WEBVTT

1
00:00.000 --> 00:07.980
So now that we've seen how the DNS policies work, let's jump into umbrella and

2
00:07.980 --> 00:08.180
take a

3
00:08.180 --> 00:11.180
look at how the web policies work.

4
00:11.180 --> 00:14.420
Now of course, this is going to be a very similar construction.

5
00:14.420 --> 00:18.910
However, there are certainly enough differences here to warrant jumping in and

6
00:18.910 --> 00:19.720
taking a look

7
00:19.720 --> 00:21.480
at this configuration.

8
00:21.480 --> 00:27.840
So let's just go ahead and jump right in to umbrella and take a look at our web

9
00:27.840 --> 00:29.100
policies.

10
00:29.100 --> 00:33.830
So from our overview page, we'll come over here again and go to policies, but
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

10
00:29.100 --> 00:33.830
So from our overview page, we'll come over here again and go to policies, but

11
00:33.830 --> 00:34.320
this time

12
00:34.320 --> 00:37.240
we're going to take a look at the web policy.

13
00:37.240 --> 00:41.570
So the first thing to understand before we really start digging into this, this

14
00:41.570 --> 00:42.040
is made

15
00:42.040 --> 00:48.600
up of rule sets and each rule set then contains rules.

16
00:48.600 --> 00:52.920
What we're looking at on this screen are the rule sets.

17
00:52.920 --> 00:59.040
And without having read, write access, we can't actually create any new rule

18
00:59.040 --> 00:59.660
sets.

19
00:59.660 --> 01:02.940
So what we're going to do is we're just going to pick on one of the rule sets.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

19
00:59.660 --> 01:02.940
So what we're going to do is we're just going to pick on one of the rule sets.

20
01:02.940 --> 01:07.740
We'll use the high restrict group because it has a lot of rules in it.

21
01:07.740 --> 01:12.620
Now the first thing to note is it once again warns us that we're in read only

22
01:12.620 --> 01:13.220
mode.

23
01:13.220 --> 01:15.740
So of course, we can't change anything.

24
01:15.740 --> 01:19.730
It does however, give us the chance here to add a rule so we can go through

25
01:19.730 --> 01:20.580
that process

26
01:20.580 --> 01:22.460
and see what it looks like.

27
01:22.460 --> 01:27.070
But before we do, let's take a look at how we can edit and modify the rules

28
01:27.070 --> 01:28.080
that already

29
01:28.080 --> 01:29.380
exist.

30
01:29.380 --> 01:35.430
So first and foremost, one of the most important things about security rules is
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
01:29.380 --> 01:35.430
So first and foremost, one of the most important things about security rules is

31
01:35.430 --> 01:36.560
their priority

32
01:36.560 --> 01:39.720
or the order in which they're going to be applied.

33
01:39.720 --> 01:45.180
And the way you change the order here is we simply move our mouse to these six

34
01:45.180 --> 01:46.000
dots before

35
01:46.000 --> 01:47.000
the numbers.

36
01:47.000 --> 01:52.050
We can turn into a little hand and then we can literally just drag these rules

37
01:52.050 --> 01:52.640
into whatever

38
01:52.640 --> 01:54.160
order we want.

39
01:54.160 --> 01:56.840
And it will then renumber the list.

40
01:56.840 --> 02:01.190
Notice however, that since we're in read only mode, umbrella is actually going
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:56.840 --> 02:01.190
Notice however, that since we're in read only mode, umbrella is actually going

41
02:01.190 --> 02:01.580
to give

42
02:01.580 --> 02:05.920
us an error there and put it right back in the order it was in.

43
02:05.920 --> 02:11.680
However, overall, that is the process for changing the order of the list.

44
02:11.680 --> 02:16.360
The other thing, of course, we can do is edit any one of these rules.

45
02:16.360 --> 02:19.360
So let's take a look at rule three here.

46
02:19.360 --> 02:24.250
The way we edit this is we simply come to the action menu over here on the far

47
02:24.250 --> 02:24.560
right.

48
02:24.560 --> 02:28.360
We click on the dropdown and notice there's two choices here.

49
02:28.360 --> 02:32.360
We can either edit the rule or disable the rule.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

49
02:28.360 --> 02:32.360
We can either edit the rule or disable the rule.

50
02:32.360 --> 02:36.440
Now one thing that is a little bit tricky about the interface here is if you

51
02:36.440 --> 02:37.000
put your

52
02:37.000 --> 02:41.000
mouse down in this section, it sort of highlights that we're editing the rule

53
02:41.000 --> 02:41.760
right now.

54
02:41.760 --> 02:44.840
But if we click here, it won't actually do anything.

55
02:44.840 --> 02:48.960
You have to actually click on the words edit rule.

56
02:48.960 --> 02:52.600
Now once we've done that, let's take a look at the things that we can change.

57
02:52.600 --> 02:55.600
First, we can change the name of the rule.

58
02:55.600 --> 03:00.400
We'll just call this test because again, it's not going to let us do it anyway.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
02:55.600 --> 03:00.400
We'll just call this test because again, it's not going to let us do it anyway.

59
03:00.400 --> 03:04.760
The next thing we can do is choose the action.

60
03:04.760 --> 03:09.580
So if we click on this dropdown, we'll see the different choices that we have

61
03:09.580 --> 03:10.040
for this

62
03:10.040 --> 03:11.040
traffic.

63
03:11.040 --> 03:15.600
First, we can allow with the security overridden.

64
03:15.600 --> 03:20.750
And what that actually means is Umbrella's security features are going to be

65
03:20.750 --> 03:21.480
enforced

66
03:21.480 --> 03:24.440
and Umbrella will block this traffic.

67
03:24.440 --> 03:31.040
If it's a known bad destination, even though this rule overall may allow it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
03:24.440 --> 03:31.040
If it's a known bad destination, even though this rule overall may allow it.

68
03:31.040 --> 03:35.700
There's also of course a choice to warn, which is going to warn the identities

69
03:35.700 --> 03:36.240
trying

70
03:36.240 --> 03:42.490
to go to that destination before actually allowing access, or we can choose

71
03:42.490 --> 03:43.280
block, which

72
03:43.280 --> 03:48.750
of course simply blocks the destination, and we can choose isolate, which will

73
03:48.750 --> 03:49.400
actually

74
03:49.400 --> 03:55.450
isolate the identities called to by the rule set in a virtual cloud based

75
03:55.450 --> 03:56.600
browser.

76
03:56.600 --> 04:01.230
Now depending on exactly what's configured in the rule, you may or may not have
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
03:56.600 --> 04:01.230
Now depending on exactly what's configured in the rule, you may or may not have

77
04:01.230 --> 04:02.400
the choice

78
04:02.400 --> 04:07.120
between allow security overridden or just allow.

79
04:07.120 --> 04:12.980
Notice if we cancel out of this and we instead choose to edit a different rule,

80
04:12.980 --> 04:13.400
notice the

81
04:13.400 --> 04:18.920
actions on this one are allow, warned, block and isolate.

82
04:18.920 --> 04:23.700
The next thing to do of course is choose which identities this rule is going to

83
04:23.700 --> 04:25.280
apply to.

84
04:25.280 --> 04:30.550
So we can hit edit identity and we can simply choose off this list, which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
04:25.280 --> 04:30.550
So we can hit edit identity and we can simply choose off this list, which

85
04:30.550 --> 04:31.800
identities are

86
04:31.800 --> 04:33.920
going to be affected.

87
04:33.920 --> 04:38.420
Again we can see the members if we click on the arrow, we can choose subsets of

88
04:38.420 --> 04:38.960
this,

89
04:38.960 --> 04:42.080
just like we could in our DNS policies.

90
04:42.080 --> 04:45.430
So clearly the interface is a little bit different here, but we're choosing the

91
04:45.430 --> 04:46.640
same thing,

92
04:46.640 --> 04:50.360
which entities does this rule set apply to.

93
04:50.360 --> 04:52.000
We'll cancel that.

94
04:52.000 --> 04:55.080
The next thing of course is to choose destinations.

95
04:55.080 --> 05:00.310
So if we choose edit destination, we can choose from application settings,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
04:55.080 --> 05:00.310
So if we choose edit destination, we can choose from application settings,

96
05:00.310 --> 05:01.800
content categories

97
05:01.800 --> 05:04.720
or destination lists.

98
05:04.720 --> 05:09.390
Once again, this has a pop out and if we choose one of these or even subc

99
05:09.390 --> 05:10.400
ategories of

100
05:10.400 --> 05:14.270
these, you can see these have subcategories as well, but we can drill down

101
05:14.270 --> 05:15.000
through here

102
05:15.000 --> 05:20.080
and pick and choose all the different things we want, then we can hit apply.

103
05:20.080 --> 05:25.600
And of course that would edit the list if we weren't in read only mode.

104
05:25.600 --> 05:29.400
Another important aspect is the ability to change the schedule.

105
05:29.400 --> 05:34.730
So we can click on the schedule right here and we can choose either a pre-made
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

105
05:29.400 --> 05:34.730
So we can click on the schedule right here and we can choose either a pre-made

106
05:34.730 --> 05:35.520
schedule

107
05:35.520 --> 05:42.610
if we had one, which we don't, or we can choose the time zone and the hour from

108
05:42.610 --> 05:42.920
what

109
05:42.920 --> 05:48.160
time to what time and on what days this rule is supposed to apply.

110
05:48.160 --> 05:54.370
So for example, we could choose America, New York to select Eastern time zone,

111
05:54.370 --> 05:55.000
which is

112
05:55.000 --> 05:58.880
where I am, then we could choose times.

113
05:58.880 --> 06:03.360
So for example, we could choose nine a.m.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
05:58.880 --> 06:03.360
So for example, we could choose nine a.m.

114
06:03.360 --> 06:09.950
The five p.m. Monday through Friday, just as an example of how we could build

115
06:09.950 --> 06:11.040
the schedule.

116
06:11.040 --> 06:14.880
So we can see here it actually updated our schedule to say Monday through

117
06:14.880 --> 06:15.720
Friday, nine

118
06:15.720 --> 06:17.160
to five.

119
06:17.160 --> 06:21.160
We can also of course configure our protected file bypass here.

120
06:21.160 --> 06:26.120
If we want to, we could turn this on or off per each rule.

121
06:26.120 --> 06:29.860
Now again, as usual, we're going to have to hit cancel for these changes

122
06:29.860 --> 06:30.720
because we're
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
06:29.860 --> 06:30.720
because we're

123
06:30.720 --> 06:32.640
in read only mode.

124
06:32.640 --> 06:37.080
Now if we wanted to add our own rule, we could say add rule, it'll put it at

125
06:37.080 --> 06:37.720
the top,

126
06:37.720 --> 06:39.920
but we've already seen how to move it.

127
06:39.920 --> 06:43.880
We of course give it a name, what it's called it something like test.

128
06:43.880 --> 06:48.000
And then we just go through all the different things that we just discussed.

129
06:48.000 --> 06:52.050
We would have to choose the rule action, what identities it applies to, what

130
06:52.050 --> 06:52.880
destinations

131
06:52.880 --> 06:56.680
it applies to, any schedule that we want to configure.

132
06:56.680 --> 07:02.040
And then we could either do the protected file bypass disabled or enabled.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

132
06:56.680 --> 07:02.040
And then we could either do the protected file bypass disabled or enabled.

133
07:02.040 --> 07:06.970
And if we wanted to, we could edit the block and warn page that the users going

134
07:06.970 --> 07:07.440
to get

135
07:07.440 --> 07:11.040
if they're blocked trying to go to this destination.

136
07:11.040 --> 07:15.000
So once again, we'll just cancel this since we can't make a new rule.

137
07:15.000 --> 07:19.350
And the last thing we want to really look at are the settings for the rule set

138
07:19.350 --> 07:20.080
itself.

139
07:20.080 --> 07:24.310
If you scroll down to the bottom of all the rules, down at the bottom here are

140
07:24.310 --> 07:24.760
the rule

141
07:24.760 --> 07:26.640
set settings.

142
07:26.640 --> 07:31.120
And here we can do things like changing the rule set name, changing the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
07:26.640 --> 07:31.120
And here we can do things like changing the rule set name, changing the

143
07:31.120 --> 07:32.240
identities, changing

144
07:32.240 --> 07:34.240
the block and warn page.

145
07:34.240 --> 07:38.360
If you notice a lot of the settings up above said inherit it.

146
07:38.360 --> 07:42.080
It's inheriting it from the rule set settings.

147
07:42.080 --> 07:46.020
So if we look down this list, there's a lot of things we could change file type

148
07:46.020 --> 07:46.720
control.

149
07:46.720 --> 07:51.020
For example, if we hit edit, we can see all the different types of files that

150
07:51.020 --> 07:51.680
should be

151
07:51.680 --> 07:54.000
blocked by this rule set.

152
07:54.000 --> 07:56.640
We of course can pick and choose on the left.

153
07:56.640 --> 07:59.760
And it again puts the things on the right.

154
07:59.760 --> 08:02.710
In case you haven't noticed the trend yet, that's how a lot of things in
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
07:59.760 --> 08:02.710
In case you haven't noticed the trend yet, that's how a lot of things in

155
08:02.710 --> 08:03.360
umbrella are

156
08:03.360 --> 08:04.920
configured.

157
08:04.920 --> 08:06.960
We'll hit cancel.

158
08:06.960 --> 08:09.680
Also worth noting is the security settings.

159
08:09.680 --> 08:14.230
If we hit edit, this is where we can turn things on and off, such as malware,

160
08:14.230 --> 08:14.840
command

161
08:14.840 --> 08:20.320
and control callbacks, phishing attacks and potentially harmful domains.

162
08:20.320 --> 08:22.480
Once again, there are some pre-builts.

163
08:22.480 --> 08:27.100
We can change these and it'll turn on and off certain features based on what

164
08:27.100 --> 08:28.040
you select.

165
08:28.040 --> 08:30.800
We'll go ahead and just hit cancel.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

165
08:28.040 --> 08:30.800
We'll go ahead and just hit cancel.

166
08:30.800 --> 08:34.200
So as you can see, there's quite a few things here we can change, but these are

167
08:34.200 --> 08:34.760
things that

168
08:34.760 --> 08:37.920
affect the rule set overall.

169
08:37.920 --> 08:43.680
So in this video, we took a look at how to configure our web security policy in

170
08:43.680 --> 08:44.720
umbrella.

171
08:44.720 --> 08:49.400
We actually saw that in a lot of ways, it's similar to what we did in our DNS

172
08:49.400 --> 08:50.280
policy,

173
08:50.280 --> 08:54.480
although of course the interface itself is considerably different.

174
08:54.480 --> 08:58.680
Next, let's take a look at the firewall policy itself.

175
08:58.680 --> 09:02.560
It again is going to be fairly similar, but still worth taking a look at.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

175
08:58.680 --> 09:02.560
It again is going to be fairly similar, but still worth taking a look at.