WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:01.770 align:middle line:90%
We hinted at this
already when we

3
00:01.770 --> 00:03.060 align:middle line:84%
were talking about AnyConnect.

4
00:03.060 --> 00:05.460 align:middle line:90%
We said something about
posture assessment.

5
00:05.460 --> 00:08.310 align:middle line:90%
But what is posture
assessment after all?

6
00:08.310 --> 00:11.850 align:middle line:90%
You see, sometimes it's
not enough to just know

7
00:11.850 --> 00:12.580 align:middle line:84%
who somebody is.

8
00:12.580 --> 00:15.150 align:middle line:90%
It's not enough to verify
username and password

9
00:15.150 --> 00:16.860 align:middle line:84%
and then just let them in.

10
00:16.860 --> 00:19.590 align:middle line:90%
For instance, would you be
OK with somebody plugging

11
00:19.590 --> 00:21.720 align:middle line:90%
into your network right
now because they typed

12
00:21.720 --> 00:23.310 align:middle line:90%
in the right
username and password

13
00:23.310 --> 00:25.830 align:middle line:90%
but maybe they were
running Windows 2000?

14
00:25.830 --> 00:27.210 align:middle line:84%
Err, Maybe not.

15
00:27.210 --> 00:29.510 align:middle line:90%
That's where posture
assessment comes into play.

16
00:29.510 --> 00:32.340 align:middle line:90%
So let's talk about how
posture assessment can really
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.510 --> 00:32.340 align:middle line:90%
So let's talk about how
posture assessment can really

17
00:32.340 --> 00:33.240 align:middle line:84%
help us out.

18
00:33.240 --> 00:35.100 align:middle line:90%
In the last Nugget,
we talked a lot

19
00:35.100 --> 00:38.220 align:middle line:90%
about how users can get
authenticated to the VPN

20
00:38.220 --> 00:40.830 align:middle line:90%
when they're working remotely,
when they're working from home.

21
00:40.830 --> 00:44.430 align:middle line:90%
But there's an OK chance
that sometimes an end user

22
00:44.430 --> 00:47.730 align:middle line:90%
will be working from home
from their personal computer.

23
00:47.730 --> 00:51.870 align:middle line:90%
Now, that poses a whole
different mess of risks.

24
00:51.870 --> 00:54.510 align:middle line:90%
And sometimes just
authenticating their username

25
00:54.510 --> 00:58.330 align:middle line:90%
and password isn't exactly the
safest thing that we can do.

26
00:58.330 --> 01:00.960 align:middle line:90%
So what AnyConnect
enables us to do
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:58.330 --> 01:00.960 align:middle line:90%
So what AnyConnect
enables us to do

27
01:00.960 --> 01:04.260 align:middle line:90%
is check out their landscape,
explore their computer

28
01:04.260 --> 01:08.110 align:middle line:90%
a little bit, and make sure it's
up to our security standards.

29
01:08.110 --> 01:11.910 align:middle line:90%
What we're talking about here
is assessing their posture,

30
01:11.910 --> 01:13.320 align:middle line:84%
the posture assessment.

31
01:13.320 --> 01:16.050 align:middle line:90%
Let's talk about how AnyConnect
and some other appliances

32
01:16.050 --> 01:19.030 align:middle line:90%
can actually perform
posture assessment for us.

33
01:19.030 --> 01:20.230 align:middle line:84%
So here I am.

34
01:20.230 --> 01:23.610 align:middle line:90%
I'm Knox, and I'm working
remotely from my home computer,

35
01:23.610 --> 01:26.430 align:middle line:90%
and I'm trying to get connected
in to AnyConnect one more

36
01:26.430 --> 01:29.550 align:middle line:90%
time so that I can access
resources on the file

37
01:29.550 --> 01:31.710 align:middle line:84%
server that's in HQ.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:29.550 --> 01:31.710 align:middle line:84%
server that's in HQ.

38
01:31.710 --> 01:34.530 align:middle line:90%
And in a traditional way
that we just described,

39
01:34.530 --> 01:36.870 align:middle line:90%
I would download the
AnyConnect client.

40
01:36.870 --> 01:40.180 align:middle line:90%
I type in the URL, the
username and the password,

41
01:40.180 --> 01:41.320 align:middle line:84%
and I'm good to go.

42
01:41.320 --> 01:42.630 align:middle line:84%
I'm off to the races.

43
01:42.630 --> 01:43.372 align:middle line:84%
Here's the thing.

44
01:43.372 --> 01:44.580 align:middle line:84%
Think about what I just said.

45
01:44.580 --> 01:45.992 align:middle line:84%
Is that the most secure thing?

46
01:45.992 --> 01:48.450 align:middle line:90%
Well, by default, you may be
thinking, yeah, sure, why not?

47
01:48.450 --> 01:50.430 align:middle line:90%
He's probably got
a newish computer,

48
01:50.430 --> 01:51.790 align:middle line:84%
and he's working from home.

49
01:51.790 --> 01:53.760 align:middle line:90%
What if I don't have a
newish computer, though?

50
01:53.760 --> 01:56.760 align:middle line:90%
What if I'm running
something like Windows 7,

51
01:56.760 --> 01:59.250 align:middle line:90%
which is no longer
supported by Windows?

52
01:59.250 --> 02:00.210 align:middle line:84%
It's end of life.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:59.250 --> 02:00.210 align:middle line:84%
It's end of life.

53
02:00.210 --> 02:01.290 align:middle line:84%
It's deprecated.

54
02:01.290 --> 02:03.780 align:middle line:90%
They're not getting any
new security patches.

55
02:03.780 --> 02:06.450 align:middle line:90%
What if I don't
have an antivirus

56
02:06.450 --> 02:08.370 align:middle line:84%
or any form of anti-malware?

57
02:08.370 --> 02:10.650 align:middle line:90%
What if I was trying to
play my favorite video

58
02:10.650 --> 02:14.490 align:middle line:90%
game using a headset and it
didn't work so I turned off

59
02:14.490 --> 02:16.560 align:middle line:84%
my Windows Firewall entirely?

60
02:16.560 --> 02:20.310 align:middle line:90%
What if there's zero
encryption or weak encryption

61
02:20.310 --> 02:21.240 align:middle line:84%
on my computer?

62
02:21.240 --> 02:23.130 align:middle line:90%
What if I haven't
encrypted my disks?

63
02:23.130 --> 02:25.600 align:middle line:90%
Or I've only encrypted
them with an ancient cipher

64
02:25.600 --> 02:27.040 align:middle line:84%
or an ancient protocol?

65
02:27.040 --> 02:29.280 align:middle line:90%
Now, all of a sudden,
I'm downloading

66
02:29.280 --> 02:32.250 align:middle line:90%
files from this
server all the way
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.280 --> 02:32.250 align:middle line:90%
files from this
server all the way

67
02:32.250 --> 02:35.040 align:middle line:90%
onto my local computer,
which is end of life,

68
02:35.040 --> 02:38.700 align:middle line:90%
is not secure with an antivirus,
is wide open to the internet,

69
02:38.700 --> 02:40.710 align:middle line:84%
and has no form of encryption.

70
02:40.710 --> 02:42.060 align:middle line:84%
This is bad news.

71
02:42.060 --> 02:45.540 align:middle line:90%
One of the top ways that
attackers attack end users

72
02:45.540 --> 02:48.120 align:middle line:90%
is because they bring
work home with them.

73
02:48.120 --> 02:51.540 align:middle line:90%
One of the ways that a major
credit bureau was recently

74
02:51.540 --> 02:54.930 align:middle line:90%
attacked a few years ago was
because the software developer

75
02:54.930 --> 02:58.290 align:middle line:90%
took a backup of the production
database home with them.

76
02:58.290 --> 03:02.070 align:middle line:90%
And next thing we know, all of
these Social Security numbers
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:58.290 --> 03:02.070 align:middle line:90%
And next thing we know, all of
these Social Security numbers

77
03:02.070 --> 03:04.590 align:middle line:90%
and credit scores and everything
like that are leaked out

78
03:04.590 --> 03:07.050 align:middle line:90%
onto the internet because
the end user, the software

79
03:07.050 --> 03:09.030 align:middle line:90%
developer, who brought
work home with them

80
03:09.030 --> 03:11.440 align:middle line:90%
didn't have a secure
environment at home.

81
03:11.440 --> 03:13.980 align:middle line:90%
That's a big no-no, and
we need to make sure

82
03:13.980 --> 03:16.800 align:middle line:90%
that someone who's connecting
into our network remotely

83
03:16.800 --> 03:19.950 align:middle line:90%
meets our security standards
and isn't just any Joe off

84
03:19.950 --> 03:23.310 align:middle line:90%
the street who happens to
know a username and password.

85
03:23.310 --> 03:26.760 align:middle line:90%
So AnyConnect does a whole
heck of a lot more than just

86
03:26.760 --> 03:29.700 align:middle line:90%
handling authentication for
end users who are trying

87
03:29.700 --> 03:31.260 align:middle line:84%
to get access into the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

87
03:29.700 --> 03:31.260 align:middle line:84%
to get access into the network.

88
03:31.260 --> 03:33.930 align:middle line:90%
AnyConnect, once it's
installed on a computer,

89
03:33.930 --> 03:37.950 align:middle line:90%
can work with other
pieces of the computer

90
03:37.950 --> 03:39.480 align:middle line:84%
to learn more about it.

91
03:39.480 --> 03:42.450 align:middle line:90%
It can check things like,
what operating system are we

92
03:42.450 --> 03:43.320 align:middle line:84%
working with?

93
03:43.320 --> 03:46.920 align:middle line:90%
Is AMP already installed
on this computer?

94
03:46.920 --> 03:51.480 align:middle line:90%
And if it's not installed,
should we install it first?

95
03:51.480 --> 03:56.070 align:middle line:90%
Or should we immediately proxy
information through AnyConnect

96
03:56.070 --> 03:57.690 align:middle line:84%
to the AMP service?

97
03:57.690 --> 03:59.010 align:middle line:84%
Yes, that's correct.

98
03:59.010 --> 04:02.490 align:middle line:90%
AnyConnect can act as
an extension of our AMP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

98
03:59.010 --> 04:02.490 align:middle line:90%
AnyConnect can act as
an extension of our AMP

99
04:02.490 --> 04:06.480 align:middle line:90%
environment that's located in
HQ towards the end users who

100
04:06.480 --> 04:08.190 align:middle line:90%
are trying to connect
into our network.

101
04:08.190 --> 04:11.400 align:middle line:90%
What type of network access
do they have at home?

102
04:11.400 --> 04:13.350 align:middle line:90%
Are there any
specific ports that we

103
04:13.350 --> 04:15.960 align:middle line:90%
need to close on this
device because we've

104
04:15.960 --> 04:17.640 align:middle line:84%
got the firewall wide open?

105
04:17.640 --> 04:20.670 align:middle line:90%
And how is encryption handled
locally on our computer

106
04:20.670 --> 04:22.380 align:middle line:84%
or within the bios itself?

107
04:22.380 --> 04:24.810 align:middle line:90%
Clearing the screen, let
me bring AnyConnect back up

108
04:24.810 --> 04:25.560 align:middle line:84%
onto the pane.

109
04:25.560 --> 04:26.160 align:middle line:84%
Look at this.

110
04:26.160 --> 04:27.535 align:middle line:90%
This is what we're
talking about.

111
04:27.535 --> 04:29.560 align:middle line:90%
First things first,
we have web security.

112
04:29.560 --> 04:33.360 align:middle line:90%
This is what type of
internet sites or practices
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:29.560 --> 04:33.360 align:middle line:90%
This is what type of
internet sites or practices

113
04:33.360 --> 04:36.100 align:middle line:90%
are they trying to browse
to in the first place.

114
04:36.100 --> 04:39.300 align:middle line:90%
This is now leveraging the
Cisco Umbrella product, which

115
04:39.300 --> 04:41.340 align:middle line:84%
was purchased from OpenDNS.

116
04:41.340 --> 04:44.100 align:middle line:90%
So we can now control
what type of websites

117
04:44.100 --> 04:47.580 align:middle line:90%
the end user is accessing when
they're connected to the VPN.

118
04:47.580 --> 04:50.340 align:middle line:90%
We also have the ability
to enforce policies

119
04:50.340 --> 04:52.420 align:middle line:84%
by scanning the system itself.

120
04:52.420 --> 04:54.660 align:middle line:90%
This is looking for
things like the firewall

121
04:54.660 --> 04:58.380 align:middle line:90%
and the AV configurations and
the encryption configurations.

122
04:58.380 --> 04:59.990 align:middle line:84%
Here goes the roaming security.

123
04:59.990 --> 05:02.030 align:middle line:90%
This is, again, a
content filter that we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

123
04:59.990 --> 05:02.030 align:middle line:90%
This is, again, a
content filter that we're

124
05:02.030 --> 05:05.030 align:middle line:90%
talking about that's
leveraged by Cisco Umbrella.

125
05:05.030 --> 05:07.560 align:middle line:90%
And lastly, we have
the AMP enabler.

126
05:07.560 --> 05:10.340 align:middle line:90%
This is where we can
actually install or enable

127
05:10.340 --> 05:14.900 align:middle line:90%
AMP or work with the local AMP
configuration within the VPN.

128
05:14.900 --> 05:18.530 align:middle line:90%
So our local AMP configuration
can communicate and coordinate

129
05:18.530 --> 05:21.800 align:middle line:90%
with AnyConnect, information
about the device itself

130
05:21.800 --> 05:24.170 align:middle line:84%
and the posture of the network.

131
05:24.170 --> 05:26.990 align:middle line:90%
So AnyConnect is so much
more than just a secure way

132
05:26.990 --> 05:29.180 align:middle line:90%
to access the network
by providing a username

133
05:29.180 --> 05:31.520 align:middle line:84%
and password and using DTLS.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

133
05:29.180 --> 05:31.520 align:middle line:84%
and password and using DTLS.

134
05:31.520 --> 05:34.460 align:middle line:90%
We can actually assess the
entire operating system,

135
05:34.460 --> 05:36.860 align:middle line:90%
the entire computer
itself, and then

136
05:36.860 --> 05:41.870 align:middle line:90%
determine, using profiling, what
kind of access or authorization

137
05:41.870 --> 05:44.970 align:middle line:90%
should be permitted, if
any, in the first place.

138
05:44.970 --> 05:47.600 align:middle line:90%
So this is how posture
assessment works, and this

139
05:47.600 --> 05:50.300 align:middle line:90%
is how the Cisco AnyConnect
client can enable

140
05:50.300 --> 05:52.940 align:middle line:90%
us to actually assess
the posture of all

141
05:52.940 --> 05:55.100 align:middle line:90%
of our remote workers
who are trying to access

142
05:55.100 --> 05:56.392 align:middle line:84%
our corporate resources.

143
05:56.392 --> 05:58.100 align:middle line:90%
I hope this has been
informative for you,

144
05:58.100 --> 06:00.400 align:middle line:90%
and I'd like to thank
you for viewing.