Definitely going to be fall.
I love the briskness of our region and everything like that.
And then just being able to put on a light coat to stay warm, you're not sweating, I
absolutely hate Florida weather because it's hot and humid and there's nothing you can
do about it.
I like the dry heat down in places like Utah, Arizona, but when it's 120 degrees it's just
brutal.
So the nice crispness came back recently from a vacation in fall from Florida and you step
off the jetway from the plane and you just get that big blast of cold crisp air.
That's the thing I really enjoy the most is the cool crisp air.
So you're true to Minnesota where you're saying it's not about the heat, it's about the humidity.
That's what makes the difference.
Yeah.
Nice.
Well, Kelsey, what's your favorite season?
I know, I'm going to say, I'm going to totally piggyback on Nate that even if it's not a
season, that like one or two days that we get of like 70 to 75 where the humidity is not
there, the wind's not super high that you can go outside and you're like, yeah, I can
wear a sweater and it's enjoyable to be outside and the bugs haven't hatched yet.
That's definitely the ideal weather day 100%.
Yeah.
And Jake?
I got to say, fall as well.
Are we all going to say fall?
Just campfire weather and yeah, I open in the windows at night and everything's nice and
cool in the morning.
Nothing beats that.
So if you find a spot where we get fall year around, tell me or don't tell me if you don't
want me to leave.
But I think I might run there if you can find it.
I think Jake and I are going to have to go dirt biking and have a campfire this fall.
So find a weekend, Nate, sign me up anytime.
Perfect.
I was going to say like fall as well.
I mean, we're all saying fall.
I love the change in colors, like the cool weather.
It's just perfect.
Yeah.
We're all up here in the Midwest loving it.
But if you're listening on YouTube, we'd love for you to comment below what your favorite
season is, what your favorite weather is.
And today on our Tech for Business podcast, we're talking about the clouds, not that kind
of cloud.
We're talking about network and cloud security.
We're joined by Nate, our director of cybersecurity and Jake, our assistant director of services.
And I'll kind of throw it out to them.
Why is the cloud security, why is the cloud security important for businesses?
Yeah, I'd say it's a very important topic to cover now.
We're seeing an unbelievable amount of customers move to the cloud away from that local infrastructure.
It's the first place they want to go.
A few customers want to remain on premise for some things, but I would say 95 to 100%
of our customers are able to move a segment of their infrastructure to the cloud, right?
So it's important for us to talk about security and make sure that we're provisioning them
in a secure environment as they move forward.
So they have a good foundation for their systems as they move there.
Yeah.
I think I'm going to, before I jump all the way down into the security and everything
is maybe quick reiterating what the cloud is.
Yes.
Thank you.
Yeah, there's a lot of people where it's so common these days that we just say the cloud,
people know what that means.
It is not floating up in the sky, right?
Ariel already stopped me from calling out all the different types of actual meteorological
clouds because I was doing that before we recorded.
But no, it's rather than running a server in your building or data center or something,
you're leasing or running a system or computing from another provider, right?
So there's a lot of different ways that you could go about this, right?
As the cloud could just be running at a vendor's data center, right?
It's still in a data center.
It's just not your data center all the way to, they're running the actual computers, you're
running the programs on top of it and then all the way to a software as a service, which
is they run all of the applications, the hardware, you just go to a website to be able to access
it.
So, you know, things like Office 365, right?
That's a software as a service.
It's running in the cloud, which means Microsoft's data centers, we just access it from a website.
So.
Otherwise, yeah, Jake, I guess maybe, do you want to maybe talk a little bit about why are
so many people moving to the cloud?
You know, what, you help lead our entire cloud team.
So, you know, what's the main motivators for customers for you?
There's various motivators.
One of the primary ones of the last couple of years is moving to a cloud-based solution
for the remote workforce to have easier capability of utilizing their applications.
You know, we at CIT have taken, you know, leaps to get into that environment, which allows
our workforce to be able to be able to use all the applications and utilities that they
used to have to be in the office for a connect over a VPN.
Now we've allowed that to be accessed easy, but also in a secure manner.
Other motivators moving to the cloud, I'd say, is, you know, aging hardware, aging operating
systems.
Companies wanting to move to more of an operational expense and get away from that capital expense
of purchasing a server, migrating the services to it, and letting it sit there for another
five years and then maintaining that.
A lot of that overhead and backend maintenance that they're used to doing with a traditional
server, some of that gets alleviated by moving to like an Azure-based system, right?
Or even a software as a service-based solution like Microsoft 365 email.
Now we don't have to patch an exchange server and do things like that.
And have an engineer spend a weekend running a cumulative update on a server.
Those days are gone for those technologies.
So say those are kind of the two big points for moving to the cloud that I'm seeing.
Awesome.
Yeah.
The OPEX versus CAPEX is a big component there, you know, and that's even bleeding
over into security solutions these days.
So for example, in the past, your security appliance that used to sit there and monitor
the network, you know, you'd pay the big beefy log storage device, you have it all sitting
there and, you know, like Jake said, every five years, potentially you're sitting there
replacing it with another server for that log retention.
Now a lot of this is hosted in the vendors data center or data lake.
And then from there, you pay it more of a per-monthly basis for access, you know, and
so depending on how many users you have, they predict how many logs it'll generate.
And then that's what helps determine the price.
So even security now is becoming very predictable in pricing.
So, you know, as an organization, you're projecting, let's say, five to 10% growth.
You just know that your security costs and everything else are also going to grow by
five or 10%.
So, speaking of that growth, right, along with cloud com scalability, right, we can
provision additional resources without having to purchase additional servers, right, to
do that.
We can spin up multiple user accounts, virtual servers, things like that as we need it.
And then we can, of course, scale that back too.
So we have tax clients, right, or who are running taxes and they get very busy for a
certain period of time.
We can give them larger, higher-resourced virtual machines that they can run for that
period of time.
And then in their off-season, we can bring those down a little bit and save on the cost
with that.
So lots of flexibility with those types of resources.
I think that's a great call-out that you can go backwards to, right, and start reducing
that cost, you know, as long as the value still is there.
So, one of the things that I wanted to talk a little bit about this is, you know, Jake
did a lot of talking about, you know, as the remote workforce is starting to go, sorry,
now that they're remote, you know, we have more connections coming into the network.
So bringing it all the way back, and, you know, there's a whole podcast that I go deep,
deep, deep into Zero Trust.
What's a few other individuals.
I promise I won't bore you here with that.
But in the past, organizations had a castle mentality, right, as you had the walls of
the building.
That was the perimeter.
As you're adopting more and more cloud technologies, that perimeter really starts to become a little
bit of a quasi-grey area, right, as, you know, where is our edge now?
And so, you know, no longer is it just, we have the walls, there's a mainframe sitting
in the server room.
You have to physically walk up to it, put it in, you know, type in your info.
Now, you know, we've introduced VPNs, all that kind of stuff.
Now we have cloud solutions.
So now what we're starting to see in the cloud environment is that the physical walls of
the organization, or maybe, you know, the physical walls in the VPN tunnel, is no longer your
perimeter anymore.
Now it's the access to those resources is the new perimeter.
So there's a whole, I don't remember if I did a podcast on it, maybe it's coming up,
about identity and access management.
So identity and access management is a whole component about not just trusting that, you
know, the user, but, you know, the multi-factor, the behaviors that are happening, tying all
that in together, and then making sure that everything checks out before you grant access
to, you know, one of these applications.
And so now to scale that to, you know, 50, 70, you know, 200 different applications that
you have within your environment, we can quickly see potentially where this complexity starts
to come.
I'll probably take a little pause there because I can keep going.
But as you can start to see is it was very, very simple before with those, the physical
walls now are becoming so deeply interconnected with how data is flowing, how, you know, we're
logging into everything.
It's becoming more of a web rather than just a castle.
So yeah.
I think we can speak to some of the networking security features that we should be implementing
when we're moving to a cloud-based solution.
You know, some of the listeners that have the conventional background of managing your
environment and your network and having a firewall sitting there to protect you from
the outside world.
What does that look like if you were to move to Azure today?
What kind of things do we have to keep in mind when we start talking about that type
of a migration?
So in a lot of ways, some of the, I lost my light here.
Sorry about that.
In a lot of ways, the networking security inside of Azure has some similarities with an on-premise
environment, right?
We're spinning up resources.
They have an internet connection out.
We also have to sometimes allow internet connections into these servers for various servers that
we may be running off of it, you know, web-based servers and things like that.
So there's means of doing, you know, web application firewalls to sit in front of these resources.
And Nate, maybe you'll speak to that a little bit later on.
But there's things that we can do in limiting inbound port access to our servers that we
have running inside of Azure, making sure we don't have our 443 ports opened up just
to anybody in the world because we're testing something.
We made it work, right?
We have to shut those things down and make sure we're not leaving those holes open to
our resources and things that we need to check as we manage these resources moving forward
and just do just constant security checks on those resources and making sure they're
secure.
When it goes to accessing those resources, a lot of times we're doing that from an office
that you may still have, right?
You may still have users that are coming in and still working at your office location.
And they want to access those resources, but we want to make it as easy as we can for them
to do those things, right?
So we can still implement our traditional VPN solutions to connect your on-premises networks
to your cloud networks and allow that seamless, accessible service for your end users, but
still keep those resources isolated from the outside world so that they can't be accessible
from people outside of your organization.
Another way of accessing resources within Azure is via just a direct point-to-site VPN
client, right?
So maybe we don't want them to be in the office.
They want to work from home and still access the server.
Particular customer in mind today, they don't want to open up a web server to the internet
for various reasons.
They're not able to put secure logins to this web application just because it's not that
technologically advanced to support that with multi-factor authentication.
Or doing this for this particular client is we're keeping that 4.4.3 web access restricted
to your internal network and then putting a VPN client on the workstations to directly
connect to Azure so they can access those resources over a private tunnel.
So there's a lot of conventional technologies that we can still utilize within the Azure
space to connect your users, where we get into more of the modern, you know, username,
password, multi-factor authentication things.
We start getting into your software as a service-based solutions, things where you're accessing that
via a web page, right?
And we need the way there's a security on that to make sure that we're safe moving to
those.
That was a lot.
I'm trying to think about where I wanted to take that.
I guess just because you called it out, I will touch a little bit on what that the web
app firewall is.
So similar to a traditional firewall, right?
It's assessing the traffic coming in and blocking the unwanted traffic.
You can take that same concept to your websites.
So maybe this is your public website.
Maybe it's some type of critical application that you have.
Oftentimes what we're seeing in the security space is people are scanning websites all
the time looking for vulnerabilities.
If you're on WordPress, take a look.
There's always some new WordPress plugin that is compromised or contains malware, that stuff.
It's super critical to keep your plugins up to date.
But going back to the WAF or the web app firewall, is it sits in front of your website?
So when someone does try and exploit some of this, right?
I'll just take the basics.
Maybe you have a little SQL database on the back end containing customer info that you're
collecting, right?
Please give me your email address, password, all that stuff.
And then the database stores it.
There's a tax called SQL injections where you can try and get the database to provide
that data back to the attacker in an unauthorized way.
Well, the web app firewall is going to see those types of attacks.
And before it goes to the website, the firewall will deny that traffic while still allowing
the traditional approved behaviors on your website.
So really, really powerful stuff.
Here at CIT, it's been a little bit since I last looked at it, but I believe we're blocking
close to 2,000 attacks a day on our own website, right?
And we're not a big company, but it's just constant, right?
So oftentimes bots or just automated computers are just running across the website testing
to see if there is something vulnerable out there.
So, otherwise, maybe one of the other things just from a networking standpoint, there's
some really cool tools coming out.
So as organizations continue to shift to the cloud more and more and more, and specifically
related to networking is the wireless access.
So there's some really, really cool stuff that's coming.
So here at CIT, again, we're getting rid of all the servers on our network, right?
And so one of those servers is, how do you grant access to the wireless network?
Well, one of the next evolutions, you know, in terms of maturity of an organization as
well, is getting to certificate-based authentication.
And now there's solutions out there that they'll run that server up in the cloud, and it'll
integrate with all of your other services to be able to push this certificate out to
your devices.
So that way you know that these are trusted devices.
And then when you try and go access the wireless, it already shares that certificate with the
wireless, and so it can automatically log in.
What that helps you do then is you're only providing that to your trusted devices.
You can start pairing that potentially with the user that's logged into that system.
If someone was known to be compromised, you can revoke that certificate.
They no longer have access.
But then at the same time, you've reduced all the concerns of some sitting in the parking
lot, brute forcing your password, trying to get in.
So, you know, as we're talking about things like the finance, the healthcare, right?
You guys are, if you have wireless, it is heavily audited.
They don't like people just having a pre-shared key that's, then you could just grant that
access to one of the patrons or, you know, the customers to come into the network and
access the internal network.
Taking even the traditional server infrastructure for that level of networking is all moving
to the cloud as well.
It's very, very powerful.
And which then ties back into security as well.
So, the...
I was going to say really quickly, I'm just going to interject because, right, loved all
of the tech talk for somebody who doesn't work in that every single day, and maybe for
a few listeners who are not technical staff, but maybe that's not on their plate and they're
going, okay, yeah, I want to use Office 365.
I want to start using that.
What does that look like to first get started?
And then how would you even know to implement all those security things?
Because, right, I get to learn all these tools from you guys, but how would other people
know which tools they need?
So, I would say Microsoft is starting to get ahead of this a little bit.
And they're enabling things called security defaults on their tenants moving forward,
right?
And having multi-factor authentication isn't as much of an option anymore because Microsoft
is enabling this on the tenants by default, right?
So, they're doing levels of that sort of protection on there by default.
Yeah.
And I would still say it's great that Microsoft is doing it.
Other vendors aren't, right?
And so, one of the challenges there, and here at CIT, I say this all the time, is an effective
approach to just IT in general or cybersecurity is it takes three things to be truly effective.
Is the technology that you have has to be the right technology, the processes, and the
people.
So, essentially, it still is going to require someone to know what they're doing and is
experienced with the configurations of those to make sure that it's truly effective.
And so, that's where I'm going to selfishly take this back and say, if you need help,
talk to CIT because mistakes happen all the time because someone wasn't familiar with
how to do something, they roll it out.
I just dealt with this, I think, two months ago.
Customer wanted to go implement multi-factor, they thought they knew, they realized that
they forgot to close down a back door that doesn't support multi-factor, had an account
compromise as well.
And again, that comes down to, we know that because we do it all the time.
And I guess the last thing that I'd say about this is there's a organization out there called
OWASP, what they do is they measure, kind of year to year, over a couple of years, what
are the top 10 security risks to web applications?
So as we're talking about the cloud.
So from in 2017, it was very on-prem focused.
In 2021, when they released this, everything really started to change around.
And if I just, I pulled up a picture of it here.
Number four was, oops, sorry, number one jumped all the way up to broken access control.
So again, granting access to those cloud infrastructure, talking about the identity as your new perimeter.
Number four was brand new, it jumped all the way from something below to the top 10 was
insecure design.
So as Jake is talking about, how do we move you from one place to the next?
There's an architecture that comes with that to make sure it's done properly and securely.
So that was brand new.
And then number five was security misconfiguration.
So there's a, I think I read somewhere where within Microsoft, if you wanted to get into
all the different configurations, there's hundreds of thousands of settings to go through.
It's massive.
And that's just Microsoft.
Now you take it to the other 80 applications that you own, you can get really, really deep
into the weeds.
But as we can see, there's a giant shift to people are deploying things in an insecure
fashion and they don't go through all the settings to ensure that it's locked down properly,
tying that back into, it now takes a village to be able to truly manage your IT.
You can't just do it alone, right?
And we take the same mentality here at CIT.
We don't just have one net admin anymore.
We have a fleet of engineers that are managing even our internal network.
Yeah.
And we still have to take into consideration our end users, right?
Keeping an eye on those emails that are coming in and being diligent to check those for authenticity
and making sure that what they're getting is true and legitimate.
So I don't know that those days will ever go away, but right now we still have to pay
attention to those, right?
Mm-hmm.
No, that makes sense.
I'm going to be the time clock here person and say, we've got about five minutes left,
so I want to open the floor to both of you to say, is there any advice, any less thoughts
for any business owners about anything talked about today or anything that we haven't talked
about yet?
Do you want to go first, Nate, or do you want me to go first?
You can go first.
I've talked enough.
All right.
Yeah.
So it's a common trend to move to the cloud, right?
And it's a conversation that we love to have with our customers in helping you design
how do we get there?
It's not an immediate migration for everybody to where they can get there tomorrow.
A lot of times there are stages and phases to these things, but we can certainly get
you in the right, say, development plan to get you to a cloud-based solution today and
get rolling in a secure fashion too.
Like Nate said, there's numerous things that have to be configured correctly from the get-go
to ensure you're secure within that system.
It's great that Microsoft is enabling multi-factor authentication right off the get-go, but there
are things that we can do as far as securing your sign-ins to only the United States, maybe
Canada if we wanted to extend that, blocking out foreign countries and be able to sign-in
to your tenant, advanced auditing and logging of your user logins and sign-ins and looking
for those that are coming from unknown IP addresses throughout the country.
What do we want to do with those?
Do we want to treat those as risky behavior?
Right?
And as far as moving to Azure, we love to sit down and have these conversations and talk
through what does that migration plan look like for you?
We end up leaving those conversations a lot of times with the customer having a mindset
of here's how we should migrate it.
By the time we get through it, we pick apart a lot of pieces and things that we can move
to other secure utilities that are cloud-based solutions.
So now we have a much smaller handful of things that we need to actually migrate to Azure
insecure.
So if we can pick apart what we have on premise today and put those into secure solutions and
have a smaller amount of things that we need to migrate to, say, an Azure place, makes
our set of our boundaries and walls a lot smaller that we have to cover on those systems.
Yeah.
I think probably my kind of closing thoughts is completely agree with Jake is these are
not overnight changes.
Here at CIT, I know that we've had at least three years since I remember being deeply
involved in it.
Planning are very, very heavy cloud security focus.
And it's been a challenge to get there.
There's a lot of roadblocks that you face along the way, but it's been a lot of architecture
and planning on the steps that it will take to get us there.
And a lot of consulting with other people.
I don't think on a vacuum here at CIT either.
But that would be the big thing there.
And then I'm going to take this all the way back to the NIST cybersecurity framework.
We've talked about it many times.
It's blasted all over the website.
But as we're talking about cloud and how one of the issues is now instead of just one server,
one application, one environment, now you have potentially hundreds of different applications
bringing it back to the NIST cybersecurity framework.
If you remember, the first step to be able to protect your environment is to identify
what you have.
You have to know what applications are being in the, using the environment.
Do you have things like shadow IT, which is the concept of people using unauthorized resources
for business use that aren't authorized.
So maybe you're a one drive shop and someone's using Dropbox, right?
You have to know that because the sprawl of your data, the sprawl of the potential access
to the network just becomes wider and wider and wider.
And it's only going to continue down that path.
We see no slowdown of people moving to the cloud.
So ask for help, be okay with not knowing everything because it's so broad these days.
Jake knows way more than I do when it comes to certain topics and I know more than him
on other topics.
And then again, just identify what you have so you can actually protect it long term.
That's the best conclusion.
I was like, you summarized it for me.
So thank you.
Amazing, but thank you, Nate.
If you need any networking or cloud, Jake is your man, not me.
So security though, call Nate.
Don't call me.
Love the cross promotion, but thank you, Nate.
And thank you, Jake for sitting down and talking about networking cloud security.
As we've said multiple times, if anybody has any questions, needs help, just wants to have
a conversation to go, how do I even get started?
Is anything secure?
Even if you're not, we do service Minnesota, Western Wisconsin.
If you're outside of that area, we do have an entire network of people that we can get
you connected with that we trust.
That's just one of the people, right, that we reach out to to say, hey, what is everybody
else doing in the space?
So we've got connections by all means.
Reach out.
You can find us online at CIT-net.com, backslash podcast, which shout out, we now have a newsletter
subscription out there.
So if you want to get first dibs on new episodes, that's my marketing spiel.
Go out there.
I swear we're not going to spam you one time a week.
And then you can also email us at info at CIT-net.com or else thank you everybody and
we'll be back next week with another episode.