Latest / CYBR.Signal / Configuration Management

Transcript

Configuration Management · CYBR.Signal

• 0:00
  SPEAKER_00: And hello, everybody.
• 0:01
  SPEAKER_00: Happy Cyber Sunday.
• 0:02
  SPEAKER_00: Hope you're doing well.
• 0:04
  SPEAKER_00: So, not too long ago, I talked about control monitoring.
• 0:08
  SPEAKER_00: Um, so any of your security controls that you put in place, but I specifically kind of kept away from the technical aspect of monitoring controls and talked more about uh monitoring those towards uh compliance standards, that kind of thing, and how if you did those on a regular basis, you could get away from having to audit more frequently.
• 0:29
  SPEAKER_00: So made the distinction between monitoring in kind of a continuous fashion as much as you can, and auditing, which is kind of a point in time.
• 0:38
  SPEAKER_00: And if you don't monitor more continuously or as much as you can, then you kind of have to audit more.
• 0:44
  SPEAKER_00: And auditing just kind of a longer drawn-out type of thing, and monitoring is more keeping kind of in touch with it as it goes and uh whatever that control is, and being able to do that more frequently, maybe you can reduce your audit burden.
• 1:01
  SPEAKER_00: But again, I stayed at the level of more around compliance and standards uh monitoring towards those versus uh a technical type of uh style of monitoring.
• 1:14
  SPEAKER_00: But one of the things what I wanted to talk about, which I think is a little more technical and is an aspect of control monitoring, is configuration management.
• 1:22
  SPEAKER_00: So when you're talking about configuration management, you're talking about not just the control itself and how it does against whatever gap you've used to used it to fill, like a firewall or something like that.
• 1:37
  SPEAKER_00: What you want to do is continuously monitor the configuration as well to make sure it's not getting out of baselines.
• 1:47
  SPEAKER_00: So, and that's kind of that first, and there's a little bit of a debate.
• 1:50
  SPEAKER_00: I mean, I don't know, it's a debate, but just in my mind, it's kind of a debate on whether or not you should do baselining or you should do asset inventory first.
• 1:59
  SPEAKER_00: But baselining is without a doubt one of the things you should do to whatever your controls are, so you know what to uh monitor against that configuration, that monitor that configuration against.
• 2:10
  SPEAKER_00: So you absolutely should do baselining, but you don't know what to baseline for until you know what all you have from a control perspective.
• 2:18
  SPEAKER_00: So there's you know, there's basic asset management, knowing all of your devices, all that stuff.
• 2:22
  SPEAKER_00: But you also should have, you know, you have more limited asset management of things of different types of assets in your environment.
• 2:30
  SPEAKER_00: And one of those assets you could look at is a control.
• 2:33
  SPEAKER_00: So you should know what controls you have in place.
• 2:35
  SPEAKER_00: So inventory, make an inventory of those controls, then baseline what you want those controls to be.
• 2:41
  SPEAKER_00: You kind of have to stay there first.
• 2:43
  SPEAKER_00: You have to do those two things.
• 2:45
  SPEAKER_00: And then it's really about monitoring that configuration on a regular basis and doing everything you can to automate that monitoring.
• 2:54
  SPEAKER_00: So basically, if there's a way and there's plenty of auditing tools that you can put in place, like specifically for firewalls, that tool could be a firewall management tool or something like that.
• 3:08
  SPEAKER_00: You know, if you've got cloud, some type of or a cloud infrastructure, there are different tools, CSPM tools, other things like that, uh, that will help you can keep up with that and automate that uh that monitoring of those configs.
• 3:23
  SPEAKER_00: But you're also wanting you, I mean, you're always wanting to look for deviations to those.
• 3:27
  SPEAKER_00: And one of the things that I talk about is when I talk about the configuration management and baselining of things, is not to think of security controls only from the aspect of some type of device you put in place to fill a gap.
• 3:44
  SPEAKER_00: So the the control can absolutely be the hardening of a server or hardening of uh endpoints or something like that.
• 3:56
  SPEAKER_00: And you've got to be able to monitor those things too.
• 3:58
  SPEAKER_00: And you can do that with logging, you can do that with in automated ways where you're are with uh an agent of some kind on an endpoint where you're watching the configuration.
• 4:09
  SPEAKER_00: Um, there's whitelisting tools that you can monitor to make sure no any kind of activity is not happening on that box that you haven't explicitly said it's okay to do, like a file running, something like that.
• 4:23
  SPEAKER_00: So there's all kinds of tools you can use that are security tools, a control in and of themselves that monitor other controls that aren't a tool, if that makes sense.
• 4:34
  SPEAKER_00: And one of those controls being hardening of different devices.
• 4:39
  SPEAKER_00: And all that what that's going to do is really reduce your attack surface.
• 4:42
  SPEAKER_00: And then beyond that, you really should document it and let people know and kind of do awareness that those controls are in place while why you are doing things like configuration management on endpoints to make sure they don't fall out of baseline, that kind of thing.
• 4:57
  SPEAKER_00: You really should raise that awareness.
• 4:59
  SPEAKER_00: So, anyway, just a few aspects of one aspect of control monitoring is configuration management and monitoring the configurations of both security tools and different machines and that kind of thing on your environment, making sure you document and making sure you let people know why you're doing it and keep them aware.
• 5:21
  SPEAKER_00: So let me know what you think.
• 5:22
  SPEAKER_00: I'll talk to you next time.