WEBVTT

1
00:00.000 --> 00:00.920 align:middle line:84%


2
00:00.920 --> 00:02.570 align:middle line:90%
In the previous
video, we identified

3
00:02.570 --> 00:04.850 align:middle line:90%
that the ESA, the email
security appliance,

4
00:04.850 --> 00:07.290 align:middle line:90%
is a lot like a bouncer at
the edge of our network,

5
00:07.290 --> 00:10.820 align:middle line:90%
so that the outside email world
all has to interface with it,

6
00:10.820 --> 00:13.040 align:middle line:90%
and then it can interface
with our internal server,

7
00:13.040 --> 00:14.510 align:middle line:90%
and it can do all
the heavy lifting

8
00:14.510 --> 00:16.219 align:middle line:84%
and protection regarding email.

9
00:16.219 --> 00:18.320 align:middle line:90%
So I'd like to share
with you in this video

10
00:18.320 --> 00:20.990 align:middle line:90%
a pretty high level overview
of some of the riggers

11
00:20.990 --> 00:23.000 align:middle line:90%
and some of the tests
and some of the filtering

12
00:23.000 --> 00:25.458 align:middle line:90%
that this guy is going to do,
the email security appliance,

13
00:25.458 --> 00:26.730 align:middle line:84%
to help keep us safe.

14
00:26.730 --> 00:28.770 align:middle line:90%
So let's use this
topology once again,

15
00:28.770 --> 00:30.770 align:middle line:90%
and let's put a server
out here on the internet,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:28.770 --> 00:30.770 align:middle line:90%
and let's put a server
out here on the internet,

16
00:30.770 --> 00:32.562 align:middle line:90%
we'll call it
server 2, and it has

17
00:32.562 --> 00:34.520 align:middle line:90%
email that it wants to
send over to our domain,

18
00:34.520 --> 00:38.030 align:middle line:90%
and we'll imagine
that we are ogit.com.

19
00:38.030 --> 00:40.610 align:middle line:90%
So this server does
an MX record lookup,

20
00:40.610 --> 00:45.200 align:middle line:90%
looking for email servers,
MX records, at ogti.com.

21
00:45.200 --> 00:49.493 align:middle line:90%
it responds back
with esa.ogti.com,

22
00:49.493 --> 00:51.410 align:middle line:90%
and then the server who
wants to send us email

23
00:51.410 --> 00:53.780 align:middle line:90%
then does an A record
lookup based on that name,

24
00:53.780 --> 00:56.720 align:middle line:90%
and then, boom, starts sending
the traffic over to us.

25
00:56.720 --> 00:59.090 align:middle line:84%
And that's going to be SMTP.

26
00:59.090 --> 01:02.960 align:middle line:90%
So from the internet, it looks
like MTA, mail transfer agent,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.090 --> 01:02.960 align:middle line:90%
So from the internet, it looks
like MTA, mail transfer agent,

27
01:02.960 --> 01:06.260 align:middle line:90%
talking to mail transfer
agent, or email server to email

28
01:06.260 --> 01:06.900 align:middle line:84%
server.

29
01:06.900 --> 01:08.400 align:middle line:90%
Now when that
connection is received

30
01:08.400 --> 01:10.730 align:middle line:90%
by our ESA, our email
security appliance,

31
01:10.730 --> 01:14.600 align:middle line:90%
it's going to be receiving that
logically on a public listener.

32
01:14.600 --> 01:17.570 align:middle line:90%
Think of a public listener
as the logical component

33
01:17.570 --> 01:20.538 align:middle line:90%
that receives all the inbound
requests from the outside world

34
01:20.538 --> 01:21.830 align:middle line:84%
where we don't trust everybody.

35
01:21.830 --> 01:23.812 align:middle line:90%
And at the same time,
if we deployed our ESA

36
01:23.812 --> 01:26.270 align:middle line:90%
with two interfaces, we could
have one interface associated

37
01:26.270 --> 01:28.220 align:middle line:90%
with a public listener
for the outside world

38
01:28.220 --> 01:31.100 align:middle line:90%
and the other interface set
up as a private listener.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:28.220 --> 01:31.100 align:middle line:90%
and the other interface set
up as a private listener.

39
01:31.100 --> 01:33.020 align:middle line:90%
And the beauty is there
the private listener

40
01:33.020 --> 01:35.390 align:middle line:90%
can interface with our
private email server,

41
01:35.390 --> 01:37.160 align:middle line:90%
and the public
listener can interface

42
01:37.160 --> 01:40.140 align:middle line:90%
with all the other MTAs
out there on the internet.

43
01:40.140 --> 01:42.530 align:middle line:90%
So server 2 builds
an SMTP connection,

44
01:42.530 --> 01:45.950 align:middle line:90%
it runs over TCP over to
the ESA with the intent

45
01:45.950 --> 01:47.088 align:middle line:84%
to send some email.

46
01:47.088 --> 01:49.380 align:middle line:90%
Now the ESA doesn't just say,
great, send me the email.

47
01:49.380 --> 01:49.940 align:middle line:84%
I'll take it.

48
01:49.940 --> 01:51.320 align:middle line:90%
What it's going
to do, it's going

49
01:51.320 --> 01:54.530 align:middle line:90%
to go ahead and check the
reputation of the sender.

50
01:54.530 --> 01:56.480 align:middle line:90%
In this case, our
sender is server 2,

51
01:56.480 --> 01:59.570 align:middle line:90%
and it's also going to
check the host access

52
01:59.570 --> 02:02.690 align:middle line:90%
table, which is also
sometimes referred to as HAT.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.570 --> 02:02.690 align:middle line:90%
table, which is also
sometimes referred to as HAT.

53
02:02.690 --> 02:04.940 align:middle line:90%
And if the reputation of
the sender is bad enough

54
02:04.940 --> 02:08.268 align:middle line:90%
or if the sender has
been blocked completely,

55
02:08.268 --> 02:09.810 align:middle line:90%
we're not going to
process that email

56
02:09.810 --> 02:11.477 align:middle line:90%
and let it get to the
real email server.

57
02:11.477 --> 02:12.720 align:middle line:84%
We can drop it right there.

58
02:12.720 --> 02:13.970 align:middle line:90%
And so there's a lot
of things that affect

59
02:13.970 --> 02:15.110 align:middle line:84%
the reputation of a server.

60
02:15.110 --> 02:18.170 align:middle line:90%
Is that server known
to send lots of spam?

61
02:18.170 --> 02:20.610 align:middle line:90%
Or is it known to send
lots of malicious code

62
02:20.610 --> 02:22.250 align:middle line:84%
as part of phishing attacks?

63
02:22.250 --> 02:24.140 align:middle line:90%
And because TALOS is
looking at millions

64
02:24.140 --> 02:26.390 align:middle line:90%
of emails every
single hour, it can

65
02:26.390 --> 02:28.880 align:middle line:90%
identify where those
malicious players are,

66
02:28.880 --> 02:31.790 align:middle line:90%
and then educate our ESA
so that when traffic comes
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:28.880 --> 02:31.790 align:middle line:90%
and then educate our ESA
so that when traffic comes

67
02:31.790 --> 02:35.270 align:middle line:90%
in we may have a bad reputation
or a good reputation,

68
02:35.270 --> 02:37.287 align:middle line:90%
and based on that,
the email security

69
02:37.287 --> 02:39.620 align:middle line:90%
appliance can drop like most
of the traffic right there.

70
02:39.620 --> 02:41.162 align:middle line:90%
And say, you know
what, I'm not going

71
02:41.162 --> 02:43.340 align:middle line:90%
to forward those emails
because the sender has

72
02:43.340 --> 02:44.595 align:middle line:84%
a bad reputation.

73
02:44.595 --> 02:46.970 align:middle line:90%
So I will show you-- as we
continue through these videos,

74
02:46.970 --> 02:49.370 align:middle line:90%
I will show you how the
reputation of the sender

75
02:49.370 --> 02:53.120 align:middle line:90%
and the host access table or
HAT are kind of linked or tied

76
02:53.120 --> 02:55.562 align:middle line:90%
together, and how the ESA
makes those decisions.

77
02:55.562 --> 02:57.020 align:middle line:90%
But the key here
is that it's going

78
02:57.020 --> 03:00.380 align:middle line:90%
to drop like most of the traffic
or most of the email messages
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:57.020 --> 03:00.380 align:middle line:90%
to drop like most of the traffic
or most of the email messages

79
03:00.380 --> 03:03.500 align:middle line:90%
at this point that are
from bad sites or malicious

80
03:03.500 --> 03:06.290 align:middle line:90%
or spam so they never
get to your email server.

81
03:06.290 --> 03:09.080 align:middle line:90%
So we can think of these as
like the first line of defense

82
03:09.080 --> 03:12.410 align:middle line:90%
against malicious or just bogus
emails that we don't want.

83
03:12.410 --> 03:15.170 align:middle line:90%
But there is actually one
additional initial check

84
03:15.170 --> 03:18.350 align:middle line:90%
and that is called
the RAT, which stands

85
03:18.350 --> 03:21.120 align:middle line:84%
for Recipient Access Table.

86
03:21.120 --> 03:23.850 align:middle line:90%
So if ogit.com is in
our Recipient Access

87
03:23.850 --> 03:27.290 align:middle line:90%
Table, that exact domain, we'll
be willing to receive emails.

88
03:27.290 --> 03:29.507 align:middle line:90%
Assuming the reputation is
good enough by the sender,

89
03:29.507 --> 03:32.090 align:middle line:90%
we'll be willing to receive it
because the RAT says, OK, we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:29.507 --> 03:32.090 align:middle line:90%
we'll be willing to receive it
because the RAT says, OK, we're

90
03:32.090 --> 03:34.250 align:middle line:84%
accepting emails to ogit.com.

91
03:34.250 --> 03:37.580 align:middle line:90%
But if the email is destined
for some other domain,

92
03:37.580 --> 03:39.710 align:middle line:90%
right there at the
email security alliance,

93
03:39.710 --> 03:43.340 align:middle line:90%
if that other domain is not in
the RAT, the Recipient Access

94
03:43.340 --> 03:45.960 align:middle line:90%
Table, it can just
drop it right there.

95
03:45.960 --> 03:48.410 align:middle line:90%
So that's going to cut just
like a boatload of email

96
03:48.410 --> 03:50.672 align:middle line:90%
messages right out of the
gate from ever making it

97
03:50.672 --> 03:51.380 align:middle line:84%
into our network.

98
03:51.380 --> 03:53.540 align:middle line:90%
But besides that, if we
have email messages that

99
03:53.540 --> 03:56.150 align:middle line:90%
pass those tests, it's coming
from somebody with a reputation

100
03:56.150 --> 03:57.733 align:middle line:90%
that's good enough
for us to allow it,

101
03:57.733 --> 03:59.330 align:middle line:90%
it's coming to
something in our domain

102
03:59.330 --> 04:02.463 align:middle line:90%
or that centers on the host
access table as being specified
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:59.330 --> 04:02.463 align:middle line:90%
or that centers on the host
access table as being specified

103
04:02.463 --> 04:04.880 align:middle line:90%
as allowed, go ahead and let
this sender send this message

104
04:04.880 --> 04:07.580 align:middle line:90%
in to us, there's yet a
whole another list of checks

105
04:07.580 --> 04:09.590 align:middle line:90%
that we can do on
those email messages

106
04:09.590 --> 04:12.830 align:middle line:90%
before they are forwarded
onto our real email server.

107
04:12.830 --> 04:15.500 align:middle line:90%
Let me give you a sneak peek
at what some of those are.

108
04:15.500 --> 04:19.017 align:middle line:90%
So this is an example of the
Virtual Appliance from Cisco.

109
04:19.017 --> 04:21.350 align:middle line:90%
You can get a hardware appliance
or a virtual appliance,

110
04:21.350 --> 04:23.000 align:middle line:90%
either way would
be great on-prem

111
04:23.000 --> 04:25.520 align:middle line:90%
as long as it can handle the
expected amount of traffic,

112
04:25.520 --> 04:28.435 align:middle line:90%
and this is an example of
the incoming mail policies.

113
04:28.435 --> 04:29.810 align:middle line:90%
So these checks
are about to show

114
04:29.810 --> 04:33.620 align:middle line:90%
you are done after the host
address table or the reputation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:29.810 --> 04:33.620 align:middle line:90%
you are done after the host
address table or the reputation

115
04:33.620 --> 04:36.440 align:middle line:90%
has been checked and the
recipient has been checked

116
04:36.440 --> 04:37.760 align:middle line:84%
and it makes it through that.

117
04:37.760 --> 04:39.260 align:middle line:90%
These are the
additional checks that

118
04:39.260 --> 04:41.450 align:middle line:90%
can be done based on
the license features

119
04:41.450 --> 04:43.670 align:middle line:90%
that you're using on
the email appliance,

120
04:43.670 --> 04:47.930 align:middle line:90%
and they include antispam,
antivirus, advanced malware

121
04:47.930 --> 04:51.470 align:middle line:90%
protection, graymail, content
filters, outbreak filters,

122
04:51.470 --> 04:53.030 align:middle line:84%
advanced phishing protection.

123
04:53.030 --> 04:54.920 align:middle line:90%
And then based on
all the policies

124
04:54.920 --> 04:57.560 align:middle line:90%
we have set up, if the
email passes all those,

125
04:57.560 --> 05:00.140 align:middle line:90%
then it can be delivered
on the internal network
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:57.560 --> 05:00.140 align:middle line:90%
then it can be delivered
on the internal network

126
05:00.140 --> 05:02.760 align:middle line:90%
to the real email
server, at which point

127
05:02.760 --> 05:05.670 align:middle line:90%
Bob could go ahead
and use POP3 or IMAP,

128
05:05.670 --> 05:07.930 align:middle line:90%
check his email server,
or get a notification that

129
05:07.930 --> 05:10.980 align:middle line:90%
has new email, and pull down his
messages from the email server

130
05:10.980 --> 05:11.790 align:middle line:84%
and see it.

131
05:11.790 --> 05:13.170 align:middle line:90%
You see, the
intention is we want

132
05:13.170 --> 05:16.950 align:middle line:90%
to block as much bogus,
malicious, malware-laden email

133
05:16.950 --> 05:20.820 align:middle line:90%
messages as we can before
our users ever get them.

134
05:20.820 --> 05:22.410 align:middle line:90%
Now, at the user
machine, we still

135
05:22.410 --> 05:26.550 align:middle line:90%
want to have software involved,
so if an email message did

136
05:26.550 --> 05:29.217 align:middle line:90%
get through, and it had a
link, and they clicked on it,

137
05:29.217 --> 05:31.050 align:middle line:90%
we want to have some
software at that client
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
05:29.217 --> 05:31.050 align:middle line:90%
we want to have some
software at that client

138
05:31.050 --> 05:32.850 align:middle line:90%
that when they click on a
link, it could warn them, oh,

139
05:32.850 --> 05:34.920 align:middle line:90%
is a tough website or
a dangerous website.

140
05:34.920 --> 05:38.040 align:middle line:90%
So that's important to do in
combination with the filtering

141
05:38.040 --> 05:40.890 align:middle line:90%
of email in combination with
probably the most important

142
05:40.890 --> 05:44.460 align:middle line:90%
aspect of all this, which
is end user education that

143
05:44.460 --> 05:48.510 align:middle line:90%
should train them never, never
click on a link for anything

144
05:48.510 --> 05:51.210 align:middle line:90%
that you got in your email
even with all these protections

145
05:51.210 --> 05:51.850 align:middle line:84%
in place.

146
05:51.850 --> 05:53.610 align:middle line:90%
So these are multiple
layers of defense.

147
05:53.610 --> 05:55.590 align:middle line:90%
So in the next video,
I'd like to share

148
05:55.590 --> 05:57.240 align:middle line:84%
with you about incoming mail.

149
05:57.240 --> 05:59.400 align:middle line:90%
There's a lot of work
that the ESA can do,

150
05:59.400 --> 06:02.850 align:middle line:90%
but I want to also share with
you how you can manually set up
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:59.400 --> 06:02.850 align:middle line:90%
but I want to also share with
you how you can manually set up

151
06:02.850 --> 06:07.440 align:middle line:90%
block lists regarding domains
or IP addresses of email servers

152
06:07.440 --> 06:10.407 align:middle line:90%
that you never want to
receive email messages from.

153
06:10.407 --> 06:12.240 align:middle line:90%
So even though a lot
of it can be automated,

154
06:12.240 --> 06:15.203 align:middle line:90%
I also want to show you how to
set up a block list manually

155
06:15.203 --> 06:17.620 align:middle line:90%
if you need to do it, and we'll
do that in the next video.

156
06:17.620 --> 06:18.880 align:middle line:90%
So I'll see you there
in just a moment.

157
06:18.880 --> 06:21.330 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

158
06:21.330 --> 06:24.560 align:middle line:90%
and I'd like to thank
you for viewing.