WEBVTT 1 00:00.000 --> 00:03.240 All right, let's chat about a few other Cisco appliances. 2 00:03.240 --> 00:09.340 The first of which is known as the email security appliance or the ESA. 3 00:09.340 --> 00:14.320 One of the key parts about our security portfolio is, again, we have to think 4 00:14.320 --> 00:15.260 about how malware 5 00:15.260 --> 00:16.960 gets onto our endpoints. 6 00:16.960 --> 00:22.220 And it's great to have AMP trying to protect our endpoints, but it would help 7 00:22.220 --> 00:22.920 for us to 8 00:22.920 --> 00:27.470 use a product like the email security appliance or the ESA in order to prevent 9 00:27.470 --> 00:28.280 the malware 10 00:28.280 --> 00:32.690 from ever even getting downloaded so that AMP even doesn't even have to deal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:28.280 --> 00:32.690 from ever even getting downloaded so that AMP even doesn't even have to deal 11 00:32.690 --> 00:33.440 with it. 12 00:33.440 --> 00:37.420 And so one of the primary ways our threat actors will get their malware out 13 00:37.420 --> 00:37.880 there is 14 00:37.880 --> 00:40.920 to send a phishing attempt. 15 00:40.920 --> 00:45.560 Phishing spelled this weird way with the pH in front of it to differentiate it 16 00:45.560 --> 00:46.000 is still 17 00:46.000 --> 00:48.680 sort of representative of phishing for fish. 18 00:48.680 --> 00:53.560 We're just casting our line out into the water and we're hoping somebody bites. 19 00:53.560 --> 00:57.440 And so the reality is that usually the threat actor is sending these to a bunch 20 00:57.440 --> 00:58.200 of different 21 00:58.200 --> 01:05.910 places, but then we have our happy go lucky user who gets this email and the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:58.200 --> 01:05.910 places, but then we have our happy go lucky user who gets this email and the 22 01:05.910 --> 01:07.000 email has 23 01:07.000 --> 01:10.200 a link in it that we end up clicking. 24 01:10.200 --> 01:18.500 And because this link takes us out to a bad website, so this is a bad malicious 25 01:18.500 --> 01:19.440 website, 26 01:19.440 --> 01:24.880 the website then places malware downloads malware onto the device. 27 01:24.880 --> 01:29.060 So this is one of the primary ways that our bad guys get malware out there and 28 01:29.060 --> 01:29.560 we want 29 01:29.560 --> 01:32.480 to address this from a couple of different perspectives. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 29 01:29.560 --> 01:32.480 to address this from a couple of different perspectives. 30 01:32.480 --> 01:38.290 So first of all, the email security appliance or the ESA, it also has a new 31 01:38.290 --> 01:39.040 name. 32 01:39.040 --> 01:40.640 So it's worth noting this. 33 01:40.640 --> 01:45.440 We have the secure email gateway. 34 01:45.440 --> 01:49.440 Cisco again trying to make it very clear what it's doing. 35 01:49.440 --> 01:54.010 And also they seem to like to start the word with secure the product name with 36 01:54.010 --> 01:54.600 the word 37 01:54.600 --> 01:55.600 secure. 38 01:55.600 --> 02:01.520 So either way, we've got this appliance and this is actually a physical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 38 01:55.600 --> 02:01.520 So either way, we've got this appliance and this is actually a physical 39 02:01.520 --> 02:02.120 appliance that 40 02:02.120 --> 02:08.760 is intended to sit in line with our email server, meaning that the ESA actually 41 02:08.760 --> 02:09.480 gets the 42 02:09.480 --> 02:21.400 emails and passes the good ones onto the email server. 43 02:21.400 --> 02:25.990 Now this does require us to have an on premise email server and these days more 44 02:25.990 --> 02:26.560 and more 45 02:26.560 --> 02:30.040 organizations are choosing not to deploy on premise email servers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 45 02:26.560 --> 02:30.040 organizations are choosing not to deploy on premise email servers. 46 02:30.040 --> 02:32.120 So we'll talk about that here in a moment. 47 02:32.120 --> 02:36.270 But in this situation, we've got the ESA, we get a bunch of emails and we do 48 02:36.270 --> 02:37.000 recognize 49 02:37.000 --> 02:40.480 hey, there are some bad emails in here. 50 02:40.480 --> 02:42.600 What is this looking for? 51 02:42.600 --> 02:44.400 Well it's looking for anything suspicious. 52 02:44.400 --> 02:47.800 It's looking for bad addresses. 53 02:47.800 --> 02:55.120 It's looking for emails that have attachments that seem suspicious. 54 02:55.120 --> 03:00.470 And of course, it's going to be looking for bad links, links that try to take WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 54 02:55.120 --> 03:00.470 And of course, it's going to be looking for bad links, links that try to take 55 03:00.470 --> 03:01.000 you to a 56 03:01.000 --> 03:02.840 malicious website. 57 03:02.840 --> 03:06.690 And so we're going to be looking for these with our email security appliance 58 03:06.690 --> 03:07.400 and ideally 59 03:07.400 --> 03:12.430 we filter all of them out delivering only good emails to our somewhat oblivious 60 03:12.430 --> 03:13.040 user over 61 03:13.040 --> 03:17.360 here who might have clicked on a bad email. 62 03:17.360 --> 03:18.480 Now a couple of things here. 63 03:18.480 --> 03:22.150 First of all, when we're talking about hey, trying to track attachments and 64 03:22.150 --> 03:22.680 files and 65 03:22.680 --> 03:27.610 everything as we can probably imagine the ESA is going to pull information from 66 03:27.610 --> 03:27.900 our 67 03:27.900 --> 03:29.200 Talos cloud. 68 03:29.200 --> 03:30.200 So this is great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 68 03:29.200 --> 03:30.200 So this is great. 69 03:30.200 --> 03:33.880 We love Talos and we want to take advantage of it where we can. 70 03:33.880 --> 03:37.230 Another great feature of this is that we might have another company down here 71 03:37.230 --> 03:37.880 who's also 72 03:37.880 --> 03:40.920 running an ESA. 73 03:40.920 --> 03:46.120 And now we can actually support encrypted emails. 74 03:46.120 --> 03:49.920 Emails are normally sent in plain text and that's really not great. 75 03:49.920 --> 03:53.720 We don't want to send plain text emails, especially ones that have sensitive 76 03:53.720 --> 03:54.400 information 77 03:54.400 --> 03:55.400 in there. 78 03:55.400 --> 04:00.610 And so now I can send encrypted emails to an organization that also has an ESA WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 78 03:55.400 --> 04:00.610 And so now I can send encrypted emails to an organization that also has an ESA 79 04:00.610 --> 04:02.040 or potentially, 80 04:02.040 --> 04:06.000 let's say we send it to a corporation that doesn't have an ESA over here. 81 04:06.000 --> 04:13.420 What can happen is the ESA will push this to Cisco's cloud service, still 82 04:13.420 --> 04:13.520 encrypted 83 04:13.520 --> 04:17.280 and then allow this user at this organization over here. 84 04:17.280 --> 04:20.280 Yes, this is a user with a laptop. 85 04:20.280 --> 04:21.280 Great art. 86 04:21.280 --> 04:22.280 I know. 87 04:22.280 --> 04:26.440 We can actually download this via HTTPS. 88 04:26.440 --> 04:31.400 So effectively allowing us to maintain encryption end to end. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 88 04:26.440 --> 04:31.400 So effectively allowing us to maintain encryption end to end. 89 04:31.400 --> 04:36.230 So even though they don't have an email security appliance, we can still send 90 04:36.230 --> 04:37.560 sensitive information 91 04:37.560 --> 04:39.240 via encryption. 92 04:39.240 --> 04:45.560 Now we just mentioned that a lot of our organizations these days don't actually 93 04:45.560 --> 04:47.200 deploy email servers 94 04:47.200 --> 04:48.440 on-prem. 95 04:48.440 --> 04:56.030 Instead, a lot of organizations are using Microsoft 365 if we're using Exchange 96 04:56.030 --> 04:56.360 , for 97 04:56.360 --> 05:01.200 example, and potentially other solutions for cloud email appliances. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 97 04:56.360 --> 05:01.200 example, and potentially other solutions for cloud email appliances. 98 05:01.200 --> 05:05.480 And we just said this is a physical appliance that must go in line. 99 05:05.480 --> 05:09.960 So we can't use the ESA with Microsoft 365. 100 05:09.960 --> 05:12.560 The ESA will not work as a solution. 101 05:12.560 --> 05:17.730 However, Cisco does have a solution known as the email threat defense, which 102 05:17.730 --> 05:18.040 looks a 103 05:18.040 --> 05:19.040 little familiar. 104 05:19.040 --> 05:21.440 We just talked about the firewall threat defense. 105 05:21.440 --> 05:26.500 Email threat defense is going to integrate as a cloud software package with 106 05:26.500 --> 05:27.200 Microsoft 107 05:27.200 --> 05:28.720 365. 108 05:28.720 --> 05:35.130 It's going to use APIs to communicate and it has, we'll say, rough parity with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 108 05:28.720 --> 05:35.130 It's going to use APIs to communicate and it has, we'll say, rough parity with 109 05:35.130 --> 05:35.880 the email 110 05:35.880 --> 05:37.360 security appliance. 111 05:37.360 --> 05:41.770 There will be some features that aren't included because we lose the inline 112 05:41.770 --> 05:43.800 nature of the ESA. 113 05:43.800 --> 05:49.240 So that's a conversation to have as far as whether you're deploying on-premise 114 05:49.240 --> 05:51.560 or cloud 115 05:51.560 --> 05:56.240 solutions for your email server, but either way, Cisco does have a solution to 116 05:56.240 --> 05:56.840 offer. 117 05:56.840 --> 06:02.280 Now let's go back here to talking about trying to prevent malware from getting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 117 05:56.840 --> 06:02.280 Now let's go back here to talking about trying to prevent malware from getting 118 06:02.280 --> 06:03.200 onto our happy 119 06:03.200 --> 06:05.080 go lucky user here. 120 06:05.080 --> 06:11.540 Remember one of the ways that this started was they clicked an email and they 121 06:11.540 --> 06:12.120 sent a 122 06:12.120 --> 06:14.600 request to a bad website. 123 06:14.600 --> 06:17.280 Well how exactly does that request work? 124 06:17.280 --> 06:19.360 Well we know this isn't a direct line. 125 06:19.360 --> 06:26.280 In the networking world we are given a domain name, which takes the form of a 126 06:26.280 --> 06:27.320 URL, and we 127 06:27.320 --> 06:33.040 have to go through DNS, a DNS server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 127 06:27.320 --> 06:33.040 have to go through DNS, a DNS server. 128 06:33.040 --> 06:39.480 And this DNS server is going to provide the IP address. 129 06:39.480 --> 06:42.680 Let's make that arrow a little bit clearer. 130 06:42.680 --> 06:46.400 We're going back to the user, we're providing an IP address. 131 06:46.400 --> 06:51.800 And now we can go out to the IP address to that bad website. 132 06:51.800 --> 06:56.480 So this is interesting and it creates an interesting question. 133 06:56.480 --> 07:02.760 Why should we provide the IP address to a bad website? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 133 06:56.480 --> 07:02.760 Why should we provide the IP address to a bad website? 134 07:02.760 --> 07:06.760 Why would we not just say, hey that's a bad website, you shouldn't go there. 135 07:06.760 --> 07:12.680 Well that is going to require a smarter set of services on the DNS server, but 136 07:12.680 --> 07:13.200 we have 137 07:13.200 --> 07:14.880 that capability. 138 07:14.880 --> 07:21.200 It's going to require Cisco's umbrella DNS security software package. 139 07:21.200 --> 07:26.320 Umbrella came to Cisco via an acquisition known as Open DNS. 140 07:26.320 --> 07:32.680 And Open DNS is more of a residential solution for this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 140 07:26.320 --> 07:32.680 And Open DNS is more of a residential solution for this. 141 07:32.680 --> 07:37.200 However, we in the enterprise space would want to use umbrella. 142 07:37.200 --> 07:41.110 So umbrella is going to give us a few different solutions here, which is pretty 143 07:41.110 --> 07:41.800 cool. 144 07:41.800 --> 07:45.790 It's going to, first of all, once again, tie into the Talos cloud so we know 145 07:45.790 --> 07:46.320 what the 146 07:46.320 --> 07:48.960 bad sites are. 147 07:48.960 --> 07:53.570 Then when we have a DNS request, we're going to check our knowledge of the bad 148 07:53.570 --> 07:54.240 websites 149 07:54.240 --> 07:57.400 to make sure that this isn't a known bad website. 150 07:57.400 --> 08:02.200 A lot of the websites, a lot of the URLs that are used are going to be known. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 150 07:57.400 --> 08:02.200 A lot of the websites, a lot of the URLs that are used are going to be known. 151 08:02.200 --> 08:07.160 Now bear in mind as well, the bad guys are, they're smart about this. 152 08:07.160 --> 08:13.560 This might be a totally randomly generated website. 153 08:13.560 --> 08:16.160 And I don't know, I'm just sitting here making up letters, right? 154 08:16.160 --> 08:20.510 But it could be something like this that's randomly generated and it's not used 155 08:20.510 --> 08:20.920 until 156 08:20.920 --> 08:22.120 the malware triggers. 157 08:22.120 --> 08:26.440 Well, that's fine, except remember, Talos brings in information from all over 158 08:26.440 --> 08:27.440 the world. 159 08:27.440 --> 08:33.780 But if we notice that this website then redirects to another location, another WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 159 08:27.440 --> 08:33.780 But if we notice that this website then redirects to another location, another 160 08:33.780 --> 08:34.520 IP address that 161 08:34.520 --> 08:38.390 we know is bad or suspect is bad, we can probably pretty well figure out that 162 08:38.390 --> 08:38.800 this is 163 08:38.800 --> 08:40.280 problematic. 164 08:40.280 --> 08:44.050 And so we're going to track that and again, be able to be pretty successful at 165 08:44.050 --> 08:44.600 blocking 166 08:44.600 --> 08:46.760 us going to bad websites. 167 08:46.760 --> 08:52.360 So it prevents malware from landing on the machine in the same way that the 168 08:52.360 --> 08:53.120 email security 169 08:53.120 --> 08:54.120 appliance does. 170 08:54.120 --> 08:57.520 They're trying to prevent malware from landing on the machine to begin with. 171 08:57.520 --> 09:04.240 However, this also opens up a whole new world to us for web filtering. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 171 08:57.520 --> 09:04.240 However, this also opens up a whole new world to us for web filtering. 172 09:04.240 --> 09:09.090 Organizations have long had to have sophisticated appliances and servers and 173 09:09.090 --> 09:10.360 software packages 174 09:10.360 --> 09:15.520 that prevent our users from going to websites with bad content. 175 09:15.520 --> 09:18.970 This is where we like to control the content our users are able to go out and 176 09:18.970 --> 09:19.400 see. 177 09:19.400 --> 09:23.700 For example, we might want to block violence or other inappropriate topics that 178 09:23.700 --> 09:24.320 exist on 179 09:24.320 --> 09:27.520 the internet or people that are just on their lunch breaks and they're trying 180 09:27.520 --> 09:28.000 to go out 181 09:28.000 --> 09:31.760 to websites that we would deem against our corporate policies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 181 09:28.000 --> 09:31.760 to websites that we would deem against our corporate policies. 182 09:31.760 --> 09:38.430 Well now we can again block here not just the bad websites, the ones owned by 183 09:38.430 --> 09:39.800 the malicious 184 09:39.800 --> 09:47.290 folks, but also the inappropriate or otherwise the blocked content on our 185 09:47.290 --> 09:48.520 network. 186 09:48.520 --> 09:53.720 So we can now use umbrella for web filtering in addition to malware protection. 187 09:53.720 --> 09:58.200 So between the email security appliance and umbrella, the theory here is that 188 09:58.200 --> 09:58.720 yeah, we 189 09:58.720 --> 10:05.280 might have AMP running here on the endpoint and that's great, but AMP doesn't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 189 09:58.720 --> 10:05.280 might have AMP running here on the endpoint and that's great, but AMP doesn't 190 10:05.280 --> 10:06.240 know every 191 10:06.240 --> 10:08.240 single file that is malware. 192 10:08.240 --> 10:13.920 And so if we can block the malware from even landing on the machine to start 193 10:13.920 --> 10:14.960 with, that's 194 10:14.960 --> 10:18.800 going to prevent problems later that maybe AMP could resolve, but hey, this is 195 10:18.800 --> 10:19.580 approaching 196 10:19.580 --> 10:21.960 security from multiple different angles. 197 10:21.960 --> 10:23.320 And this is a great way to start.