WEBVTT

1
00:00.000 --> 00:00.960 align:middle line:84%


2
00:00.960 --> 00:03.707 align:middle line:90%
TLS decryption is
absolutely amazing.

3
00:03.707 --> 00:05.790 align:middle line:90%
So we can have application
visibility and control,

4
00:05.790 --> 00:09.030 align:middle line:90%
but we don't want to decrypt
every possible TLS session

5
00:09.030 --> 00:11.850 align:middle line:90%
and that's because Bob the
user or some other user going

6
00:11.850 --> 00:13.562 align:middle line:90%
to their personal
banking website,

7
00:13.562 --> 00:15.270 align:middle line:90%
we don't want to
decrypt that information

8
00:15.270 --> 00:17.190 align:middle line:90%
because it's sensitive
and personal to Bob,

9
00:17.190 --> 00:18.030 align:middle line:84%
including passwords.

10
00:18.030 --> 00:18.900 align:middle line:84%
And so forth.

11
00:18.900 --> 00:20.650 align:middle line:90%
So in this video, I
want to do two things.

12
00:20.650 --> 00:22.317 align:middle line:90%
Number one, I want
to share with you how

13
00:22.317 --> 00:24.510 align:middle line:90%
we can control the
decryption policy,

14
00:24.510 --> 00:27.215 align:middle line:90%
and second and probably
more important,

15
00:27.215 --> 00:28.590 align:middle line:90%
I want to walk
you through how we

16
00:28.590 --> 00:31.800 align:middle line:90%
can verify that the
decryption is working or not
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:28.590 --> 00:31.800 align:middle line:90%
can verify that the
decryption is working or not

17
00:31.800 --> 00:34.990 align:middle line:90%
working as expected on the
Web Security Appliance.

18
00:34.990 --> 00:38.070 align:middle line:90%
So with the HTTPS
proxy services enabled,

19
00:38.070 --> 00:40.950 align:middle line:90%
here's where we go to go and
set up the decryption policy.

20
00:40.950 --> 00:44.160 align:middle line:90%
It's under Web Security Manager,
and then under Web Policies,

21
00:44.160 --> 00:47.350 align:middle line:90%
we have a separate item right
here for decryption policies.

22
00:47.350 --> 00:49.080 align:middle line:90%
So we'll click on
decryption policies.

23
00:49.080 --> 00:51.690 align:middle line:90%
So here into the Decryption,
Policies we have a default

24
00:51.690 --> 00:54.030 align:middle line:90%
global policy,
which says decrypt.

25
00:54.030 --> 00:56.850 align:middle line:90%
So if we wanted to, we can
modify this default policy

26
00:56.850 --> 00:58.680 align:middle line:84%
or we could add a policy.

27
00:58.680 --> 01:02.130 align:middle line:90%
And we could put it on top of or
in front of this global policy.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.680 --> 01:02.130 align:middle line:90%
And we could put it on top of or
in front of this global policy.

28
01:02.130 --> 01:04.629 align:middle line:90%
So let's make one just
for Bob, as an example.

29
01:04.629 --> 01:06.630 align:middle line:90%
So we'll click on
Add Policy and we'll

30
01:06.630 --> 01:10.615 align:middle line:90%
call this "Decryption Policy
One," as in our first one

31
01:10.615 --> 01:11.740 align:middle line:84%
we're making here together.

32
01:11.740 --> 01:13.532 align:middle line:90%
We're going to put it
on top of or in front

33
01:13.532 --> 01:15.210 align:middle line:90%
of the global
policy, and then we

34
01:15.210 --> 01:17.222 align:middle line:90%
can scroll down and
put in the details.

35
01:17.222 --> 01:19.680 align:middle line:90%
So we can have it applied just
to a specific identification

36
01:19.680 --> 01:21.455 align:middle line:84%
profile or all profiles.

37
01:21.455 --> 01:22.830 align:middle line:90%
And so if we want
to be granular,

38
01:22.830 --> 01:24.510 align:middle line:90%
we can select the
identification profile

39
01:24.510 --> 01:27.270 align:middle line:90%
that we created earlier,
which is our profile one,

40
01:27.270 --> 01:30.480 align:middle line:90%
and then let's go further
and just apply this to Bob.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:27.270 --> 01:30.480 align:middle line:90%
and then let's go further
and just apply this to Bob.

41
01:30.480 --> 01:32.910 align:middle line:90%
Just an example of how
granular it can be.

42
01:32.910 --> 01:35.640 align:middle line:90%
So we'll put Bob's username
in there, click on Done,

43
01:35.640 --> 01:36.940 align:middle line:84%
and let's confirm our work.

44
01:36.940 --> 01:38.797 align:middle line:90%
So we have a
Decryption Policy One ,

45
01:38.797 --> 01:41.130 align:middle line:90%
and we're looking for just
the user called Bob from this

46
01:41.130 --> 01:43.530 align:middle line:90%
identity profile
called OurProfileOne.

47
01:43.530 --> 01:45.780 align:middle line:90%
And we're not putting any
additional constraints on it

48
01:45.780 --> 01:46.240 align:middle line:84%
down here.

49
01:46.240 --> 01:47.280 align:middle line:84%
So we'll click on Submit.

50
01:47.280 --> 01:48.780 align:middle line:90%
And now that we have
this new policy that's

51
01:48.780 --> 01:50.610 align:middle line:90%
going to be hit first
and match on Bob,

52
01:50.610 --> 01:52.620 align:middle line:90%
we also want to
specify what we do not

53
01:52.620 --> 01:54.690 align:middle line:90%
want to go ahead and
do decryption for.

54
01:54.690 --> 01:57.250 align:middle line:90%
So in this policy called
Decryption Policy One,

55
01:57.250 --> 02:00.420 align:middle line:90%
now let's go specify that we
don't want to do decryption
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:57.250 --> 02:00.420 align:middle line:90%
now let's go specify that we
don't want to do decryption

56
02:00.420 --> 02:02.210 align:middle line:84%
based on the category of URL.

57
02:02.210 --> 02:03.960 align:middle line:90%
So we'll click on the
Global Policy option

58
02:03.960 --> 02:06.002 align:middle line:90%
here because by default,
that's what we're using.

59
02:06.002 --> 02:08.355 align:middle line:90%
And let's specify that for
auctions-- let's go ahead

60
02:08.355 --> 02:09.300 align:middle line:84%
and take auctions.

61
02:09.300 --> 02:10.175 align:middle line:84%
So that's right here.

62
02:10.175 --> 02:12.510 align:middle line:90%
So let's say pass through
as opposed to decrypt,

63
02:12.510 --> 02:16.210 align:middle line:90%
and let's also go ahead and do
financial institutions as well.

64
02:16.210 --> 02:18.340 align:middle line:90%
So we'll go down to finance,
which is right here.

65
02:18.340 --> 02:19.350 align:middle line:84%
We'll say pass through.

66
02:19.350 --> 02:21.820 align:middle line:90%
So the default is
decrypt everything.

67
02:21.820 --> 02:23.670 align:middle line:90%
So now with this
policy in place,

68
02:23.670 --> 02:27.990 align:middle line:90%
traffic from Bob that's headed
to a finance category URL

69
02:27.990 --> 02:31.050 align:middle line:84%
or auctions category URL--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:27.990 --> 02:31.050 align:middle line:84%
or auctions category URL--

70
02:31.050 --> 02:32.590 align:middle line:90%
now for those
categories of URLs,

71
02:32.590 --> 02:35.040 align:middle line:90%
it's going to be passed
through and not decrypted.

72
02:35.040 --> 02:38.370 align:middle line:90%
So it's going to bypass the
decryption function on the Web

73
02:38.370 --> 02:39.580 align:middle line:84%
Security Appliance.

74
02:39.580 --> 02:41.400 align:middle line:90%
So we'll scroll all
the way to the bottom

75
02:41.400 --> 02:43.410 align:middle line:84%
here and click on Submit.

76
02:43.410 --> 02:44.530 align:middle line:84%
Very important.

77
02:44.530 --> 02:48.510 align:middle line:90%
So there's our decryption
policy with two passwords, one

78
02:48.510 --> 02:50.233 align:middle line:84%
for finance, one for auctions.

79
02:50.233 --> 02:51.900 align:middle line:90%
And if you we want
to apply that change,

80
02:51.900 --> 02:53.250 align:middle line:90%
we'll go ahead and click
up here on the right hand

81
02:53.250 --> 02:54.750 align:middle line:84%
corner, Commit Changes.

82
02:54.750 --> 02:56.730 align:middle line:90%
And we can add a
comment to this commit.

83
02:56.730 --> 02:58.740 align:middle line:90%
I'm going to go ahead and just
commit it without a comment.

84
02:58.740 --> 03:00.157 align:middle line:90%
And while that's
committing, let's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
02:58.740 --> 03:00.157 align:middle line:90%
And while that's
committing, let's

85
03:00.157 --> 03:03.130 align:middle line:90%
talk about and remind ourselves
about why the TLS decryption is

86
03:03.130 --> 03:03.630 align:middle line:84%
important.

87
03:03.630 --> 03:07.350 align:middle line:90%
If the user's is using HTTPS
with some flavor of TLS

88
03:07.350 --> 03:10.020 align:middle line:90%
and going through
the WSA, the WSA

89
03:10.020 --> 03:12.690 align:middle line:90%
doesn't really have access to
look at the application layer

90
03:12.690 --> 03:13.347 align:middle line:84%
data.

91
03:13.347 --> 03:15.180 align:middle line:90%
So if we're trying to
control an application

92
03:15.180 --> 03:17.347 align:middle line:90%
and the WSA can't see it
because it's all encrypted,

93
03:17.347 --> 03:18.100 align:middle line:84%
that's a problem.

94
03:18.100 --> 03:20.142 align:middle line:90%
So the Web Security
Appliance steps in the middle

95
03:20.142 --> 03:23.070 align:middle line:90%
and builds TLS sessions-- one
between itself and the client,

96
03:23.070 --> 03:25.260 align:middle line:90%
and one between itself
and the real server.

97
03:25.260 --> 03:26.970 align:middle line:90%
And by doing so, it
can see that traffic

98
03:26.970 --> 03:28.590 align:middle line:90%
and have better
insight into what's

99
03:28.590 --> 03:31.830 align:middle line:90%
going on at the application with
a better chance of enforcing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

99
03:28.590 --> 03:31.830 align:middle line:90%
going on at the application with
a better chance of enforcing

100
03:31.830 --> 03:33.630 align:middle line:90%
our application
control regarding

101
03:33.630 --> 03:36.570 align:middle line:90%
an application that we want to
deny or not allow for the user

102
03:36.570 --> 03:37.930 align:middle line:84%
to access over the web.

103
03:37.930 --> 03:38.430 align:middle line:84%
All right.

104
03:38.430 --> 03:39.990 align:middle line:84%
So the commit has been done.

105
03:39.990 --> 03:43.630 align:middle line:90%
Let's go ahead and test this
out from our client computer.

106
03:43.630 --> 03:46.403 align:middle line:90%
So here's our client computer
and let's open up a browser.

107
03:46.403 --> 03:47.820 align:middle line:90%
I'm going to go
ahead and bring up

108
03:47.820 --> 03:49.500 align:middle line:84%
an incognito window in Chrome.

109
03:49.500 --> 03:52.890 align:middle line:84%
And let's go to google.com.

110
03:52.890 --> 03:55.500 align:middle line:84%
We'll authenticate as Bob.

111
03:55.500 --> 03:57.570 align:middle line:90%
This is the WSA saying
who the heck are you

112
03:57.570 --> 03:59.665 align:middle line:90%
based on the way we have
a set up and we're there.

113
03:59.665 --> 04:02.040 align:middle line:90%
Now one of the important
aspects I want to share with you
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
03:59.665 --> 04:02.040 align:middle line:90%
Now one of the important
aspects I want to share with you

114
04:02.040 --> 04:05.760 align:middle line:90%
right now is, how do we
know that the Web Security

115
04:05.760 --> 04:08.040 align:middle line:90%
Appliance is actually
doing the TLS decryption.

116
04:08.040 --> 04:10.350 align:middle line:84%
And here's how we can know.

117
04:10.350 --> 04:13.230 align:middle line:90%
If we click on the little
lock next to google.com--

118
04:13.230 --> 04:16.620 align:middle line:90%
so I went to google.com
it redirected me to HTTPS

119
04:16.620 --> 04:18.428 align:middle line:90%
and it's saying the
certificate is valid,

120
04:18.428 --> 04:20.970 align:middle line:90%
the connection is secure, but
if we click on the certificate,

121
04:20.970 --> 04:21.980 align:middle line:84%
check this out.

122
04:21.980 --> 04:22.980 align:middle line:84%
Look who it's issued to.

123
04:22.980 --> 04:24.990 align:middle line:90%
It's issued to
google.com, but it says

124
04:24.990 --> 04:29.210 align:middle line:84%
it's issued from wsa.ogit.com.

125
04:29.210 --> 04:30.960 align:middle line:90%
And the reason the
client's accepting this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:29.210 --> 04:30.960 align:middle line:90%
And the reason the
client's accepting this

126
04:30.960 --> 04:33.510 align:middle line:90%
is because as part of our
enterprise route certificate,

127
04:33.510 --> 04:35.700 align:middle line:90%
the clients are
already set up to trust

128
04:35.700 --> 04:38.520 align:middle line:90%
the CA and the subordinate
CA, so that if it

129
04:38.520 --> 04:42.150 align:middle line:90%
does get a certificate
signed by wsa.ogit.com,

130
04:42.150 --> 04:45.160 align:middle line:90%
it says, yep, I trust
that certificate authority

131
04:45.160 --> 04:46.830 align:middle line:90%
and I'm accepting
the certificate.

132
04:46.830 --> 04:48.750 align:middle line:90%
And that's happening
because the decryption

133
04:48.750 --> 04:52.440 align:middle line:90%
policy is applying to everything
except for and auctions.

134
04:52.440 --> 04:53.200 align:middle line:84%
So let's do this.

135
04:53.200 --> 04:55.530 align:middle line:84%
Let's search for auctions.

136
04:55.530 --> 04:56.820 align:middle line:84%
So let's grab one of these.

137
04:56.820 --> 05:02.225 align:middle line:90%
I'm going to grab www.ha.com
and it should work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
04:56.820 --> 05:02.225 align:middle line:90%
I'm going to grab www.ha.com
and it should work.

138
05:02.225 --> 05:03.850 align:middle line:90%
We have no filtering
in place for that.

139
05:03.850 --> 05:05.520 align:middle line:90%
But if we go to
the certificate--

140
05:05.520 --> 05:07.580 align:middle line:84%
so we have an HTTPS session--

141
05:07.580 --> 05:09.900 align:middle line:90%
we click on the little
lock here and then look

142
05:09.900 --> 05:11.560 align:middle line:90%
at the certificate
and click on it,

143
05:11.560 --> 05:14.728 align:middle line:90%
it says it was issued by
DigiCert, by a PKI provider.

144
05:14.728 --> 05:16.770 align:middle line:90%
That's because we told
our Web Security Appliance

145
05:16.770 --> 05:19.350 align:middle line:90%
that anything going to
auction sites or finance,

146
05:19.350 --> 05:21.543 align:middle line:90%
do not bother doing
the TLS decryption.

147
05:21.543 --> 05:22.460 align:middle line:84%
Let's try another one.

148
05:22.460 --> 05:25.350 align:middle line:84%
Let's go to paypal.com.

149
05:25.350 --> 05:27.630 align:middle line:90%
That would be related
to finance for sure.

150
05:27.630 --> 05:30.640 align:middle line:90%
So this site, paypal.com
in the finance category,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:27.630 --> 05:30.640 align:middle line:90%
So this site, paypal.com
in the finance category,

151
05:30.640 --> 05:32.370 align:middle line:90%
click on the lock and
go to certificate,

152
05:32.370 --> 05:36.332 align:middle line:90%
it's also issued by PKI
certificate authority.

153
05:36.332 --> 05:37.540 align:middle line:84%
So if we go to anywhere else.

154
05:37.540 --> 05:40.920 align:middle line:90%
In fact, let's go
to CBT Nuggets.

155
05:40.920 --> 05:44.610 align:middle line:90%
Go to cbtnuggets.com and
look at the lock there

156
05:44.610 --> 05:46.560 align:middle line:90%
and click on
certificate, it says

157
05:46.560 --> 05:49.200 align:middle line:84%
it's issued by wsa.ogit.com.

158
05:49.200 --> 05:53.340 align:middle line:90%
So everything except for
finance and except for auctions

159
05:53.340 --> 05:55.530 align:middle line:90%
will have the TLS
decryption applied to it

160
05:55.530 --> 05:56.880 align:middle line:84%
at the Web Security Appliance.

161
05:56.880 --> 05:58.380 align:middle line:90%
I think they get
the benefit of that

162
05:58.380 --> 06:00.810 align:middle line:90%
is we want the Web Security
Appliance to have application
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

162
05:58.380 --> 06:00.810 align:middle line:90%
is we want the Web Security
Appliance to have application

163
06:00.810 --> 06:03.330 align:middle line:90%
visibility, so it can stop
or deny the applications

164
06:03.330 --> 06:06.282 align:middle line:90%
that we don't want to go through
the Web Security Appliance.

165
06:06.282 --> 06:07.740 align:middle line:90%
In this video,
we've identified how

166
06:07.740 --> 06:09.300 align:middle line:90%
we can set up a
decryption policy

167
06:09.300 --> 06:12.990 align:middle line:90%
and specifically tell the Web
Security Appliance to not do

168
06:12.990 --> 06:15.900 align:middle line:90%
TLS decryption based on the
category of website that

169
06:15.900 --> 06:17.555 align:middle line:84%
is going to, such as finance

170
06:17.555 --> 06:19.180 align:middle line:90%
So thanks for joining
me in this video.

171
06:19.180 --> 06:20.650 align:middle line:84%
I'll see you in the next one.

172
06:20.650 --> 06:23.100 align:middle line:90%
Meanwhile, I hope this has
been informative for you

173
06:23.100 --> 06:26.480 align:middle line:90%
and I'd like to thank
you for viewing.