Welcome to Cyber Res Video. Siris on the Company, a Security Plus 5 +01 Certification and Exam.
I'm your Instructor, Round Warner.
This is the fourth video associated with Domain three on architecture and design.
In this video, I'll explain important the importance of secure staging deployment concepts.
The following are all important part of application development to ensure that the code is staged put into production without issues or security challenges.
Concepts will be covering in this video include secure base lining
and integrity management.
Let me start with secure base line.
Establishing a secure base line is an important concept in securing networking.
Essentially, this is the process whereby you find a baseline for any system. So I talked about baselines in an earlier video.
Find the baseline for the system application or service that it needs to be secure.
Certainly, absolute security is not possible, so the goal is secure enough
based on your organization, security needs and risk appetite
by establishing a secure base line. Any change can then be compared to that baseline to see if the change is is within your security parameters.
Once a baseline is to find the next step is to monitor that system,
whether it's a single service computer or an application
to ensure that has not been changed
and that the baseline state system stays within the baselines.
This process is also defined as integrity measurement. For example, nest SP 801 55 Defined standards for testing the integrity of a system BIOS to ensure it has not changed. You can use software also to manage integrity
for bass lines. For example, trip wire provides hashing
of operating system components.
Review the topics of base lining integrity measurement within your study notes.
Next, we'll talk about environment
when you're deploying anything, whether it's an application operating system, a patch or new device,
the manner in which you deploy it can have a significant impact on the security of your network.
The first and most common way to address this is to enable separate environments. I'll talk about the separate environments.
The first is that development environment.
This is where the application is developed. This is used for both desktop applications and server or Web applications.
With proper testing, security flaws can be found while the application is in the development environment
for applications, operating systems and environ and other devices. There should also be a test
environment. This replicates the production environment as much as possible.
Think of it as a mini network
the most more closely, the test environment mimics the real world. More likely, you'll find an address, security and quality issues within your testing
next to staging.
Normally, any new addition to the network is deployed in stages, not simply put out to the entire network.
This is particularly important with applications or even patches for existing applications and operating systems.
Roll the new software out in sections of the network within a period of time between each new stage to be able to catch flaws, errors or other types of issues.
This provides you chance to fix those issues
in the staging environment before it is moved to production.
Production environment is where you do business.
It's where your company makes their money and therefore it should be restricted. And you shouldn't be running tests within your production environment.
I'll talk about sand boxing on the next life, basically within staging environment. It's completely isolated. Test network review these types of environments, see how they're used within your organization and be prepared for this topic on the security plus exam.
Sand boxing is a test environment. It's completely isolated from other applications or other parts of your network
when a new items, such as a patch or an application is being tested. Wanted to be in an isolated place such as this hand box.
You can also run sandboxes within an operating system and allows for programs and processes to be run in isolation
to limit access to other resource is files or system components on the host computer,
for example, Web pages. They run within your Web browser and are not supposed to be leaking out the other applications.
Sandbox is a nice security feature that reduces your risk.
In this video, I discussed how to design and implement a network in such a way is to enhance its security by enabling different environments.
Let's practice on a sample quiz Question.
Alice is a C. I. S. O for a financial institution.
She's looking for an environment used for testing that is completely off of their network.
Which do you recommend?
The answer is a a sandbox network
This concludes the video for section three dot for where I explained the importance of secure staging deployment concepts.
Please refer to your study notes for more information on this topic.