Hello, my name is James Youngblood, and in this module we will go over searching for deficiencies in security architectures. In this lesson, I will discuss how and where to begin when it comes to network security. Let's get started. When we're talking about network security, we're talking about a lot of information coming in and out of our networks. We wanna make sure that the data that's coming in or going out of it is not malicious. Let's actually get started and look at some of the things we can do to actually find where our network may have some deficiencies. Now I'm gonna start this module by asking you a question. Where does your network actually begin? Does it begin with your outward facing firewall that's right where your network connection is or your internet connection is? Or does it begin where your end users are? And that's a good question for you to keep in mind as we go through this course. I'm gonna show you a couple things here as far as for where to begin at and preparing for trying to find where we have deficiencies. And what I like to tell students is where you need to start at is by actually knowing what you have. What assets do you actually have? Typically, in most networks, we're gonna have four types of assets. You're gonna have security assets, network assets, computer assets, and software assets. When we're talking about security assets, we're talking about firewalls, network intrusion prevention systems, network intrusion detection systems and unified threat management systems. A lot of times these are all kind of interwoven into one device, but they may be individual devices as well depending upon how your network is set up. Make sure that any definitions, any virus definitions or any kind of threat definitions are actually updated on these. It's very tempting to not update the software or not pay the subscriptions that updates our software on these devices. But do keep in mind when you take that mentality, it's usually going to end up costing you in the long run because threats are constantly happening and attacks are constantly occurring across the globe. And they're looking for networks where there is outdated information, there are outdated definitions. So make sure that we are keeping these updated. The next type of assets that we're gonna find are gonna be our network assets. And these are gonna be things such as your cable modem will be one, the router will be one, switches. These are all network devices. A few other network devices you may wanna keep in mind will also be hubs and bridges. With a hub, the hub itself can actually be a security risk. Hubs are kind of referred to as dummy devices in the fact that all they do is they simply repeat a signal that they receive. The signal comes in in one port, and it gets transmitted out all the other ports. There's no filtering there at all. Every device connected to the hub receives that signal. So if we have an important piece of information that is only intended for one user, a hub is gonna send it to all the users anyway. So that's not necessarily a very secure way of transmitting data. When we're dealing with our switches and our routers, we wanna make sure that we have password protection on. You may also want to actually do MAC address filtering where literally the only device that can plug into a particular port is the device that has that particular MAC address on it. Make sure the passwords are updated so that our settings on these devices can't be changed. So moving on to computer assets. Now when we're talking about computer assets, we're referring to things such as computers. These are PCs, servers, laptops, tablets, and cell phones. Most of these devices have some security features built into them or that can be enabled on them. For your PCs and your laptops and your servers, most of them will have a built-in firewall. You wanna make sure that that firewall if it's your company's policy, to have it turned on. Make sure it's turned on. Make sure that the settings match the security template that is set up for your company. You wanna make sure that all of the features that are supposed to be turned on are turned on, and all the ones that aren't are turned off. The last thing is your software assets. These are gonna be things such as our antivirus program and our anti-malware program. You wanna make sure that the definitions are updated. Make sure you keep your subscription active so that that way you can receive regular updates on them. I'm gonna recommend at this point, get a piece of paper and write down what devices you actually have. What are the security assets that are part of your network? What about your network devices? What about your computer equipment and what software do you have? Write these down. It's just a good idea to have a list there so that way you can kind of know what you're looking at. Each of these devices typically will have a log that is generated on them whenever there's any kind of activity that takes place. It cannot be stressed enough that system logs from PCs and firewalls or routers and switches and other network devices, not only should they be checked, but they should actually be checked and monitored daily. This is just good security practice. The problem with looking at event logs though, there is an issue with that. Just by turning my computer on, I'm generating about 80 events in that event log, and that's a lot of information to look at, and that's just for one computer. What happens when I have a network of say 30 computers? Well, now that's exponentially larger, and it's gonna be very hard for me as an individual to go through each one of those computers every single day and go through every one of those event logs. So what I actually actually want to do is I want to find a piece of software that can actually help me with being able to monitor that. The software products are called security Information and event management tools. We call this SIEM for short. And there are several different companies that make SIEM software. SIEM software makes it easy to collect and store all these logs into a central location, and they have tools that help us find suspicious activity. Now you can see here on my screen, I actually have an example of a screen from a SIEM software tool. This is a security event manager, and it shows several different reports that are generated by the SIEM software. All these reports that you see here on the screen it's information taken from different event logs on my equipment, and it checks the whole network looking for these. And it looks to see are there any issues going on? Is there any suspicious activity? And of course, the great news is is because the fact that it brings all this into a centralized location, it makes it very easy to generate reports so that I can actually show other management, hey, this is what we're dealing with. Sometimes it helps to see what others are doing. What do you do when the company down the road from you has a breach in their network? Well, one of the things I'd wanna do is I'd wanna talk to the security guy say, hey, what happened? I can get some good information from them about what actually did happen to their equipment, what actually did take place that allowed the breach to occur. So read and research articles dealing with security breaches, learn what was done or not done that led to the breach. And then ask, is your network vulnerable to it? Next you wanna read the reviews on security equipment and software cause it does help to know what equipment you have, how does it compare to other products out there? Do you have a great product? Do you have kind of a middle of the road product or is yours kind of a very bad product and needs to be replaced? And then finally, you want to subscribe to a security white paper. These are news articles that cover the newest threats and defenses in IT. And like I said, if you don't know about a threat, how can you defend against it? This should give you a good start as far as for being able to know where to begin, finding where there's deficiencies in your network security. You should now have a better understanding of where and how to begin when it comes to network security. Stay tuned for the next lesson where I will discuss who our adversaries are in network security. Thanks for watching.
