WEBVTT

00:00:01.640 --> 00:00:05.630
Hi, I'm Zachary Bennett. Welcome to the module, Managing

00:00:05.630 --> 00:00:07.850
Access and Authorization with Squid.

00:00:08.640 --> 00:00:10.250
In this introductory clip,

00:00:10.400 --> 00:00:14.590
you'll get a high‑level overview of Squid, and you'll learn how it fits into the

00:00:14.590 --> 00:00:21.570
broader security picture in NIST. In this course, we'll be looking at the tool,

00:00:21.570 --> 00:00:25.890
Squid. Squid's a tool that you'll run into out in the wild quite a bit as a

00:00:25.890 --> 00:00:27.850
security professional working with the web.

00:00:28.740 --> 00:00:31.350
So what is Squid, and why do we care about it?

00:00:32.970 --> 00:00:36.360
Well, Squid is one of those rare tools still in wide use today

00:00:36.750 --> 00:00:38.660
that has been around for quite some time.

00:00:39.240 --> 00:00:41.550
We're talking since the mid 1990s,

00:00:42.000 --> 00:00:45.910
something, which in the software industry, might as well be since the

00:00:45.910 --> 00:00:50.690
Stone Age. Squid was created by some computer scientists,

00:00:50.830 --> 00:00:54.670
their names appearing here, who worked out of a couple of different universities.

00:00:55.340 --> 00:00:58.720
But today, Squid is open source and is maintained

00:00:58.720 --> 00:01:00.650
by a robust group of volunteers.

00:01:01.740 --> 00:01:05.250
Simply put, Squid is a caching web proxy.

00:01:05.640 --> 00:01:09.150
It sits in front of a web server and receives traffic on its behalf.

00:01:10.100 --> 00:01:11.960
Squid has a number of benefits,

00:01:12.440 --> 00:01:15.330
but in this course, we'll be most focused on the security

00:01:15.330 --> 00:01:17.360
features and benefits that it provides.

00:01:19.040 --> 00:01:21.950
Why is Squid used so ubiquitously today?

00:01:23.040 --> 00:01:24.390
Well, first off,

00:01:24.400 --> 00:01:28.240
it is very good as a proxy cache. It helps accelerate

00:01:28.240 --> 00:01:32.790
servers that it receives traffic on behalf of. Squid is also

00:01:32.800 --> 00:01:34.850
open source and freely available.

00:01:35.640 --> 00:01:38.960
This plays a big role in why it is so widely used today.

00:01:40.140 --> 00:01:43.760
It is kept up to date with patches and new versions coming out regularly.

00:01:44.540 --> 00:01:50.530
This is impressive, given Squid's age. Squid is also very fast

00:01:50.540 --> 00:01:54.840
and highly configurable. Squid has been around a long time, and

00:01:54.840 --> 00:01:58.200
so it has pretty much any option you can think of when it comes

00:01:58.200 --> 00:01:59.660
to configuring a web proxy.

00:02:00.740 --> 00:02:04.220
Lastly and probably the biggest benefit of Squid is

00:02:04.220 --> 00:02:06.160
that it reduces server bandwidth.

00:02:06.980 --> 00:02:10.720
Squid is very good at receiving web traffic and sending out responses

00:02:10.720 --> 00:02:13.060
on behalf of the servers that it sits in front of.

00:02:13.740 --> 00:02:17.160
This reduces bandwidth tremendously for these servers.

00:02:19.140 --> 00:02:22.950
So how does this all fit in when it comes to a cybersecurity perspective?

00:02:23.640 --> 00:02:24.560
Well, first,

00:02:24.560 --> 00:02:27.730
let's take a quick look at the NIST cybersecurity framework.

00:02:27.730 --> 00:02:31.270
In this module and course, we'll be focusing in on the

00:02:31.270 --> 00:02:32.750
protect function of the framework.

00:02:33.940 --> 00:02:36.530
The protect function of the framework has everything to do with

00:02:36.530 --> 00:02:41.920
limiting or containment of a potential cybersecurity event. In

00:02:41.920 --> 00:02:45.520
this module, we'll see how Squid can be configured and used in

00:02:45.520 --> 00:02:47.050
order to serve in this capacity.

00:02:48.440 --> 00:02:50.590
Let's dive into this a little bit deeper though,

00:02:50.600 --> 00:02:56.580
as each NIST framework function has categories and subcategories. Within

00:02:56.580 --> 00:03:00.520
the protect function of the framework, we'll be looking at the Identity

00:03:00.520 --> 00:03:03.060
Management and Access Control category.

00:03:04.140 --> 00:03:09.160
This category is all about ensuring that users and user groups can only

00:03:09.160 --> 00:03:13.970
access those resources, which they are meant to access, and that access to

00:03:13.970 --> 00:03:17.060
resources in general are authenticated appropriately.

00:03:17.940 --> 00:03:21.240
Specifically in this course, we'll be focused on a single

00:03:21.240 --> 00:03:24.960
subcategory within identity management and access control,

00:03:25.520 --> 00:03:31.360
namely PR.AC‑4. In this subcategory,

00:03:31.840 --> 00:03:36.550
we're focused on making sure that access and authorization is properly managed.

00:03:37.490 --> 00:03:41.760
The principles of least privilege and separation of duties must be adhered to.

00:03:42.930 --> 00:03:45.750
Squid can be configured to ensure that users and groups of

00:03:45.750 --> 00:03:48.790
users can only access those resources,

00:03:48.800 --> 00:03:53.560
which they are meant to access and nothing else, but enough theory.

00:03:54.040 --> 00:03:57.180
Please join me for the next clip where we'll dive into Squid

00:03:57.180 --> 00:03:59.450
as a tool and learn how to start using it.