WEBVTT

1
00:00.000 --> 00:00.840 align:middle line:84%


2
00:00.840 --> 00:02.430 align:middle line:84%
Hello, and welcome back.

3
00:02.430 --> 00:04.740 align:middle line:90%
It's often great to be
reminded about things,

4
00:04.740 --> 00:07.560 align:middle line:90%
like such as
birthdays, reminding

5
00:07.560 --> 00:10.950 align:middle line:90%
ourselves to exercise, to eat
right, to be kind to everybody.

6
00:10.950 --> 00:14.160 align:middle line:90%
Well, it's also important
to be reminded occasionally

7
00:14.160 --> 00:15.660 align:middle line:90%
about those things
that we should

8
00:15.660 --> 00:18.840 align:middle line:90%
be both considering and
doing for secure management

9
00:18.840 --> 00:19.465 align:middle line:84%
of our network.

10
00:19.465 --> 00:21.298 align:middle line:90%
And that's what I'd
like to do in this video

11
00:21.298 --> 00:23.550 align:middle line:90%
is take a nice look at a
laundry list of elements

12
00:23.550 --> 00:26.070 align:middle line:90%
that we should be doing to
manage our network securely.

13
00:26.070 --> 00:28.680 align:middle line:90%
So let's use this
network as a backdrop

14
00:28.680 --> 00:30.693 align:middle line:90%
as we talk about secure
network management.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.680 --> 00:30.693 align:middle line:90%
as we talk about secure
network management.

15
00:30.693 --> 00:32.610 align:middle line:90%
And one of the first
things we had to consider

16
00:32.610 --> 00:36.580 align:middle line:84%
is OOB, out-of-band management.

17
00:36.580 --> 00:39.900 align:middle line:90%
So if we have user
VLANs and user networks,

18
00:39.900 --> 00:43.200 align:middle line:90%
we might want to carve out
either physically or logically

19
00:43.200 --> 00:45.540 align:middle line:84%
separate management networks.

20
00:45.540 --> 00:48.120 align:middle line:90%
And that helps us isolate
our management traffic

21
00:48.120 --> 00:49.140 align:middle line:84%
from the user traffic.

22
00:49.140 --> 00:51.390 align:middle line:90%
It also helps keep our
management network traffic

23
00:51.390 --> 00:54.090 align:middle line:90%
separate from where a
hacker or an attacker

24
00:54.090 --> 00:55.620 align:middle line:84%
might try to compromise us.

25
00:55.620 --> 00:58.470 align:middle line:90%
So out-of-band versus in-band
management of our networks

26
00:58.470 --> 01:00.090 align:middle line:84%
is a good thing to consider.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.470 --> 01:00.090 align:middle line:84%
is a good thing to consider.

27
01:00.090 --> 01:01.590 align:middle line:90%
Also, if the data
network goes down,

28
01:01.590 --> 01:04.830 align:middle line:90%
we have auxiliary or redundant
out-of-band management systems.

29
01:04.830 --> 01:07.540 align:middle line:90%
So we can still get to our
stuff and see what's going on,

30
01:07.540 --> 01:09.540 align:middle line:90%
which is really critical
if parts of the network

31
01:09.540 --> 01:10.470 align:middle line:84%
are failing.

32
01:10.470 --> 01:12.930 align:middle line:90%
Another element that we want
to always use when possible

33
01:12.930 --> 01:14.760 align:middle line:84%
are secure protocols.

34
01:14.760 --> 01:16.290 align:middle line:90%
And secure protocols
would include

35
01:16.290 --> 01:19.320 align:middle line:90%
options such as secure
copy protocol, SCP,

36
01:19.320 --> 01:26.160 align:middle line:90%
as opposed to FTP or TFTP,
or secure FTP or HTTPS,

37
01:26.160 --> 01:28.380 align:middle line:84%
using SSL/TLS.

38
01:28.380 --> 01:31.530 align:middle line:90%
And with the SNMP, we'd
want to use version three.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.380 --> 01:31.530 align:middle line:90%
And with the SNMP, we'd
want to use version three.

39
01:31.530 --> 01:33.180 align:middle line:90%
And as part of
SNMP version three,

40
01:33.180 --> 01:35.610 align:middle line:90%
we'd want to make sure we're
using the authentication

41
01:35.610 --> 01:38.220 align:middle line:90%
and encryption services that
are available in that management

42
01:38.220 --> 01:39.030 align:middle line:84%
protocol.

43
01:39.030 --> 01:41.070 align:middle line:90%
And if we are using a
protocol, and it's not

44
01:41.070 --> 01:42.903 align:middle line:90%
being protected well
enough, we could always

45
01:42.903 --> 01:45.870 align:middle line:90%
tuck that into some type of
a virtual private network

46
01:45.870 --> 01:48.000 align:middle line:90%
to make sure that data
plane traffic is safe

47
01:48.000 --> 01:49.550 align:middle line:84%
as it crosses the network.

48
01:49.550 --> 01:52.350 align:middle line:90%
And with the VPN, we
could be leveraging HTTPS,

49
01:52.350 --> 01:54.150 align:middle line:90%
or we could be leveraging
IPSEC, depending

50
01:54.150 --> 01:55.410 align:middle line:84%
on the implementation.

51
01:55.410 --> 01:57.090 align:middle line:90%
And also, there's
security measures

52
01:57.090 --> 01:59.580 align:middle line:90%
that we often do on
our networks that

53
01:59.580 --> 02:02.290 align:middle line:90%
aren't directly related to
the management of the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:59.580 --> 02:02.290 align:middle line:90%
aren't directly related to
the management of the network.

54
02:02.290 --> 02:05.160 align:middle line:90%
But any time we can help
prevent the network from being

55
02:05.160 --> 02:07.303 align:middle line:84%
compromised, it's a great idea.

56
02:07.303 --> 02:08.720 align:middle line:90%
So some of those
security measures

57
02:08.720 --> 02:11.377 align:middle line:90%
would be DHCP snooping,
which is going to do

58
02:11.377 --> 02:12.460 align:middle line:84%
a couple of things for us.

59
02:12.460 --> 02:15.990 align:middle line:90%
One, it's going to help
prevent a rogue or bogus DHCP

60
02:15.990 --> 02:17.820 align:middle line:84%
server from being successful.

61
02:17.820 --> 02:20.250 align:middle line:90%
It's also going to build
a database of our clients

62
02:20.250 --> 02:22.050 align:middle line:90%
in their layer three
layer two mappings

63
02:22.050 --> 02:24.150 align:middle line:90%
that we can use
with ARP inspection.

64
02:24.150 --> 02:26.340 align:middle line:90%
We can also implement
port security

65
02:26.340 --> 02:28.617 align:middle line:90%
to verify that only
specific layer two addresses

66
02:28.617 --> 02:30.450 align:middle line:90%
or quantities of layer
two addresses show up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:28.617 --> 02:30.450 align:middle line:90%
or quantities of layer
two addresses show up

67
02:30.450 --> 02:31.680 align:middle line:84%
on our switch ports.

68
02:31.680 --> 02:33.450 align:middle line:90%
And we have separate
sets of videos

69
02:33.450 --> 02:35.440 align:middle line:90%
on each of these
aspects in detail,

70
02:35.440 --> 02:37.320 align:middle line:90%
including the
configuration of them.

71
02:37.320 --> 02:39.240 align:middle line:90%
And for switches,
many companies are not

72
02:39.240 --> 02:41.580 align:middle line:90%
going to run DTP,
dynamic trunk protocol.

73
02:41.580 --> 02:42.850 align:middle line:84%
I'll put a big no there.

74
02:42.850 --> 02:44.970 align:middle line:90%
And they're going to take
all their unused ports

75
02:44.970 --> 02:48.747 align:middle line:90%
and place them as access
ports in an unused VLAN.

76
02:48.747 --> 02:50.580 align:middle line:90%
And that way, if an
attacker or someone even

77
02:50.580 --> 02:52.890 align:middle line:90%
accidentally connects to a port
they're not supposed to be on,

78
02:52.890 --> 02:55.390 align:middle line:90%
they're not going to get very
far because the port basically

79
02:55.390 --> 02:58.500 align:middle line:90%
goes to an unused VLAN that
has no access anywhere else

80
02:58.500 --> 02:59.750 align:middle line:84%
in the network.

81
02:59.750 --> 03:02.910 align:middle line:90%
And that would include no DHCP
services or any layer three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:59.750 --> 03:02.910 align:middle line:90%
And that would include no DHCP
services or any layer three

82
03:02.910 --> 03:04.740 align:middle line:90%
routing services
or anything else.

83
03:04.740 --> 03:06.210 align:middle line:90%
And also for our
devices, we'd want

84
03:06.210 --> 03:08.040 align:middle line:90%
to go ahead and
do some hardening.

85
03:08.040 --> 03:10.770 align:middle line:90%
And I've got separate sets of
videos regarding hardening,

86
03:10.770 --> 03:14.280 align:middle line:90%
both the control plane and the
management plane and the data

87
03:14.280 --> 03:15.160 align:middle line:84%
plane.

88
03:15.160 --> 03:17.370 align:middle line:90%
So check out those sets of
videos as well regarding

89
03:17.370 --> 03:19.565 align:middle line:84%
hardening our network devices.

90
03:19.565 --> 03:20.940 align:middle line:90%
All right, so back
to management.

91
03:20.940 --> 03:23.080 align:middle line:90%
If we are logging
into these devices,

92
03:23.080 --> 03:26.580 align:middle line:90%
whether it's us at a
PC logging in directly

93
03:26.580 --> 03:29.670 align:middle line:90%
to these devices with a
secure protocol, like SSH--

94
03:29.670 --> 03:31.140 align:middle line:84%
I'll add that up there as well--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.670 --> 03:31.140 align:middle line:84%
I'll add that up there as well--

95
03:31.140 --> 03:32.790 align:middle line:90%
or if we're connecting
to a controller,

96
03:32.790 --> 03:34.890 align:middle line:90%
and the controller is
connected to those devices,

97
03:34.890 --> 03:37.110 align:middle line:90%
we'd want to make
sure we're using AAA.

98
03:37.110 --> 03:39.410 align:middle line:90%
So authentication,
who the heck are you?

99
03:39.410 --> 03:41.560 align:middle line:90%
Authorization, what
are you allowed to do?

100
03:41.560 --> 03:43.810 align:middle line:90%
And then accounting,
what did you do?

101
03:43.810 --> 03:47.460 align:middle line:90%
So with ISE as a AAA server,
we could leverage TACACS.

102
03:47.460 --> 03:51.030 align:middle line:90%
And that way we could control
what the admin one or admin two

103
03:51.030 --> 03:53.310 align:middle line:90%
or admin three, whatever
those usernames are,

104
03:53.310 --> 03:56.220 align:middle line:90%
we can control specifically
what they're allowed to access

105
03:56.220 --> 03:58.530 align:middle line:90%
and what commands they're
allowed to implement.

106
03:58.530 --> 03:59.910 align:middle line:84%
And then log all of that.

107
03:59.910 --> 04:01.680 align:middle line:90%
Also, as far as the
logging, it would
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.910 --> 04:01.680 align:middle line:90%
Also, as far as the
logging, it would

108
04:01.680 --> 04:05.070 align:middle line:90%
be really important to have a
copy of those logs sent over

109
04:05.070 --> 04:10.120 align:middle line:90%
to a server that does not allow
admin access to that server.

110
04:10.120 --> 04:12.240 align:middle line:90%
So perhaps we have
a syslog server here

111
04:12.240 --> 04:13.440 align:middle line:84%
that's general purpose.

112
04:13.440 --> 04:15.900 align:middle line:90%
And we have a replica
of that syslog server,

113
04:15.900 --> 04:18.425 align:middle line:90%
a copy of that data over
here on another server.

114
04:18.425 --> 04:20.550 align:middle line:90%
So that way, if we need to
go back and do an audit,

115
04:20.550 --> 04:22.230 align:middle line:90%
we can see exactly
what happened.

116
04:22.230 --> 04:25.355 align:middle line:90%
And the admin, like a rogue
admin, can't go to the server

117
04:25.355 --> 04:27.480 align:middle line:90%
or start changing it because
he doesn't have access

118
04:27.480 --> 04:29.340 align:middle line:84%
to this replica or to this copy.

119
04:29.340 --> 04:31.570 align:middle line:90%
And as far as
authenticating, if we can,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:29.340 --> 04:31.570 align:middle line:90%
And as far as
authenticating, if we can,

120
04:31.570 --> 04:35.448 align:middle line:90%
it'd be great to use MFA,
or sometimes called 2FA.

121
04:35.448 --> 04:36.990 align:middle line:90%
So that's multi-factor
authentication

122
04:36.990 --> 04:38.440 align:middle line:84%
or two-factor authentication.

123
04:38.440 --> 04:40.440 align:middle line:90%
We've got a separate set
of videos just on that.

124
04:40.440 --> 04:43.860 align:middle line:90%
But that way, we can really make
sure that Bob the admin really

125
04:43.860 --> 04:44.790 align:middle line:84%
is Bob.

126
04:44.790 --> 04:46.980 align:middle line:90%
And even if we're not
using elaborate setups

127
04:46.980 --> 04:50.070 align:middle line:90%
with ISE and TACACS to
control who can do what,

128
04:50.070 --> 04:53.340 align:middle line:90%
even locally on the devices,
we can use parser views

129
04:53.340 --> 04:55.770 align:middle line:90%
to give subsets of
commands and options

130
04:55.770 --> 04:58.272 align:middle line:90%
to an individual user
based on their log in.

131
04:58.272 --> 04:59.730 align:middle line:90%
And so in a large
environment, we'd

132
04:59.730 --> 05:02.450 align:middle line:90%
want centralized administration
with a AAA server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
04:59.730 --> 05:02.450 align:middle line:90%
want centralized administration
with a AAA server.

133
05:02.450 --> 05:03.950 align:middle line:90%
But even in smaller
organizations,

134
05:03.950 --> 05:06.980 align:middle line:90%
we could use parser views
or custom privilege levels

135
05:06.980 --> 05:09.170 align:middle line:90%
to give subsets of
functionality based

136
05:09.170 --> 05:12.020 align:middle line:90%
on the user who is connecting
to and managing that device.

137
05:12.020 --> 05:15.650 align:middle line:90%
For our firewalls, this
could be a Firepower Device,

138
05:15.650 --> 05:18.040 align:middle line:90%
or maybe it's one
of the older ASAs.

139
05:18.040 --> 05:19.730 align:middle line:90%
We'd want to leverage
the features that

140
05:19.730 --> 05:22.130 align:middle line:90%
brings to the table,
including on the ASA

141
05:22.130 --> 05:28.520 align:middle line:90%
there's this option called NSEL,
which stands for NetFlow Secure

142
05:28.520 --> 05:30.230 align:middle line:84%
Event Logging.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:28.520 --> 05:30.230 align:middle line:84%
Event Logging.

143
05:30.230 --> 05:33.870 align:middle line:90%
So I spent about a decade
or so with the ASA.

144
05:33.870 --> 05:35.810 align:middle line:84%
It's like an old friend.

145
05:35.810 --> 05:38.150 align:middle line:90%
These days, we're using
Firepower with advanced threat

146
05:38.150 --> 05:39.440 align:middle line:84%
detection and all that stuff.

147
05:39.440 --> 05:41.570 align:middle line:90%
But on the ASA, if
you're still using one,

148
05:41.570 --> 05:43.280 align:middle line:90%
you can use NetFlow
Secure Event Logging.

149
05:43.280 --> 05:46.040 align:middle line:90%
And what it does, it combines
the benefits of NetFlow

150
05:46.040 --> 05:48.920 align:middle line:90%
to collect and report over to
a collector information that's

151
05:48.920 --> 05:50.720 align:middle line:84%
happening on the ASA.

152
05:50.720 --> 05:52.600 align:middle line:90%
So it leverages
NetFlow version nine.

153
05:52.600 --> 05:55.522 align:middle line:90%
And it can track a flow
creation when initial session

154
05:55.522 --> 05:57.230 align:middle line:90%
is going out to the
internet for stateful

155
05:57.230 --> 05:59.720 align:middle line:90%
filtering to allow the
reply traffic coming back.

156
05:59.720 --> 06:04.160 align:middle line:90%
We can record the flow
tear-down and also flow-denied.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:59.720 --> 06:04.160 align:middle line:90%
We can record the flow
tear-down and also flow-denied.

157
06:04.160 --> 06:07.460 align:middle line:90%
So the benefit of having
this all working with NetFlow

158
06:07.460 --> 06:09.980 align:middle line:90%
is that if we have a
NetFlow collector that's

159
06:09.980 --> 06:12.740 align:middle line:90%
giving us nice beautiful
graphics and reporting,

160
06:12.740 --> 06:16.070 align:middle line:90%
it's an easy way to see
large volumes of information

161
06:16.070 --> 06:17.680 align:middle line:84%
with a NetFlow collector.

162
06:17.680 --> 06:19.490 align:middle line:90%
And on the ASA,
what we used to do

163
06:19.490 --> 06:23.840 align:middle line:90%
to implement that type of thing
was an MPF, the modular policy

164
06:23.840 --> 06:26.390 align:middle line:90%
framework, which is
basically class maps which

165
06:26.390 --> 06:27.590 align:middle line:84%
identify the traffic.

166
06:27.590 --> 06:29.510 align:middle line:90%
Policy maps, which
say what we're

167
06:29.510 --> 06:31.220 align:middle line:84%
going to do with the traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

167
06:29.510 --> 06:31.220 align:middle line:84%
going to do with the traffic.

168
06:31.220 --> 06:33.710 align:middle line:90%
And that's what we'd want
to include a flow export

169
06:33.710 --> 06:35.630 align:middle line:84%
event in that policy map.

170
06:35.630 --> 06:38.415 align:middle line:90%
And to apply it, we'd use
a service policy command.

171
06:38.415 --> 06:39.290 align:middle line:84%
So here's the kicker.

172
06:39.290 --> 06:41.450 align:middle line:90%
If we already have the
collector in place,

173
06:41.450 --> 06:43.700 align:middle line:90%
and we're using NetFlow
with our other devices,

174
06:43.700 --> 06:45.860 align:middle line:90%
and we have an
ASA, we could also

175
06:45.860 --> 06:49.160 align:middle line:90%
leverage NSEL, the NetFlow
Secure Event Logging,

176
06:49.160 --> 06:52.310 align:middle line:90%
to include the ASA
information in our collector.

177
06:52.310 --> 06:56.663 align:middle line:84%


178
06:56.663 --> 06:57.830 align:middle line:84%
Man, this screen is crowded.

179
06:57.830 --> 06:58.940 align:middle line:84%
Let me clear it up off here.

180
06:58.940 --> 07:00.898 align:middle line:90%
And in the world of
software-defined networking
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
06:58.940 --> 07:00.898 align:middle line:90%
And in the world of
software-defined networking

181
07:00.898 --> 07:03.320 align:middle line:90%
where we sit here,
this is us, and then we

182
07:03.320 --> 07:05.270 align:middle line:90%
talk to some type
of a controller.

183
07:05.270 --> 07:06.950 align:middle line:90%
And that the controllers
and interacting

184
07:06.950 --> 07:08.420 align:middle line:84%
with our network devices.

185
07:08.420 --> 07:11.060 align:middle line:90%
We could be managing next
generation firewalls,

186
07:11.060 --> 07:13.580 align:middle line:90%
next generation IPS,
infrastructure devices

187
07:13.580 --> 07:14.923 align:middle line:84%
like routers and switches.

188
07:14.923 --> 07:17.090 align:middle line:90%
And the key is we want to
make sure we have security

189
07:17.090 --> 07:18.090 align:middle line:84%
all the way across.

190
07:18.090 --> 07:20.210 align:middle line:90%
So if there's multi-factor
authentication for us

191
07:20.210 --> 07:22.250 align:middle line:84%
to log on, that's great.

192
07:22.250 --> 07:25.070 align:middle line:90%
We want to use secure protocols
between the controller

193
07:25.070 --> 07:26.015 align:middle line:84%
and those devices.

194
07:26.015 --> 07:27.890 align:middle line:90%
And again, if we can
manage those out-of-band

195
07:27.890 --> 07:31.040 align:middle line:90%
with a separate either
physical or logical network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

195
07:27.890 --> 07:31.040 align:middle line:90%
with a separate either
physical or logical network

196
07:31.040 --> 07:33.102 align:middle line:90%
for that management
function, that's ideal.

197
07:33.102 --> 07:35.060 align:middle line:90%
Another element, too,
and I'll go ahead and use

198
07:35.060 --> 07:37.160 align:middle line:90%
a separate video,
regarding change control,

199
07:37.160 --> 07:40.950 align:middle line:90%
is to make sure that we have
backups of our configurations.

200
07:40.950 --> 07:44.048 align:middle line:90%
So that if something bad happens
to this router right here,

201
07:44.048 --> 07:45.590 align:middle line:90%
and we need to
replace it, if there's

202
07:45.590 --> 07:47.465 align:middle line:90%
no fault tolerance in
place, and it goes out,

203
07:47.465 --> 07:48.430 align:middle line:84%
we need to replace it.

204
07:48.430 --> 07:51.140 align:middle line:90%
It should be not a matter of
oh no, what was that config?

205
07:51.140 --> 07:53.050 align:middle line:90%
We should have
configuration management

206
07:53.050 --> 07:55.670 align:middle line:90%
that's storing all of our
configurations securely

207
07:55.670 --> 07:57.800 align:middle line:90%
encrypted so that
we can restore them

208
07:57.800 --> 08:00.860 align:middle line:90%
when needed after we replace
the hardware that's failed.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

208
07:57.800 --> 08:00.860 align:middle line:90%
when needed after we replace
the hardware that's failed.

209
08:00.860 --> 08:03.110 align:middle line:90%
In this video, we've taken
a look at a high level view

210
08:03.110 --> 08:04.550 align:middle line:90%
at some techniques
that we can use

211
08:04.550 --> 08:06.590 align:middle line:90%
for better management and
more secure management

212
08:06.590 --> 08:07.450 align:middle line:84%
of our network.

213
08:07.450 --> 08:09.980 align:middle line:90%
And in the next video, I'd like
to dive a little bit deeper

214
08:09.980 --> 08:11.720 align:middle line:84%
into the world of syslog.

215
08:11.720 --> 08:13.890 align:middle line:90%
So I'll see you in that
video in just a moment.

216
08:13.890 --> 08:16.160 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

217
08:16.160 --> 08:19.420 align:middle line:90%
And I'd like to thank
you for viewing.