WEBVTT

1
00:00.000 --> 00:01.680 align:middle line:84%


2
00:01.680 --> 00:03.960 align:middle line:90%
In this video, you and I
get to chat about something

3
00:03.960 --> 00:06.720 align:middle line:90%
that computers do hundreds
of times every single day,

4
00:06.720 --> 00:11.400 align:middle line:90%
and is absolutely treacherous
if it's not handled correctly.

5
00:11.400 --> 00:13.660 align:middle line:90%
And let's use this
typology as a backdrop.

6
00:13.660 --> 00:15.750 align:middle line:90%
And let's imagine
we have Bob, which

7
00:15.750 --> 00:18.360 align:middle line:90%
could represent any user
on our computer networks,

8
00:18.360 --> 00:19.740 align:middle line:84%
and he is at this computer.

9
00:19.740 --> 00:21.990 align:middle line:90%
And the thing that
Bob and Bob's computer

10
00:21.990 --> 00:23.790 align:middle line:90%
is likely to do
hundreds of times a day,

11
00:23.790 --> 00:27.102 align:middle line:90%
is access some type of
resource out on the internet.

12
00:27.102 --> 00:28.560 align:middle line:90%
And so it goes
something like this.

13
00:28.560 --> 00:30.420 align:middle line:90%
Bob brings up his
favorite browser.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:28.560 --> 00:30.420 align:middle line:90%
Bob brings up his
favorite browser.

14
00:30.420 --> 00:37.020 align:middle line:84%
He types in www.mfs.com.

15
00:37.020 --> 00:39.780 align:middle line:90%
I'm just going to use an acronym
there-- myfavoritesite.com

16
00:39.780 --> 00:41.580 align:middle line:84%
And then presses Enter.

17
00:41.580 --> 00:45.630 align:middle line:90%
And then magically that website
content appears on his page.

18
00:45.630 --> 00:47.550 align:middle line:90%
Now behind the scenes,
what's happening

19
00:47.550 --> 00:51.000 align:middle line:90%
is Bob's computer
is using DNS, which

20
00:51.000 --> 00:53.850 align:middle line:90%
is an acronym for
Domain Name System.

21
00:53.850 --> 00:55.920 align:middle line:90%
It's basically the way
that Bob's computer can

22
00:55.920 --> 00:59.310 align:middle line:90%
take this name,
like www.mfs.com,

23
00:59.310 --> 01:02.100 align:middle line:90%
and what they call resolving
it, or figuring out what
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.310 --> 01:02.100 align:middle line:90%
and what they call resolving
it, or figuring out what

24
01:02.100 --> 01:05.015 align:middle line:84%
the IP address is behind that.

25
01:05.015 --> 01:06.390 align:middle line:90%
And we can think
of an IP address

26
01:06.390 --> 01:08.550 align:middle line:90%
were like the street name
and house number for how

27
01:08.550 --> 01:10.000 align:middle line:84%
to reach that device.

28
01:10.000 --> 01:12.000 align:middle line:84%
So Bob does the DNS request.

29
01:12.000 --> 01:14.310 align:middle line:90%
He gets the DNS response
from a DNS server.

30
01:14.310 --> 01:16.950 align:middle line:90%
That DNS server could be
here locally in its network,

31
01:16.950 --> 01:19.240 align:middle line:84%
or here, or out on the internet.

32
01:19.240 --> 01:21.570 align:middle line:90%
And then once Bob has the
IP address of that server,

33
01:21.570 --> 01:23.400 align:middle line:90%
Bob then forwards
his packets, which

34
01:23.400 --> 01:26.408 align:middle line:90%
get routed across the network,
and then reach that server.

35
01:26.408 --> 01:28.950 align:middle line:90%
So we'll say this is the server
that Bob was trying to reach.

36
01:28.950 --> 01:32.650 align:middle line:90%
And then the response comes back
all the way to Bob's computer.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

36
01:28.950 --> 01:32.650 align:middle line:90%
And then the response comes back
all the way to Bob's computer.

37
01:32.650 --> 01:35.400 align:middle line:90%
So that's the basic mechanics
of resolving a name to an IP

38
01:35.400 --> 01:37.950 align:middle line:90%
address with a DNS
server, but let's talk

39
01:37.950 --> 01:40.080 align:middle line:90%
about what mischief
and treachery

40
01:40.080 --> 01:42.990 align:middle line:90%
can happen if
somebody is malicious

41
01:42.990 --> 01:45.330 align:middle line:90%
and they're trying to harm
either Bob's computer,

42
01:45.330 --> 01:46.890 align:middle line:84%
or harm our network.

43
01:46.890 --> 01:49.140 align:middle line:90%
The first negative piece
that can come out of this

44
01:49.140 --> 01:51.330 align:middle line:84%
is bad information.

45
01:51.330 --> 01:53.020 align:middle line:90%
And what I mean
bad-- for example,

46
01:53.020 --> 01:54.630 align:middle line:90%
it could be incorrect
information.

47
01:54.630 --> 01:58.740 align:middle line:90%
If somebody has compromised the
DNS server that Bob is using,

48
01:58.740 --> 02:00.840 align:middle line:90%
and the information
gets sent back to Bob--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
01:58.740 --> 02:00.840 align:middle line:90%
and the information
gets sent back to Bob--

49
02:00.840 --> 02:04.200 align:middle line:90%
let's say the server
is at 1.2.3.4,

50
02:04.200 --> 02:07.620 align:middle line:90%
but the DNS response that comes
back says, oh, that's it--

51
02:07.620 --> 02:10.050 align:middle line:84%
3.4.5.6.

52
02:10.050 --> 02:12.840 align:middle line:90%
Bob could be going to a
completely different computer,

53
02:12.840 --> 02:14.340 align:middle line:90%
which could be a
malicious website--

54
02:14.340 --> 02:16.200 align:middle line:90%
I'll just draw
angry eyes there--

55
02:16.200 --> 02:18.180 align:middle line:90%
that maybe is made to
look like the website

56
02:18.180 --> 02:19.590 align:middle line:84%
that Bob was trying to go to.

57
02:19.590 --> 02:21.840 align:middle line:90%
And maybe it's prompting
him now for information,

58
02:21.840 --> 02:24.160 align:middle line:90%
or trying to run
scripts on his computer.

59
02:24.160 --> 02:26.430 align:middle line:90%
But the result of Bob
going to the incorrect,

60
02:26.430 --> 02:29.550 align:middle line:90%
or a malicious website because
of having incorrect DNS

61
02:29.550 --> 02:32.340 align:middle line:90%
information, that could
compromise Bob's system.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

61
02:29.550 --> 02:32.340 align:middle line:90%
information, that could
compromise Bob's system.

62
02:32.340 --> 02:35.935 align:middle line:90%
And other challenges we
could have malicious websites

63
02:35.935 --> 02:37.060 align:middle line:84%
that Bob's trying to go to.

64
02:37.060 --> 02:43.870 align:middle line:90%
So maybe Bob goes
to www.badsite.com,

65
02:43.870 --> 02:45.400 align:middle line:84%
and he presses Enter.

66
02:45.400 --> 02:47.410 align:middle line:90%
And DNS does its
resolution, provides

67
02:47.410 --> 02:51.280 align:middle line:90%
of an IP address of
6.42.9.9, or whatever

68
02:51.280 --> 02:52.820 align:middle line:84%
the IP address might be.

69
02:52.820 --> 02:56.170 align:middle line:90%
So even if the IP address
that's being returned via DNS is

70
02:56.170 --> 02:59.260 align:middle line:90%
correct, we don't-- we really
in our company don't want Bob

71
02:59.260 --> 03:02.500 align:middle line:90%
going to a malicious site that
intentionally is going to harm
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:59.260 --> 03:02.500 align:middle line:90%
going to a malicious site that
intentionally is going to harm

72
03:02.500 --> 03:03.920 align:middle line:84%
Bob's computer.

73
03:03.920 --> 03:05.620 align:middle line:90%
So even if Bob
wanted to go there,

74
03:05.620 --> 03:07.960 align:middle line:90%
ideally we wouldn't want him
to go to a malicious site.

75
03:07.960 --> 03:10.480 align:middle line:90%
But there's nothing
by default that's

76
03:10.480 --> 03:12.280 align:middle line:90%
stopping Bob from
resolving that name,

77
03:12.280 --> 03:14.800 align:middle line:90%
and going to that IP address,
and then hitting that website.

78
03:14.800 --> 03:17.620 align:middle line:90%
So up here I'll put
bad/incorrect information

79
03:17.620 --> 03:19.270 align:middle line:84%
could be returned to us.

80
03:19.270 --> 03:22.910 align:middle line:90%
And the third, which is really,
really bad, is tunneling.

81
03:22.910 --> 03:23.800 align:middle line:84%
So DNS.

82
03:23.800 --> 03:26.260 align:middle line:90%
When Bob makes a query,
it's using at Layer 4

83
03:26.260 --> 03:27.580 align:middle line:84%
in the TCP/IP protocol suite.

84
03:27.580 --> 03:30.880 align:middle line:90%
It's using a protocol called
UDP, User Datagram Protocol,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
03:27.580 --> 03:30.880 align:middle line:90%
It's using a protocol called
UDP, User Datagram Protocol,

85
03:30.880 --> 03:32.590 align:middle line:90%
and the well-known
port for a DNS

86
03:32.590 --> 03:35.410 align:middle line:84%
request is going to Port 53.

87
03:35.410 --> 03:38.860 align:middle line:90%
And then unfortunately, because
attackers know that UDP Port 53

88
03:38.860 --> 03:40.870 align:middle line:90%
is being allowed
through our networks,

89
03:40.870 --> 03:44.170 align:middle line:90%
an attacker actually could
do tunneling using UDP:53,

90
03:44.170 --> 03:46.630 align:middle line:90%
so that if we looked at the
traffic going in and out from

91
03:46.630 --> 03:50.440 align:middle line:90%
Bob's computer, it looks like
it's UDP Port 53, no problem.

92
03:50.440 --> 03:52.870 align:middle line:90%
But inside the
packets, the attacker

93
03:52.870 --> 03:55.420 align:middle line:90%
could be exfiltrating
or exporting

94
03:55.420 --> 03:58.860 align:middle line:90%
information about
reconnaissance in Bob's network.

95
03:58.860 --> 04:01.540 align:middle line:90%
So if this computer has
a virus or malware that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:58.860 --> 04:01.540 align:middle line:90%
So if this computer has
a virus or malware that's

96
04:01.540 --> 04:04.990 align:middle line:90%
collecting data, or even
locally on Bob's computer,

97
04:04.990 --> 04:07.240 align:middle line:90%
a malicious app could
be taking that data

98
04:07.240 --> 04:09.670 align:middle line:90%
and tucking it
piece-by-piece into what

99
04:09.670 --> 04:11.868 align:middle line:90%
looks like, on the
outside, DNS information,

100
04:11.868 --> 04:13.660 align:middle line:90%
and allow that traffic
to be forwarded out.

101
04:13.660 --> 04:16.000 align:middle line:90%
And then we'd have some
attackers DNS server,

102
04:16.000 --> 04:18.110 align:middle line:90%
or a device listening
on that port, which

103
04:18.110 --> 04:19.360 align:middle line:84%
is collecting the information.

104
04:19.360 --> 04:21.760 align:middle line:90%
Or another problem
with DNS tunneling

105
04:21.760 --> 04:23.615 align:middle line:90%
which is also
very, very real, is

106
04:23.615 --> 04:25.240 align:middle line:90%
that if there's some
malicious software

107
04:25.240 --> 04:29.260 align:middle line:90%
here that is trying to make
Bob's computer a bot, as part

108
04:29.260 --> 04:31.540 align:middle line:90%
of a botnet, and we have
to say we have a command
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
04:29.260 --> 04:31.540 align:middle line:90%
of a botnet, and we have
to say we have a command

109
04:31.540 --> 04:33.110 align:middle line:84%
and control center out here.

110
04:33.110 --> 04:35.860 align:middle line:90%
So a command and control
center, like the hackers'

111
04:35.860 --> 04:38.330 align:middle line:90%
central command, where you
can issue commands and tell

112
04:38.330 --> 04:40.090 align:middle line:84%
all these bots what to do.

113
04:40.090 --> 04:43.570 align:middle line:90%
If we've compromised the
system and we're tunneling DNS,

114
04:43.570 --> 04:45.880 align:middle line:90%
we could actually have command
and control information

115
04:45.880 --> 04:47.380 align:middle line:90%
from this command
and control server

116
04:47.380 --> 04:49.840 align:middle line:90%
from the attacker, that's
able to communicate back

117
04:49.840 --> 04:53.170 align:middle line:90%
to these bots inside our network
because the traffic simply

118
04:53.170 --> 04:55.460 align:middle line:90%
looks like DNS
requests and responses.

119
04:55.460 --> 04:57.215 align:middle line:90%
And if we're not paying
closer attention,

120
04:57.215 --> 04:58.840 align:middle line:90%
we could effectively
allow the attacker

121
04:58.840 --> 05:01.960 align:middle line:90%
on the outside to be
controlling a bot on the inside
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:58.840 --> 05:01.960 align:middle line:90%
on the outside to be
controlling a bot on the inside

122
05:01.960 --> 05:05.328 align:middle line:90%
by tunneling their commands in
what looks like UDP traffic.

123
05:05.328 --> 05:07.120 align:middle line:90%
So the next question
we might ask ourselves

124
05:07.120 --> 05:08.980 align:middle line:90%
is, OK, what can be
done to help this?

125
05:08.980 --> 05:11.230 align:middle line:90%
And the answer to that, or
one of the answers to that,

126
05:11.230 --> 05:13.780 align:middle line:90%
is a product called
Cisco Umbrella.

127
05:13.780 --> 05:15.790 align:middle line:90%
Let me share with you
how that can help protect

128
05:15.790 --> 05:18.340 align:middle line:90%
Bob and all the other
computers in our environment

129
05:18.340 --> 05:20.050 align:middle line:84%
from these types of attacks.

130
05:20.050 --> 05:22.540 align:middle line:90%
And here's how Cisco
Umbrella comes to the rescue.

131
05:22.540 --> 05:25.180 align:middle line:90%
We have Cisco, and
they have this group

132
05:25.180 --> 05:27.430 align:middle line:90%
in the cloud referred
to as Talos, which

133
05:27.430 --> 05:28.750 align:middle line:84%
is their security intelligence.

134
05:28.750 --> 05:31.000 align:middle line:90%
And they are looking
at and have a database
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

134
05:28.750 --> 05:31.000 align:middle line:90%
And they are looking
at and have a database

135
05:31.000 --> 05:35.770 align:middle line:90%
of billions and billions and
billions of DNS requests.

136
05:35.770 --> 05:39.280 align:middle line:90%
They also know the reputation
of websites and servers

137
05:39.280 --> 05:40.900 align:middle line:90%
out there on the
internet, and they're

138
05:40.900 --> 05:43.760 align:middle line:90%
keeping all of that in their
databases in the cloud.

139
05:43.760 --> 05:46.900 align:middle line:90%
So if somebody is trying to go
to this server, or that server,

140
05:46.900 --> 05:49.120 align:middle line:90%
or that server,
Cisco has knowledge

141
05:49.120 --> 05:52.000 align:middle line:90%
regarding the cloud, regarding
the reputation of those sites.

142
05:52.000 --> 05:54.200 align:middle line:90%
Let's imagine this
guy is bad news.

143
05:54.200 --> 05:56.000 align:middle line:84%
And this guy is bad news.

144
05:56.000 --> 05:57.400 align:middle line:84%
And this one's OK.

145
05:57.400 --> 05:59.270 align:middle line:90%
So these two have a
really bad reputation,

146
05:59.270 --> 06:01.960 align:middle line:90%
this one has a good
reputation, meaning it's safe.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

146
05:59.270 --> 06:01.960 align:middle line:90%
this one has a good
reputation, meaning it's safe.

147
06:01.960 --> 06:04.220 align:middle line:90%
So Talos has all that
information in the cloud.

148
06:04.220 --> 06:07.630 align:middle line:90%
Now, if we have Bob over here
still, how do we protect Bob?

149
06:07.630 --> 06:10.870 align:middle line:90%
What we do is, we tell Bob
hey, instead of just using

150
06:10.870 --> 06:13.000 align:middle line:90%
a normal DNS server,
let's go ahead

151
06:13.000 --> 06:17.440 align:middle line:90%
and use a DNS server that's
managed by Cisco, as part

152
06:17.440 --> 06:18.790 align:middle line:84%
of Cisco Umbrella.

153
06:18.790 --> 06:23.560 align:middle line:90%
And so Bob's computer now makes
requests up to the Cisco DNS.

154
06:23.560 --> 06:26.110 align:middle line:90%
And then instead of this
DNS server just willfully

155
06:26.110 --> 06:29.530 align:middle line:90%
responding with anything Bob's
asking for, if there's a site,

156
06:29.530 --> 06:31.330 align:middle line:90%
or in our policy,
for restricting
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
06:29.530 --> 06:31.330 align:middle line:90%
or in our policy,
for restricting

157
06:31.330 --> 06:34.840 align:middle line:90%
certain types of sites,
like alcohol, or hate sites,

158
06:34.840 --> 06:37.660 align:middle line:90%
or other things, that can
all be identified in policy.

159
06:37.660 --> 06:39.310 align:middle line:90%
And then when Bob
makes the request,

160
06:39.310 --> 06:41.260 align:middle line:90%
and based on Cisco
knowing exactly

161
06:41.260 --> 06:43.270 align:middle line:90%
what the categories are,
and the reputation are,

162
06:43.270 --> 06:45.310 align:middle line:90%
and the mannerisms of
these different websites,

163
06:45.310 --> 06:47.987 align:middle line:90%
the response can actually come
back and say, yep, here you go.

164
06:47.987 --> 06:49.570 align:middle line:90%
Here's the IP address
that you wanted,

165
06:49.570 --> 06:51.670 align:middle line:84%
or it can simply say this--

166
06:51.670 --> 06:52.390 align:middle line:84%
sorry, Bob.

167
06:52.390 --> 06:53.740 align:middle line:90%
And it can give him
back a notification

168
06:53.740 --> 06:56.157 align:middle line:90%
saying, you know what, that
website you're trying to go to

169
06:56.157 --> 06:59.890 align:middle line:90%
is malicious, or is
restricted by policy,

170
06:59.890 --> 07:01.890 align:middle line:90%
or whatever the condition
is that's stopping it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:59.890 --> 07:01.890 align:middle line:90%
or whatever the condition
is that's stopping it.

171
07:01.890 --> 07:04.265 align:middle line:90%
And the key here is, we're
stopping Bob from ever getting

172
07:04.265 --> 07:05.440 align:middle line:84%
to these servers over here.

173
07:05.440 --> 07:08.370 align:middle line:90%
Because if the DNS gives back
a negative response and says,

174
07:08.370 --> 07:10.398 align:middle line:90%
sorry, this isn't
safe, Bob's computer

175
07:10.398 --> 07:12.190 align:middle line:90%
will never try to
connect to those servers,

176
07:12.190 --> 07:14.080 align:middle line:90%
and we're preventing
those types of attacks

177
07:14.080 --> 07:17.020 align:middle line:90%
in the tunneling and everything
else, even before they begin.

178
07:17.020 --> 07:19.180 align:middle line:90%
It's sort of like a kid
who wants to go shopping,

179
07:19.180 --> 07:22.180 align:middle line:90%
and he's asking an adult or
a parent about which store

180
07:22.180 --> 07:24.370 align:middle line:90%
they should go to,
store A, or store B. Now

181
07:24.370 --> 07:27.280 align:middle line:90%
if the parent knows that
hey, store A is risky,

182
07:27.280 --> 07:29.260 align:middle line:90%
it's bad news, it's
high-priced, and everything

183
07:29.260 --> 07:31.930 align:middle line:90%
else, the parent can simply
say no, don't go to that store,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

183
07:29.260 --> 07:31.930 align:middle line:90%
else, the parent can simply
say no, don't go to that store,

184
07:31.930 --> 07:34.270 align:middle line:90%
and prevent the child from going
to that store the first place.

185
07:34.270 --> 07:36.580 align:middle line:90%
Or at the same time, that
parent can talk to the child

186
07:36.580 --> 07:38.080 align:middle line:90%
and say, yeah, the
store B is great.

187
07:38.080 --> 07:38.660 align:middle line:84%
Go there.

188
07:38.660 --> 07:40.618 align:middle line:90%
So if the kid later, like
two days later, says,

189
07:40.618 --> 07:43.770 align:middle line:90%
I want to go to store A, the
parent could consistently

190
07:43.770 --> 07:46.830 align:middle line:90%
say, nope, store A is bad,
and prevent the child,

191
07:46.830 --> 07:48.420 align:middle line:90%
just like preventing
Bob, our user,

192
07:48.420 --> 07:51.190 align:middle line:90%
from ever going there
in the first place.

193
07:51.190 --> 07:54.240 align:middle line:90%
So that's the big picture,
the overall broad view

194
07:54.240 --> 07:55.440 align:middle line:84%
of Cisco Umbrella.

195
07:55.440 --> 07:57.503 align:middle line:90%
And as we continue going
through these videos,

196
07:57.503 --> 07:58.920 align:middle line:90%
I'd like to share
with you how you

197
07:58.920 --> 08:02.010 align:middle line:90%
can use the basic services
of Umbrella for free.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

197
07:58.920 --> 08:02.010 align:middle line:90%
can use the basic services
of Umbrella for free.

198
08:02.010 --> 08:05.070 align:middle line:90%
And then we'll take a look at
the paid services for Umbrella,

199
08:05.070 --> 08:07.530 align:middle line:90%
and how we can start to
implement additional policy

200
08:07.530 --> 08:10.200 align:middle line:90%
to protect our users on
our local area networks,

201
08:10.200 --> 08:12.840 align:middle line:90%
and as they travel, and
everywhere in between

202
08:12.840 --> 08:14.910 align:middle line:90%
by leveraging the
tools within Umbrella.

203
08:14.910 --> 08:16.890 align:middle line:90%
So we'll continue the
story in this journey

204
08:16.890 --> 08:19.380 align:middle line:90%
as we continue in the next
video, and I'll see you there

205
08:19.380 --> 08:20.560 align:middle line:84%
in just a moment.

206
08:20.560 --> 08:22.800 align:middle line:90%
Meanwhile, I hope this has
been informative for you

207
08:22.800 --> 08:26.120 align:middle line:90%
and I'd like to thank
you for viewing.