WEBVTT

1
00:00.000 --> 00:01.270 align:middle line:84%


2
00:01.270 --> 00:03.880 align:middle line:90%
One of the trickiest pieces
for any security appliance

3
00:03.880 --> 00:06.400 align:middle line:90%
is to allow what needs to be
allowed, and at the same time

4
00:06.400 --> 00:09.010 align:middle line:90%
be very granular in
choosing what to deny.

5
00:09.010 --> 00:11.560 align:middle line:90%
A good case in
point is Facebook.

6
00:11.560 --> 00:13.840 align:middle line:90%
Maybe we want our users to
be able to go to Facebook

7
00:13.840 --> 00:16.030 align:middle line:90%
and use most of their
apps and services there.

8
00:16.030 --> 00:19.090 align:middle line:90%
But maybe just not messaging
or file transfer services

9
00:19.090 --> 00:20.170 align:middle line:84%
at Facebook.

10
00:20.170 --> 00:21.370 align:middle line:84%
Can we restrict those?

11
00:21.370 --> 00:22.870 align:middle line:90%
Well that depends
on your appliance.

12
00:22.870 --> 00:25.000 align:middle line:90%
It just so happens that
the web security appliance

13
00:25.000 --> 00:28.690 align:middle line:90%
has the ability to identify
and filter specific web

14
00:28.690 --> 00:31.640 align:middle line:90%
applications that we don't want
our users to have access to.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:28.690 --> 00:31.640 align:middle line:90%
applications that we don't want
our users to have access to.

15
00:31.640 --> 00:34.510 align:middle line:90%
So in this video, we're going to
still focus on access controls,

16
00:34.510 --> 00:37.210 align:middle line:90%
but with a focus on
application-specific programs

17
00:37.210 --> 00:40.130 align:middle line:90%
or services that we
want to permit or block.

18
00:40.130 --> 00:42.400 align:middle line:90%
So here in the access
policy, we got there

19
00:42.400 --> 00:44.560 align:middle line:90%
by going to Web Security
Manager and then

20
00:44.560 --> 00:46.630 align:middle line:90%
clicking on Access
Policies right here,

21
00:46.630 --> 00:49.270 align:middle line:90%
we created a new policy
called No Drinks for Bob.

22
00:49.270 --> 00:51.340 align:middle line:84%
I think I'd like to edit that.

23
00:51.340 --> 00:53.350 align:middle line:90%
And we'll just call
this Sorry Bob,

24
00:53.350 --> 00:55.750 align:middle line:90%
because we're, about to
limit more than just alcohol.

25
00:55.750 --> 00:58.630 align:middle line:84%
So we'll say Sorry Bob.

26
00:58.630 --> 00:59.360 align:middle line:84%
Great.

27
00:59.360 --> 01:01.192 align:middle line:90%
And we'll go ahead
and click on Submit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.360 --> 01:01.192 align:middle line:90%
And we'll go ahead
and click on Submit.

28
01:01.192 --> 01:02.650 align:middle line:90%
And we have a few
other changes I'm

29
01:02.650 --> 01:04.450 align:middle line:90%
going to make before we
actually do the commit up

30
01:04.450 --> 01:05.450 align:middle line:84%
here in the upper right.

31
01:05.450 --> 01:07.270 align:middle line:90%
So regarding
application filtering,

32
01:07.270 --> 01:10.150 align:middle line:90%
by default we have
345 applications

33
01:10.150 --> 01:13.330 align:middle line:90%
that are being monitored and
allowed in the global policy.

34
01:13.330 --> 01:17.072 align:middle line:90%
If we want to take this policy
rule number one and modify it,

35
01:17.072 --> 01:18.280 align:middle line:84%
we can just click right here.

36
01:18.280 --> 01:20.800 align:middle line:90%
By default, this is going
to match the default policy.

37
01:20.800 --> 01:21.800 align:middle line:84%
We're going to tweak it.

38
01:21.800 --> 01:24.440 align:middle line:90%
So if it's Bob, we're going
to filter on what applications

39
01:24.440 --> 01:25.460 align:middle line:84%
he can go ahead and use.

40
01:25.460 --> 01:26.960 align:middle line:90%
So there's a couple
of options here.

41
01:26.960 --> 01:29.620 align:middle line:90%
One is to use global policy
application settings.

42
01:29.620 --> 01:32.230 align:middle line:90%
And the other is to go ahead
and define custom settings.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:29.620 --> 01:32.230 align:middle line:90%
And the other is to go ahead
and define custom settings.

43
01:32.230 --> 01:36.060 align:middle line:90%
And what I'd like to do is
let's go down to something fun.

44
01:36.060 --> 01:37.600 align:middle line:90%
Let's pick something
we can measure.

45
01:37.600 --> 01:40.780 align:middle line:90%
So let's go down to,
we could go to Google.

46
01:40.780 --> 01:42.640 align:middle line:90%
Let's go down to
internet utilities.

47
01:42.640 --> 01:44.950 align:middle line:90%
And here's a whole bunch
of internet utilities

48
01:44.950 --> 01:47.968 align:middle line:90%
that we could deny if we wanted
to, as far as applications.

49
01:47.968 --> 01:49.510 align:middle line:90%
So across from Google
Translate where

50
01:49.510 --> 01:52.007 align:middle line:90%
it says Use Global, which
is Monitor at the moment,

51
01:52.007 --> 01:52.840 align:middle line:84%
we'll click on that.

52
01:52.840 --> 01:53.990 align:middle line:84%
And we're going to change it.

53
01:53.990 --> 01:55.750 align:middle line:90%
So as part of this
policy, we'll go ahead

54
01:55.750 --> 01:57.790 align:middle line:90%
and block by clicking on
the Block radio button

55
01:57.790 --> 01:59.230 align:middle line:84%
and clicking on Apply.

56
01:59.230 --> 02:00.820 align:middle line:84%
And then let's scroll down.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:59.230 --> 02:00.820 align:middle line:84%
And then let's scroll down.

57
02:00.820 --> 02:02.022 align:middle line:84%
Click on Submit.

58
02:02.022 --> 02:03.730 align:middle line:90%
And then once we click
on Commit Changes,

59
02:03.730 --> 02:05.470 align:middle line:90%
we'll have this
access policy 1 called

60
02:05.470 --> 02:08.889 align:middle line:90%
Sorry Bob that will be blocking
any URL categories regarding

61
02:08.889 --> 02:09.699 align:middle line:84%
alcohol.

62
02:09.699 --> 02:12.310 align:middle line:90%
And it'll also be
blocking Google Translate.

63
02:12.310 --> 02:13.480 align:middle line:84%
So let's go ahead and--

64
02:13.480 --> 02:16.790 align:middle line:90%
Actually before we do that,
let's test before we commit it.

65
02:16.790 --> 02:19.000 align:middle line:90%
Let's test and verify
that Bob can get there

66
02:19.000 --> 02:20.980 align:middle line:84%
before we do the blocking.

67
02:20.980 --> 02:22.960 align:middle line:90%
So we'll go back
to Bob's computer.

68
02:22.960 --> 02:25.720 align:middle line:90%
And we'll watch an incognito
window from Google Chrome

69
02:25.720 --> 02:28.630 align:middle line:90%
just to gives the best chance
of not catching anything.

70
02:28.630 --> 02:33.040 align:middle line:90%
And let's go to
translate.google.com.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:28.630 --> 02:33.040 align:middle line:90%
And let's go to
translate.google.com.

71
02:33.040 --> 02:36.130 align:middle line:84%
We'll log in as Bob.

72
02:36.130 --> 02:37.870 align:middle line:84%
And sure enough, OK, great.

73
02:37.870 --> 02:41.240 align:middle line:84%
Google Translate seems to work.

74
02:41.240 --> 02:42.400 align:middle line:84%
So we said Hello.

75
02:42.400 --> 02:44.410 align:middle line:90%
And we want to see
it in Spanish, Hola.

76
02:44.410 --> 02:45.310 align:middle line:84%
OK, fantastic.

77
02:45.310 --> 02:47.020 align:middle line:90%
Google Translate
works like a champ.

78
02:47.020 --> 02:47.998 align:middle line:84%
Now that's before--

79
02:47.998 --> 02:49.540 align:middle line:90%
I'll go ahead and
close that browser.

80
02:49.540 --> 02:51.972 align:middle line:90%
That's before we
commit these changes.

81
02:51.972 --> 02:53.680 align:middle line:90%
So we'll go ahead and
commit the changes.

82
02:53.680 --> 02:55.630 align:middle line:90%
Without our comment
regarding this change.

83
02:55.630 --> 02:57.970 align:middle line:90%
We'll call it No
Translations for You,

84
02:57.970 --> 02:59.890 align:middle line:84%
and click on Commit Changes.

85
02:59.890 --> 03:03.010 align:middle line:90%
We'll give that just a
moment to confirm it's done.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
02:59.890 --> 03:03.010 align:middle line:90%
We'll give that just a
moment to confirm it's done.

86
03:03.010 --> 03:05.030 align:middle line:90%
And then we'll go back
to Bob's computer.

87
03:05.030 --> 03:07.570 align:middle line:90%
So back at Bob's computer,
we'll go ahead and open up

88
03:07.570 --> 03:10.210 align:middle line:84%
an incognito window once again.

89
03:10.210 --> 03:12.310 align:middle line:90%
We'll go to
translate.google.com.

90
03:12.310 --> 03:15.970 align:middle line:84%
We'll authenticate as Bob.

91
03:15.970 --> 03:16.810 align:middle line:84%
Press Enter.

92
03:16.810 --> 03:19.030 align:middle line:84%
And that is still working.

93
03:19.030 --> 03:19.690 align:middle line:84%
Why is that?

94
03:19.690 --> 03:20.560 align:middle line:84%
Holy Schnikers!

95
03:20.560 --> 03:21.530 align:middle line:84%
Let's take a look.

96
03:21.530 --> 03:23.350 align:middle line:90%
So our changes have
been committed.

97
03:23.350 --> 03:24.250 align:middle line:84%
We are blocking.

98
03:24.250 --> 03:26.260 align:middle line:90%
Let's just verify
that we're blocking

99
03:26.260 --> 03:28.150 align:middle line:84%
based on Google Translate.

100
03:28.150 --> 03:30.700 align:middle line:90%
And if you go down to
Define Custom Settings
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:28.150 --> 03:30.700 align:middle line:90%
And if you go down to
Define Custom Settings

101
03:30.700 --> 03:33.760 align:middle line:90%
and expand Internet
Utilities, Google Translate

102
03:33.760 --> 03:35.110 align:middle line:84%
should be blocked.

103
03:35.110 --> 03:36.770 align:middle line:84%
Let me try that one more time.

104
03:36.770 --> 03:39.130 align:middle line:90%
So we'll go ahead
and close that.

105
03:39.130 --> 03:40.880 align:middle line:90%
Perhaps I went to the
browser too quickly.

106
03:40.880 --> 03:43.130 align:middle line:90%
So let's go ahead and bring
up another browser window.

107
03:43.130 --> 03:45.630 align:middle line:84%


108
03:45.630 --> 03:48.310 align:middle line:90%
We'll go to
translate.google.com.

109
03:48.310 --> 03:51.460 align:middle line:84%
We'll authenticate as Bob.

110
03:51.460 --> 03:53.020 align:middle line:84%
Click on Sign In.

111
03:53.020 --> 03:53.687 align:middle line:84%
And there we go.

112
03:53.687 --> 03:54.478 align:middle line:84%
That's much better.

113
03:54.478 --> 03:56.930 align:middle line:90%
I must have just gone a little
bit too quickly last time.

114
03:56.930 --> 03:59.210 align:middle line:90%
So it's showing us the
page cannot be displayed.

115
03:59.210 --> 04:00.880 align:middle line:90%
It shows us the
source IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

115
03:59.210 --> 04:00.880 align:middle line:90%
It shows us the
source IP address.

116
04:00.880 --> 04:03.970 align:middle line:90%
That is my laptop that I'm
currently remote desktop to,

117
04:03.970 --> 04:05.140 align:middle line:84%
which represents Bob.

118
04:05.140 --> 04:06.670 align:middle line:84%
There's Bob's username.

119
04:06.670 --> 04:09.070 align:middle line:90%
There's the category of
web page translation.

120
04:09.070 --> 04:11.590 align:middle line:90%
There are URL we were going
for was translate.google.com.

121
04:11.590 --> 04:14.710 align:middle line:90%
And it says BLOCK AVC,
application, visibility,

122
04:14.710 --> 04:15.212 align:middle line:84%
and control.

123
04:15.212 --> 04:17.170 align:middle line:90%
Now let me share with
you some really sad news,

124
04:17.170 --> 04:17.837 align:middle line:84%
and that's this.

125
04:17.837 --> 04:18.647 align:middle line:84%
This block worked.

126
04:18.647 --> 04:19.730 align:middle line:84%
And I'm grateful for that.

127
04:19.730 --> 04:22.577 align:middle line:90%
However, many times we'll
block an application

128
04:22.577 --> 04:24.160 align:middle line:90%
or if you do an
application filtering,

129
04:24.160 --> 04:25.720 align:middle line:90%
and a customer can
still get there.

130
04:25.720 --> 04:26.750 align:middle line:84%
Why is that?

131
04:26.750 --> 04:28.968 align:middle line:90%
Well, with application,
visibility, and control,

132
04:28.968 --> 04:30.760 align:middle line:90%
we're looking at the
actual payload of what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
04:28.968 --> 04:30.760 align:middle line:90%
we're looking at the
actual payload of what

133
04:30.760 --> 04:31.802 align:middle line:84%
they're trying to get to.

134
04:31.802 --> 04:33.478 align:middle line:90%
Now in this case, I
think it saw the URL

135
04:33.478 --> 04:35.020 align:middle line:90%
and said Oh, that's
Google Translate.

136
04:35.020 --> 04:37.340 align:middle line:90%
And as a result, it
stopped it right there.

137
04:37.340 --> 04:40.030 align:middle line:90%
But if a customer was
doing a HQBS session

138
04:40.030 --> 04:42.400 align:middle line:90%
and then they were going
on to some other service,

139
04:42.400 --> 04:45.058 align:middle line:90%
because the payload is
all encrypted with HTTPS,

140
04:45.058 --> 04:47.350 align:middle line:90%
the web security appliance
may not be able to catch it,

141
04:47.350 --> 04:50.290 align:middle line:90%
because it couldn't identify
that specific service that

142
04:50.290 --> 04:51.640 align:middle line:84%
was being sought after.

143
04:51.640 --> 04:54.040 align:middle line:90%
So the solution that many
firewalls and the web security

144
04:54.040 --> 04:56.440 align:middle line:90%
alliance takes is to
go ahead and actually

145
04:56.440 --> 04:59.980 align:middle line:90%
do TLS decryption, where
the client like Bob,

146
04:59.980 --> 05:03.330 align:middle line:90%
has a TLS session using
HQBS, going from his client
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
04:59.980 --> 05:03.330 align:middle line:90%
has a TLS session using
HQBS, going from his client

147
05:03.330 --> 05:04.830 align:middle line:84%
to the web security appliance.

148
05:04.830 --> 05:06.900 align:middle line:90%
And then the traffic
is naked for a moment.

149
05:06.900 --> 05:08.358 align:middle line:90%
And then the web
security appliance

150
05:08.358 --> 05:10.620 align:middle line:90%
builds its own session
out to the final server.

151
05:10.620 --> 05:13.140 align:middle line:90%
And that way it can see the
payload and the application

152
05:13.140 --> 05:16.480 align:middle line:90%
layer services and so forth,
and then apply the rules.

153
05:16.480 --> 05:18.760 align:middle line:90%
So in short if we want
application, visibility,

154
05:18.760 --> 05:20.550 align:middle line:90%
and control to work
consistently to block

155
05:20.550 --> 05:22.560 align:middle line:90%
all of our applications
that we say it should,

156
05:22.560 --> 05:25.450 align:middle line:90%
we need to have that
TLS decryption in place.

157
05:25.450 --> 05:27.180 align:middle line:90%
So in the next video,
I'd like to provide

158
05:27.180 --> 05:30.510 align:middle line:90%
an overview of how that looks
and how that works on the web
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

158
05:27.180 --> 05:30.510 align:middle line:90%
an overview of how that looks
and how that works on the web

159
05:30.510 --> 05:31.390 align:middle line:84%
security appliance.

160
05:31.390 --> 05:33.533 align:middle line:90%
So I'll see you there
in just a moment.

161
05:33.533 --> 05:35.700 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

162
05:35.700 --> 05:39.020 align:middle line:90%
And I'd like to thank
you for viewing.