WEBVTT

1
00:00.000 --> 00:01.200 align:middle line:84%


2
00:01.200 --> 00:04.140 align:middle line:90%
I love it when a good policy
comes together and works

3
00:04.140 --> 00:04.990 align:middle line:84%
as intended.

4
00:04.990 --> 00:06.180 align:middle line:84%
I mean, who doesn't, right?

5
00:06.180 --> 00:09.990 align:middle line:90%
So in the previous video,
we created several elements

6
00:09.990 --> 00:13.260 align:middle line:90%
that can go into a policy, but
they're not applied to a policy

7
00:13.260 --> 00:13.960 align:middle line:84%
yet.

8
00:13.960 --> 00:16.079 align:middle line:90%
So in this video, we'll
create a custom policy.

9
00:16.079 --> 00:17.579 align:middle line:90%
And we'll take all
those components,

10
00:17.579 --> 00:19.620 align:middle line:90%
like those shopping cart
items, and place them

11
00:19.620 --> 00:21.810 align:middle line:90%
in that shopping cart
as part of a policy

12
00:21.810 --> 00:24.660 align:middle line:90%
that we can then enforce
on either a roaming user,

13
00:24.660 --> 00:27.000 align:middle line:90%
or a group of network
devices, based on where

14
00:27.000 --> 00:28.630 align:middle line:84%
we want that policy applied.

15
00:28.630 --> 00:31.440 align:middle line:90%
So as a quick sanity check, I'm
going to check my destination
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:28.630 --> 00:31.440 align:middle line:90%
So as a quick sanity check, I'm
going to check my destination

16
00:31.440 --> 00:33.270 align:middle line:84%
list for our custom list.

17
00:33.270 --> 00:34.140 align:middle line:84%
There it is.

18
00:34.140 --> 00:37.560 align:middle line:90%
The content categories, there's
our custom content category.

19
00:37.560 --> 00:40.890 align:middle line:90%
Application settings, security
settings, and blog page.

20
00:40.890 --> 00:43.150 align:middle line:90%
We made custom elements
for each one of those.

21
00:43.150 --> 00:46.980 align:middle line:90%
So let's go up to policies,
and click on All Policies.

22
00:46.980 --> 00:48.360 align:middle line:84%
Here's our default policy.

23
00:48.360 --> 00:50.550 align:middle line:90%
Now, we could
modify the default,

24
00:50.550 --> 00:53.070 align:middle line:90%
or I recommend we
create a new policy,

25
00:53.070 --> 00:56.130 align:middle line:90%
and place it in front of or
on top of the default policy.

26
00:56.130 --> 00:58.260 align:middle line:90%
These are processed
in a top down order.

27
00:58.260 --> 01:00.520 align:middle line:90%
So when there's a match
based on the identity of who
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.260 --> 01:00.520 align:middle line:90%
So when there's a match
based on the identity of who

28
01:00.520 --> 01:03.540 align:middle line:90%
are trying to enforce
policy on, then that policy

29
01:03.540 --> 01:04.680 align:middle line:84%
will be implemented.

30
01:04.680 --> 01:06.240 align:middle line:84%
So let's click on Add.

31
01:06.240 --> 01:08.293 align:middle line:90%
And now it's asking
right out of the gate,

32
01:08.293 --> 01:09.960 align:middle line:90%
it's like, who would
you like to protect

33
01:09.960 --> 01:13.740 align:middle line:90%
with this policy, AD groups, AD
users, AD computers, networks?

34
01:13.740 --> 01:17.490 align:middle line:90%
Now, at the moment, I have not
installed the roaming client

35
01:17.490 --> 01:18.960 align:middle line:84%
on Bob's computer.

36
01:18.960 --> 01:22.800 align:middle line:90%
He is currently using the
DNS servers from Umbrella,

37
01:22.800 --> 01:25.060 align:middle line:90%
but he's not associated
with our policy yet.

38
01:25.060 --> 01:27.270 align:middle line:90%
So for the moment, for
this brand new policy,

39
01:27.270 --> 01:29.430 align:middle line:90%
I'm going to leave
this unselected.

40
01:29.430 --> 01:31.710 align:middle line:90%
And then before we
try it with Bob,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.430 --> 01:31.710 align:middle line:90%
And then before we
try it with Bob,

41
01:31.710 --> 01:33.120 align:middle line:84%
we'll associate this with Bob.

42
01:33.120 --> 01:34.995 align:middle line:90%
And that'll give me a
chance to also show you

43
01:34.995 --> 01:36.115 align:middle line:84%
how to do that as well.

44
01:36.115 --> 01:37.740 align:middle line:90%
So for the first
step, I'm going to say

45
01:37.740 --> 01:40.770 align:middle line:90%
don't worry about applying this
policy to any entities yet.

46
01:40.770 --> 01:42.150 align:middle line:84%
Let's click on Next.

47
01:42.150 --> 01:44.520 align:middle line:90%
And now it's asking, what
should this policy do?

48
01:44.520 --> 01:47.200 align:middle line:90%
And I'm going to go ahead
and accept everything here.

49
01:47.200 --> 01:49.920 align:middle line:90%
And if we click on Advanced
Settings, check this out.

50
01:49.920 --> 01:51.880 align:middle line:84%
This is so stinking cool.

51
01:51.880 --> 01:53.135 align:middle line:84%
We can enforce saved search.

52
01:53.135 --> 01:55.260 align:middle line:90%
And what that means is if
we go to a search engine,

53
01:55.260 --> 01:56.760 align:middle line:90%
if a user goes to
a search engine

54
01:56.760 --> 01:58.560 align:middle line:90%
and they're searching
for something,

55
01:58.560 --> 02:00.850 align:middle line:90%
saved search can be
turned on or off.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

55
01:58.560 --> 02:00.850 align:middle line:90%
saved search can be
turned on or off.

56
02:00.850 --> 02:02.460 align:middle line:90%
And if we check
this checkbox, it's

57
02:02.460 --> 02:04.860 align:middle line:90%
going to verify that
that user is only

58
02:04.860 --> 02:07.680 align:middle line:90%
allowed to go to search engines
where saved search is enabled.

59
02:07.680 --> 02:10.699 align:middle line:90%
Otherwise, they won't be allowed
to go to that search engine.

60
02:10.699 --> 02:12.590 align:middle line:90%
And again, that can
be enforced by a DNS,

61
02:12.590 --> 02:15.750 align:middle line:90%
because Talos in the cloud
has all that information.

62
02:15.750 --> 02:19.340 align:middle line:90%
The other amazing option here
is under Intelligent Proxy,

63
02:19.340 --> 02:22.110 align:middle line:90%
which you have to have the
proper license to use it.

64
02:22.110 --> 02:23.660 align:middle line:90%
But if we enable
Intelligent Proxy,

65
02:23.660 --> 02:26.840 align:middle line:90%
and we do SSL decryption, and
enable IP layer enforcement,

66
02:26.840 --> 02:27.870 align:middle line:84%
here's what it means.

67
02:27.870 --> 02:28.850 align:middle line:84%
So here's Bob.

68
02:28.850 --> 02:31.880 align:middle line:90%
And Bob is going to be
sending his request either
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:28.850 --> 02:31.880 align:middle line:90%
And Bob is going to be
sending his request either

69
02:31.880 --> 02:35.240 align:middle line:90%
through the local virtual
appliance, which then goes up

70
02:35.240 --> 02:37.322 align:middle line:90%
to the Umbrella
cloud DNS servers.

71
02:37.322 --> 02:38.780 align:middle line:90%
And then we'll get
a response back.

72
02:38.780 --> 02:46.490 align:middle line:90%
Let's imagine that Bob is
going to www.ifffy.com Ifffy,

73
02:46.490 --> 02:47.270 align:middle line:84%
it's Ifffy.

74
02:47.270 --> 02:51.050 align:middle line:90%
Let's imagine that Talos doesn't
know for sure whether that's

75
02:51.050 --> 02:54.530 align:middle line:90%
a malicious site, or based
on our policy for filtering

76
02:54.530 --> 02:56.780 align:middle line:90%
alcohol sites, maybe
it doesn't know yet,

77
02:56.780 --> 02:58.820 align:middle line:90%
or it's not sure what
type of site that is.

78
02:58.820 --> 03:02.150 align:middle line:90%
If Talos is not sure, the
category or the application
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

78
02:58.820 --> 03:02.150 align:middle line:90%
If Talos is not sure, the
category or the application

79
03:02.150 --> 03:04.370 align:middle line:90%
services and so forth that
are associated with this,

80
03:04.370 --> 03:06.590 align:middle line:90%
it can direct Bob so
it builds effectively

81
03:06.590 --> 03:09.583 align:middle line:90%
a TLS session up to the
servers as part of Umbrella.

82
03:09.583 --> 03:11.000 align:middle line:90%
And then what they
can do, they're

83
03:11.000 --> 03:12.500 align:middle line:84%
terminating that TLS session.

84
03:12.500 --> 03:15.020 align:middle line:90%
And then they can make their
own request out to that server.

85
03:15.020 --> 03:17.188 align:middle line:90%
Another benefit is it's
encrypted between--

86
03:17.188 --> 03:18.230 align:middle line:84%
let me change my colors--

87
03:18.230 --> 03:22.070 align:middle line:90%
it's encrypted between here
and here, and here and here.

88
03:22.070 --> 03:23.810 align:middle line:90%
But for a moment in
time, that traffic

89
03:23.810 --> 03:27.240 align:middle line:90%
if it was TLS on both sides,
it's not encrypted right here.

90
03:27.240 --> 03:29.840 align:middle line:90%
And that's what intelligent
proxy, along with SSL

91
03:29.840 --> 03:31.100 align:middle line:84%
decryption is doing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:29.840 --> 03:31.100 align:middle line:84%
decryption is doing.

92
03:31.100 --> 03:33.110 align:middle line:90%
So it involves two
steps proxying, meaning

93
03:33.110 --> 03:35.150 align:middle line:90%
we're doing a proxy
service between Bob

94
03:35.150 --> 03:38.612 align:middle line:90%
and the server he's going to,
and this SSL decryption allows

95
03:38.612 --> 03:40.695 align:middle line:90%
us to go ahead and identify
what's really going on

96
03:40.695 --> 03:43.880 align:middle line:90%
on the application layer so that
the Umbrella cloud server can

97
03:43.880 --> 03:47.060 align:middle line:90%
identify correctly what's going
on at the application layer,

98
03:47.060 --> 03:49.050 align:middle line:90%
and then enforce
policy based on that.

99
03:49.050 --> 03:51.140 align:middle line:90%
So this part right
here does require

100
03:51.140 --> 03:53.480 align:middle line:90%
one of the more advanced
licenses, because it's so cool,

101
03:53.480 --> 03:54.855 align:middle line:90%
because we're not
taking chances.

102
03:54.855 --> 03:56.330 align:middle line:90%
We're erring on
the side of caution

103
03:56.330 --> 03:57.830 align:middle line:90%
by proxying them
up to the cloud,

104
03:57.830 --> 03:59.372 align:middle line:90%
and then down to
that site, and being

105
03:59.372 --> 04:01.790 align:middle line:90%
able to see the details
of what's really going on
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
03:59.372 --> 04:01.790 align:middle line:90%
able to see the details
of what's really going on

106
04:01.790 --> 04:03.690 align:middle line:84%
on the Umbrella servers.

107
04:03.690 --> 04:05.990 align:middle line:90%
And as we continue down
here in this policy,

108
04:05.990 --> 04:08.360 align:middle line:90%
here's a cool option
regarding logging.

109
04:08.360 --> 04:10.700 align:middle line:90%
So do you want to
log all requests?

110
04:10.700 --> 04:13.130 align:middle line:90%
Do you want to log
only security events?

111
04:13.130 --> 04:14.840 align:middle line:90%
Or do you not want
to log any requests?

112
04:14.840 --> 04:17.190 align:middle line:90%
And also, as part of our
security settings right here--

113
04:17.190 --> 04:18.930 align:middle line:84%
let me change that color again--

114
04:18.930 --> 04:20.279 align:middle line:84%
those are also specified.

115
04:20.279 --> 04:22.821 align:middle line:90%
So in this wizard, it's walking
us through all these options.

116
04:22.821 --> 04:24.890 align:middle line:90%
But whatever we specify
here can be overridden

117
04:24.890 --> 04:27.132 align:middle line:90%
by what we select when
we choose the security

118
04:27.132 --> 04:28.340 align:middle line:84%
settings that we want to use.

119
04:28.340 --> 04:30.290 align:middle line:90%
And I think we did
create a custom security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:28.340 --> 04:30.290 align:middle line:90%
And I think we did
create a custom security

120
04:30.290 --> 04:31.500 align:middle line:84%
setting that we can apply.

121
04:31.500 --> 04:34.170 align:middle line:90%
So as we continue with the
wizard, we'll click on Next.

122
04:34.170 --> 04:36.260 align:middle line:90%
So it's showing us here
the categories to block.

123
04:36.260 --> 04:38.820 align:middle line:90%
And this is representing
the security settings.

124
04:38.820 --> 04:40.440 align:middle line:90%
So if we want to
take the default,

125
04:40.440 --> 04:42.530 align:middle line:90%
it has malware, command
and control callbacks,

126
04:42.530 --> 04:43.680 align:middle line:84%
and phishing attacks.

127
04:43.680 --> 04:46.220 align:middle line:90%
But I believe we created
a custom security setting.

128
04:46.220 --> 04:48.980 align:middle line:90%
So we select it right here,
Our Custom Security Setting.

129
04:48.980 --> 04:50.458 align:middle line:84%
We enabled all of them.

130
04:50.458 --> 04:53.000 align:middle line:90%
So here are all of the shields
lit up, indicating all of them

131
04:53.000 --> 04:54.110 align:middle line:84%
are part of this policy.

132
04:54.110 --> 04:55.120 align:middle line:84%
We'll accept that.

133
04:55.120 --> 04:56.030 align:middle line:84%
Click on Next.

134
04:56.030 --> 04:58.588 align:middle line:90%
Now it's asking us
about content access.

135
04:58.588 --> 05:00.380 align:middle line:90%
And that would be this
category right here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
04:58.588 --> 05:00.380 align:middle line:90%
And that would be this
category right here,

136
05:00.380 --> 05:01.790 align:middle line:84%
what URL categories.

137
05:01.790 --> 05:04.290 align:middle line:90%
So we could say high,
moderate, low, or custom.

138
05:04.290 --> 05:06.290 align:middle line:90%
If we say custom, it's
going to go ahead and let

139
05:06.290 --> 05:09.870 align:middle line:90%
us choose our custom content
filtering that we created.

140
05:09.870 --> 05:11.810 align:middle line:90%
And that was over here
under the components.

141
05:11.810 --> 05:13.580 align:middle line:90%
Or if we didn't have one
created and we wanted to say,

142
05:13.580 --> 05:15.680 align:middle line:90%
hi, that just blocks
most of the risky stuff

143
05:15.680 --> 05:16.830 align:middle line:84%
out there on the internet.

144
05:16.830 --> 05:20.210 align:middle line:90%
But because we created the
custom content categories,

145
05:20.210 --> 05:22.280 align:middle line:84%
let's go ahead and select it.

146
05:22.280 --> 05:24.170 align:middle line:90%
And that's just
blocking alcohol.

147
05:24.170 --> 05:25.530 align:middle line:84%
And we'll click on Next.

148
05:25.530 --> 05:27.440 align:middle line:90%
And now this next
section in this wizard

149
05:27.440 --> 05:29.420 align:middle line:90%
is regarding
application settings.

150
05:29.420 --> 05:31.460 align:middle line:90%
So we can use the
defaults, or we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:29.420 --> 05:31.460 align:middle line:90%
So we can use the
defaults, or we

151
05:31.460 --> 05:33.260 align:middle line:90%
can go ahead and use
our custom app setting

152
05:33.260 --> 05:34.980 align:middle line:84%
right here, which we created.

153
05:34.980 --> 05:37.620 align:middle line:90%
And I think we blocked a
whole bunch of drive options.

154
05:37.620 --> 05:41.480 align:middle line:90%
So if we open up cloud storage
by expanding that, sure enough,

155
05:41.480 --> 05:43.460 align:middle line:84%
A drive, Amazon drive.

156
05:43.460 --> 05:45.828 align:middle line:90%
And I guess I could
search for this as well.

157
05:45.828 --> 05:48.120 align:middle line:90%
And sure enough, there's all
the ones that we selected.

158
05:48.120 --> 05:50.180 align:middle line:90%
So we're just going to
pull that from our list,

159
05:50.180 --> 05:50.975 align:middle line:84%
and click on Next.

160
05:50.975 --> 05:53.100 align:middle line:90%
And then it's showing us
the defaults for blocking.

161
05:53.100 --> 05:54.780 align:middle line:84%
This is the destination list.

162
05:54.780 --> 05:56.538 align:middle line:90%
So we created a custom
destination list.

163
05:56.538 --> 05:57.580 align:middle line:84%
And we could just add it.

164
05:57.580 --> 05:59.390 align:middle line:90%
We just put a check
in that box to add it.

165
05:59.390 --> 06:02.030 align:middle line:90%
And now it's part
of our block list.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
05:59.390 --> 06:02.030 align:middle line:90%
And now it's part
of our block list.

166
06:02.030 --> 06:03.710 align:middle line:84%
And we'll click on Next.

167
06:03.710 --> 06:06.380 align:middle line:90%
Then it's going to ask about
additional file analysis, which

168
06:06.380 --> 06:09.080 align:middle line:90%
is using Cisco Advanced
Malware Protection, or AMP.

169
06:09.080 --> 06:09.888 align:middle line:84%
That sounds great.

170
06:09.888 --> 06:10.430 align:middle line:84%
We'll use it.

171
06:10.430 --> 06:11.450 align:middle line:84%
We'll click on Next.

172
06:11.450 --> 06:13.790 align:middle line:90%
And it's asking us about
Block page settings.

173
06:13.790 --> 06:17.120 align:middle line:90%
And because we created a custom
Block page, let's go ahead

174
06:17.120 --> 06:19.360 align:middle line:84%
and we'll choose it right here.

175
06:19.360 --> 06:21.110 align:middle line:90%
So in this wizard, we
have the opportunity

176
06:21.110 --> 06:23.098 align:middle line:90%
to modify, and
create, and tweak.

177
06:23.098 --> 06:25.640 align:middle line:90%
So whether we want to create
the policy components beforehand

178
06:25.640 --> 06:27.260 align:middle line:90%
or do it during,
either way is great.

179
06:27.260 --> 06:29.960 align:middle line:90%
But the goal would be to
implement the policy that's

180
06:29.960 --> 06:31.900 align:middle line:84%
intended by your organization.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
06:29.960 --> 06:31.900 align:middle line:84%
intended by your organization.

181
06:31.900 --> 06:33.650 align:middle line:90%
So we'll go ahead and
use our custom Block

182
06:33.650 --> 06:37.682 align:middle line:90%
page, click on Next, and
then we'll give it a name.

183
06:37.682 --> 06:39.140 align:middle line:90%
So we'll call it
our custom policy.

184
06:39.140 --> 06:40.995 align:middle line:84%
And here is an overview of it.

185
06:40.995 --> 06:42.620 align:middle line:90%
So under the identities,
we haven't yet

186
06:42.620 --> 06:45.620 align:middle line:90%
applied this to any
identity in our environment.

187
06:45.620 --> 06:47.730 align:middle line:84%
We'll do that in the next video.

188
06:47.730 --> 06:50.930 align:middle line:90%
So for our custom policy,
we're using our custom settings

189
06:50.930 --> 06:52.610 align:middle line:84%
regarding security settings.

190
06:52.610 --> 06:56.120 align:middle line:90%
We're using our custom content
filtering, which is right here.

191
06:56.120 --> 06:57.980 align:middle line:90%
For application
filtering and settings,

192
06:57.980 --> 07:00.950 align:middle line:90%
we're using our application
settings we created.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

192
06:57.980 --> 07:00.950 align:middle line:90%
we're using our application
settings we created.

193
07:00.950 --> 07:02.570 align:middle line:90%
For the destination
lists, we actually

194
07:02.570 --> 07:04.730 align:middle line:90%
created one additional
destination list

195
07:04.730 --> 07:06.240 align:middle line:84%
for that one domain.

196
07:06.240 --> 07:07.790 align:middle line:84%
So that bad boy is right there.

197
07:07.790 --> 07:09.170 align:middle line:84%
We modified the Block page.

198
07:09.170 --> 07:11.630 align:middle line:90%
And we also enabled
file analysis.

199
07:11.630 --> 07:13.855 align:middle line:90%
Also, here if we click
on Advanced Settings,

200
07:13.855 --> 07:15.980 align:middle line:90%
here we have the options
for the intelligent proxy,

201
07:15.980 --> 07:17.810 align:middle line:90%
whether or not we ought to
enable the SSL decryption.

202
07:17.810 --> 07:19.490 align:middle line:90%
So if we made some
decisions earlier,

203
07:19.490 --> 07:20.750 align:middle line:84%
we could change it here.

204
07:20.750 --> 07:22.070 align:middle line:90%
And also here in
under Policy Settings,

205
07:22.070 --> 07:23.480 align:middle line:90%
we have the options,
once again, for logging.

206
07:23.480 --> 07:25.188 align:middle line:90%
Logging everything,
logging only security

207
07:25.188 --> 07:27.210 align:middle line:90%
events, or don't
log any requests.

208
07:27.210 --> 07:29.240 align:middle line:90%
So let's go ahead
and click on Save.

209
07:29.240 --> 07:31.602 align:middle line:90%
And now we have our
custom policy first,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

209
07:29.240 --> 07:31.602 align:middle line:90%
And now we have our
custom policy first,

210
07:31.602 --> 07:33.560 align:middle line:90%
which is not going to
match on anybody until we

211
07:33.560 --> 07:35.370 align:middle line:90%
tell it to, which we'll
do in the next video.

212
07:35.370 --> 07:37.850 align:middle line:90%
And then following that, we
have the default policy, which

213
07:37.850 --> 07:39.192 align:middle line:84%
we'll match on everybody else.

214
07:39.192 --> 07:41.150 align:middle line:90%
So we definitely want to
have our custom policy

215
07:41.150 --> 07:44.310 align:middle line:90%
match on at least one identity
so we can actually test it.

216
07:44.310 --> 07:46.590 align:middle line:90%
So in the next video, that's
exactly what we'll do.

217
07:46.590 --> 07:48.990 align:middle line:90%
So I'll walk you through that
process in just a moment.

218
07:48.990 --> 07:51.260 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

219
07:51.260 --> 07:54.550 align:middle line:90%
And I'd like to thank
you for viewing.