Skip to main content

A starting point for SaaS security and NIST 800-53

SaaS (Security as-if adding Salt) haha



Security is like salt. You need to add it at the right time, add just the right amount, and keep in mind the health/dietary needs. One can’t really learn the art-of-salt, unless one cooks, and eats what they cooked!

So here you go! My view of learning Security as-if learning the art of salting.

What does this paradigm mean to say learning a SaaS Cloud Platform?

Well, it means, go ahead, get say a trail Office 365 subscription*, set up the default, then start securing it, or as security people say, harden it. It escapes me as to why it is still called hardening, feels like it is neither Agile or DevSecopsy**, so let's say hardening is like a callus that a pro-player develops.

Anyways, unless one sets up a user, one will not experience the skipped/skimped password settings, and next unless one assigns a role** one will not experience membership management issues. So, go ahead create a few fictitious users*** and assign them trial licenses and roles.

Furthermore, only after one sets up a few users can the users share data, and unless one looks into logs can one spot of who is sharing what, and one won't understand the deep interconnectedness of say, a breach of confidentiality and logging and monitoring. So, go ahead set up a SharePoint site or two for each user, and share docs across users, and then go to the Admin center and look at the SharePoint file activity report.

Go ahead and share one of the fictitious user’s ID and a different fictitious user ID and password on any social site or blog. Then wait for Cyber Criminals (some professionals see hacking or the term hacker as a way to describe their job as a security professional and don’t appreciate the term being interchangeable with criminal/malicious actors) to attack you. Keep a close watch on your logs to see what happens. What will you do if you do see unexpected reads on your SharePoint files? Well, you won't see them unless one of your Azure AD accounts is hacked! This is because SharePoint is not accessible for anonymous access anymore.

Just doing the above four 'controls' gets you started in your journey of NIST 800-53***** controls of IA-5, AT-3, AC-5, AC-6, IR-8, AU-6, and other associated ones, in a tactile manner.

Ok now please remove the fictitious user IDs and unsubscribe! Lest you may end up paying Microsoft a bit more $ than you anticipated!!

Happy Learning!
Srini Kasturi 

* Even if you pay for the top of the line subscription for a few months, as I see it, you will still come out far cheaper than eating out for a month or two. Not too high a price to pay for the reward! 

** For now, suffice it to say that a role has to do with the what role people play along a business process, and a group has to do with what people belong to such as a geographic location or a business unit.

*** URLs and menus you need 

**** For now, suffice it to say that Agile is fast adjustments by Project Manager to fast changes in Business plays and DevOps is fast adjustments by Developers and Operators to meet these changes in Business plays.









Comments

Post a Comment

Popular posts from this blog

Shield's damaged! What is the risk level Scotty?

Understanding Security Risk Level Security Risks are like having a hole in your shield: no matter the side, the hole is still there. You can raise your shields, but until you fix the hole, you are living under a false sense of security. IT folks enter risk conversations much like the blind men describing an elephant ( https://en.wikipedia.org/wiki/Blind_men_and_an_elephant ). Each person is trying to convince everyone else and each one's statement is true to their perception but may be missing the overall perspective. A security professional is required to think through all stacks, layers, phases, control standards, and baselines. It is not optional.  They may know the elephant, but they may not know its purpose and value! Add the daunting task of keeping up with rapidly-evolving technologies and you have a very difficult task. How do we help all stakeholders get onto the same page and reduce risk due to ...
2 comments
Read more

Finding your starting point.

Cybersecurity is a vast field.   It often feels like one needs to be a good Business Analyst, Programmer, Architect, Operations Manager, Lawyer, Contracts Officer– all at the same time!  The saving grace though is that not all jobs need you to be a complete expert in any one single area to have a successful career. With this assurance, let’s get started on learning cybersecurity.  One very good starting point is the NIST NICE model. It is a good place to find what you like within the broad spectrum of Cybersecurity. You can then extract its Knowledge-Skills-Abilities (KSA) framework data and resources and get going. If job market relevance is your concern, then leverage Cyberseek.org . It represents today’s job market needs and maps them to the NICE framework as well. If you have a technical background or career, head on over to the Cloud Security Alliance (CSA)  Enterprise Archi...
2 comments
Read more