WEBVTT

1
00:00.000 --> 00:00.500 align:middle line:84%


2
00:00.500 --> 00:03.900 align:middle line:90%
Now that we have a basic idea
of how outbreak control really

3
00:03.900 --> 00:06.070 align:middle line:90%
works, what is it trying
to do in the first place,

4
00:06.070 --> 00:07.800 align:middle line:90%
and how do we get
started with it,

5
00:07.800 --> 00:10.080 align:middle line:90%
we can now explore some
of the other features that

6
00:10.080 --> 00:11.380 align:middle line:84%
come with outbreak control.

7
00:11.380 --> 00:13.500 align:middle line:90%
We really get the
gist of it, that this

8
00:13.500 --> 00:16.950 align:middle line:90%
is just what we're permitting or
denying within our environment

9
00:16.950 --> 00:20.100 align:middle line:90%
outside of what also the
AMP Cloud is pushing down

10
00:20.100 --> 00:20.790 align:middle line:84%
to our endpoint.

11
00:20.790 --> 00:21.610 align:middle line:84%
It's so cool.

12
00:21.610 --> 00:23.730 align:middle line:90%
I love that we can
explore this technology.

13
00:23.730 --> 00:26.340 align:middle line:90%
Let's check out some of the
more advanced features of AMP

14
00:26.340 --> 00:28.170 align:middle line:84%
for Endpoints Outbreak Control.

15
00:28.170 --> 00:31.440 align:middle line:90%
So in the previous Nugget, we
introduced the simple outbreak
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:28.170 --> 00:31.440 align:middle line:90%
So in the previous Nugget, we
introduced the simple outbreak

16
00:31.440 --> 00:32.338 align:middle line:84%
control mechanism.

17
00:32.338 --> 00:33.630 align:middle line:84%
There wasn't much to it, right?

18
00:33.630 --> 00:37.350 align:middle line:90%
We simply upload a file
into a new outbreak control

19
00:37.350 --> 00:38.370 align:middle line:84%
configuration.

20
00:38.370 --> 00:40.650 align:middle line:90%
And next thing we know,
AMP is handling it for us.

21
00:40.650 --> 00:43.560 align:middle line:90%
But there's other ways
that we can control what

22
00:43.560 --> 00:44.760 align:middle line:84%
goes on in our environment.

23
00:44.760 --> 00:47.530 align:middle line:90%
It's not necessarily
just a hash of a file.

24
00:47.530 --> 00:50.340 align:middle line:90%
Let's explore the other
outbreak control mechanisms

25
00:50.340 --> 00:51.780 align:middle line:84%
that we can work with here.

26
00:51.780 --> 00:53.850 align:middle line:90%
If I go back to the
Outbreak Control section

27
00:53.850 --> 00:55.225 align:middle line:90%
and click the
little dropdown, we

28
00:55.225 --> 00:57.390 align:middle line:90%
can see we've got
some other options.

29
00:57.390 --> 01:00.750 align:middle line:90%
We have the Advanced
Outbreak Control, as well as
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:57.390 --> 01:00.750 align:middle line:90%
We have the Advanced
Outbreak Control, as well as

30
01:00.750 --> 01:03.750 align:middle line:90%
Outbreak Control that are
specific to Android devices.

31
01:03.750 --> 01:05.850 align:middle line:90%
These are tablets
and cell phones.

32
01:05.850 --> 01:07.860 align:middle line:90%
Beyond that, we
have applications

33
01:07.860 --> 01:11.430 align:middle line:90%
that we can explicitly
permit or explicitly block.

34
01:11.430 --> 01:12.720 align:middle line:84%
Now let me explain this.

35
01:12.720 --> 01:16.770 align:middle line:90%
The applications are the
dot exe or executable files.

36
01:16.770 --> 01:18.930 align:middle line:90%
These aren't going
to be like layer five

37
01:18.930 --> 01:21.020 align:middle line:90%
through layer seven
network information.

38
01:21.020 --> 01:23.520 align:middle line:90%
We're not blocking websites or
Netflix or anything like that

39
01:23.520 --> 01:24.020 align:middle line:84%
here.

40
01:24.020 --> 01:27.390 align:middle line:90%
We're blocking explicitly
executable applications.

41
01:27.390 --> 01:32.440 align:middle line:90%
But we do have IP addresses that
we can block and allow as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:27.390 --> 01:32.440 align:middle line:90%
But we do have IP addresses that
we can block and allow as well.

42
01:32.440 --> 01:35.100 align:middle line:90%
So again, with all of these
items that we configure,

43
01:35.100 --> 01:39.960 align:middle line:90%
this pushes these informations
down to the endpoint devices

44
01:39.960 --> 01:43.140 align:middle line:90%
once they're associated
with a policy.

45
01:43.140 --> 01:47.220 align:middle line:90%
This is just setting up lists
of things to accept or block.

46
01:47.220 --> 01:51.270 align:middle line:90%
But they don't take effect until
we push it down via a policy.

47
01:51.270 --> 01:53.040 align:middle line:90%
Let's explore something
like the blocked

48
01:53.040 --> 01:54.660 align:middle line:84%
applications for a second.

49
01:54.660 --> 01:57.450 align:middle line:90%
Here, we can outline
more applications

50
01:57.450 --> 01:59.520 align:middle line:84%
that we want to allow or block.

51
01:59.520 --> 02:01.680 align:middle line:84%
I like this one here like putty.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.520 --> 02:01.680 align:middle line:84%
I like this one here like putty.

52
02:01.680 --> 02:03.870 align:middle line:90%
We may only want
our network admins

53
02:03.870 --> 02:05.790 align:middle line:84%
to be able to launch putty.

54
02:05.790 --> 02:08.250 align:middle line:90%
And everybody else,
like end users,

55
02:08.250 --> 02:11.710 align:middle line:90%
should not be able to launch
the putty executable file.

56
02:11.710 --> 02:14.370 align:middle line:90%
If I click on Edit here,
we can see how this works.

57
02:14.370 --> 02:17.190 align:middle line:90%
Well, it looks just pretty much
the exact same way as before,

58
02:17.190 --> 02:17.820 align:middle line:84%
doesn't it?

59
02:17.820 --> 02:18.870 align:middle line:84%
Yeah, exactly.

60
02:18.870 --> 02:21.510 align:middle line:90%
In this case, what we're
saying is the applications,

61
02:21.510 --> 02:24.030 align:middle line:90%
we upload the
executable file itself.

62
02:24.030 --> 02:27.660 align:middle line:90%
It creates the hash of
the file right here.

63
02:27.660 --> 02:30.120 align:middle line:90%
And on our end points
where this file
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:27.660 --> 02:30.120 align:middle line:90%
And on our end points
where this file

64
02:30.120 --> 02:34.140 align:middle line:90%
has been blocked via a
policy, if it detects

65
02:34.140 --> 02:37.860 align:middle line:90%
this hash trying to execute, AMP
will stop that from happening.

66
02:37.860 --> 02:39.990 align:middle line:90%
Some other very cool
things that come

67
02:39.990 --> 02:42.550 align:middle line:90%
from clicking on this
little files included here,

68
02:42.550 --> 02:47.040 align:middle line:90%
we can analyze the file as well
as see what kind of trajectory

69
02:47.040 --> 02:50.220 align:middle line:90%
it takes when it's launched
within an environment.

70
02:50.220 --> 02:51.630 align:middle line:90%
We can actually
see, what does it

71
02:51.630 --> 02:54.240 align:middle line:90%
try to do within
the operating system

72
02:54.240 --> 02:56.670 align:middle line:90%
as well as within the
environment itself?

73
02:56.670 --> 02:58.740 align:middle line:90%
Beyond that, we
can add this file

74
02:58.740 --> 03:00.900 align:middle line:90%
to other items like
simple detections,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:58.740 --> 03:00.900 align:middle line:90%
to other items like
simple detections,

75
03:00.900 --> 03:03.120 align:middle line:90%
allowed applications,
or blocked applications.

76
03:03.120 --> 03:05.160 align:middle line:90%
We can do all of that
from right here as well.

77
03:05.160 --> 03:07.500 align:middle line:90%
See, if I hover over
allowed applications,

78
03:07.500 --> 03:10.320 align:middle line:90%
I can choose to add this file
to a different global app

79
03:10.320 --> 03:11.760 align:middle line:84%
whitelist or so on.

80
03:11.760 --> 03:14.290 align:middle line:90%
So maybe in my
blocked applications,

81
03:14.290 --> 03:16.050 align:middle line:90%
I have the putty
application here.

82
03:16.050 --> 03:19.080 align:middle line:90%
I want to attach that
to my end user policy.

83
03:19.080 --> 03:21.060 align:middle line:90%
But in the allowed
applications, I

84
03:21.060 --> 03:23.700 align:middle line:90%
may want to put that on
my security app whitelist

85
03:23.700 --> 03:26.280 align:middle line:90%
and push that down
to my domain admins.

86
03:26.280 --> 03:27.820 align:middle line:84%
That's how this works.

87
03:27.820 --> 03:29.790 align:middle line:90%
Beyond that, Threat
Grid and Umbrella,

88
03:29.790 --> 03:31.890 align:middle line:90%
give us ways that we
can view or browse
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:29.790 --> 03:31.890 align:middle line:90%
give us ways that we
can view or browse

89
03:31.890 --> 03:35.230 align:middle line:90%
what this program does
from a global standpoint.

90
03:35.230 --> 03:39.060 align:middle line:90%
We can see other analyses
using Cisco products of what

91
03:39.060 --> 03:40.690 align:middle line:84%
this application is doing.

92
03:40.690 --> 03:42.660 align:middle line:90%
So that's the
application controls.

93
03:42.660 --> 03:46.260 align:middle line:90%
Let's also glance real quick at
the IP Block and Allow lists.

94
03:46.260 --> 03:48.540 align:middle line:90%
If I choose the
IP blacklist here,

95
03:48.540 --> 03:50.740 align:middle line:90%
you can see it's
pretty straightforward.

96
03:50.740 --> 03:54.180 align:middle line:90%
We specify a exact
IP address, or we

97
03:54.180 --> 03:55.870 align:middle line:84%
could specify a CIDR block.

98
03:55.870 --> 04:00.480 align:middle line:90%
So this could be
like 10.10.10.0/24.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:55.870 --> 04:00.480 align:middle line:90%
So this could be
like 10.10.10.0/24.

99
04:00.480 --> 04:02.820 align:middle line:90%
And we can specify
what groups of users

100
04:02.820 --> 04:06.060 align:middle line:90%
or which policies
need to have this.

101
04:06.060 --> 04:08.910 align:middle line:90%
So I see here I have a
domain controller policy.

102
04:08.910 --> 04:10.930 align:middle line:90%
It's got the little
Windows symbol here.

103
04:10.930 --> 04:13.380 align:middle line:90%
And since this is
in the IP blacklist,

104
04:13.380 --> 04:16.950 align:middle line:90%
I assume that my domain
controllers cannot access

105
04:16.950 --> 04:18.810 align:middle line:84%
the host 20.20.20.20.

106
04:18.810 --> 04:21.269 align:middle line:90%
The flip side of that is
I have an IP whitelist.

107
04:21.269 --> 04:24.780 align:middle line:90%
And I see the CIDR blocks
listed here as whitelist.

108
04:24.780 --> 04:27.090 align:middle line:90%
So my domain
controllers would be

109
04:27.090 --> 04:30.950 align:middle line:90%
able to access these specific
IPs or these CIDR notation
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
04:27.090 --> 04:30.950 align:middle line:90%
able to access these specific
IPs or these CIDR notation

110
04:30.950 --> 04:31.450 align:middle line:84%
blocks.

111
04:31.450 --> 04:33.940 align:middle line:90%
There's that 10.10.10.0/24
I had mentioned earlier.

112
04:33.940 --> 04:36.540 align:middle line:90%
So the key takeaway here
is that outbreak control

113
04:36.540 --> 04:38.530 align:middle line:90%
comes in many different
shapes and sizes.

114
04:38.530 --> 04:42.480 align:middle line:90%
We can specify a simple outbreak
control where we upload a file.

115
04:42.480 --> 04:45.690 align:middle line:90%
We can do the applications
themselves and then

116
04:45.690 --> 04:48.930 align:middle line:90%
permit or deny applications
based on which policy

117
04:48.930 --> 04:50.050 align:middle line:84%
they're attached to.

118
04:50.050 --> 04:54.210 align:middle line:90%
And same goes for specific
IP addresses or CIDR notated

119
04:54.210 --> 04:56.380 align:middle line:84%
blocks of IP addresses too.

120
04:56.380 --> 04:58.320 align:middle line:90%
So that's been using
and understanding

121
04:58.320 --> 04:59.972 align:middle line:90%
all of the outbreak
control features.

122
04:59.972 --> 05:01.680 align:middle line:90%
I hope this has been
informative for you,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:59.972 --> 05:01.680 align:middle line:90%
I hope this has been
informative for you,

123
05:01.680 --> 05:04.100 align:middle line:90%
and I'd like to thank
you for viewing.