WEBVTT

1
00:00.000 --> 00:08.200
So now that we have an idea of some of the advantages and disadvantages or

2
00:08.200 --> 00:13.350
concerns about moving to the cloud and what that's going to affect as far as

3
00:13.350 --> 00:15.000
security and our networking,

4
00:15.000 --> 00:20.530
now let's talk in this video a little bit about the type of traffic that we

5
00:20.530 --> 00:22.000
need to secure.

6
00:22.000 --> 00:28.660
Now, let's qualify what we mean by that. Our job here is not to discuss whether

7
00:28.660 --> 00:35.000
we need to secure or allow RDP traffic or SSH or VPN traffic or SQL traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

7
00:28.660 --> 00:35.000
we need to secure or allow RDP traffic or SSH or VPN traffic or SQL traffic.

8
00:35.000 --> 00:40.000
That's not the discussion. We're talking about traffic flows.

9
00:40.000 --> 00:46.730
Specifically, we wanted to find two very particular terms, North, South traffic

10
00:46.730 --> 00:49.000
and East, West traffic.

11
00:49.000 --> 00:53.320
Now, if you're already familiar with these terms, this will serve as a review

12
00:53.320 --> 00:57.580
for you. But if you're not familiar with these terms, they are used quite

13
00:57.580 --> 01:02.000
frequently in regards to data centers and the cloud.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:57.580 --> 01:02.000
frequently in regards to data centers and the cloud.

14
01:02.000 --> 01:06.490
So we want to make sure that you understand exactly what type of traffic we're

15
01:06.490 --> 01:09.000
talking about when we use those terms.

16
01:09.000 --> 01:15.330
So let's just go ahead, jump in and define what those mean and what concerns we

17
01:15.330 --> 01:21.680
have with that traffic in regards to our cloud and connecting our devices into

18
01:21.680 --> 01:23.000
the cloud.

19
01:23.000 --> 01:29.000
So let's begin our discussion here by talking about North South traffic.

20
01:29.000 --> 01:36.150
This is specifically referring to the traffic going from clients to servers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

20
01:29.000 --> 01:36.150
This is specifically referring to the traffic going from clients to servers.

21
01:36.150 --> 01:40.000
You'll also hear this referred to as vertical traffic.

22
01:40.000 --> 01:45.400
And sort of the way it gets both of these names is it's quite common to draw

23
01:45.400 --> 01:50.000
out your data center as say a bunch of resources like this.

24
01:50.000 --> 01:55.690
And we usually draw them out horizontally. And then we would have something

25
01:55.690 --> 02:00.000
like a client up here that's accessing these resources.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
02:00.000 --> 02:06.000
And of course, that would be then Southbound traffic because it's headed south.

27
02:06.000 --> 02:11.000
The servers responding to that would then be the northbound traffic.

28
02:11.000 --> 02:21.000
So this is sort of where it gets its name. Honestly, it's really just because

29
02:21.000 --> 02:21.000
of how we normally draw these diagrams.

30
02:21.000 --> 02:27.090
And hopefully it's also a little bit straightforward that this is usually the

31
02:27.090 --> 02:32.910
most significant amount of data center or in our current discussion cloud
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
02:27.090 --> 02:32.910
most significant amount of data center or in our current discussion cloud

32
02:32.910 --> 02:34.000
traffic.

33
02:34.000 --> 02:39.250
The main reason to have these servers be them in a data center or in a cloud is

34
02:39.250 --> 02:44.680
for clients to interact with them. So this is normally going to be the largest

35
02:44.680 --> 02:50.000
amount of traffic north south between the clients and the servers.

36
02:50.000 --> 02:56.920
Also very commonly, this is going to pass through some other form of usually

37
02:56.920 --> 03:03.300
application aware services. So for example, firewalls that are application
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
02:56.920 --> 03:03.300
application aware services. So for example, firewalls that are application

38
03:03.300 --> 03:08.890
aware. So they can allow certain types of traffic, not other certain types of

39
03:08.890 --> 03:11.000
traffic, usually a stateful firewall.

40
03:11.000 --> 03:16.120
So that return traffic is allowed automatically. Also, particularly when there

41
03:16.120 --> 03:21.000
's a lot of traffic involved, this may also be behind load balancers as well.

42
03:21.000 --> 03:26.130
So again, there's usually going to be other things in the path between the

43
03:26.130 --> 03:28.000
clients and the servers.

44
03:28.000 --> 03:33.010
Now, of course, in order for these firewalls and load balancers to perform some
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
03:28.000 --> 03:33.010
Now, of course, in order for these firewalls and load balancers to perform some

45
03:33.010 --> 03:36.000
form of an action on our north south traffic.

46
03:36.000 --> 03:40.960
Well, it's going to have to be classified. We're going to have to be able to

47
03:40.960 --> 03:45.800
identify the traffic to know what to do with it. Some of the more common ways

48
03:45.800 --> 03:51.000
to do this would of course be to identify it by either source and destination

49
03:51.000 --> 03:55.000
IP address, source and destination port numbers,

50
03:55.000 --> 04:01.010
possibly even the protocol itself, or maybe even something within the protocol.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

50
03:55.000 --> 04:01.010
possibly even the protocol itself, or maybe even something within the protocol.

51
04:01.010 --> 04:07.910
So for example, HTTP headers, maybe geolocation information. So, you know,

52
04:07.910 --> 04:12.000
maybe what region of the cloud is this traffic going to we're coming from.

53
04:12.000 --> 04:17.590
That sort of information, or commonly we can just do regular expression

54
04:17.590 --> 04:23.230
matching on some of the various headers. So there's various different ways that

55
04:23.230 --> 04:29.000
we can classify this traffic, and we're going to use these methods to help the

56
04:29.000 --> 04:33.000
firewalls and the load balancers be able to perform their jobs correctly.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

56
04:29.000 --> 04:33.000
firewalls and the load balancers be able to perform their jobs correctly.

57
04:33.000 --> 04:38.270
So that's how they're going to be identifying that traffic. Now, of course, let

58
04:38.270 --> 04:42.660
's not forget that another job of the firewall is going to be to stop various

59
04:42.660 --> 04:44.000
types of attacks.

60
04:44.000 --> 04:48.640
This isn't generally going to fall on the load balancers to do this. Again,

61
04:48.640 --> 04:54.500
this is more of a firewall function, but things that we want to either detect

62
04:54.500 --> 05:00.000
or prevent or both would be things like SQL injection attacks,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
05:00.000 --> 05:05.270
maybe ping flood attacks, which really are sort of a form of denial of service

64
05:05.270 --> 05:10.380
attack, but they're often listed separately. So also denial of service and

65
05:10.380 --> 05:14.000
distributed denial of service attacks.

66
05:14.000 --> 05:18.800
These are some general things that firewalls will protect us from, even outside

67
05:18.800 --> 05:23.000
of the realm of the traffic that we're actually trying to match on.

68
05:23.000 --> 05:28.150
So these are usually sort of built in protections, regardless of what traffic

69
05:28.150 --> 05:33.000
we're either permitting or denying with our overall firewall rules.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

69
05:28.150 --> 05:33.000
we're either permitting or denying with our overall firewall rules.

70
05:33.000 --> 05:38.130
So the main takeaways here, again, the north, south traffic is the traffic from

71
05:38.130 --> 05:43.300
the clients to the servers, either entering or leaving the data center or the

72
05:43.300 --> 05:44.000
cloud.

73
05:44.000 --> 05:50.950
So we'll contrast this now with our East West traffic. East West traffic is

74
05:50.950 --> 05:57.050
between the servers in the data center. So this would be the traffic that never

75
05:57.050 --> 06:02.000
actually leaves the data center, essentially server to server communication.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
05:57.050 --> 06:02.000
actually leaves the data center, essentially server to server communication.

76
06:02.000 --> 06:09.130
Now, here's the real concern in most cases with East West traffic. This type of

77
06:09.130 --> 06:15.000
traffic is very often overlooked from a security perspective.

78
06:15.000 --> 06:19.340
A lot of people look at this and say, well, it's all traffic within my data

79
06:19.340 --> 06:23.220
center. It's not traversing the internet. It's already within a secure

80
06:23.220 --> 06:24.000
environment.

81
06:24.000 --> 06:30.800
So for that reason, it's often been overlooked. Also, it generally hasn't been
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

81
06:24.000 --> 06:30.800
So for that reason, it's often been overlooked. Also, it generally hasn't been

82
06:30.800 --> 06:35.000
a whole lot of traffic. However, the face of this is changing.

83
06:35.000 --> 06:41.360
This type of traffic is definitely on the rise. When we look at things like

84
06:41.360 --> 06:46.700
virtualization, doing things like workload mobility, where we may be moving a

85
06:46.700 --> 06:49.000
server from one device to another.

86
06:49.000 --> 06:54.390
Also, of course, multi-tiered applications, where we have front end talking to

87
06:54.390 --> 06:59.550
middleware, talking to a back end database server, and the only part that would

88
06:59.550 --> 07:04.000
be north south in that environment would be the traffic to the web server.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
06:59.550 --> 07:04.000
be north south in that environment would be the traffic to the web server.

89
07:04.000 --> 07:09.600
The traffic within the data center is going to be between these multi-tiered

90
07:09.600 --> 07:11.000
applications.

91
07:11.000 --> 07:17.770
And of course, the main concern here is we have to allow this traffic, but it

92
07:17.770 --> 07:20.000
also has to be controlled.

93
07:20.000 --> 07:24.750
And the reason it's important that it's controlled is if one of the servers

94
07:24.750 --> 07:30.000
hosting these applications we were just talking about were to get compromised,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
07:30.000 --> 07:37.060
that server could be used to launch attacks on other servers within the cloud

96
07:37.060 --> 07:38.000
or the data center.

97
07:38.000 --> 07:42.110
So it's important that we control the traffic that's actually allowed between

98
07:42.110 --> 07:47.000
the servers. Of course, the traffic that's needed has to be allowed.

99
07:47.000 --> 07:50.000
But we also don't want to allow more than we need to.

100
07:50.000 --> 07:54.900
Now, there's a lot of different methods we could use here. The most common is

101
07:54.900 --> 08:00.940
to use micro segmentation, which is going to involve some various different
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
07:54.900 --> 08:00.940
to use micro segmentation, which is going to involve some various different

102
08:00.940 --> 08:02.000
technologies.

103
08:02.000 --> 08:09.040
So for example, we have things called VPCs or virtual private clouds, which we

104
08:09.040 --> 08:13.000
have in the AWS and Google cloud environments.

105
08:13.000 --> 08:17.000
We have vNats, which we have in the Azure environment.

106
08:17.000 --> 08:24.000
Then within these network segmentation tools, we also have subnets.

107
08:24.000 --> 08:29.000
And within those subnets, we have route tables.

108
08:29.000 --> 08:34.000
Now, you might wonder why route tables are on a list focusing on security.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

108
08:29.000 --> 08:34.000
Now, you might wonder why route tables are on a list focusing on security.

109
08:34.000 --> 08:40.390
But keep in mind that whatever routes we control in these route tables, that's

110
08:40.390 --> 08:44.000
going to control which devices can talk to which other devices.

111
08:44.000 --> 08:49.000
If they don't have routes to the other subnets, then they can't talk to them.

112
08:49.000 --> 08:54.100
So controlling the routes in the route table is a method. Again, all of these

113
08:54.100 --> 08:59.610
tools working together. But this is one of those methods of controlling the

114
08:59.610 --> 09:02.000
traffic between the devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
08:59.610 --> 09:02.000
traffic between the devices.

115
09:02.000 --> 09:09.000
Sort of a more concrete method would be to use access control lists or ACLs.

116
09:09.000 --> 09:13.710
And within the cloud environment, we have sort of a unique structure called

117
09:13.710 --> 09:18.610
security groups. And again, different providers will call these slightly

118
09:18.610 --> 09:20.000
different things.

119
09:20.000 --> 09:26.690
Security groups is what Amazon calls them in AWS. But the basic idea, where an

120
09:26.690 --> 09:32.380
ACL gets applied to a subnet and therefore controls all of the access in and
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
09:26.690 --> 09:32.380
ACL gets applied to a subnet and therefore controls all of the access in and

121
09:32.380 --> 09:34.000
out of that subnet.

122
09:34.000 --> 09:40.620
And a security group gets assigned to a resource. So it's going to be a little

123
09:40.620 --> 09:46.000
bit more granular. So although similar, these are two different things.

124
09:46.000 --> 09:50.000
We'll be addressing this in more detail in an upcoming video.

125
09:50.000 --> 09:53.000
Now, there is one more type of traffic that we want to discuss here.

126
09:53.000 --> 09:57.000
That's not exactly north south and it's not exactly east west.

127
09:57.000 --> 10:01.620
To a certain extent, it could be either depending on how we choose to implement
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
09:57.000 --> 10:01.620
To a certain extent, it could be either depending on how we choose to implement

128
10:01.620 --> 10:07.040
it. But what we're talking about is traffic that's going between the different

129
10:07.040 --> 10:09.000
regions within the cloud.

130
10:09.000 --> 10:14.000
Again, all of our providers offer regions of some sort.

131
10:14.000 --> 10:18.000
And they offer different ways to get the traffic between those regions.

132
10:18.000 --> 10:23.630
But the general idea is that the cloud providers separate their networks into

133
10:23.630 --> 10:27.680
these regions. And again, they may call them different things. This is just a

134
10:27.680 --> 10:29.000
general discussion.

135
10:29.000 --> 10:36.590
Those regions are then usually divided into availability zones or a Z's. Again,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
10:29.000 --> 10:36.590
Those regions are then usually divided into availability zones or a Z's. Again,

136
10:36.590 --> 10:39.000
that's Amazon's name for them.

137
10:39.000 --> 10:49.720
Other providers may have a slightly different name, but it's the same basic

138
10:49.720 --> 10:51.000
idea. Then we use those VPCs or VNets inside of the availability zones.

139
10:51.000 --> 10:56.670
So what we're really trying to talk about right here is actually connecting

140
10:56.670 --> 11:00.000
those VPCs or VNets within the provider.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

141
11:00.000 --> 11:05.120
And there's sort of two major ways to do this. First, of course, we would stay

142
11:05.120 --> 11:08.000
on the cloud or within the cloud provider.

143
11:08.000 --> 11:13.390
Then, of course, the other option is to simply go external external. We would

144
11:13.390 --> 11:16.000
literally just be talking about the internet here.

145
11:16.000 --> 11:20.070
So we send the traffic out through the internet, even though it's going right

146
11:20.070 --> 11:22.000
back to the same cloud provider.

147
11:22.000 --> 11:27.770
This would generally then be considered to be North South traffic because it's

148
11:27.770 --> 11:31.000
leaving the cloud and then coming back to the cloud.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

148
11:27.770 --> 11:31.000
leaving the cloud and then coming back to the cloud.

149
11:31.000 --> 11:35.470
Within the cloud, the different providers, of course, have different offerings

150
11:35.470 --> 11:39.000
here. AWS offers private links.

151
11:39.000 --> 11:45.220
There's VPC peering connections. We have the AWS Transit Gateway and just some

152
11:45.220 --> 11:47.000
attributes of these.

153
11:47.000 --> 11:52.200
They are usually lower latency because they're staying on the provider's own

154
11:52.200 --> 11:58.240
network, but they also usually charge a little bit extra for these types of

155
11:58.240 --> 11:59.000
connections.

156
11:59.000 --> 12:04.000
So overall, you have to make the decision of what works best for you.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
11:59.000 --> 12:04.000
So overall, you have to make the decision of what works best for you.

157
12:04.000 --> 12:10.300
And one other thing to note here is that if you do stay within the cloud, that

158
12:10.300 --> 12:15.170
means you are staying on the service provider's network, not traversing the

159
12:15.170 --> 12:16.000
internet.

160
12:16.000 --> 12:21.970
Therefore, this is actually going to reduce your attack surface and therefore

161
12:21.970 --> 12:27.550
would arguably be a bit more secure than just going out and connecting our two

162
12:27.550 --> 12:28.000
different VPCs.

163
12:28.000 --> 12:34.150
Through an internet connection. Although through the internet, we will be using
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

163
12:28.000 --> 12:34.150
Through an internet connection. Although through the internet, we will be using

164
12:34.150 --> 12:38.000
a secure connection, such as an IP sack VPN.

165
12:38.000 --> 12:43.380
So in this video, we talked about the different types of traffic that we need

166
12:43.380 --> 12:46.000
to control in our cloud environment.

167
12:46.000 --> 12:52.290
And keep in mind by type in this video, what we mean is the type of traffic as

168
12:52.290 --> 12:54.000
far as the flows.

169
12:54.000 --> 12:58.650
We talked about North South traffic being trafficked. It is either entering or

170
12:58.650 --> 13:03.940
leaving the data center or cloud and East West traffic being traffic between
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

170
12:58.650 --> 13:03.940
leaving the data center or cloud and East West traffic being traffic between

171
13:03.940 --> 13:10.000
the servers that we need for things like virtualization and multi tiered

172
13:10.000 --> 13:10.000
applications.

173
13:10.000 --> 13:13.210
So now that we have an idea of what this different types of traffic is

174
13:13.210 --> 13:20.610
involving, let's take a look at some more detail on AWS's offerings for network

175
13:20.610 --> 13:22.000
security.