WEBVTT 1 00:00.000 --> 00:05.520 Yeah, I know. We are focused in right now. It seems like on all the security 2 00:05.520 --> 00:05.960 products 3 00:05.960 --> 00:10.460 they're going to detect when we have malware on the network and there's weird 4 00:10.460 --> 00:11.380 traffic flows 5 00:11.380 --> 00:15.700 happening and where all of a sudden trying to attack different things 6 00:15.700 --> 00:16.740 internally on the 7 00:16.740 --> 00:21.000 network without ever having come through the Internet. And yet, we do still at 8 00:21.000 --> 00:21.600 some point 9 00:21.600 --> 00:25.680 have to prevent those threat actors from getting in from the Internet and that 10 00:25.680 --> 00:26.440 is still going 11 00:26.440 --> 00:33.940 to require a firewall or potentially a next generation firewall or an NGFW. Now WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 11 00:26.440 --> 00:33.940 to require a firewall or potentially a next generation firewall or an NGFW. Now 12 00:33.940 --> 00:34.560 , despite 13 00:34.560 --> 00:37.930 next generation being there in the name, we might think, Oh, this is a brand 14 00:37.930 --> 00:38.840 new concept. 15 00:38.840 --> 00:42.900 These have been around for a while. And so we just have to recognize that they 16 00:42.900 --> 00:43.440 're referred 17 00:43.440 --> 00:48.990 to as NGFWs. What are we talking about here? What is a next generation firewall 18 00:48.990 --> 00:49.760 ? Well, a 19 00:49.760 --> 00:57.380 firewall is focused primarily on one thing, access control. Who is allowed on 20 00:57.380 --> 00:59.000 the network? 21 00:59.000 --> 01:02.460 And we put a firewall at the network edge because we want to prevent these WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:59.000 --> 01:02.460 And we put a firewall at the network edge because we want to prevent these 22 01:02.460 --> 01:03.680 threat actors 23 01:03.680 --> 01:08.880 from getting in. In fact, we don't really want anybody just to come in to the 24 01:08.880 --> 01:09.520 network 25 01:09.520 --> 01:13.990 here through the firewall unless usually a couple of things. First of all, we 26 01:13.990 --> 01:14.640 might want 27 01:14.640 --> 01:19.260 to allow web traffic is want people to get to our website. And so we'll build a 28 01:19.260 --> 01:19.560 DMZ 29 01:19.560 --> 01:25.520 off of it and allow them to access it that way. Or we might have VPNs, you know 30 01:25.520 --> 01:26.280 , users 31 01:26.280 --> 01:32.500 who are remote and they're logging in via VPN. But even VPNs, they're kind of a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 31 01:26.280 --> 01:32.500 who are remote and they're logging in via VPN. But even VPNs, they're kind of a 32 01:32.500 --> 01:33.000 form 33 01:33.000 --> 01:37.510 of access control, but they do fall within the category of a traditional 34 01:37.510 --> 01:38.760 firewall. Well, 35 01:38.760 --> 01:44.140 a next generation firewall is going to add functionality to the firewall, 36 01:44.140 --> 01:45.360 including intrusion 37 01:45.360 --> 01:51.570 prevention systems or IPS, potentially malware protection, trying to analyze 38 01:51.570 --> 01:52.520 packets as it 39 01:52.520 --> 01:56.930 comes through the firewall. And maybe we can figure out that there's malware in 40 01:56.930 --> 01:57.400 a packet 41 01:57.400 --> 02:02.040 as it traverses coming back into the network. But we might take a look at web WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 41 01:57.400 --> 02:02.040 as it traverses coming back into the network. But we might take a look at web 42 02:02.040 --> 02:03.520 security options. 43 02:03.520 --> 02:10.450 Can we filter out bad websites, for example? We can look at traffic encryption 44 02:10.450 --> 02:11.280 and all kinds 45 02:11.280 --> 02:15.220 of other options that are available that don't belong necessarily on 46 02:15.220 --> 02:16.640 traditional firewall 47 02:16.640 --> 02:20.800 platforms. Now, Cisco's had a lot of firewall platforms over the course of time 48 02:20.800 --> 02:21.720 . Their traditional 49 02:21.720 --> 02:26.880 firewalls started with the picks. And most recently, even though it's been a 50 02:26.880 --> 02:27.520 while at 51 02:27.520 --> 02:32.120 this point, the adaptive security appliance or the ASA, the ASA already sort of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 51 02:27.520 --> 02:32.120 this point, the adaptive security appliance or the ASA, the ASA already sort of 52 02:32.120 --> 02:32.880 attempted 53 02:32.880 --> 02:37.480 to do this. I mean, it brought in VPNs, it brought in a little bit of IPS. But 54 02:37.480 --> 02:38.680 now Cisco 55 02:38.680 --> 02:44.510 has for quite a while had a true next generation firewall in the form of 56 02:44.510 --> 02:47.360 firepower. And specifically, 57 02:47.360 --> 02:55.390 Cisco refers to this as fire power threat defense or FTD. So when we're talking 58 02:55.390 --> 02:56.040 about 59 02:56.040 --> 03:01.350 firepower and firepower threat defense, we're pretty much just talking about a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 59 02:56.040 --> 03:01.350 firepower and firepower threat defense, we're pretty much just talking about a 60 03:01.350 --> 03:02.240 firewall, 61 03:02.240 --> 03:07.670 which not to trivialize it, we definitely need a firewall in our network. But 62 03:07.670 --> 03:08.320 as we might 63 03:08.320 --> 03:12.590 imagine, most of the sophistication of security architectures these days seems 64 03:12.590 --> 03:13.760 to happen here, 65 03:13.760 --> 03:18.210 trying to prevent a lot of the internal nuances that can happen when malware 66 03:18.210 --> 03:19.160 gets downloaded 67 03:19.160 --> 03:23.680 and threat actors gain access to our networks in other ways. But we definitely 68 03:23.680 --> 03:24.360 want to have 69 03:24.360 --> 03:27.770 a next generation firewall in our network. And we probably want to consider in 70 03:27.770 --> 03:28.240 a couple 71 03:28.240 --> 03:32.590 of places, we probably want to consider deploying this at the internet edge, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 71 03:28.240 --> 03:32.590 of places, we probably want to consider deploying this at the internet edge, 72 03:32.590 --> 03:33.400 which is not going 73 03:33.400 --> 03:37.420 to come as any surprise. It's the example we keep using there. We want to keep 74 03:37.420 --> 03:38.000 our threat 75 03:38.000 --> 03:42.710 actors from accessing our network through the internet. But we might also 76 03:42.710 --> 03:44.040 consider deploying 77 03:44.040 --> 03:49.220 this into other network locations, especially at the data center. Corporate 78 03:49.220 --> 03:51.320 networks can 79 03:51.320 --> 03:56.160 be large enough that it makes sense to deploy a very large firewall between our 80 03:56.160 --> 03:56.760 data center 81 03:56.760 --> 04:01.720 and the rest of the network. And here's why. If we think about this, well, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 81 03:56.760 --> 04:01.720 and the rest of the network. And here's why. If we think about this, well, 82 04:01.720 --> 04:02.160 actually, let's 83 04:02.160 --> 04:06.670 just use this diagram over here, let's say that malware got on this machine 84 04:06.670 --> 04:07.560 here. The 85 04:07.560 --> 04:12.140 threat actor has bypassed this firewall check, we're good, we're on the inside 86 04:12.140 --> 04:13.280 of the firewall. 87 04:13.280 --> 04:17.610 And keep in mind, they're trying to access data stores. Well, where do these 88 04:17.610 --> 04:18.320 data stores 89 04:18.320 --> 04:24.600 live? These data stores and these servers tend to live in the data center. And 90 04:24.600 --> 04:24.840 the data 91 04:24.840 --> 04:28.990 center also tends to be layer three segmented from the rest of the network, 92 04:28.990 --> 04:29.640 which is no 93 04:29.640 --> 04:35.630 problem. We go through the network core. And so this threat actor who's taking WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 93 04:29.640 --> 04:35.630 problem. We go through the network core. And so this threat actor who's taking 94 04:35.630 --> 04:36.080 control 95 04:36.080 --> 04:40.270 of this machine is going to go through the core, which doesn't deploy security 96 04:40.270 --> 04:41.000 mechanisms 97 04:41.000 --> 04:46.570 itself. And then it allows it to communicate with the data center. Well, this 98 04:46.570 --> 04:47.400 is exactly 99 04:47.400 --> 04:53.250 where we might want to deploy a firewall. Because if we can deploy a firewall 100 04:53.250 --> 04:55.160 here, now 101 04:55.160 --> 04:58.930 we have to get through a firewall after all. Remember, the threat actor thought 102 04:58.930 --> 04:59.320 they were 103 04:59.320 --> 05:04.300 on the other side of the firewall and yet now whoops, wrong one. Now they're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 04:59.320 --> 05:04.300 on the other side of the firewall and yet now whoops, wrong one. Now they're 104 05:04.300 --> 05:04.960 facing a 105 05:04.960 --> 05:10.420 firewall that is protecting that protecting really what they're after. I mean, 106 05:10.420 --> 05:10.640 this is 107 05:10.640 --> 05:15.670 the treasure trove over here, draw a little bad treasure chest. But the idea 108 05:15.670 --> 05:16.240 here is they 109 05:16.240 --> 05:20.160 want to get into the data center, they want the data, they want the file stores 110 05:20.160 --> 05:20.560 , they 111 05:20.560 --> 05:26.650 want all of these different aspects of the data that the company's trying to 112 05:26.650 --> 05:27.640 protect. 113 05:27.640 --> 05:31.950 And so putting a firewall here does indeed make a lot of sense. So the firewall WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 113 05:27.640 --> 05:31.950 And so putting a firewall here does indeed make a lot of sense. So the firewall 114 05:31.950 --> 05:32.240 threat 115 05:32.240 --> 05:35.660 defense, that is Cisco's next generation firewall. It's a product that we 116 05:35.660 --> 05:36.520 should absolutely 117 05:36.520 --> 05:40.780 consider deploying not only at the internet edge, but also potentially to 118 05:40.780 --> 05:41.280 protect our 119 05:41.280 --> 05:45.160 data centers and other network locations, depending on the network needs.