Transcription
Hello guys, welcome back to the channel!
For today's video, I will be talking about the IT security tasks and responsibilities that I do at work. Okay, so in this video, I will be discussing the security tests that we do at work, the reasons why we do them, and some security best practices.
I will be sharing my experience as an all-around IT support, as our company security is still a part of what we do and our responsibilities working in IT. There are still security practices involved in our daily responsibilities that I really wanted to share with you guys.
Also, I just want to say, no offense to our cybersecurity folks out there; I have nothing against security. It's just not my cup of tea, just like networking or programming or other areas in tech may not be interesting to other people.
So if you're interested to see what kind of security tasks and responsibilities I have at my workplace, please keep on watching. Without further ado, let's get started!
Okay, to get started, we implement authentication through multi-factor authentication (MFA). Of course, some of the reasons why we implement authentication in our companies is for enhanced security and to prevent unauthorized access.
Where I'm working right now, the system that we use is called Okta. This is the authentication software that we use to implement MFA for all of our users and devices. At work, we typically just set up MFA for users' devices, especially if they have new phones. We do it more often with the new hires and typically assist them in installing the app on the phone and then setting it up with our system.
Next is vulnerability management. This involves identifying, assessing, and remediating vulnerabilities in systems, applications, and networks to reduce the risk of exploitation by malicious actors. Vulnerability management is important to protect our assets, like our computers, servers, and sensitive company files, including intellectual property from data breaches.
For example, security incidents can result from exploiting those vulnerabilities. So this is an example of a report from CrowdStrike that we got when a threat was detected from the system. We usually just get emails like this when a threat or malicious file has been detected from downloads, for example.
We usually talk to the users to justify the need for the program because sometimes it's a false positive. But in this case, this is Fortnite, so this is a no, and this does get removed immediately.
Here is an example of a Tenable scan from a computer, and it will show you the severity of the vulnerabilities, with critical being the highlight. It will show you the plugin ID and the description for each vulnerability.
Now here is an example of a table scan that we receive through emails. We get this weekly and a list of the high and critical severities for the vulnerabilities from the machines in our company. It usually has more assets than this, but this is what it looks like.
You can see the asset name here, the date when the vulnerability was found, and the very important part here is the vulnerability name. This is the culprit for the vulnerability, and this will give you the details on how to remediate or resolve this vulnerability.
Our most common vulnerabilities for the past months have been Log4j because it is well known that older versions of Log4j have vulnerabilities. We still have machines that have the older version of Log4j that need to be updated to a newer version.
On this side is the vulnerability description, which describes the vulnerability and gives you a solution on how to fix it. For example, this one is indicating that there's a Log4j vulnerability, and we also have this plugin result showing the path of the program Log4j is installed in. It also mentions what the fixed version should be.
For example, here our version of Log4j is 2.8.2 and we have to update it to this fixed version of 2.2.2.
Another common vulnerability recently has been the older versions of Adobe. We had Adobe from 2020 and below, and those are causing vulnerabilities because of bugs and issues. We have to update it to the current version, and in this description, you can see that 15.4.1 is the one with the vulnerability, and we have to update it to the fixed version.
Patch management is also another responsibility that we handle. This involves regularly applying security patches and updates to operating systems, software, and firmware to address known vulnerabilities and enhance system security.
We do the monthly patches and automate them for all of the user computers, but for important computers like servers and production computers, we do it manually. This is because sometimes, before we reboot the machines, we have to do something special like restart services.
Another task we manage is security awareness training. This involves providing education and training to users and employees on security best practices, common threats, phishing awareness, and the importance of safeguarding sensitive information. Examples of this are sending phishing email tests to users on a quarterly basis and also sending emails on security best practices and tips, especially when creating passwords.
Another responsibility is implementing firewalls. We have a specialized corporate networking team that handles all of our firewall policies. So, our firewall work is limited to just whitelisting and blacklisting IP addresses on Palo Alto, which is the system that we use for firewalls.
Lastly, we implement encryption. We use BitLocker to encrypt the drives on our computers, and we utilize VPN for our remote access. We also use KMS, or Key Management Systems, to protect encryption keys from unauthorized access or tampering.
Okay, so that's it for today's video! That's a summary of our security responsibilities that we handle at work. If you have any questions, please feel free to leave them in the comment section below.
I hope you enjoyed watching, and I hope to see you guys in my next videos. Thank you so much!