WEBVTT

1
00:00.000 --> 00:00.580 align:middle line:84%


2
00:00.580 --> 00:03.190 align:middle line:90%
In this video, we get to
chat about email security

3
00:03.190 --> 00:05.290 align:middle line:90%
with an eye on the
Email Security Appliance

4
00:05.290 --> 00:07.690 align:middle line:90%
from Cisco Systems,
and let's use

5
00:07.690 --> 00:09.730 align:middle line:84%
this technology as a backdrop.

6
00:09.730 --> 00:12.850 align:middle line:90%
So we have Bob the user,
one of my favorite users

7
00:12.850 --> 00:16.450 align:middle line:90%
ever, right there at computer
2, and Bob is an email user.

8
00:16.450 --> 00:18.610 align:middle line:90%
And as an email user,
he has a client piece

9
00:18.610 --> 00:23.290 align:middle line:90%
of software referred to as an
MUA, that's a mail user agent,

10
00:23.290 --> 00:25.780 align:middle line:90%
like Outlook or some
other email client,

11
00:25.780 --> 00:27.680 align:middle line:90%
and it's interacting
with an email server.

12
00:27.680 --> 00:29.692 align:middle line:90%
So let's imagine the
email server's up here.

13
00:29.692 --> 00:31.150 align:middle line:90%
So Bob's computer
in the background
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.692 --> 00:31.150 align:middle line:90%
So Bob's computer
in the background

14
00:31.150 --> 00:35.470 align:middle line:90%
is using an IMAP or a
POP3 between the client

15
00:35.470 --> 00:37.930 align:middle line:90%
or the PC he's running
on and the email server,

16
00:37.930 --> 00:39.790 align:middle line:90%
and that's what he
uses to retrieve email

17
00:39.790 --> 00:41.000 align:middle line:84%
from the email server.

18
00:41.000 --> 00:43.330 align:middle line:90%
So if this represents
the email store,

19
00:43.330 --> 00:45.100 align:middle line:90%
where all the email
is sitting, Bob's

20
00:45.100 --> 00:47.950 align:middle line:90%
going to use his client
software and IMAP or POP3

21
00:47.950 --> 00:50.440 align:middle line:90%
to pull that down to
the local computer.

22
00:50.440 --> 00:52.390 align:middle line:90%
Or if he's using a
web based interface,

23
00:52.390 --> 00:55.510 align:middle line:90%
he might just be using a
browser to view that email as it

24
00:55.510 --> 00:56.770 align:middle line:84%
sits on the server.

25
00:56.770 --> 00:59.590 align:middle line:90%
And if Bob sends an email
to Lois, that's no problem.

26
00:59.590 --> 01:01.810 align:middle line:90%
That data stays all
local on the email server
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.590 --> 01:01.810 align:middle line:90%
That data stays all
local on the email server

27
01:01.810 --> 01:03.410 align:middle line:84%
within the same organization.

28
01:03.410 --> 01:05.500 align:middle line:90%
And then Lois would
use IMAP or POP3

29
01:05.500 --> 01:07.990 align:middle line:90%
with her client to go ahead
and retrieve it and look

30
01:07.990 --> 01:08.860 align:middle line:84%
at that data.

31
01:08.860 --> 01:11.380 align:middle line:90%
And if Bob is going to
send outbound email,

32
01:11.380 --> 01:14.431 align:middle line:90%
Bob's computer is
going to be using SMTP.

33
01:14.431 --> 01:17.110 align:middle line:90%
That's the simple
mail transfer protocol

34
01:17.110 --> 01:19.810 align:middle line:90%
that's being used to send
the email from Bob's computer

35
01:19.810 --> 01:21.290 align:middle line:84%
over to the email server.

36
01:21.290 --> 01:25.150 align:middle line:90%
So let's imagine Bob's
domain is ogit.com.

37
01:25.150 --> 01:28.360 align:middle line:90%
So Bob's email is
like Bob@ogit.com,

38
01:28.360 --> 01:31.420 align:middle line:90%
and if he wants to send an
email to some other domain,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.360 --> 01:31.420 align:middle line:90%
and if he wants to send an
email to some other domain,

39
01:31.420 --> 01:34.300 align:middle line:90%
maybe over to
acme.com, maybe it's

40
01:34.300 --> 01:37.600 align:middle line:90%
Lois@acme.com in a
different organization,

41
01:37.600 --> 01:39.790 align:middle line:90%
he sends it to his
email server, and then

42
01:39.790 --> 01:42.100 align:middle line:90%
the email server is going
to be forwarding that over

43
01:42.100 --> 01:45.010 align:middle line:90%
to the email server
responsible for acme.com.

44
01:45.010 --> 01:46.540 align:middle line:90%
We'll call this
server 2 over here,

45
01:46.540 --> 01:49.810 align:middle line:90%
and the email server is
also going to be using SMTP

46
01:49.810 --> 01:50.742 align:middle line:84%
to forward that email.

47
01:50.742 --> 01:53.200 align:middle line:90%
Now, there's a lot of details
that we'll take a closer look

48
01:53.200 --> 01:55.360 align:middle line:90%
at as we proceed
here about what goes

49
01:55.360 --> 01:56.920 align:middle line:84%
on when those emails are sent.

50
01:56.920 --> 01:59.530 align:middle line:90%
But in the process of taking
that email and sending it,

51
01:59.530 --> 02:01.240 align:middle line:90%
this email server
is also referred to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.530 --> 02:01.240 align:middle line:90%
this email server
is also referred to

52
02:01.240 --> 02:04.900 align:middle line:90%
as ab MTA, a mail
transfer agent,

53
02:04.900 --> 02:07.743 align:middle line:90%
or an email server that can
talk to other email servers.

54
02:07.743 --> 02:09.160 align:middle line:90%
And the way that
this email server

55
02:09.160 --> 02:11.260 align:middle line:90%
would find the appropriate
email server on the internet,

56
02:11.260 --> 02:13.000 align:middle line:90%
for example, to
forward that email to,

57
02:13.000 --> 02:15.130 align:middle line:90%
it's going to do a
lookup for a special type

58
02:15.130 --> 02:18.220 align:middle line:90%
of DNS record called an MX
record, a mail exchange record.

59
02:18.220 --> 02:21.430 align:middle line:90%
So in server 1, does an MX
record look out for acme.com.

60
02:21.430 --> 02:22.930 align:middle line:90%
It's going to give
a list of server,

61
02:22.930 --> 02:29.750 align:middle line:90%
such as server2.acme.com, maybe
server3.acme.com and so forth.

62
02:29.750 --> 02:33.700 align:middle line:90%
And then, once he has a list of
the MX servers for that domain,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:29.750 --> 02:33.700 align:middle line:90%
And then, once he has a list of
the MX servers for that domain,

63
02:33.700 --> 02:36.550 align:middle line:90%
he can then go ahead and resolve
the individual name to an IP

64
02:36.550 --> 02:37.615 align:middle line:84%
address with an A record.

65
02:37.615 --> 02:38.990 align:middle line:90%
Then with that IP
address, he can

66
02:38.990 --> 02:41.740 align:middle line:90%
establish a session with
SMTP, and then forward

67
02:41.740 --> 02:43.198 align:middle line:84%
that email over to that server.

68
02:43.198 --> 02:44.740 align:middle line:90%
And the same thing
happens in reverse

69
02:44.740 --> 02:47.740 align:middle line:90%
when acme.com, their mail
servers need to send an email

70
02:47.740 --> 02:51.910 align:middle line:90%
or to the email servers
responsible at ogit.com.

71
02:51.910 --> 02:55.000 align:middle line:90%
They would do an MX record
lookup for ogit.com,

72
02:55.000 --> 02:58.510 align:middle line:90%
and then from the list provided
of names of servers there,

73
02:58.510 --> 03:01.060 align:middle line:90%
they would then do an A record
lookup for the individual IP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

73
02:58.510 --> 03:01.060 align:middle line:90%
they would then do an A record
lookup for the individual IP

74
03:01.060 --> 03:02.140 align:middle line:84%
address of a server.

75
03:02.140 --> 03:03.970 align:middle line:90%
They would establish
an SMTP session,

76
03:03.970 --> 03:05.590 align:middle line:84%
and then send the email message.

77
03:05.590 --> 03:08.230 align:middle line:90%
And over here, if we
had a client like Jill

78
03:08.230 --> 03:10.632 align:middle line:90%
over at acme.com, who
is running a client,

79
03:10.632 --> 03:12.340 align:middle line:90%
and she wanted to
retrieve a message that

80
03:12.340 --> 03:14.325 align:middle line:90%
was sent to her from
the email server,

81
03:14.325 --> 03:15.700 align:middle line:90%
her software would
once again use

82
03:15.700 --> 03:19.112 align:middle line:90%
POP3 or IMAP to retrieve the
email messages from the server.

83
03:19.112 --> 03:21.070 align:middle line:90%
So a question that might
come up is, OK, Keith,

84
03:21.070 --> 03:23.800 align:middle line:90%
where does the Email Security
Appliance fit in this mix

85
03:23.800 --> 03:25.910 align:middle line:84%
here for on-prem solution?

86
03:25.910 --> 03:26.890 align:middle line:84%
Let me show you.

87
03:26.890 --> 03:29.380 align:middle line:90%
What we would do is we
would put the Email Security

88
03:29.380 --> 03:33.770 align:middle line:90%
Appliance between the real email
server and the outside world.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:29.380 --> 03:33.770 align:middle line:90%
Appliance between the real email
server and the outside world.

89
03:33.770 --> 03:37.450 align:middle line:90%
And so in DNS, we would
create our MX records,

90
03:37.450 --> 03:39.730 align:middle line:90%
and let's call
this esa.ogit.com.

91
03:39.730 --> 03:45.880 align:middle line:90%
So our MX records ogti.com would
point to this server's name.

92
03:45.880 --> 03:51.250 align:middle line:90%
So the MX record would
say esa.ogti.com, and then

93
03:51.250 --> 03:54.340 align:middle line:90%
the A record, this is what the
IP address is for that device,

94
03:54.340 --> 03:58.810 align:middle line:90%
it would be like 23.1.2.72
or what of the address

95
03:58.810 --> 04:00.610 align:middle line:90%
is that's reachable
for that device.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:58.810 --> 04:00.610 align:middle line:90%
is that's reachable
for that device.

96
04:00.610 --> 04:02.260 align:middle line:90%
And in many environments,
that's likely

97
04:02.260 --> 04:05.170 align:middle line:90%
going to go to an outside
IP address on a firewall

98
04:05.170 --> 04:06.700 align:middle line:90%
or some type of
firewall service,

99
04:06.700 --> 04:09.910 align:middle line:90%
that then is doing translation
to the internal address

100
04:09.910 --> 04:10.888 align:middle line:84%
on that server.

101
04:10.888 --> 04:13.180 align:middle line:90%
So the place that the email
security appliance fits in,

102
04:13.180 --> 04:15.013 align:middle line:90%
we just basically tell
the rest of the world

103
04:15.013 --> 04:16.190 align:middle line:84%
that is our email server.

104
04:16.190 --> 04:18.459 align:middle line:90%
So the rest of the world
is interacting directly

105
04:18.459 --> 04:20.070 align:middle line:90%
with our email
security appliance,

106
04:20.070 --> 04:21.820 align:middle line:90%
and then the ESA is
going to deal directly

107
04:21.820 --> 04:23.220 align:middle line:84%
with our internal email server.

108
04:23.220 --> 04:25.150 align:middle line:90%
So from the
perspective of users,

109
04:25.150 --> 04:27.310 align:middle line:90%
they still get their email
from the email server.

110
04:27.310 --> 04:29.560 align:middle line:90%
It's just we're adding
a middleman, the ESA,

111
04:29.560 --> 04:31.540 align:middle line:90%
the email security
appliance, that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

111
04:29.560 --> 04:31.540 align:middle line:90%
the email security
appliance, that's

112
04:31.540 --> 04:34.450 align:middle line:90%
going to do a whole bunch of
filtering and reduction of spam

113
04:34.450 --> 04:37.330 align:middle line:90%
and malicious emails, so
that they never make it

114
04:37.330 --> 04:39.088 align:middle line:84%
to the inboxes of our users.

115
04:39.088 --> 04:40.630 align:middle line:90%
And one last thought
on this overview

116
04:40.630 --> 04:43.120 align:middle line:90%
is that the security
appliance doesn't just

117
04:43.120 --> 04:45.160 align:middle line:90%
have to be an on-prem
solution, there's

118
04:45.160 --> 04:49.960 align:middle line:90%
also cloud-based email security
or CES, which could also

119
04:49.960 --> 04:52.750 align:middle line:90%
be-- so if you're using
an online email server,

120
04:52.750 --> 04:56.020 align:middle line:90%
you can use cloud-based
Cisco Email Security,

121
04:56.020 --> 04:57.580 align:middle line:90%
and get the same
types of features

122
04:57.580 --> 05:00.620 align:middle line:90%
and functionality for
filtering and blocking
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:57.580 --> 05:00.620 align:middle line:90%
and functionality for
filtering and blocking

123
05:00.620 --> 05:04.310 align:middle line:90%
phishing attacks and
malware attacks and spam

124
05:04.310 --> 05:06.860 align:middle line:90%
and other nasty emails that
otherwise might show up

125
05:06.860 --> 05:08.420 align:middle line:84%
in our users mailboxes.

126
05:08.420 --> 05:09.920 align:middle line:90%
So in this video,
we've taken a look

127
05:09.920 --> 05:12.503 align:middle line:90%
at where the security appliance,
the email security appliance,

128
05:12.503 --> 05:15.980 align:middle line:90%
would fit in as a middleman
between our email server

129
05:15.980 --> 05:17.103 align:middle line:84%
and the rest of the world.

130
05:17.103 --> 05:19.520 align:middle line:90%
And the next thing I'd like
to chat with you about is, OK,

131
05:19.520 --> 05:22.010 align:middle line:90%
if this guy is the middleman,
this email security appliance,

132
05:22.010 --> 05:22.927 align:middle line:84%
what can it do for us?

133
05:22.927 --> 05:25.210 align:middle line:90%
What's the logic as far as
when traffic is coming in

134
05:25.210 --> 05:26.960 align:middle line:90%
or when emails are
coming in, what does it

135
05:26.960 --> 05:28.440 align:middle line:84%
do to really help our users?

136
05:28.440 --> 05:30.273 align:middle line:90%
And that's what I'd
like to discuss with you
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

136
05:28.440 --> 05:30.273 align:middle line:90%
And that's what I'd
like to discuss with you

137
05:30.273 --> 05:31.260 align:middle line:84%
next in the next video.

138
05:31.260 --> 05:33.253 align:middle line:90%
So I'll see you there
in just a moment.

139
05:33.253 --> 05:35.420 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

140
05:35.420 --> 05:38.710 align:middle line:90%
and I'd like to thank
you for viewing.