WEBVTT

00:00:05.633 --> 00:00:07.533 align:middle line:80% position:50% size:80%
Narrator: Cloud computing
is transforming the way

00:00:07.533 --> 00:00:09.500 align:middle line:80% position:50% size:80%
we do business,
making I.T. more efficient

00:00:09.500 --> 00:00:11.233 align:middle line:80% position:50% size:80%
and cost-effective,

00:00:11.233 --> 00:00:13.400 align:middle line:80% position:50% size:80%
but it's also opening companies
up to new types

00:00:13.400 --> 00:00:15.000 align:middle line:80% position:50% size:80%
of cyber threats.

00:00:15.000 --> 00:00:18.367 align:middle line:80% position:50% size:80%
Today, it's not a matter of if
but when.

00:00:18.367 --> 00:00:20.533 align:middle line:80% position:50% size:80%
Mary is going on a cruise
and notices the cruise line's

00:00:20.533 --> 00:00:23.533 align:middle line:80% position:50% size:80%
website offers an image-sharing
mobile application

00:00:23.533 --> 00:00:25.267 align:middle line:80% position:50% size:80%
that is hosted on a cloud.

00:00:25.267 --> 00:00:28.200 align:middle line:80% position:50% size:80%
The app will let her access
her itinerary, track her trip,

00:00:28.200 --> 00:00:30.033 align:middle line:80% position:50% size:80%
and share her vacation images
with friends

00:00:30.033 --> 00:00:32.100 align:middle line:80% position:50% size:80%
over social networks.

00:00:32.100 --> 00:00:34.000 align:middle line:80% position:50% size:80%
However, after a week on-board,

00:00:34.000 --> 00:00:36.100 align:middle line:80% position:50% size:80%
Mary begins to feel
a little uneasy,

00:00:36.100 --> 00:00:37.633 align:middle line:80% position:50% size:80%
and it's not seasickness.

00:00:37.633 --> 00:00:39.567 align:middle line:80% position:50% size:80%
Many of her friends have
complained to her that they

00:00:39.567 --> 00:00:41.600 align:middle line:80% position:50% size:80%
were spammed after viewing
photos she shared

00:00:41.600 --> 00:00:43.400 align:middle line:80% position:50% size:80%
via the cruise line app.

00:00:43.400 --> 00:00:45.333 align:middle line:80% position:50% size:80%
She complains to
the cruise director.

00:00:45.333 --> 00:00:48.100 align:middle line:80% position:50% size:80%
Meanwhile, back on shore, the
cruise line's development team

00:00:48.100 --> 00:00:51.733 align:middle line:80% position:50% size:80%
is already aware of the problem
and is working to rectify it.

00:00:51.733 --> 00:00:53.967 align:middle line:80% position:50% size:80%
So how could a cruise line
know about this type of breach

00:00:53.967 --> 00:00:56.067 align:middle line:80% position:50% size:80%
before the users themselves
are aware,

00:00:56.067 --> 00:00:58.167 align:middle line:80% position:50% size:80%
and what measures can they take
to both alleviate

00:00:58.167 --> 00:01:01.333 align:middle line:80% position:50% size:80%
any current problems and prevent
them from happening again?

00:01:01.333 --> 00:01:02.667 align:middle line:80% position:50% size:80%
The best defense?

00:01:02.667 --> 00:01:05.333 align:middle line:80% position:50% size:80%
A security incident response
team that can quickly take

00:01:05.333 --> 00:01:07.767 align:middle line:80% position:50% size:80%
whatever steps are needed
to thwart attacks

00:01:07.767 --> 00:01:09.433 align:middle line:80% position:50% size:80%
and restore system health.

00:01:09.433 --> 00:01:11.567 align:middle line:80% position:50% size:80%
This team is on point
to guard the cloud,

00:01:11.567 --> 00:01:14.367 align:middle line:80% position:50% size:80%
armed with the latest software
and security technology.

00:01:14.367 --> 00:01:16.400 align:middle line:80% position:50% size:80%
They can tackle the full gamut
of security issues

00:01:16.400 --> 00:01:19.400 align:middle line:80% position:50% size:80%
through 3 important steps:
monitoring data,

00:01:19.400 --> 00:01:21.333 align:middle line:80% position:50% size:80%
gaining visibility in the cloud,

00:01:21.333 --> 00:01:23.200 align:middle line:80% position:50% size:80%
and managing access.

00:01:23.200 --> 00:01:24.967 align:middle line:80% position:50% size:80%
Let's look at monitoring data.

00:01:24.967 --> 00:01:27.900 align:middle line:80% position:50% size:80%
Danielle is the cruise line's
data security analyst.

00:01:27.900 --> 00:01:31.033 align:middle line:80% position:50% size:80%
Her cloud data activity
monitoring system notifies her

00:01:31.033 --> 00:01:33.067 align:middle line:80% position:50% size:80%
that there's something fishy
going on,

00:01:33.067 --> 00:01:35.467 align:middle line:80% position:50% size:80%
but the system doesn't just flag
a set list of threats.

00:01:35.467 --> 00:01:38.633 align:middle line:80% position:50% size:80%
It can detect new types of
possible security threats.

00:01:38.633 --> 00:01:40.933 align:middle line:80% position:50% size:80%
It uses advanced
machine learning techniques

00:01:40.933 --> 00:01:43.633 align:middle line:80% position:50% size:80%
to build detailed models
of normal system behavior

00:01:43.633 --> 00:01:46.000 align:middle line:80% position:50% size:80%
and flags any deviations
to these models,

00:01:46.000 --> 00:01:48.533 align:middle line:80% position:50% size:80%
assessing the risk
in each deviation.

00:01:48.533 --> 00:01:50.367 align:middle line:80% position:50% size:80%
This, combined with
built-in insights around

00:01:50.367 --> 00:01:52.600 align:middle line:80% position:50% size:80%
known hacking techniques,
enables the system

00:01:52.600 --> 00:01:56.500 align:middle line:80% position:50% size:80%
to rapidly detect unusual user
and database activity.

00:01:56.500 --> 00:01:59.600 align:middle line:80% position:50% size:80%
Danielle goes to Ian,
the enterprise security analyst.

00:01:59.600 --> 00:02:02.267 align:middle line:80% position:50% size:80%
Ian is able to provide her
with the detail needed

00:02:02.267 --> 00:02:04.400 align:middle line:80% position:50% size:80%
to gain visibility in the cloud.

00:02:04.400 --> 00:02:06.833 align:middle line:80% position:50% size:80%
He monitors all the traffic
going in and out of the cloud,

00:02:06.833 --> 00:02:09.200 align:middle line:80% position:50% size:80%
using a variety of
sophisticated software

00:02:09.200 --> 00:02:11.467 align:middle line:80% position:50% size:80%
or virtualized
software appliances.

00:02:11.467 --> 00:02:14.867 align:middle line:80% position:50% size:80%
It detects multiple suspicious
events we call offenses.

00:02:14.867 --> 00:02:18.100 align:middle line:80% position:50% size:80%
All this activity is collected
and analyzed within the cloud

00:02:18.100 --> 00:02:20.200 align:middle line:80% position:50% size:80%
to work out not only
what is happening

00:02:20.200 --> 00:02:22.967 align:middle line:80% position:50% size:80%
but who is responsible
for the offense.

00:02:22.967 --> 00:02:24.933 align:middle line:80% position:50% size:80%
The system basically
looks for patterns.

00:02:24.933 --> 00:02:26.700 align:middle line:80% position:50% size:80%
It will correlate perhaps
millions of events

00:02:26.700 --> 00:02:28.667 align:middle line:80% position:50% size:80%
as it searches for
suspicious patterns,

00:02:28.667 --> 00:02:30.700 align:middle line:80% position:50% size:80%
patterns that deviate
significantly

00:02:30.700 --> 00:02:32.500 align:middle line:80% position:50% size:80%
from normal system behavior.

00:02:32.500 --> 00:02:35.067 align:middle line:80% position:50% size:80%
It provides the visibility to
quickly pinpoint and identify

00:02:35.067 --> 00:02:36.800 align:middle line:80% position:50% size:80%
the hacker's credentials.

00:02:36.800 --> 00:02:39.467 align:middle line:80% position:50% size:80%
In this case, Ian and Danielle
quickly realize that

00:02:39.467 --> 00:02:41.100 align:middle line:80% position:50% size:80%
a group of hackers
has compromised

00:02:41.100 --> 00:02:43.233 align:middle line:80% position:50% size:80%
a team member's password
and used it to access

00:02:43.233 --> 00:02:45.233 align:middle line:80% position:50% size:80%
the cloud management console.

00:02:45.233 --> 00:02:47.433 align:middle line:80% position:50% size:80%
From there, they were able to
create unauthorized

00:02:47.433 --> 00:02:49.867 align:middle line:80% position:50% size:80%
administrator accounts, which
then introduced the malware

00:02:49.867 --> 00:02:51.733 align:middle line:80% position:50% size:80%
that created the spam.

00:02:51.733 --> 00:02:54.067 align:middle line:80% position:50% size:80%
To address this issue,
the incident response team

00:02:54.067 --> 00:02:57.000 align:middle line:80% position:50% size:80%
can remove the new administrator
roles created by the hackers

00:02:57.000 --> 00:02:59.600 align:middle line:80% position:50% size:80%
and change all cloud credentials
and passwords.

00:02:59.600 --> 00:03:02.067 align:middle line:80% position:50% size:80%
These measures thwart
the hackers' malicious activity

00:03:02.067 --> 00:03:04.367 align:middle line:80% position:50% size:80%
by shutting down
their privileged access.

00:03:04.367 --> 00:03:05.900 align:middle line:80% position:50% size:80%
To prevent further
cloud breaches,

00:03:05.900 --> 00:03:07.767 align:middle line:80% position:50% size:80%
Ian finally talks to Annika,

00:03:07.767 --> 00:03:09.967 align:middle line:80% position:50% size:80%
the identity and access
architect.

00:03:09.967 --> 00:03:11.933 align:middle line:80% position:50% size:80%
Annika's job
is to manage access.

00:03:11.933 --> 00:03:15.300 align:middle line:80% position:50% size:80%
She uses a privileged identity
management system, or P.I.M.,

00:03:15.300 --> 00:03:17.700 align:middle line:80% position:50% size:80%
that controls access
to the critical cloud resources

00:03:17.700 --> 00:03:21.033 align:middle line:80% position:50% size:80%
that store confidential
and sensitive information.

00:03:21.033 --> 00:03:23.367 align:middle line:80% position:50% size:80%
The P.I.M. uses a method of
checking fresh credentials

00:03:23.367 --> 00:03:27.400 align:middle line:80% position:50% size:80%
in and out each time the system
that Annika manages is accessed.

00:03:27.400 --> 00:03:29.867 align:middle line:80% position:50% size:80%
This adds an extra layer of
security for users who have

00:03:29.867 --> 00:03:33.600 align:middle line:80% position:50% size:80%
the high level of access to
this confidential information.

00:03:33.600 --> 00:03:36.200 align:middle line:80% position:50% size:80%
All of these steps are crucial,
particularly when you consider

00:03:36.200 --> 00:03:40.567 align:middle line:80% position:50% size:80%
that a typical organization has
785 different cloud applications

00:03:40.567 --> 00:03:43.200 align:middle line:80% position:50% size:80%
in use, but surprisingly,
on average,

00:03:43.200 --> 00:03:45.100 align:middle line:80% position:50% size:80%
they only know about 60 of them.

00:03:45.100 --> 00:03:48.167 align:middle line:80% position:50% size:80%
The rest of the apps are unknown
and unsanctioned.

00:03:48.167 --> 00:03:51.467 align:middle line:80% position:50% size:80%
Security is a journey,
not a destination.

00:03:51.467 --> 00:03:54.833 align:middle line:80% position:50% size:80%
Security intelligence monitors
data, gains visibility,

00:03:54.833 --> 00:03:58.000 align:middle line:80% position:50% size:80%
and manages access in order to
evolve and respond

00:03:58.000 --> 00:04:01.467 align:middle line:80% position:50% size:80%
to the ever-changing world
of the cloud.