WEBVTT

1
00:00.000 --> 00:00.385 align:middle line:84%


2
00:00.385 --> 00:01.760 align:middle line:90%
In every environment,
we're going

3
00:01.760 --> 00:04.490 align:middle line:90%
to have lots of devices that
are connecting to our network.

4
00:04.490 --> 00:05.780 align:middle line:84%
Some are mobile devices.

5
00:05.780 --> 00:08.060 align:middle line:90%
Some are, like, laptops
and roaming devices.

6
00:08.060 --> 00:10.580 align:middle line:90%
Others may be desktops,
Internet of Things, et cetera.

7
00:10.580 --> 00:12.830 align:middle line:90%
So in this video, I'd like
to share with you about why

8
00:12.830 --> 00:15.770 align:middle line:90%
it's so darn important when
we have the option to do so,

9
00:15.770 --> 00:18.930 align:middle line:90%
to implement endpoint
security on our devices.

10
00:18.930 --> 00:21.020 align:middle line:90%
So let's imagine we
have our end user at one

11
00:21.020 --> 00:22.220 align:middle line:84%
of these machines over here.

12
00:22.220 --> 00:23.810 align:middle line:84%
We'll call that end user Bob.

13
00:23.810 --> 00:26.840 align:middle line:90%
Now, hopefully, we've done
some things beforehand

14
00:26.840 --> 00:28.580 align:middle line:90%
to help make our
network more secure,

15
00:28.580 --> 00:32.030 align:middle line:90%
including training, so that
Bob is aware of what a phishing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:28.580 --> 00:32.030 align:middle line:90%
including training, so that
Bob is aware of what a phishing

16
00:32.030 --> 00:34.640 align:middle line:90%
attack looks like, and also
aware of social engineering

17
00:34.640 --> 00:37.640 align:middle line:90%
and good practices, for example,
locking their screen when

18
00:37.640 --> 00:39.830 align:middle line:90%
they're not at their
computer, and so forth.

19
00:39.830 --> 00:41.600 align:middle line:90%
Also in our
environment, we may have

20
00:41.600 --> 00:43.610 align:middle line:90%
put between Bob and
the rest of the world,

21
00:43.610 --> 00:46.880 align:middle line:90%
we may have email security
appliances or web security

22
00:46.880 --> 00:50.270 align:middle line:90%
appliances, which could be
either on-prem or services up

23
00:50.270 --> 00:50.993 align:middle line:84%
in the cloud.

24
00:50.993 --> 00:52.910 align:middle line:90%
We're probably doing
some protection regarding

25
00:52.910 --> 00:54.433 align:middle line:84%
DNS with Cisco Umbrella.

26
00:54.433 --> 00:55.850 align:middle line:90%
And at the edge
of our network, we

27
00:55.850 --> 00:58.520 align:middle line:90%
might have some next-generation
firewall services

28
00:58.520 --> 01:01.460 align:middle line:90%
with next-generation IPS
looking for malicious traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:58.520 --> 01:01.460 align:middle line:90%
with next-generation IPS
looking for malicious traffic

29
01:01.460 --> 01:03.320 align:middle line:90%
and controlling
what can go through,

30
01:03.320 --> 01:06.200 align:middle line:90%
including application
visibility and control

31
01:06.200 --> 01:07.610 align:middle line:84%
to enforce our policy.

32
01:07.610 --> 01:09.590 align:middle line:90%
But at the end of
the day, we still

33
01:09.590 --> 01:12.740 align:middle line:90%
want on these computers that
are end users are using,

34
01:12.740 --> 01:14.840 align:middle line:90%
we still want to have
some endpoint security

35
01:14.840 --> 01:17.810 align:middle line:90%
at those devices because
there may be attacks.

36
01:17.810 --> 01:19.760 align:middle line:90%
Maybe somebody
compromises the building

37
01:19.760 --> 01:21.710 align:middle line:90%
and they get on
that local device.

38
01:21.710 --> 01:24.530 align:middle line:90%
We want to make sure we have
information at that device.

39
01:24.530 --> 01:27.110 align:middle line:90%
Or if our security appliances
didn't pick up on something,

40
01:27.110 --> 01:28.970 align:middle line:90%
we want to get alerts
and notifications

41
01:28.970 --> 01:30.710 align:middle line:90%
if something
malicious or abnormal
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:28.970 --> 01:30.710 align:middle line:90%
if something
malicious or abnormal

42
01:30.710 --> 01:32.553 align:middle line:84%
is happening at the computer.

43
01:32.553 --> 01:34.220 align:middle line:90%
And when we implement
endpoint security,

44
01:34.220 --> 01:35.762 align:middle line:90%
we're not just
improving the security

45
01:35.762 --> 01:37.820 align:middle line:90%
of our overall network,
we also may be doing it

46
01:37.820 --> 01:41.150 align:middle line:90%
for our compliance reasons or
as part of our risk management

47
01:41.150 --> 01:42.050 align:middle line:84%
strategy.

48
01:42.050 --> 01:44.030 align:middle line:90%
Because in a layered
approach, we're

49
01:44.030 --> 01:46.820 align:middle line:90%
less likely to be compromised
if we're doing multiple checks,

50
01:46.820 --> 01:49.880 align:middle line:90%
for example, with all these
devices, with these devices,

51
01:49.880 --> 01:51.592 align:middle line:84%
and at the end station.

52
01:51.592 --> 01:53.300 align:middle line:90%
So we might ask, what
are some techniques

53
01:53.300 --> 01:55.675 align:middle line:90%
we could use to help improve
the security of this device?

54
01:55.675 --> 01:57.950 align:middle line:90%
Well, we'd want to have some
anti-malware or antivirus

55
01:57.950 --> 01:59.510 align:middle line:84%
software on that system.

56
01:59.510 --> 02:02.630 align:middle line:90%
With Cisco, we have AMP, the
Advanced Malware Protection.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
01:59.510 --> 02:02.630 align:middle line:90%
With Cisco, we have AMP, the
Advanced Malware Protection.

57
02:02.630 --> 02:04.970 align:middle line:90%
We'd also want to make sure
that the definitions were

58
02:04.970 --> 02:06.920 align:middle line:84%
being updated periodically.

59
02:06.920 --> 02:09.440 align:middle line:90%
We'd also want to make
sure we have limited rights

60
02:09.440 --> 02:10.470 align:middle line:84%
at that computer.

61
02:10.470 --> 02:13.240 align:middle line:90%
So if Bob logs in, Bob's got
the ability to do his job.

62
02:13.240 --> 02:14.150 align:middle line:84%
But he does not--

63
02:14.150 --> 02:17.900 align:middle line:90%
I repeat, does not-- have
admin rights on this computer.

64
02:17.900 --> 02:20.690 align:middle line:90%
And in addition, before we
let a computer on the network,

65
02:20.690 --> 02:23.090 align:middle line:90%
we also might want to go
ahead and check their posture.

66
02:23.090 --> 02:25.040 align:middle line:90%
Now, posturing is a
fancy way of saying,

67
02:25.040 --> 02:26.960 align:middle line:90%
let's check this
machine out, make

68
02:26.960 --> 02:28.790 align:middle line:90%
sure it meets our
minimum requirements--

69
02:28.790 --> 02:31.700 align:middle line:90%
minimum requirements
regarding the OS-build.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
02:28.790 --> 02:31.700 align:middle line:90%
minimum requirements
regarding the OS-build.

70
02:31.700 --> 02:33.200 align:middle line:90%
Maybe there's a
patch from Microsoft

71
02:33.200 --> 02:35.900 align:middle line:90%
that we want to make sure
is in place, or a hotfix.

72
02:35.900 --> 02:39.210 align:middle line:90%
Or maybe we want to
verify that the antivirus,

73
02:39.210 --> 02:42.890 align:middle line:90%
anti-malware software has been
updated within a certain number

74
02:42.890 --> 02:44.510 align:middle line:84%
of days and is fairly current.

75
02:44.510 --> 02:47.810 align:middle line:90%
Or maybe we want to look in the
registry for a certain entry.

76
02:47.810 --> 02:50.690 align:middle line:90%
Or we want to look for a certain
file in a certain location

77
02:50.690 --> 02:52.430 align:middle line:90%
to verify this is
one of our machines

78
02:52.430 --> 02:53.840 align:middle line:84%
before we let it on the network.

79
02:53.840 --> 02:56.570 align:middle line:90%
And the big part of implementing
that is having an agent that

80
02:56.570 --> 02:59.900 align:middle line:90%
can run on this device, either
permanently or temporarily,

81
02:59.900 --> 03:02.360 align:middle line:90%
and then have some type
of a central server that's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
02:59.900 --> 03:02.360 align:middle line:90%
and then have some type
of a central server that's

82
03:02.360 --> 03:04.910 align:middle line:90%
being checked with
to verify that device

83
03:04.910 --> 03:06.620 align:middle line:84%
has those installed components.

84
03:06.620 --> 03:08.570 align:middle line:90%
And one of the most
popular ways of doing that

85
03:08.570 --> 03:10.938 align:middle line:84%
is to use AnyConnect from Cisco.

86
03:10.938 --> 03:12.230 align:middle line:84%
And you might think AnyConnect?

87
03:12.230 --> 03:13.700 align:middle line:90%
Isn't that like
the VPN software?

88
03:13.700 --> 03:16.020 align:middle line:90%
Well, AnyConnect has a
whole bunch of modules,

89
03:16.020 --> 03:18.890 align:middle line:90%
including a posture
module that when

90
03:18.890 --> 03:21.140 align:middle line:90%
it's running on this machine
can interrogate and look

91
03:21.140 --> 03:23.510 align:middle line:90%
for certain versions
of OS, or look

92
03:23.510 --> 03:26.330 align:middle line:90%
for certain versions of
antivirus and updates,

93
03:26.330 --> 03:28.160 align:middle line:90%
or look for certain
entries in the registry

94
03:28.160 --> 03:29.330 align:middle line:84%
or for a certain file.

95
03:29.330 --> 03:31.760 align:middle line:90%
And then based on meeting
those requirements,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
03:29.330 --> 03:31.760 align:middle line:90%
And then based on meeting
those requirements,

96
03:31.760 --> 03:33.498 align:middle line:90%
the system can be
allowed on the network.

97
03:33.498 --> 03:35.540 align:middle line:90%
Or if they don't meet
those posture requirements,

98
03:35.540 --> 03:36.620 align:middle line:84%
we can quarantine them.

99
03:36.620 --> 03:38.390 align:middle line:90%
We can not give
them full access.

100
03:38.390 --> 03:41.300 align:middle line:90%
We can give them partial access
so they can correct or remedy

101
03:41.300 --> 03:43.160 align:middle line:90%
the problem that they
currently have before

102
03:43.160 --> 03:44.490 align:middle line:84%
giving them full access.

103
03:44.490 --> 03:47.300 align:middle line:90%
So the AnyConnect client is a
very popular way of doing that.

104
03:47.300 --> 03:49.700 align:middle line:90%
It can also act as
802.1x supplicant,

105
03:49.700 --> 03:51.300 align:middle line:84%
which is convenient as well.

106
03:51.300 --> 03:52.850 align:middle line:90%
And then for the
server, we're going

107
03:52.850 --> 03:55.703 align:middle line:90%
to use ISE, the Identity
Services Engine, which

108
03:55.703 --> 03:56.620 align:middle line:84%
we'll talk more about.

109
03:56.620 --> 03:57.770 align:middle line:90%
And I'll give you
an example of that

110
03:57.770 --> 04:00.053 align:middle line:90%
as we continue going
through this set of videos.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:57.770 --> 04:00.053 align:middle line:90%
as we continue going
through this set of videos.

111
04:00.053 --> 04:01.970 align:middle line:90%
Now, one of the tricky
aspects of implementing

112
04:01.970 --> 04:04.190 align:middle line:90%
good security, especially
for mobile devices,

113
04:04.190 --> 04:06.133 align:middle line:90%
is to have a good
inventory of what

114
04:06.133 --> 04:08.300 align:middle line:90%
is connecting to our network,
what are the operating

115
04:08.300 --> 04:09.620 align:middle line:84%
systems that are running?

116
04:09.620 --> 04:12.140 align:middle line:90%
And then once we know that, how
do we control those devices?

117
04:12.140 --> 04:14.098 align:middle line:90%
And that's going to be
done through some really

118
04:14.098 --> 04:16.490 align:middle line:90%
effective mobile device
management strategy.

119
04:16.490 --> 04:18.839 align:middle line:90%
And we'll take a closer look
at that in the next video.

120
04:18.839 --> 04:20.563 align:middle line:90%
So I'll see you there
in just a moment.

121
04:20.563 --> 04:22.730 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

122
04:22.730 --> 04:26.110 align:middle line:90%
And I'd like to thank
you for viewing.