That's right, when it comes down to working with servers, 2 2
we have to worry about data security. 3 3
What is it, why do we care and how do we do it find out more next. 4 4
>> You're watching IT pro TV. 5 5
[MUSIC] 6 6
That's right, you have made another choice. 7 7
Once again, that's a good choice for you as you're preparing for 8 8
the server plus exam you're here of course. 9 9
Well with Mr server himself, Wes Bryan as we continue on in our 10 10
server plus we are now taking a look at the idea of data security. 11 11
Now Wes, in terms of working with servers, I can think about data but 12 12
is it really my particular responsibility to worry about data security? 13 13
>> Yes. 14 14
>> Okay. >> Yes, absolutely, 15 15
let me be a little more specific than that. 16 16
Data security is everybody's job, right, and that's important to understand. 17 17
You'll hear some of our other security experts, you know, 18 18
the agitators here talk about building a culture of security right now. 19 19
What this episode will not be is an entire definition of everything security. 20 20
So we're gonna focus really just on the data itself now, 21 21
it's important on the exam. 22 22
Alright, let's set the stage for 23 23
what level of information should you know, right? 24 24
Be able to identify, be able to summarize and 25 25
that's really what they want you to do. 26 26
They want you to summarize back to us, what is the point of data security and 27 27
that's what we want to show you here, but we want to go a little bit farther and 28 28
not just have an explanation. 29 29
And I want to show you a couple of the techniques that we can utilize and 30 30
Windows environments in order to secure that information. 31 31
>> So Wes, once we've actually classified the data, 32 32
what about the idea of lifecycle management? 33 33
>> Sure, so once we, you know, once we classify the information that dictates how 34 34
we're going to treat that information from the moment of its creation to the point 35 35
when we actually maybe no longer retain it anymore and we need to eradicate or 36 36
dispose it. 37 37
Like for instance in a situation where maybe we're decommissioning a server and 38 38
we're gonna go ahead and maybe recycle it or loan it out to a school, right? 39 39
We don't want residual information on there, 40 40
so it's from the beginning of the creation of the information through the duration of 41 41
that information being important. 42 42
How we store that information, who has access to that information and 43 43
finally leading up to retention and disposal later on. 44 44
Now another thing that we have to keep in mind of is they talk about the cost of 45 45
security versus the risk and the impact of that data loss. 46 46
And again, it all centers around the classification, 47 47
understanding what information it is that you have will dictate 48 48
the measures that you put in place over its entire life cycle. 49 49
So those are some of the things that we also have to keep in mind. 50 50
Right retention policies, that's another thing. 51 51
What data do we need to hold and how long do we have to hold it for? 52 52
Right, you've heard of the proverbial bank box. 53 53
Right, that typically stores records maybe for seven years in analog form. 54 54
Well, well this is a digital age, you might have to you 55 55
might have to retain certain records, certain data for a long period of time. 56 56
Right, so also pay attention to retention policies. 57 57
All of these things dictate how you're going to manage that data throughout its 58 58
life cycle. 59 59
>> All right, so now that we understand that part in the terms of the business 60 60
process of this, let's talk about how we begin to do some data security. 61 61
So normally we think about the idea of encrypting data, right? 62 62
>> We do and there's a couple of different things, 63 63
a couple different levels of encryption that I want you to be aware of. 64 64
Let me show you, we've done a lot of talking here. 65 65
Let's go ahead and dive into some show and tell here, I'm actually on my file server. 66 66
02 here and I just got file Explorer opened up and 67 67
I'm just gonna right click and I'm gonna choose to create a file. 68 68
I'm gonna call this file something like secrets and 69 69
we're going to right click on it. 70 70
What I want to show you is that I could add a property to this 71 71
file by right clicking on it, choosing properties and 72 72
then doing a little bit with some of the advanced attributes. 73 73
Right, so here's the properties on general and by the way, 74 74
classification that's gonna be defined as you You could do the data classification 75 75
that I was talking about. 76 76
Right, so we talk about the attributes here. 77 77
Right, I could turn around and 78 78
I could encrypt the contents to secure the data and I could choose, okay. 79 79
And then choose apply, all right. 80 80
Now what it's asking me is say you're encrypting a file that's in 81 81
an encrypted folder. 82 82
If the file is modified, editing software might store temporary unencrypted copy. 83 83
So it's asking me do you want to encrypt the container that this file is it? 84 84
Right and I could say yeah encrypt the file and 85 85
its parent folder because it is recommended. 86 86
And what I should see here is that it's going there we go. 87 87
That's what I wanted you to see, 88 88
this is also important to when it comes to encryption of your information. 89 89
Even though this is not a recovery episode, I would not be doing you any 90 90
justice If I didn't mention this right now if you encrypt information it creates 91 91
a cryptographic key that's used to unlock and 92 92
lock that information that is tied to this user account. 93 93
This is file level encryption for your data, 94 94
it's a it's associated with an identity. 95 95
If that identity is lost her that key is compromised. 96 96
Not compromised but corrupted, all right. 97 97
And you can't get to that key anymore, you lose access to the information that's 98 98
important because again this is not a recovery type episode. 99 99
But we do want you to keep in mind that when you start to encrypt you have 100 100
typically cryptographic keys that need to be managed and maintain typically 101 101
by what's known as a KRA key recovery agent so that those keys are compromised. 102 102
You can gain access to the information, 103 103
just a slight public service announcement PSA. 104 104
If you will, all right and I'm gonna go ahead and 105 105
I'm gonna say back up later just because our demo I should back this up right now. 106 106
All right, so this is in a test environment only do as I say, not as I do. 107 107
And we choose, okay, all right, 108 108
now we get a little bit of an indication if I kinda zoom in there that that is 109 109
actually encrypted because I got a little lock icon too. 110 110
All right now, that's file level encryption Ronnie, you ask. 111 111
You know, how do we go about doing that, that's great for the file itself. 112 112
Right, but that doesn't protect the contents of the disk. 113 113
Right, that's why we typically don't just do file encryption actually that's kind of 114 114
putting you know the chicken the whole chicken in the egg conversation. 115 115
First thing we we go ahead is we encrypt the entire drive, all right. 116 116
We encrypt if you will even the boot process, 117 117
we implement things like secure boot that makes sure that only trusted 118 118
boot loaders can actually load up the operating system. 119 119
We put bios password you have I password. 120 120
So you can't even bootstrapped the hard drive until you put in a password then we 121 121
encrypt the hard drive itself. 122 122
And if we want to go even farther inside of that hard drive we do file level 123 123
encryption. 124 124
Let me show you the drive level encryption to, all right. 125 125
If I go ahead and I choose file, 126 126
explore a couple of different ways you can get to this. 127 127
But I'm just gonna go ahead and I'm gonna go the easy route here. 128 128
And if I choose this pc, all right, and 129 129
I kind of zoom into our local disk C and I right click on there. 130 130
Does't look like they have the option to manage bit locker from there. 131 131
I know that's in Windows 10, so let's go ahead, 132 132
let's just do this a little bit different way. 133 133
Shoot you know what it is, Ronnie, so I'm looking at here and 134 134
I'm like wait a second, I know that it's in the right click options. 135 135
Let me show you and 136 136
it's not there, the reason is inside of your server operating system. 137 137
Bit locker apparently needs to be installed as an optional feature. 138 138
Let me guys show you here and so again it's not in the list here but 139 139
if I was doing and solve this as a feature it would be but 140 140
I can show you once it is installed it would look something like this. 141 141
So I'm on my local machine because we do use full drive encryption as part of 142 142
our security policy here at IT Pro TV. 143 143
It's required that we have full drive encryption. 144 144
So my local machine is using the same exact technology that you would see in 145 145
the server. 146 146
I just need to install that extra feature to make it available in the server. 147 147
It's available by default on the client side, so 148 148
notice that Ronnie I've got that little lock icon and it's unlocked. 149 149
Right, so what does that mean, does it mean it's unencrypted? 150 150
Well kind of it means it's temporarily unencrypted because I'm 151 151
currently using it. 152 152
But once I shut this computer down it then means that the drive is 153 153
in an encrypted state so that if somebody was to take this drive out, all right. 154 154
I was gonna say hey Ronnie, I got the five finger discount. 155 155
I stole your drive and I'm gonna go ahead and 156 156
slave it into another device that I'm gonna boot it up. 157 157
Bit locker is gonna go wait a second, 158 158
I don't recognize the processor that's in this machine. 159 159
It's called a TPM, I don't see any of that and it fails to boot the drive and 160 160
it locks it into a recovery mode. 161 161
Right, if we right click we can actually this is what I was looking for 162 162
that is absent without the feature being installed is managed bit locker here. 163 163
All right, and you can see that bit locker is on. 164 164
All right, and I could turn it off if I want and then it's going to reach out and 165 165
it's going to turn it back on according to our security policy. 166 166
But notice that that means that this drive is encrypted, right? 167 167
It's the entire disc versus just if you will file level encryption to. 168 168
So that's example Ronnie of how we could encrypt or 169 169
secure that data as it is at rest. 170 170
>> We can also think about the idea since data not only exist at rest but 171 171
also in transit. 172 172
So help us out here to. 173 173
>> Sure, absolutely, so if I'm connecting between two endpoints and you might say, 174 174
well, when is the last time you've done that anytime you visit a web server, 175 175
you are one side of the endpoints. 176 176
That server is the other side of the endpoint, 177 177
you want to make sure that the encryption or the communication that's going across 178 178
the network in this case probably out to the internet is 179 179
scrambled in a way that unauthorized users cannot gain access to that information. 180 180
Right, so how do we do that, what we do that with https, right. 181 181
Hypertext transfer protocol over technically transport layer security. 182 182
If we're using transport layer security to encrypt our communications across 183 183
the network, we need to make sure that we're using TLS 1.3. 184 184
Right, because there's 1.21.1 and 185 185
all of those are deprecating now in their weaker encryption protocols 186 186
that could lead you into some kind of unauthorized access data exfiltration 187 187
if you will in the problem with that now is you have a security breach. 188 188
All right, so one of the ways that we can also encrypt our communications, 189 189
encrypt our data as it's over the network. 190 190
Not only http, we've talked about it before is things like a secure shell. 191 191
So for instance, if I right click on my start button here and 192 192
I choose to open the power shell, right, 193 193
I can do something like this where I choose ssh space administrator and 194 194
I'm going to put the IP address oops. 195 195
An IP address of my other file server and I'm gonna go ahead and 196 196
I'm gonna authenticate. 197 197
All right, and now with this connection that I've got via ssh between two servers, 198 198
the communication is encrypted between those two servers through 199 199
a tunnelized protocol. 200 200
Right, we use this a lot of times, ssh, when we are for instance, 201 201
Ronnie does when he's configuring switches and routers, right? 202 202
Because we don't want somebody to be able to scrape that information, pull it off 203 203
the wire, save it to their hard drive and then look at those that communication and 204 204
say, those are configuration files on a catalyst, whatever switch. 205 205
Right now I know they're running a cattle switch now, 206 206
I can see some of the commands. 207 207
Right, if we were doing something like the old telnet it would be in the wild 208 208
in clear text. 209 209
So you want to make sure that when your data is traversing the network back to 210 210
the original point. 211 211
And Ronnie asked that's data in transit in order to encrypt and 212 212
make sure that your data is secure over the network. 213 213
You and implement encryption protocols and 214 214
secure remote connection protocols is important as well. 215 215
So that unauthorized users that are potentially on your network right, 216 216
can no longer see that information. 217 217
It remains scrambled and it also makes sure that only the authorized people have 218 218
access to that data and the authorized people or what we want. 219 219
Right, that's a good people accessing good data. 220 220
That is at the end of the day, that is the goal of data security. 221 221
>> Now Wes, you also have the idea here of on site versus off site as well, help us. 222 222
>> Well sure, so your data is so important that we want to encrypt it. 223 223
Right, but we also take things like backups. 224 224
Right, and that's important to understand that the back, what is the backup, 225 225
a backup is that contents of that data? 226 226
That is so important that you can't you can't afford to lose it. 227 227
Well, if I have a backup and it's in an unencrypted manner. 228 228
Well then I could just take that information, restore it to a machine and 229 229
then I have access to that information. 230 230
So it is important in part of data security that you are encrypting your 231 231
information, whether it's stored on site or it's stored offsite. 232 232
All right, the other part of that too is data security. 233 233
Also we have to remember if you're not familiar with you should be by now and 234 234
you're training here at server plus. 235 235
Is that CIA triad, confidentiality, integrity and availability? 236 236
Remember the availability part, why would we have a backup on a in a physical 237 237
location on site and also have one offsite maybe secure location or 238 238
even in the cloud for disaster recovery. 239 239
Remember that's part of data security is making sure that authorized users have 240 240
access to that information. 241 241
That's the availability side of the CIA triad which is why we typically have 242 242
a backup of our data encrypted on site, backup. 243 243
Our data encrypted offsite whether that's a separate physical location. 244 244
Typically it is but it could be a physical location that you own or 245 245
it could be a physical location that a cloud service provider owns and 246 246
you actually store that information in their network. 247 247
And then you pay them for the managed service of managing, maintaining and 248 248
securing your information. 249 249
But those are the couple of different locations and 250 250
some of the considerations that I would be able to identify on the exam when they 251 251
ask you about data security. 252 252
>> All right, Wes there's only one other topic that you have here which is UFI. 253 253
And bios, passwords, I have not been super successful when 254 254
people have actually brought me machines with the idea of passwords on these 255 255
things because they generally say, I can't remember what that is. 256 256
And if that happens Wes, what actually happens. 257 257
>> You're probably gonna have to re flash the firmware. 258 258
>> [LAUGH] Yeah. 259 259
>> So that's a bad day at the office, but 260 260
that that's kind of like that first line of defense, you know, on the computer. 261 261
Right, we've encrypted the drive, we encrypted the files within the drive. 262 262
Now, what we've done is we've encrypted that boot process, right? 263 263
Whether it's a bootloader that we've said, hey, you know, I don't even want you to 264 264
run the bootloader until we authenticate after I authenticate. 265 265
I want to make sure that only you run trusted boot loaders. 266 266
Right, so we implement something like UFI secure boot that works in combination with 267 267
a TPM, a trusted platform module which is a cryptographic processor. 268 268
That bit locker also uses by the way that we've been showing you that says that 269 269
if that drive is in a state, if those system drivers, 270 270
if that early antivirus launch software that comes up. 271 271
If any of that's been modified, don't let that operating system boot because it's 272 272
it's no longer a trusted operating system and it's not in a trusted configuration. 273 273
So that bios or UFI password is going to require the person to put the password in 274 274
before the operating system even launches. 275 275
So this is separate from this is a very hardware dependent hardware specific 276 276
implementation that's really implemented across all motherboards if you will. 277 277
And it's a part of your firmware plan, all right. 278 278
>> Well there's a lot of good information there on your data security and 279 279
make sure you actually do take a look at this, especially for the server plus. 280 280
Exam Wes has emphasized that these are very important concepts and 281 281
something you should not overlook. 282 282
Well that will go ahead and wrap it up for 283 283
this episode of Camp TIA's Server Plus show. 284 284
But there is more to come and that means you want to stay right here for 285 285
the very next episode. 286 286
>> Thank you for watching IT Pro TV. 287 287
[MUSIC]