bit over five
years now, and most of that time I spent literally configuring
voice over IP phones using the Cisco call manager, and that's
what I'm gonna what I'm gonna be presenting with them today.
So the Cisco Unified Communications manager or call
manager for short, how I call it it is and IP based communication
system that allows you to contact your coworkers or
customers through audio and video regardless of physical
locations. It's primary functions. It's literally called
processing and phone registration.
So for those that are not aware, this is what a normal voice
phone looks like. It's old, there are newer versions that
are way more fancier, but most of them are similar in this
setup, where on the left side it's just gonna be your front
side of your phone with everything you need. And then on
the backside 2 key parts over here would be the label part
over here. Oops. Sorry. The label over here where you're
gonna find the Mac.
Address for your phone and then your porch over here. The port
in the middle. That's the one you would connect from your
phone to your switch. And that's actually what's gonna power on
your phone and actually be able to connect your phone and
everything.
The port to the right side of it, the far right one is the
best one. If you have a really OCD when it comes to cable
management, because that forward actually allows you to connect
your computer, workstation or laptop to your phone and
actually be able to access the network and everything and
everything through your phone. So instead of having two long
wires of of CAT5 running from the wall outlet.
To your table. Now you only need one long cable and then one
short cable, so it's really handy when it comes to cable
management.
So to access your coal manager, you literally only need to go
into your favorite web browser and type in the IP address of
the call manager. That's pretty much the only way you can access
it.
So once you type in the IP address and you click search,
their first part's gonna come up asking you for your username and
password. Everyone's gonna have different username and
passwords. My company likes to use the default one, so don't
use the default password, but do whatever you guys have to do
once you log in, it's gonna take you to this menu part here on
the right side where.
You will be able to see every single tab that you guys have on
the actual Cisco call manager and then this bottom part right
here. It's like one of the in my opinion, one of the best
security feature it has because it tells you the last successful
log on you that someone has logged in to your Cisco call
manager. So I had this one time that I didn't log in for one day
at all and when I logged in the next day I literally saw
someone.
Other than me had logged in to my call manager that day before
and ended up switching stuff around without my permission, so
that was a fun day. But yes, just a key feature in that.
So for the top right here, all this taps over here have
different settings depending on what you're trying to configure.
On your Cisco call manager, on the system tab here on the left.
This is where you would actually configure your DHCP server in
order for your call manager to actually send out an IP address
to every and all devices that ever plugged into your network.
Next to that we got the call routing which is only gonna.
Matter if you're trying to place in route patterns, depending on
what type of phone you're using or the phone you're trying to
call to, you might have to add a specific route pattern for it.
On the Media resources tab, you're able to their configure
what's called a music on hold file. So if y'all ever called
Echo Company and they're like please hold and then you hear
that elevator music. Yes, this is where you would actually go
into and set up that elevator music.
When I was in Iraq, I actually had made a lot of fun with this
part because I changed the songs weekly. So one week I would have
careless whispers play, and then the other week I would have
fireworks from Katy Perry plane and yes, and they it was
definitely fun.
Now the tab we're gonna be focusing on today is gonna be
this device tab over here. So once you hover your mouse over
it, it's gonna this little sub menu's gonna pop up with
everything that's in there. So we have the Ctr. route point,
the gatekeeper, the gateway, your phone, your trunk, remote
destination and device settings. The one we're gonna focus on on
click on. It's gonna be your phone tab right there, so.
After clicking that, it's gonna take you through this menu where
you're gonna see every and all phones or devices that have
plugged into your network. So and it only takes 1 device to be
plugged in, and it's automatically gonna be popping
up here, either registered or not registered. But even if you
unplug them, it's still gonna show that there were plugged in
and it's gonna save that configuration from that phone
and the information from that phone.
So regardless if you plugged it in from one office and you took
the phone with you to like 1/3 office, that's like on the third
floor or something like that and you plug it in over there. The
Cisco call manager is gonna remember that phone, and as soon
as it's plugged back into the network, it's gonna register it
without having to go through the process, which I'm about to show
you today.
So sometimes the call manager might have what's called an auto
registration. That one most of the time works. Other times it
does not work, but auto registration is that instead of
doing the whole process, which I'm I'm about to show you all
you will have to do is plug in the phone and the phone itself
is gonna come up and register with its software. It's IP
address and then it's specific phone number so.
Nighttime sort of temps. It works, but sometimes it doesn't.
So and then you would have to do what I'm about to show you right
now, which is to manually add that specific phone in.
So over here, you're gonna click on the add new tab over here and
then this is where all the magic starts happening. You're very
first question that's gonna pop up. It's gonna be on the left
side here. It's gonna ask you for the phone type that you're
trying to configure. When you click on the down arrow over
here, it's gonna show you every and all Cisco devices that the
call manager can configure.
So or you would have to do is Scroll down and find the Cisco
phone or device name that you're trying to configure and
highlight it and then click it and then click next after
clicking next, this next tab's gonna come up where it's gonna
show you the product type this over here where it says Cisco IP
communicator. If you chose like a phone that's a 7960 model.
It's gonna say Cisco 7960. So that's gonna change depending on
the device you use.
But the device protocol is gonna stay the same, which is gonna be
the SCCP the SIP. It's another configuration for different
device. So as long as you have the device that you're
configuring is Cisco, then it's gonna be an SCP protocol.
After you highlight that, you're gonna click next.
And I know it looks like a lot, but most of this information
it's literally gonna be the default one, and you're not
gonna have to change. But the most important cue key futures
here is that every.
Area that you see that there's an asterisk right next to it is
literally the only things that needs to be configured in order
for the phone to work. So and most of that stuff is actually
default, so.
On this left picture right here, you're gonna see you have your
product type. It's gonna be the device you're configuring the
device protocol you selected, which is SCP and this first type
right here where it says device name that normally is gonna be
either the what you're trying to name it or it's sometimes can be
the Mac address of the phone you're connecting. So the
pending on the phone that you choose and the protocol is gonna
pop either one or the other.
But that device name is where you actually gonna put in the
name of that device that you're trying to configure. That device
pool, which is the next one with the astrik, that one it depends
network to network. So in my case, our device pool was a 7.11
G pool and that's literally the device pool that we had to
select. But the pending on your organization just choose the one
that's local to your network.
Then next one over here. It's gonna be the phone button
template. So that template right there is just pretty much the
software that the.
Phone is gonna use in order to give you that little menu on the
screen, so depending on the phone that you choose or the
device that you choose, you gotta make sure that this button
template matches that device. So if you hover over it and you
choose a 7960 phone template, then you have to make sure that
the phone you're plugging in is a 7960, otherwise it's not gonna
accept that configuration because it doesn't belong to the
actual device.
Connecting.
Next one down here. It's gonna be your location. This one. It's
just gonna stay at the hub. None. Or depending if you
organization says otherwise, then it's a default one. That's
just gonna stay over here also. Scrolling back a little bit on
the user. Hold MOH audio source. This is where you actually.
Place in the music on hold. If you had the configured so all
you have to do is click over here and then click the song
that you have configured or anything and it's gonna add it
to the phone.
Scrolling over to the next slide over here and the next photo,
your next setting is gonna be your common phone profile. This
one, it's gonna actually stay as I stand there coming phone
profile or in my change it also depends, but we leave it as a
default one.
On location states up none on the built in bridge stays as a
default. The privacy stays as the default. The device mobility
mode also stays as a default on the owner one. Here is a mix and
match where you can either use one or the other. We used the
anonymous version whenever we create our phones because our
call manager.
Right now the actual call manager out there that most
updated one, it's like version 17. I think it is or 15
somewhere around there. My company's running version 9 so
we're way outdated on that part, but it still works.
So we used anonymous because if we use user it starts using a
little extra license that we don't have and it's just
corrupts the whole setup on the phone. So we just leave it as
anonymous and then skip to the next part.
Then phone personalization and servicing provides provisioning
also stays at default.
So once you gather all that your next one, you're gonna Scroll
down and actually want to look for what's called the device
security profile. This is pretty much the security profile that
the phones gonna be using in order to connect with other
phones. The importing key feature there is that that
whatever security profile use on that device, you want to make
sure it is used on all of the devices that's connected to your
network.
Because if they security profiles don't match, they're
not gonna connect.
Normally whenever we use it, we use the. It's gonna be like a
non secure sync profile for MLPP. That's normally the one we
use, but that might change depending on what network we're
using or how we wanna set up the actual phones.
After that's done, everything else that comes after that is
gonna be default, so you can just scroll all the way to the
bottom and click the little save button at the end.
So once you do that, this menu's gonna pop up. So everything
that's here in the middle, it's actually everything. You just
configure the moment before, so it's gonna tell you over here if
the device is active, if the device is trusted and
everything, if the phones plugged in. This right here is
gonna gonna come up. It's gonna say hey, it's inactive until you
plug in the phone and then this is gonna reset and then give you
the hey the phones connecting and everything is good to go.
So since we know that the phones good and that's the and
everything on the software part is good, now we have to add a
directory number. So you will go to the left part over here under
the associations and click the add new the end button.
So on the directory number it can be as simple as a 6 digit
number or even a 10 digit number. We use 6 digits in my
area, but some other people like to use the 10 digit one just
cause it makes them easier. So they're pending on what it is.
You can easily write here. The number that that specific phones
gonna have.
Now make sure that if you're you doing like multiple phones
manually, make sure that that directory number does not repeat
on other phones, because if you have two phones with the with
the exact same directory number, whenever I dial that phone, both
phones are gonna start ringing.
And.
If I wanna choose contact one person, but then someone in the
other income answers it and it's like, hello, who's this? And I'm
like, hey, is this so and so? And they're like no wrong number
then. Yeah. It's gonna be a bad day.
So after you plugged in that phone this you're gonna Scroll
down to where it says, line one on the device, and it's gonna
give you the device name. This top three tabs right here are,
in my opinion, the most useful ones that you can have in order
to make the user experience better. So on the display caller
ID, that's actually gonna be whatever name you put in there,
it's what's the gonna show up on your phone.
So if you wanna add a specific names for specific phones, that
is where you would actually place in the name and then on
the ASCII display caller ID.
That one is the name that's gonna pop up whenever that
phones calling someone else.
So someone that's receiving a call instead of just saying a
random phone number, it's gonna tell them exactly who's calling.
If it's ohh, the director of this department or the manager
of this department. So it comes really useful for the user
experience and literally makes your life easier. And whenever
you want to answer the phone or want to know who's actually
calling and for what.
The line text label that's, that's that one. It's gonna be
the same thing, the same number or name you place in. It's gonna
pop up there.
So after you do all of that, you're gonna scroll all the way
down and click the save button. It's gonna go through it. Simple
save configuration loading and everything. Once it's done, you
wanna go ahead and click the apply configuration button. What
this will do is that everything that you just saved on this
directory number, it's gonna go ahead and apply it to your phone
so that it makes those changes on the actual physical phone.
So in it, don't be scared. If the phone starts turning off and
turning off, turning back on and turning off because that's how
it's gonna do until it's gonna come up fully up with the
correct configurations and everything there.
So it's scary, but thrilling me the phones perfectly fine. It's
just like to do that.
So after that, you're gonna go ahead and go back to your
device, tab up here, and then your phone subcategory, and you
should be able to see the phone you just plugged in with the
device name. The description that you set up with it, what
pool they belong to, their protocol. They have been
assigned, and it should say register. That's what it means
is that it's being fully registered with the Cisco call
manager. It has an IP number, it has an IP on it.
It has a directory number on it and then we collect that and
it's fully able to make phone calls and forward perfectly
fine. And then over here it's gonna throw the IP address that
it's been assigned.
So which? Once that's done, you're gonna see that your phone
is gonna go from looking like this left phone where it says
configuring P and there's nothing on it to the picture
that's on the right, where it's gonna show you the phone number
you have added to it the name of the phone, and then all your
options are gonna be here for the redial. New call and
everything like that. I wanna phone is like this. It's pretty
much when you're 100% sure that you can actually make phone
calls.
And it's gonna work perfectly fine.
Well, thank you for your attention. That's pretty much
all I have for my presentation and I hope you guys have a good
night.
Thank you, Isaac. That was really great.
My company uses Cisco.
White phone to connect the agents connect to the client's
phone inside of VPN, so I'm very familiar with Cisco phones.
That's awesome.
Ohh yes, it's the IT. It's definitely how to explain it. I
I'm used to it too. The only the only issues I have is that our
call managers, since it's always outdated, we have to use the old
phones. So when you see the new phones they're like so much
prettier, so much nicer. So much easier to handle. But then our
phones we have to run like the old version because they do not
Right.
have the new software for those new phones.
Well, we're crossing our fingers for that. You get the new stuff.
Another thing I like.
Ohh yeah, we're not expecting to getting anything new to like
Go ahead.
pretty much July of this year, but it will. Good thing I like
OK.
about the call manager is that compared to call manager express
that everything else is on the command prompt, it's definitely
more user friendly over here.
Well, that's awesome. Thank you so much.
I think PAX is the last presenter. You are up Pax.
Hello yes I am the last one. I'm gonna keep this short because,
you know, I know everybody is trying to go.
Ohh, probably get some sleep.
So I'm gonna start sharing my screen.
Real fast.
You know, going to update my driver right now.
There we go.
Sorry, you gotta change some permissions before I do this.
OK, let's see if it will work.
Can you guys see my screen managers?
Not yet.
Let's try again.
OK, perfect. How about now?
Yep, sure can.
Alright, perfect. So this will be a bit similar to what Michael
was presenting. He was talking about GRC. This is kind of the.
Yeah.
Other side while he's in the industry, what I did and what
I'm gonna be doing is consulting as an outside firm, kind of
providing insights to firms for cybersecurity and what they need
to do to be compliant with, you know, different laws and
regulations.
Most of the things I worked with and most of the companies that
were my clients were either healthcare or government
contractors and those two categories of companies have to
specifically follow.
A series of rules under NIST.
Uh and HIPPA, I know Michael mentioned this RFP, which is the
risk management framework. What I worked with was in the CSF
CSF, which is the cybersecurity framework and then HIPAA privacy
rule and also security rule are very useful when you're, you
know hospital or any kind of entity that is dealing with
basically.
Identifiable information or health care information that is
stored on any type of technological devices.
So the way works, I kind of wanted to describe like a day I
a consultant and how it works when you get a client and the
way it works is you set up an reviews first.
And it really depends on the size of the company you're
interviewing with and the number of departments that they have.
But from my experience, mostly.
Every company has a CIO, a CISO, or an IT manager that is aware
of basically everything that is going on in the company. As far
as cybersecurity goes, that is usually the longest interview
that we had to sit through last four hours. We go through a very
specific questionnaire, depending on what the company
does.
They either go through a NIST gap assessment or HIPPA gap
assessment, or a joint NIST and HIPPA gap assessment that are
kind of mapped out. I'll show you guys what it looks like a
little down the road, but yeah, so we would talk to people from
the company.
Database managers, HR, head of security, whoever that has any
responsibility as far as security goes inside a company.
To like be compliant with these rules.
After the interviews, depending on what information we've gotten
from them, we usually send the request out for.
Forms and you know policies and documentation. Uh, because we
have to take notes inside the interview and then we have to
verify everything that has been said in the interview with their
policies because.
When the time comes for auditing and the government comes to
audit these companies, uh, they check both the policy then the
documentation and what is actually going on in real life.
And a company can have, I don't know. Let's say they have a CMS
system set up and they have a log system set up or it can say
that they do in their policy and they actually don't. So you
really have to get in there and make sure that everything
matches up before any audits.
And one point here is that others are not fun when your
company gets audited, it usually comes with.
Uh, not just suggestions or recommendations. It comes with
fines. And you know, people getting laid off if everything
is not OK. So usually consulting firms are hired before audits
are done to give recommendations. We do the exact
same thing that auditors do, except we don't find them. We
just, you know, take the money and we give our recommendation
to fix everything before any other stuff.
But yeah, these are some of the documents that I've dealt with.
Sometimes it's one huge document, three 400 pages long
with like a table of contents that includes everything. Those
are usually just security policies, and sometimes they're
very nice and short documents. They all have different labels
saying, I don't know, data retention policy, acceptable use
onboarding, offboarding all the HR things.
Business continuity and disaster recovery plans.
But after we take those documents and do our interviews,
we have to go ahead and write a report, and this report is based
off of this NIST and cybersecurity, NIST
Cybersecurity framework and the HIPAA Privacy and security
rules. Depending on what the company has asked us to do.
So I'm going to go ahead and show you guys. One tool that was
very useful for me to use when I first started.
Doing my work as a, you know, a consultant, this was the first
thing that my manager showed me when I started. And it's very,
very useful and.
It has everything anybody would need, so this is supposed to
work what I knew it's not gonna work, so I am actually, I have
this pulled up idea.
Can you guys see this or no?
Yes.
I don't think. Ohh yeah, perfect. So the CF surf tools.
Right here.
OK, so this CSF dot tools are is directly related to NIST and
they have all of the.
You know, there's documentation that you would need. Usually the
new CSF is a combination between NIST SP 800, one 71 and 853.
What most companies that deal with HIPAA use is the 853
revision 5 because it maps out very nicely to HIPAA when you
put them together. It's kind of like you're looking at the same
things. The difference between the two is that NIST gets broken
down into controls, and HIPPA gets broken down into
safeguards, and HIPPA is a little more.
Uh, general, they kind of give you a guideline, but they don't
tell you exactly what to do, which is kind of annoying
because when they audit you, they're very, very specific.
So people use NIST to have a better understanding of what to
actually do.
This representation of NIST under the CSF tools is very
nice. It has everything broken down, so NIST has these five
components identify, protect, detect, respond and recover.
When you hover over it, it tells you exactly what this is, and
then it gets even better. You just click on it and it gives
you all the controls on their dad and then you can go even
further down and further down and it just keeps on going.
But just to give an overview of you know these controls the
identify is usually where you kind of develop an understanding
of the procedures inside of a company. It gets broken down to
asset management which is where you get into inventory like how
do you guys do your software and hardware inventory. Are you
aware of everything that is on every computer and every device
on your network? Is everything labeled is everything.
You know.
A confusion, uh, confidentiality wise is everything labeled, and
then you have the business environment you gotta see. Like,
what's your objectives as far as roles and responsibilities go
do. Does everybody know what they're doing inside the company
or not? Because if they don't, that can be very risky. I'm not
gonna go through all of this, but we have governance and risk
assessment, which is usually why people show up for consulting.
This is where they get and they're like, OK, well, we kind
of need help. We need somebody to tell us what to do. And then
we go and we show them what to do. And then they get to
protect. They try to secure all of their systems before anything
bad happens. But with technology, it's kind of
impossible to protect everything. You are going to
have some type of vulnerability somewhere. As it was said
before, there are certain things like software that accompany
needs to use and.
They're aware that it's vulnerable. It's just kind of
how you take that risk. Are you gonna choose to ignore the risk
because it's, you know, the likelihood is very low on that
risk happening. That happens a lot, but then when?
There are vulnerability gets exploited, then they have to
detect it and they have to respond and the recovery is
where the disaster recovery plans and business continuity
comes to place. But yeah, it's a pretty exhaustive process. It
takes months usually.
Uh, I have been.
I worked with one client that it took over three months just to
get interviews done, because every time we had an interview.
They would give me an answer and then I'll go into their
documentation and then I'll go into their systems and I would
realize that. Ohh well, you forgot to tell me that this one
was broken and then we have to set up another interview because
everything has to be very official and everything has to
be noted because there's a confidentiality problem that you
can share these information with anybody other than the person
that they that gave it to you. So yeah, it it does get.
A little exhausting, but the outcome is always good and also
I personally really enjoy these things. I love working with
policies and just reading through what people are doing
wrong.
Yeah. Other than that, we do have a HIPAA. So this is a very
good source. It's.
It's literally their website. If you're curious about what the
Hippo privacy rule is, or the security rule, it's very easy to
just Google a summary of them and they will tell you exactly
what they are.
There are concerned with how.
Health care information is stored and transmitted within
companies and outside of companies with their third
parties.
Because, you know, most hospitals, especially large
hospitals, don't process their own patient data, they are
always outsource it to some third party.
Company that works with data and that company needs to be
evaluated as well to make sure that they don't have any
security holes and you gotta make sure that all the personal
like the PII is scrubbed before the information is transmitted.
And this is an example of what the hippo controls look like, or
they're safeguards versus NIST, which is laid out like this.
This is what hippos looked like. It's gets to like unique user
identification. It has all of these weird numbers in it, and
there are a lot of them.
It can get to about, I think, 104 different safeguards
depending on which document you're looking at and what you
actually need to be answering to as far as auditing those. But
yeah, that's another. This is another one. So The funny thing
about this is that you are a cybersecurity consultant, but
when you go in, everything is a part of cybersecurity, like you
have to check the doors for.
You know, do you have safe exits? Do you have safety for,
like, fire hazards? Do you have safety for like, water hazards?
So everything kind of falls under cybersecurity because at
the end of the day, if your hospital catches on fire, you're
gonna have data in there and something bad is going to happen
to it. I know this sounds very cynical because there are
definitely people in there too, but.
I as far as our job goes, we have to make sure that your I IT
hard hardware is safe and in a good position to kind of protect
everything that patients have given you.
But yeah, that's a day in the life of a cybersecurity
consultant. I just wanted to give this presentation because
when I first started studying cybersecurity, I had no idea
that consulting was actually job.
It took a few years for me and a very unexpected job offer from a
company to realize ohh yeah this is an option.
So yeah, I hope this was helpful.
Uh. If anybody has any questions.
Uh, go on ahead. Other than that, thank you for listening.
Wow, that was awesome. Thank you for that.
I work in the healthcare industry, so I am well aware of
all those security protocols and I'm the site lead at my call
center. So we have a NIST room where the computers are built.
And for government contracts and only certain people can go in
there and they have to be turned on specifically at different,
you know, junctures throughout the throughout the month,
there's just a lot of of security protocols to all of
that. And you you gave me a lot of information there that makes
sense now.
This is, yeah, so good job.
Yeah, I'm.
It is. It is pretty. We are usually the annoying people that
show up on not really anybody's favorite person to show up to
your job. It's I'm gonna be the one to tell you like you have to
do those little things and most of the times it does get
ignored. But the good thing about consulting work rather
than, I don't know, hands on in house security roles is that you
are not responsible. So if I say something and you don't do it I
don't have to pay for what you've lost.
You know, so yeah, that liability aspect is really good,
especially for like starting a career and cybersecurity.
It gives you good pointers as far as what you can learn, but
not being liable for anything.
Oh, great job. So does anyone have any questions for any of
Thank you.
our presenters? That was a lot of really great information,
everyone.
No questions.
Alright.
Well, I will go ahead and close the meeting down. I'll stop the
recording. And of course, if you wanna rewatch it, it will be
available.
I hope everyone has a great night and a great weekend and we
will see you next week.
Have a good night everyone.
Goodnight.
My.
Goodnight. Thanks for all the information guys.