WEBVTT

1
00:00.000 --> 00:01.443 align:middle line:84%


2
00:01.443 --> 00:03.360 align:middle line:90%
In this video, you and
I get to talk about how

3
00:03.360 --> 00:04.842 align:middle line:84%
we could deploy the WSA.

4
00:04.842 --> 00:06.300 align:middle line:90%
It's going to be
an on-prem device.

5
00:06.300 --> 00:08.940 align:middle line:90%
And some of the benefits it's
going to bring to the table

6
00:08.940 --> 00:11.640 align:middle line:90%
once it's deployed and
used in our environments.

7
00:11.640 --> 00:13.680 align:middle line:90%
And let's turn our
attention to this typology,

8
00:13.680 --> 00:17.880 align:middle line:90%
with the user Computer Two, and
that user is going to be Bob.

9
00:17.880 --> 00:20.340 align:middle line:90%
And let's imagine that
Bob goes out to a website,

10
00:20.340 --> 00:22.390 align:middle line:90%
and we'll put that
site out here.

11
00:22.390 --> 00:26.790 align:middle line:90%
And we'll call this
www.whatever.com.

12
00:26.790 --> 00:28.530 align:middle line:90%
Now behind the
scenes, Bob's computer

13
00:28.530 --> 00:30.780 align:middle line:90%
is going to do a DNS
request to resolve
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.530 --> 00:30.780 align:middle line:90%
is going to do a DNS
request to resolve

14
00:30.780 --> 00:33.553 align:middle line:90%
that URL, that name of that
website to an IP address.

15
00:33.553 --> 00:35.220 align:middle line:90%
And then he's going
to forward a packet.

16
00:35.220 --> 00:37.803 align:middle line:90%
So it'll be sent to the switch,
swivel there to switch it over

17
00:37.803 --> 00:39.842 align:middle line:90%
to the default gateway,
and then the router

18
00:39.842 --> 00:41.550 align:middle line:90%
will make a layer
three routing decision.

19
00:41.550 --> 00:43.470 align:middle line:90%
And each layer three
device on the path

20
00:43.470 --> 00:45.390 align:middle line:90%
will forward it
towards that server.

21
00:45.390 --> 00:46.770 align:middle line:90%
And once Bob
reaches that server,

22
00:46.770 --> 00:48.210 align:middle line:90%
and they do their
three way handshake,

23
00:48.210 --> 00:49.470 align:middle line:90%
the server is going
to respond back

24
00:49.470 --> 00:50.400 align:middle line:90%
and they're going
to have a session.

25
00:50.400 --> 00:52.770 align:middle line:90%
So now Bob can communicate
with that server.

26
00:52.770 --> 00:54.750 align:middle line:90%
And that leads us to
the very first problem

27
00:54.750 --> 00:56.680 align:middle line:90%
that the web security
appliance solves.

28
00:56.680 --> 00:57.570 align:middle line:84%
Now, that server.

29
00:57.570 --> 00:58.630 align:middle line:84%
Is it malicious?

30
00:58.630 --> 00:59.970 align:middle line:84%
Was it just put up?

31
00:59.970 --> 01:01.290 align:middle line:84%
Does it have a bad reputation?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
00:59.970 --> 01:01.290 align:middle line:84%
Does it have a bad reputation?

32
01:01.290 --> 01:02.262 align:middle line:84%
How would Bob know?

33
01:02.262 --> 01:02.970 align:middle line:84%
Bob doesn't know.

34
01:02.970 --> 01:05.553 align:middle line:90%
He's just resolving the name to
an IP address and going at it.

35
01:05.553 --> 01:07.592 align:middle line:90%
And hopefully when he
gets the responses,

36
01:07.592 --> 01:09.300 align:middle line:90%
he's not clicking on
inappropriate things

37
01:09.300 --> 01:11.050 align:middle line:84%
to compromise his system.

38
01:11.050 --> 01:12.690 align:middle line:90%
Now at the workstation,
we definitely

39
01:12.690 --> 01:13.920 align:middle line:84%
want to have it locked down.

40
01:13.920 --> 01:16.727 align:middle line:90%
Our end user should not
have admin privileges,

41
01:16.727 --> 01:18.810 align:middle line:90%
and that way if they click
on something, hopefully

42
01:18.810 --> 01:21.810 align:middle line:90%
they won't have the rights to
have that malware installed

43
01:21.810 --> 01:22.650 align:middle line:84%
on their system.

44
01:22.650 --> 01:25.208 align:middle line:90%
Hopefully, they will also
have anti- malware software

45
01:25.208 --> 01:26.500 align:middle line:84%
running on that local computer.

46
01:26.500 --> 01:28.095 align:middle line:84%
But, it would be better.

47
01:28.095 --> 01:29.970 align:middle line:90%
Someone once said that
an ounce of prevention

48
01:29.970 --> 01:31.350 align:middle line:84%
is worth a pound of cure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:29.970 --> 01:31.350 align:middle line:84%
is worth a pound of cure.

49
01:31.350 --> 01:33.180 align:middle line:90%
It'd be way better
if we could prevent

50
01:33.180 --> 01:35.400 align:middle line:90%
that conversation with
that malicious site

51
01:35.400 --> 01:36.540 align:middle line:84%
from ever happening.

52
01:36.540 --> 01:38.970 align:middle line:90%
And that's where the web
security appliance, the WSA,

53
01:38.970 --> 01:40.300 align:middle line:84%
can have an important role.

54
01:40.300 --> 01:42.840 align:middle line:90%
So if we were to deploy
a web security appliance.

55
01:42.840 --> 01:44.850 align:middle line:90%
This can be deployed
as a physical appliance

56
01:44.850 --> 01:46.492 align:middle line:84%
or as a virtual machine.

57
01:46.492 --> 01:47.700 align:middle line:84%
That's a good starting point.

58
01:47.700 --> 01:49.390 align:middle line:90%
And have basic
configuration on it.

59
01:49.390 --> 01:51.210 align:middle line:90%
So I've got an
interface right now

60
01:51.210 --> 01:54.000 align:middle line:90%
that can be reached, and use
that .155 on the network.

61
01:54.000 --> 01:56.430 align:middle line:90%
Then, we would either
train Bob's computer

62
01:56.430 --> 02:00.570 align:middle line:90%
to use a proxy that would send
all web request out to the WSA
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
01:56.430 --> 02:00.570 align:middle line:90%
to use a proxy that would send
all web request out to the WSA

63
02:00.570 --> 02:02.490 align:middle line:90%
instead of going out
to the server itself,

64
02:02.490 --> 02:05.610 align:middle line:90%
or we capture that traffic as
it's going up to the server,

65
02:05.610 --> 02:08.039 align:middle line:90%
and we redirect it to the
web security appliance.

66
02:08.039 --> 02:10.542 align:middle line:90%
And the cool thing about having
that traffic stop at the web

67
02:10.542 --> 02:12.750 align:middle line:90%
security appliance is now
this web security appliance

68
02:12.750 --> 02:16.770 align:middle line:90%
can now act as a proxy, but
a proxy with a really serious

69
02:16.770 --> 02:19.000 align:middle line:84%
attitude and lots of policies.

70
02:19.000 --> 02:20.730 align:middle line:90%
Some of those
policies could include

71
02:20.730 --> 02:22.327 align:middle line:84%
who we're trying to match on.

72
02:22.327 --> 02:24.660 align:middle line:90%
Are we matching on traffic
coming from a certain subnet?

73
02:24.660 --> 02:27.120 align:middle line:90%
Or is that traffic coming
from a specific user

74
02:27.120 --> 02:28.380 align:middle line:84%
in Active Directory?

75
02:28.380 --> 02:30.900 align:middle line:90%
Or that user is a member of
a group, a specific group
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:28.380 --> 02:30.900 align:middle line:90%
Or that user is a member of
a group, a specific group

76
02:30.900 --> 02:32.040 align:middle line:84%
in Active Directory.

77
02:32.040 --> 02:34.560 align:middle line:90%
Or with the proxies set up
to go to a specific port,

78
02:34.560 --> 02:36.130 align:middle line:84%
we could match on that as well.

79
02:36.130 --> 02:37.740 align:middle line:90%
And then at the
WSA, the cool part

80
02:37.740 --> 02:41.490 align:middle line:90%
is, we can now do some
analysis and prevention of Bob

81
02:41.490 --> 02:44.610 align:middle line:90%
the user going to a
less than favorable,

82
02:44.610 --> 02:46.560 align:middle line:84%
or a less than safe, website.

83
02:46.560 --> 02:48.300 align:middle line:84%
So we could block on URL.

84
02:48.300 --> 02:49.770 align:middle line:90%
So perhaps Bob's
traffic is trying

85
02:49.770 --> 02:51.540 align:middle line:90%
to go to a URL that's
marked in a category

86
02:51.540 --> 02:53.373 align:middle line:90%
that we don't want to
allow that traffic to.

87
02:53.373 --> 02:56.190 align:middle line:90%
Maybe it's alcohol, or
gaming, or something else

88
02:56.190 --> 02:57.690 align:middle line:84%
that's against company policy.

89
02:57.690 --> 03:00.660 align:middle line:90%
We can identify that at
the WSA, and if Bob's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
02:57.690 --> 03:00.660 align:middle line:90%
We can identify that at
the WSA, and if Bob's

90
03:00.660 --> 03:03.420 align:middle line:90%
trying to go to a URL in that
category that we've denied,

91
03:03.420 --> 03:05.460 align:middle line:90%
it can stop it right
there at the WSA.

92
03:05.460 --> 03:08.170 align:middle line:90%
It simply won't propagate the
request out to the internet.

93
03:08.170 --> 03:09.950 align:middle line:84%
Another aspect is reputation.

94
03:09.950 --> 03:12.450 align:middle line:90%
Now one question might be, how
is the web security appliance

95
03:12.450 --> 03:13.950 align:middle line:90%
going to know about the
reputation of a website

96
03:13.950 --> 03:15.360 align:middle line:84%
that Bob is trying to go to?

97
03:15.360 --> 03:17.850 align:middle line:84%
And that boils down to Talos.

98
03:17.850 --> 03:21.755 align:middle line:90%
And because Talos has literally
millions of sensors and devices

99
03:21.755 --> 03:23.880 align:middle line:90%
out there on the internet
that are collecting data,

100
03:23.880 --> 03:25.740 align:middle line:90%
it can correlate
that data, and then

101
03:25.740 --> 03:28.740 align:middle line:90%
educate our devices regarding
the reputation of a site.

102
03:28.740 --> 03:31.558 align:middle line:90%
So if the site has a
reputation of being malicious,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:28.740 --> 03:31.558 align:middle line:90%
So if the site has a
reputation of being malicious,

103
03:31.558 --> 03:33.600 align:middle line:90%
the web security appliance
can block that traffic

104
03:33.600 --> 03:35.963 align:middle line:90%
based on our comfort level
with how much of a risk

105
03:35.963 --> 03:36.630 align:middle line:84%
we want to take.

106
03:36.630 --> 03:40.200 align:middle line:90%
Or if Bob is trying to go to
a site that's uncategorized,

107
03:40.200 --> 03:43.350 align:middle line:90%
the security intelligence with
Talos is educating our WSA,

108
03:43.350 --> 03:45.965 align:middle line:90%
can make a decision based on
all the factors it does have,

109
03:45.965 --> 03:47.340 align:middle line:90%
and the information
it does have,

110
03:47.340 --> 03:48.882 align:middle line:90%
whether to allow
that traffic or not.

111
03:48.882 --> 03:50.940 align:middle line:90%
Even if the website that
Bob's trying to go to

112
03:50.940 --> 03:54.900 align:middle line:90%
is not specifically categorized
as alcohol- based, or gaming,

113
03:54.900 --> 03:57.780 align:middle line:90%
or some other category that
we've previously identified

114
03:57.780 --> 03:59.700 align:middle line:84%
as being undesirable to go to.

115
03:59.700 --> 04:01.710 align:middle line:90%
We can also filter
based on apps.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
03:59.700 --> 04:01.710 align:middle line:90%
We can also filter
based on apps.

116
04:01.710 --> 04:03.790 align:middle line:90%
So if we have certain
types of applications,

117
04:03.790 --> 04:06.870 align:middle line:90%
whether it's Facebook or
Google or what have you,

118
04:06.870 --> 04:08.610 align:middle line:90%
our web security
appliance can identify

119
04:08.610 --> 04:10.770 align:middle line:90%
that's the type of
service or function

120
04:10.770 --> 04:12.717 align:middle line:90%
that's being requested,
and it can stop it

121
04:12.717 --> 04:13.800 align:middle line:84%
from happening right here.

122
04:13.800 --> 04:17.220 align:middle line:90%
Also, the WSA can be used for
DLP, data loss prevention.

123
04:17.220 --> 04:19.612 align:middle line:90%
So somebody is trying
to sneak out or send out

124
04:19.612 --> 04:21.570 align:middle line:90%
information that is
sensitive, like credit card

125
04:21.570 --> 04:23.685 align:middle line:90%
information, social
security numbers,

126
04:23.685 --> 04:25.810 align:middle line:90%
details like that that
shouldn't leave the company,

127
04:25.810 --> 04:27.720 align:middle line:90%
or at least shouldn't leave
it from Bob's computer.

128
04:27.720 --> 04:29.095 align:middle line:90%
With data loss
prevention, we can

129
04:29.095 --> 04:31.620 align:middle line:90%
look for that type of traffic,
and then stop it right here
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

129
04:29.095 --> 04:31.620 align:middle line:90%
look for that type of traffic,
and then stop it right here

130
04:31.620 --> 04:33.047 align:middle line:84%
at the web security appliance.

131
04:33.047 --> 04:35.130 align:middle line:90%
Another huge benefit of
the web security appliance

132
04:35.130 --> 04:36.480 align:middle line:84%
is dealing with malware.

133
04:36.480 --> 04:38.280 align:middle line:90%
By looking at file
types, again, having

134
04:38.280 --> 04:40.560 align:middle line:90%
the intelligence from
Talos to identify

135
04:40.560 --> 04:42.240 align:middle line:90%
malware, if it's
trying to go through.

136
04:42.240 --> 04:44.115 align:middle line:90%
And certainly preventing
that type of traffic

137
04:44.115 --> 04:46.690 align:middle line:90%
if it's identifiable from
getting back to the user.

138
04:46.690 --> 04:48.210 align:middle line:90%
Now, a common
question that comes up

139
04:48.210 --> 04:49.680 align:middle line:90%
when I talk about these
really cool security

140
04:49.680 --> 04:52.020 align:middle line:90%
features for web security
appliances are, wait a sec,

141
04:52.020 --> 04:52.650 align:middle line:84%
Keith.

142
04:52.650 --> 04:54.660 align:middle line:90%
Those same features,
like, URL filtering,

143
04:54.660 --> 04:56.850 align:middle line:90%
reputation-based
filtering, all the rest,

144
04:56.850 --> 04:58.530 align:middle line:90%
those features are
available on FTD,

145
04:58.530 --> 05:00.390 align:middle line:90%
the firepower threat
defense systems.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

145
04:58.530 --> 05:00.390 align:middle line:90%
the firepower threat
defense systems.

146
05:00.390 --> 05:02.320 align:middle line:90%
And the answer
is, yes, they are.

147
05:02.320 --> 05:05.740 align:middle line:90%
So you probably don't need
to buy licenses for firepower

148
05:05.740 --> 05:08.350 align:middle line:90%
threat defense and also for
a web security appliance,

149
05:08.350 --> 05:10.850 align:middle line:90%
and have them both doing the
exact same functionality.

150
05:10.850 --> 05:13.060 align:middle line:90%
But you would want to have
these features at least

151
05:13.060 --> 05:14.830 align:middle line:90%
somewhere in the
path between your end

152
05:14.830 --> 05:16.180 align:middle line:84%
users and the internet.

153
05:16.180 --> 05:18.040 align:middle line:90%
And the web security
appliance is definitely

154
05:18.040 --> 05:20.180 align:middle line:90%
one of those options
that can make that work.

155
05:20.180 --> 05:21.550 align:middle line:90%
Now, one of the cool things
about the web security

156
05:21.550 --> 05:23.230 align:middle line:90%
appliance is that we
can set up policies

157
05:23.230 --> 05:25.450 align:middle line:90%
based on a subnet the
user is coming from,

158
05:25.450 --> 05:29.110 align:middle line:90%
or the user him- or herself
based on their identity

159
05:29.110 --> 05:30.293 align:middle line:84%
or group membership.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
05:29.110 --> 05:30.293 align:middle line:84%
or group membership.

160
05:30.293 --> 05:32.710 align:middle line:90%
And so to really leverage that
in a corporate environment,

161
05:32.710 --> 05:36.130 align:middle line:90%
we need to link or marry
the web security appliance

162
05:36.130 --> 05:38.020 align:middle line:90%
with Active Directory,
where we have

163
05:38.020 --> 05:39.390 align:middle line:84%
those users and those groups.

164
05:39.390 --> 05:41.140 align:middle line:90%
So in the next video,
I'd like to walk you

165
05:41.140 --> 05:43.480 align:middle line:90%
through how we can
integrate the web security

166
05:43.480 --> 05:45.292 align:middle line:90%
alliance with Active
Directory, which

167
05:45.292 --> 05:46.750 align:middle line:90%
is really important
for the ability

168
05:46.750 --> 05:49.420 align:middle line:90%
to identify Bob or
Joe or Mary or Sam

169
05:49.420 --> 05:52.000 align:middle line:90%
or whoever the user is,
when their traffic shows up

170
05:52.000 --> 05:53.590 align:middle line:90%
at the web security
appliance so we

171
05:53.590 --> 05:55.000 align:middle line:84%
can apply the correct policy.

172
05:55.000 --> 05:57.280 align:middle line:90%
So we'll do the integration
between Active Directory

173
05:57.280 --> 05:59.270 align:middle line:90%
and web security appliance
in the next video.

174
05:59.270 --> 06:01.570 align:middle line:90%
Meanwhile, I hope this has
been informative for you,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

174
05:59.270 --> 06:01.570 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

175
06:01.570 --> 06:04.860 align:middle line:90%
and I'd like to thank
you for viewing.