WEBVTT

1
00:00.000 --> 00:01.270 align:middle line:84%


2
00:01.270 --> 00:03.520 align:middle line:90%
More and more today,
we want to take steps

3
00:03.520 --> 00:05.770 align:middle line:90%
to secure our
networks, including

4
00:05.770 --> 00:07.610 align:middle line:84%
the access into those networks.

5
00:07.610 --> 00:11.380 align:middle line:90%
And one of the options of doing
that is multi- authentication,

6
00:11.380 --> 00:13.700 align:middle line:90%
and that's what this
video is all about.

7
00:13.700 --> 00:16.690 align:middle line:90%
So as we discuss authentication,
the basic premise

8
00:16.690 --> 00:18.730 align:middle line:90%
of general authentication
is finding out

9
00:18.730 --> 00:22.700 align:middle line:90%
that Bob, really is Bob, when
he's connecting to the network.

10
00:22.700 --> 00:25.840 align:middle line:90%
And so for a long, long time,
we use the username, like,

11
00:25.840 --> 00:28.090 align:middle line:90%
username of Bob and a
password combination.

12
00:28.090 --> 00:30.100 align:middle line:90%
And that is something
that Bob knows.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

12
00:28.090 --> 00:30.100 align:middle line:90%
And that is something
that Bob knows.

13
00:30.100 --> 00:32.350 align:middle line:90%
And so to log on the
computer, he logs on.

14
00:32.350 --> 00:34.270 align:middle line:90%
And with single sign
on, then he has access--

15
00:34.270 --> 00:36.130 align:middle line:90%
if we're in Microsoft
Active Directory--

16
00:36.130 --> 00:38.530 align:middle line:90%
Bob's then got access
to all those resources

17
00:38.530 --> 00:41.380 align:middle line:90%
inside of Active Directory,
which he is entitled

18
00:41.380 --> 00:42.760 align:middle line:84%
to through authorization.

19
00:42.760 --> 00:45.490 align:middle line:90%
In addition, whether a
device is wireless or wired,

20
00:45.490 --> 00:48.460 align:middle line:90%
another way of authenticating
user at the network is use

21
00:48.460 --> 00:53.620 align:middle line:90%
802.1x, which would have
a supplicant running

22
00:53.620 --> 00:54.250 align:middle line:84%
on the client.

23
00:54.250 --> 00:56.500 align:middle line:90%
An example of a great
supplicant in the world of Cisco

24
00:56.500 --> 00:57.370 align:middle line:84%
is AnyConnect.

25
00:57.370 --> 00:59.170 align:middle line:90%
So AnyConnect is,
like, does it all,

26
00:59.170 --> 01:01.960 align:middle line:90%
AnyConnect is like
the VPN component.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:59.170 --> 01:01.960 align:middle line:90%
AnyConnect is like
the VPN component.

27
01:01.960 --> 01:04.150 align:middle line:90%
AnyConnect can be
used for posturing

28
01:04.150 --> 01:07.420 align:middle line:90%
if we're doing posturing with
an Identity Services Engine.

29
01:07.420 --> 01:09.910 align:middle line:90%
And it can also act as
a supplicant running

30
01:09.910 --> 01:13.150 align:middle line:90%
on the computer that's going to
provide the credentials of Bob

31
01:13.150 --> 01:14.900 align:middle line:84%
to get access into the network.

32
01:14.900 --> 01:16.510 align:middle line:90%
So if AnyConnect
is the supplicant

33
01:16.510 --> 01:19.060 align:middle line:90%
and we're doing authentication
at the switch port,

34
01:19.060 --> 01:20.830 align:middle line:90%
the switch would be
the authenticator.

35
01:20.830 --> 01:25.240 align:middle line:90%
And then the AAA server would
be the authentication server.

36
01:25.240 --> 01:27.190 align:middle line:90%
And when we're
authenticating end users,

37
01:27.190 --> 01:29.530 align:middle line:90%
that's generally
going to use RADIUS

38
01:29.530 --> 01:31.480 align:middle line:90%
between the switch,
the authenticator,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

38
01:29.530 --> 01:31.480 align:middle line:90%
between the switch,
the authenticator,

39
01:31.480 --> 01:32.993 align:middle line:84%
and the authentication server.

40
01:32.993 --> 01:34.660 align:middle line:90%
In this case, our
authentication server,

41
01:34.660 --> 01:36.850 align:middle line:90%
again, is going to be
Identity Services Engine.

42
01:36.850 --> 01:40.390 align:middle line:90%
But what if we have a device
that doesn't have a supplicant

43
01:40.390 --> 01:42.730 align:middle line:90%
and we still want to
identify who they are?

44
01:42.730 --> 01:45.850 align:middle line:90%
Another option that we can
use is web authentication.

45
01:45.850 --> 01:47.860 align:middle line:90%
And here's the basics
for web authentication.

46
01:47.860 --> 01:49.652 align:middle line:90%
When the computer
connects into the network

47
01:49.652 --> 01:53.410 align:middle line:90%
or tries to, we give them some
very basic functionality, like,

48
01:53.410 --> 01:54.170 align:middle line:84%
DHCP--

49
01:54.170 --> 01:56.750 align:middle line:90%
if they're a DHCP client,
they're going to need that--

50
01:56.750 --> 01:59.230 align:middle line:90%
and the services of DNS
so they can resolve a name

51
01:59.230 --> 02:00.250 align:middle line:84%
to an IP address.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:59.230 --> 02:00.250 align:middle line:84%
to an IP address.

52
02:00.250 --> 02:03.280 align:middle line:90%
But before we allow that
traffic from that port

53
02:03.280 --> 02:05.050 align:middle line:90%
just to do anything
they want to,

54
02:05.050 --> 02:08.020 align:middle line:90%
we're going to go ahead
and redirect them over

55
02:08.020 --> 02:09.160 align:middle line:84%
to a web page.

56
02:09.160 --> 02:11.230 align:middle line:90%
And that web page is
then going to prompt

57
02:11.230 --> 02:13.960 align:middle line:90%
them to log in if
that web page is

58
02:13.960 --> 02:15.950 align:middle line:90%
on a local device
on that network.

59
02:15.950 --> 02:18.245 align:middle line:90%
Maybe it's a wireless LAN
controller, for example,

60
02:18.245 --> 02:20.620 align:middle line:90%
and that's the web page they're
using for authentication.

61
02:20.620 --> 02:22.480 align:middle line:90%
That would be
referred to as local.

62
02:22.480 --> 02:25.360 align:middle line:90%
Or if the client is
redirected to an ISE server,

63
02:25.360 --> 02:28.450 align:middle line:90%
that would be referred to as
central web authentication.

64
02:28.450 --> 02:30.670 align:middle line:90%
But in either case,
were stopping the client
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.450 --> 02:30.670 align:middle line:90%
But in either case,
were stopping the client

65
02:30.670 --> 02:32.830 align:middle line:90%
with a browser
interface before they're

66
02:32.830 --> 02:34.660 align:middle line:90%
allowed to go any
further in the network

67
02:34.660 --> 02:36.670 align:middle line:90%
to put in the credentials
of who they are.

68
02:36.670 --> 02:39.220 align:middle line:90%
Maybe it's a guest user account
that they've been assigned,

69
02:39.220 --> 02:41.980 align:middle line:90%
or if they're Active Directory
credentials, which ISE is then

70
02:41.980 --> 02:43.390 align:middle line:84%
tied into on the back end.

71
02:43.390 --> 02:46.210 align:middle line:90%
But the key here is that
authentication is critical

72
02:46.210 --> 02:49.750 align:middle line:90%
so we know who the entity
is behind the computer

73
02:49.750 --> 02:51.130 align:middle line:84%
or the networking device.

74
02:51.130 --> 02:54.730 align:middle line:90%
And these are some creative ways
with portals and redirecting

75
02:54.730 --> 02:57.610 align:middle line:90%
to pause the user for a moment
and get that information.

76
02:57.610 --> 02:59.260 align:middle line:90%
All right, so having
said that, let's

77
02:59.260 --> 03:02.530 align:middle line:90%
talk about what we can do
to increase the protection
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.260 --> 03:02.530 align:middle line:90%
talk about what we can do
to increase the protection

78
03:02.530 --> 03:04.660 align:middle line:90%
and security when
a user needs to log

79
03:04.660 --> 03:08.020 align:middle line:84%
in using multi- authentication.

80
03:08.020 --> 03:10.150 align:middle line:90%
Sometimes the acronym
shows up as MFA

81
03:10.150 --> 03:13.360 align:middle line:90%
or 2FA, which would be
two-factor authentication.

82
03:13.360 --> 03:15.580 align:middle line:90%
Just think of an
authentication like a bucket.

83
03:15.580 --> 03:17.290 align:middle line:90%
Let's imagine we
have three buckets.

84
03:17.290 --> 03:20.560 align:middle line:90%
And I will put this one in red,
I'll put this one in black,

85
03:20.560 --> 03:22.180 align:middle line:84%
and I'll put this one in green.

86
03:22.180 --> 03:26.950 align:middle line:90%
And let me label these as
category one, category two,

87
03:26.950 --> 03:28.780 align:middle line:84%
and category three.

88
03:28.780 --> 03:31.390 align:middle line:90%
And these buckets
represent factors.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:28.780 --> 03:31.390 align:middle line:90%
And these buckets
represent factors.

89
03:31.390 --> 03:33.490 align:middle line:90%
And what multi-factor
authentication means

90
03:33.490 --> 03:35.560 align:middle line:90%
is that before we
really believe that Bob

91
03:35.560 --> 03:37.870 align:middle line:90%
is Bob, if we're doing
multi-factor or two-factor

92
03:37.870 --> 03:40.930 align:middle line:90%
authentication, is that we need
to have at least one factor

93
03:40.930 --> 03:42.437 align:middle line:84%
from two different categories.

94
03:42.437 --> 03:44.020 align:middle line:90%
And so the question
may come up, well,

95
03:44.020 --> 03:46.040 align:middle line:90%
what are these
categories of factors?

96
03:46.040 --> 03:47.980 align:middle line:90%
The first one is something
we've used forever

97
03:47.980 --> 03:51.880 align:middle line:90%
and that is something that we
know, like knowledge-based.

98
03:51.880 --> 03:54.220 align:middle line:90%
Like if Bob knows
what his password is,

99
03:54.220 --> 03:55.480 align:middle line:84%
that's what he knows.

100
03:55.480 --> 03:58.090 align:middle line:90%
If Bob knows his mother's
maiden name, that's something

101
03:58.090 --> 03:59.470 align:middle line:84%
he knows.

102
03:59.470 --> 04:02.162 align:middle line:90%
If Bob knows the last four
digits of his social security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:59.470 --> 04:02.162 align:middle line:90%
If Bob knows the last four
digits of his social security

103
04:02.162 --> 04:04.120 align:middle line:90%
number, again, that's
something that Bob knows.

104
04:04.120 --> 04:05.560 align:middle line:84%
And that would be category one.

105
04:05.560 --> 04:06.460 align:middle line:84%
So let's imagine.

106
04:06.460 --> 04:08.043 align:middle line:90%
Let's go ahead and
put a password here

107
04:08.043 --> 04:09.340 align:middle line:84%
as something Bob could know.

108
04:09.340 --> 04:12.260 align:middle line:90%
And that would be
one of the factors.

109
04:12.260 --> 04:14.870 align:middle line:90%
So if we use at least
two different categories,

110
04:14.870 --> 04:16.370 align:middle line:90%
we have two-factor
authentication,

111
04:16.370 --> 04:18.579 align:middle line:90%
which also can be called
multi-factor because it's

112
04:18.579 --> 04:19.610 align:middle line:84%
more than just one.

113
04:19.610 --> 04:21.579 align:middle line:90%
So let's take a look at what
these other categories could

114
04:21.579 --> 04:22.150 align:middle line:84%
include.

115
04:22.150 --> 04:26.680 align:middle line:90%
For category two, is
something that the user has.

116
04:26.680 --> 04:30.400 align:middle line:90%
Now, what could Bob possibly
have that would let him in?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:26.680 --> 04:30.400 align:middle line:90%
Now, what could Bob possibly
have that would let him in?

117
04:30.400 --> 04:33.640 align:middle line:90%
And one answer would be
a little token generator

118
04:33.640 --> 04:35.200 align:middle line:90%
in a little key
fob looking thing.

119
04:35.200 --> 04:37.270 align:middle line:90%
Or it could be
software, and every 60

120
04:37.270 --> 04:38.950 align:middle line:84%
seconds it generates a code.

121
04:38.950 --> 04:40.750 align:middle line:90%
And if Bob has
that code, maybe we

122
04:40.750 --> 04:42.435 align:middle line:90%
are prompting him
when he logs in,

123
04:42.435 --> 04:43.810 align:middle line:90%
that he has to
know his password,

124
04:43.810 --> 04:45.765 align:middle line:90%
and he has to put in
the code which he has.

125
04:45.765 --> 04:47.890 align:middle line:90%
And if we're doing that,
we're requiring a password

126
04:47.890 --> 04:49.390 align:middle line:90%
and the token that's
being generated

127
04:49.390 --> 04:51.130 align:middle line:90%
from this little
token generator, that

128
04:51.130 --> 04:53.890 align:middle line:90%
would be an example of
multi-factor authentication.

129
04:53.890 --> 04:55.870 align:middle line:90%
And the third very
common element

130
04:55.870 --> 04:59.680 align:middle line:90%
is something that the user is
or something that the user does,

131
04:59.680 --> 05:01.920 align:middle line:90%
and that would be
like biometrics.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:59.680 --> 05:01.920 align:middle line:90%
and that would be
like biometrics.

132
05:01.920 --> 05:04.020 align:middle line:90%
Maybe a fingerprint
reader or something

133
05:04.020 --> 05:08.340 align:middle line:90%
that scans his eye or retina
or iris, looking for details

134
05:08.340 --> 05:09.300 align:middle line:84%
there.

135
05:09.300 --> 05:11.260 align:middle line:90%
It could also be something
that the user does.

136
05:11.260 --> 05:12.780 align:middle line:90%
For example, if
you and I typed out

137
05:12.780 --> 05:15.030 align:middle line:90%
a sentence, the same
exact sentence, the way

138
05:15.030 --> 05:18.030 align:middle line:90%
we type it out, the
pressure, the frequency,

139
05:18.030 --> 05:20.183 align:middle line:90%
the time between
keystrokes, and so forth

140
05:20.183 --> 05:21.600 align:middle line:90%
is going to be
slightly different.

141
05:21.600 --> 05:23.160 align:middle line:90%
And a computer
could analyze that.

142
05:23.160 --> 05:24.960 align:middle line:90%
And it could tell the
difference between me

143
05:24.960 --> 05:27.000 align:middle line:90%
typing in that sentence
and you typing it in.

144
05:27.000 --> 05:30.390 align:middle line:90%
And that could be one of the
factors, the something the user
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:27.000 --> 05:30.390 align:middle line:90%
And that could be one of the
factors, the something the user

145
05:30.390 --> 05:33.580 align:middle line:90%
is, that's used as part of
multi-factor authentication.

146
05:33.580 --> 05:36.540 align:middle line:90%
Now, the problem with having
multi-factor authentication

147
05:36.540 --> 05:39.130 align:middle line:90%
is you have to get that
information into the system.

148
05:39.130 --> 05:40.770 align:middle line:90%
So the onboarding
process for that

149
05:40.770 --> 05:43.225 align:middle line:90%
would be typing that
sentence several times,

150
05:43.225 --> 05:45.600 align:middle line:90%
or if it's a fingerprint
reader, getting that fingerprint

151
05:45.600 --> 05:48.030 align:middle line:90%
into the system, or
the scan of the eyeball

152
05:48.030 --> 05:49.230 align:middle line:84%
or any part of the eye.

153
05:49.230 --> 05:51.430 align:middle line:90%
Now, one distinction I
like to make to is this.

154
05:51.430 --> 05:53.400 align:middle line:90%
What if we log into
a website and we

155
05:53.400 --> 05:57.330 align:middle line:90%
have to provide a password, we
have to recognize a picture,

156
05:57.330 --> 06:01.290 align:middle line:90%
and we have to provide the
last four digits of our social,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:57.330 --> 06:01.290 align:middle line:90%
and we have to provide the
last four digits of our social,

157
06:01.290 --> 06:04.210 align:middle line:90%
and also maybe a security
question, and maybe one

158
06:04.210 --> 06:06.600 align:middle line:90%
other thing that
we have to specify?

159
06:06.600 --> 06:09.780 align:middle line:90%
If we're asking for one, two,
three, four bits of data,

160
06:09.780 --> 06:12.330 align:middle line:90%
or four different things,
is that multi-factor

161
06:12.330 --> 06:12.990 align:middle line:84%
authentication?

162
06:12.990 --> 06:13.940 align:middle line:84%
The answer is no.

163
06:13.940 --> 06:15.210 align:middle line:84%
It's pretty good security.

164
06:15.210 --> 06:18.030 align:middle line:90%
I mean, we're doing a lot of
good stuff that the user knows.

165
06:18.030 --> 06:20.730 align:middle line:90%
But it's not multi-factor
authentication

166
06:20.730 --> 06:23.970 align:middle line:90%
because it's only using the
contents of one category,

167
06:23.970 --> 06:25.312 align:middle line:84%
something that the user knows.

168
06:25.312 --> 06:27.270 align:middle line:90%
If we want it to be
multi-factor authentication

169
06:27.270 --> 06:29.070 align:middle line:90%
or two-factor
authentication, we have

170
06:29.070 --> 06:32.112 align:middle line:90%
to have requirements from
at least two categories.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
06:29.070 --> 06:32.112 align:middle line:90%
to have requirements from
at least two categories.

171
06:32.112 --> 06:33.570 align:middle line:90%
Now, one of the
questions is, if we

172
06:33.570 --> 06:36.487 align:middle line:90%
go to the extra work of doing
multi-factor authentication,

173
06:36.487 --> 06:38.070 align:middle line:90%
including on a
smartphone, where maybe

174
06:38.070 --> 06:40.950 align:middle line:90%
the multi-factor authentication
includes a picture,

175
06:40.950 --> 06:42.840 align:middle line:90%
like, the person
looks at the camera,

176
06:42.840 --> 06:45.330 align:middle line:90%
and it recognizes their
face, and boom, lets them in.

177
06:45.330 --> 06:47.400 align:middle line:90%
They had the passcode
to unlock the phone,

178
06:47.400 --> 06:50.040 align:middle line:90%
and then the visual recognition
of their face, that's

179
06:50.040 --> 06:52.890 align:middle line:90%
multi-factor authentication--
the password and also

180
06:52.890 --> 06:54.228 align:middle line:84%
their face, that they had.

181
06:54.228 --> 06:55.770 align:middle line:90%
And let's talk about
how that's going

182
06:55.770 --> 06:57.990 align:middle line:90%
to protect us and the
users if we're doing

183
06:57.990 --> 06:59.460 align:middle line:84%
multi-factor authentication.

184
06:59.460 --> 07:01.080 align:middle line:90%
If somebody installs
a key logger
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

184
06:59.460 --> 07:01.080 align:middle line:90%
If somebody installs
a key logger

185
07:01.080 --> 07:03.210 align:middle line:90%
and is capturing
all the keystrokes,

186
07:03.210 --> 07:05.700 align:middle line:90%
and somebody steals
Bob's password,

187
07:05.700 --> 07:07.830 align:middle line:90%
if we're using multi-factor
authentication,

188
07:07.830 --> 07:11.640 align:middle line:90%
that password by itself is
not enough for the attacker

189
07:11.640 --> 07:14.790 align:middle line:90%
to log in as Bob because he
only has one of the factors.

190
07:14.790 --> 07:17.370 align:middle line:90%
He would have to also have
the second or third element

191
07:17.370 --> 07:18.870 align:middle line:90%
that we're also
requiring as part

192
07:18.870 --> 07:20.310 align:middle line:84%
of multi-factor authentication.

193
07:20.310 --> 07:22.380 align:middle line:90%
Oftentimes, that
second factor is

194
07:22.380 --> 07:24.600 align:middle line:90%
going to be a token
that's generated

195
07:24.600 --> 07:28.010 align:middle line:90%
by an application or a key
fob that's time-sensitive.

196
07:28.010 --> 07:30.910 align:middle line:90%
So a new token is
generated every 60 seconds.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

196
07:28.010 --> 07:30.910 align:middle line:90%
So a new token is
generated every 60 seconds.

197
07:30.910 --> 07:32.790 align:middle line:90%
So if somebody just gets
the password of Bob,

198
07:32.790 --> 07:34.230 align:middle line:90%
they don't have
the key generator,

199
07:34.230 --> 07:36.600 align:middle line:90%
they're not going to be able
to go ahead and log in as Bob.

200
07:36.600 --> 07:38.400 align:middle line:90%
So that means if somebody
goes to Bob's machine,

201
07:38.400 --> 07:40.150 align:middle line:90%
maybe they sneak in
at night or whatever,

202
07:40.150 --> 07:42.735 align:middle line:90%
or they get his laptop
and they try to log on,

203
07:42.735 --> 07:44.610 align:middle line:90%
most systems are going
to have controls where

204
07:44.610 --> 07:46.943 align:middle line:90%
after so many logins it's
going to go ahead and give you

205
07:46.943 --> 07:48.510 align:middle line:84%
a timeout or stop it altogether.

206
07:48.510 --> 07:50.010 align:middle line:90%
But if it didn't,
and somebody tried

207
07:50.010 --> 07:53.430 align:middle line:90%
to do a brute force attack,
or a very extensive dictionary

208
07:53.430 --> 07:56.220 align:middle line:90%
attack, or they're just trying
millions of combinations,

209
07:56.220 --> 07:58.050 align:middle line:90%
if they don't have
that second aspect

210
07:58.050 --> 08:00.090 align:middle line:90%
of the multi-factor
authentication
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

210
07:58.050 --> 08:00.090 align:middle line:90%
of the multi-factor
authentication

211
08:00.090 --> 08:01.650 align:middle line:90%
or the two-factor
authentication,

212
08:01.650 --> 08:04.470 align:middle line:90%
the attacker just won't get
in with a password by itself.

213
08:04.470 --> 08:05.160 align:middle line:84%
It's not enough.

214
08:05.160 --> 08:06.660 align:middle line:90%
So in this video,
we've taken a look

215
08:06.660 --> 08:09.270 align:middle line:90%
at how we can improve the
security and verification

216
08:09.270 --> 08:11.520 align:middle line:90%
of the entities who are
trying to get into our network

217
08:11.520 --> 08:13.440 align:middle line:90%
by using multi-factor
or for using

218
08:13.440 --> 08:16.380 align:middle line:90%
two, two-factor
authentication for access

219
08:16.380 --> 08:17.538 align:middle line:84%
to our network resources.

220
08:17.538 --> 08:19.830 align:middle line:90%
And one other challenge I'd
like to chat with you about

221
08:19.830 --> 08:22.140 align:middle line:90%
is what if somebody does
have the credentials?

222
08:22.140 --> 08:25.050 align:middle line:90%
They've got the right username
and password combination along

223
08:25.050 --> 08:27.840 align:middle line:90%
with a token, or
a biometric aspect

224
08:27.840 --> 08:30.210 align:middle line:90%
like an eyeball read or
a thumbprint or whatever,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

224
08:27.840 --> 08:30.210 align:middle line:90%
like an eyeball read or
a thumbprint or whatever,

225
08:30.210 --> 08:31.080 align:middle line:84%
and we--

226
08:31.080 --> 08:33.030 align:middle line:90%
they pass authentication,
do we want

227
08:33.030 --> 08:35.140 align:middle line:90%
to let every system
just get on the network?

228
08:35.140 --> 08:36.539 align:middle line:84%
And the answer is no.

229
08:36.539 --> 08:39.370 align:middle line:90%
We might have security
policies in place to say, hey,

230
08:39.370 --> 08:41.909 align:middle line:90%
you have to have an
antivirus that was updated

231
08:41.909 --> 08:43.110 align:middle line:84%
within the last seven days.

232
08:43.110 --> 08:44.670 align:middle line:90%
Or you have to have
this antivirus.

233
08:44.670 --> 08:47.310 align:middle line:90%
Or you have to have this patch
if you're a current Windows 10

234
08:47.310 --> 08:48.640 align:middle line:84%
user, et cetera, et cetera.

235
08:48.640 --> 08:51.120 align:middle line:90%
And we can force
that with posturing

236
08:51.120 --> 08:53.850 align:middle line:90%
by using two components,
the AnyConnect

237
08:53.850 --> 08:56.910 align:middle line:90%
client with a posturing
module on the client itself,

238
08:56.910 --> 09:00.270 align:middle line:90%
and ISE, the Identity Services
Engine in the background
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

238
08:56.910 --> 09:00.270 align:middle line:90%
and ISE, the Identity Services
Engine in the background

239
09:00.270 --> 09:01.510 align:middle line:84%
doing the enforcement.

240
09:01.510 --> 09:03.550 align:middle line:90%
And that's what the
next video is all about.

241
09:03.550 --> 09:05.590 align:middle line:90%
So I'll see you there
in just a moment.

242
09:05.590 --> 09:07.950 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

243
09:07.950 --> 09:11.240 align:middle line:90%
and I'd like to thank
you for viewing.