WEBVTT

1
00:00.000 --> 00:08.400
So exciting news here, especially for those rainy days, Cisco has now joined

2
00:08.400 --> 00:09.640
other companies

3
00:09.640 --> 00:12.760
like Tots in making umbrellas.

4
00:12.760 --> 00:15.840
Wait, no, that's not right.

5
00:15.840 --> 00:16.840
No.

6
00:16.840 --> 00:19.880
Cisco now makes a product called Umbrella.

7
00:19.880 --> 00:25.990
Now joking aside, this is a cloud-based security product that we can use as a

8
00:25.990 --> 00:27.040
secure internet

9
00:27.040 --> 00:32.220
gateway for our SD-WAN environment when going out to cloud providers,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

9
00:27.040 --> 00:32.220
gateway for our SD-WAN environment when going out to cloud providers,

10
00:32.220 --> 00:34.440
particularly for features

11
00:34.440 --> 00:38.840
such as software as a service or SaaS.

12
00:38.840 --> 00:43.530
So let's spend just a moment getting acquainted with what Umbrella actually is

13
00:43.530 --> 00:44.800
and what features

14
00:44.800 --> 00:48.520
it brings to the table.

15
00:48.520 --> 00:52.800
So let's try to answer the question, what is Cisco Umbrella?

16
00:52.800 --> 01:02.340
Well, to start with, it is part of the Cisco Secure Access Service Edge or SaaS
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:52.800 --> 01:02.340
Well, to start with, it is part of the Cisco Secure Access Service Edge or SaaS

17
01:02.340 --> 01:03.000
e.

18
01:03.000 --> 01:08.020
If you're not familiar with SaaSe, this is actually a term that was coined by a

19
01:08.020 --> 01:08.720
company

20
01:08.720 --> 01:15.490
called Gartner in 2019, and the way they define it is it's a network

21
01:15.490 --> 01:17.880
architecture that combines

22
01:17.880 --> 01:23.370
particularly security functions along with our WAN or wide area network

23
01:23.370 --> 01:24.480
capabilities

24
01:24.480 --> 01:31.760
and the goal is to support dynamic and secure access for the organization.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

24
01:24.480 --> 01:31.760
and the goal is to support dynamic and secure access for the organization.

25
01:31.760 --> 01:35.280
And that's exactly what Cisco Umbrella does.

26
01:35.280 --> 01:41.250
Its job is to make it very difficult for attackers to gain access and

27
01:41.250 --> 01:44.520
infiltrate an organization.

28
01:44.520 --> 01:49.520
So of course, the real question comes in, how does it do that and how does this

29
01:49.520 --> 01:50.120
fit into

30
01:50.120 --> 01:56.280
our whole picture of connecting our Cisco devices into the cloud?

31
01:56.280 --> 02:02.300
Well it probably helps that Umbrella is itself a cloud delivered secure
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

31
01:56.280 --> 02:02.300
Well it probably helps that Umbrella is itself a cloud delivered secure

32
02:02.300 --> 02:03.880
internet gateway

33
02:03.880 --> 02:06.320
or SIG.

34
02:06.320 --> 02:08.520
So what does all that really mean?

35
02:08.520 --> 02:13.520
Well what it means is we're going to provide our first line of defense.

36
02:13.520 --> 02:17.560
In other words, this is effectively going to be our firewall.

37
02:17.560 --> 02:20.760
And that is certainly one of its features.

38
02:20.760 --> 02:23.920
But it's a little bit more than that and we'll talk about that as we move

39
02:23.920 --> 02:25.640
through here.

40
02:25.640 --> 02:31.440
What's also cool is that this can actually protect users that are both inside
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
02:25.640 --> 02:31.440
What's also cool is that this can actually protect users that are both inside

41
02:31.440 --> 02:32.480
and outside

42
02:32.480 --> 02:34.640
of the corporate network.

43
02:34.640 --> 02:37.240
It does this in several different ways.

44
02:37.240 --> 02:42.640
The first and of course probably the most important is it blocks any malicious

45
02:42.640 --> 02:43.400
internet

46
02:43.400 --> 02:48.880
destinations before a connection is established.

47
02:48.880 --> 02:53.800
So it actually prevents the connection from being established to begin with.

48
02:53.800 --> 03:00.070
It can do this by blocking unwanted domains, by blocking IP addresses that are
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

48
02:53.800 --> 03:00.070
It can do this by blocking unwanted domains, by blocking IP addresses that are

49
03:00.070 --> 03:00.920
known bad

50
03:00.920 --> 03:02.160
actors.

51
03:02.160 --> 03:06.820
So sites that you know are malicious or you don't want people to go to and it

52
03:06.820 --> 03:07.440
can even

53
03:07.440 --> 03:11.360
do it based on specific cloud applications.

54
03:11.360 --> 03:14.080
So there's a lot of different options here.

55
03:14.080 --> 03:19.080
Let's go ahead and take a look at some of its biggest key features.

56
03:19.080 --> 03:23.440
Basically how does it accomplish the things we just listed above?

57
03:23.440 --> 03:29.880
The first is probably its biggest feature, the DNS layer security.

58
03:29.880 --> 03:32.080
What exactly does that mean?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

58
03:29.880 --> 03:32.080
What exactly does that mean?

59
03:32.080 --> 03:35.520
Essentially it uses DNS.

60
03:35.520 --> 03:39.880
This is how it's actually preventing those connections from happening.

61
03:39.880 --> 03:46.240
If I don't resolve DNS requests to well known malicious sites, I can actually

62
03:46.240 --> 03:47.760
stop the traffic

63
03:47.760 --> 03:53.040
and of course if I stop it completely, that's going to stop it for all ports,

64
03:53.040 --> 03:53.920
protocols

65
03:53.920 --> 03:59.150
and again even direct to IP connections because we're not allowing the name

66
03:59.150 --> 04:00.400
lookup to begin
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
03:59.150 --> 04:00.400
lookup to begin

67
04:00.400 --> 04:01.400
with.

68
04:01.400 --> 04:07.670
Now the way we put Cisco umbrella in the middle of the path so to speak is we

69
04:07.670 --> 04:08.160
're going to

70
04:08.160 --> 04:15.720
point the organization's DNS traffic to the Cisco umbrella global network.

71
04:15.720 --> 04:20.520
This then protects all your devices against threats because it's acting as your

72
04:20.520 --> 04:22.040
DNS server

73
04:22.040 --> 04:26.550
and this is how it's going to prevent those connections from occurring to begin

74
04:26.550 --> 04:26.800
with.

75
04:26.800 --> 04:32.540
Again, that's the final point here is that it actually blocks those requests to
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
04:26.800 --> 04:32.540
Again, that's the final point here is that it actually blocks those requests to

76
04:32.540 --> 04:33.040
known

77
04:33.040 --> 04:40.040
malicious, unwanted or again bad acting domains and the key is before the

78
04:40.040 --> 04:41.640
connection is even

79
04:41.640 --> 04:42.800
established.

80
04:42.800 --> 04:47.980
So there's literally no chance for the bad actors to try to sneak in malicious

81
04:47.980 --> 04:48.640
traffic

82
04:48.640 --> 04:51.560
we never connect to begin with.

83
04:51.560 --> 04:54.280
So this is sort of that first layer of security.

84
04:54.280 --> 04:58.160
It also provides a secure web gateway.

85
04:58.160 --> 05:03.540
This is a pretty cool feature because it offers full visibility into all of the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

85
04:58.160 --> 05:03.540
This is a pretty cool feature because it offers full visibility into all of the

86
05:03.540 --> 05:05.120
internet traffic

87
05:05.120 --> 05:11.160
across all your locations, your devices, your users, all of the devices in your

88
05:11.160 --> 05:12.280
SD WAN and

89
05:12.280 --> 05:17.110
really in your enterprise network because you're going to send all your traffic

90
05:17.110 --> 05:17.280
out

91
05:17.280 --> 05:19.480
to Cisco umbrella.

92
05:19.480 --> 05:24.430
And what's really cool about this feature is it's multi layered meaning it

93
05:24.430 --> 05:25.400
includes things

94
05:25.400 --> 05:29.000
like SSL inspection, URL filtering.

95
05:29.000 --> 05:31.040
It can even do sandboxing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

95
05:29.000 --> 05:31.040
It can even do sandboxing.

96
05:31.040 --> 05:33.240
So there's a lot of really cool features here.

97
05:33.240 --> 05:37.320
And again, we'll be digging into some of these more in the upcoming videos.

98
05:37.320 --> 05:39.920
This again is just our introduction.

99
05:39.920 --> 05:44.200
Now we already mentioned of course that this also includes a firewall.

100
05:44.200 --> 05:50.720
It's referred to as the CDFW or the cloud delivered firewall.

101
05:50.720 --> 05:55.330
This of course functions much like other firewalls where it will log and block

102
05:55.330 --> 05:56.800
all the traffic.

103
05:56.800 --> 06:02.760
And of course, like any other firewall, this can block based on the IP address,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
05:56.800 --> 06:02.760
And of course, like any other firewall, this can block based on the IP address,

104
06:02.760 --> 06:03.200
the port

105
06:03.200 --> 06:08.960
number, what protocols being used, and we can have rules to permit or deny any

106
06:08.960 --> 06:09.720
particular

107
06:09.720 --> 06:12.200
type of traffic we want.

108
06:12.200 --> 06:19.400
There's also a piece here called the cloud access security broker or CASB.

109
06:19.400 --> 06:26.280
Its job is to keep an eye on those SaaS applications specifically.

110
06:26.280 --> 06:32.220
Again it gives us visibility and control over those SaaS applications that we
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
06:26.280 --> 06:32.220
Again it gives us visibility and control over those SaaS applications that we

111
06:32.220 --> 06:32.680
're trying

112
06:32.680 --> 06:36.160
to access from inside of our enterprise.

113
06:36.160 --> 06:42.220
Another part of this feature is it helps manage and hopefully prevent the use

114
06:42.220 --> 06:44.320
of shadow IT.

115
06:44.320 --> 06:48.190
If you're not familiar with the term shadow IT, there's a definition given

116
06:48.190 --> 06:48.840
below this

117
06:48.840 --> 06:51.560
video for more complete answer.

118
06:51.560 --> 06:56.090
But essentially what it means is devices or cloud services that are being

119
06:56.090 --> 06:56.960
implemented

120
06:56.960 --> 07:02.840
by your users without necessarily the approval of the IT department.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

120
06:56.960 --> 07:02.840
by your users without necessarily the approval of the IT department.

121
07:02.840 --> 07:07.620
This is usually going to be for newer technologies that maybe your company hasn

122
07:07.620 --> 07:09.200
't approved yet,

123
07:09.200 --> 07:13.040
but the users have decided that it's a cool feature and they want to use it.

124
07:13.040 --> 07:17.630
So again, maybe some sort of software as a service offering that you haven't

125
07:17.630 --> 07:18.280
approved

126
07:18.280 --> 07:22.270
yet, but your users have decided it would help them with their job and they

127
07:22.270 --> 07:22.960
just start

128
07:22.960 --> 07:23.960
using it.

129
07:23.960 --> 07:29.170
Well again, this can help discover that and manage, in other words, stop it

130
07:29.170 --> 07:30.520
from happening.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
07:29.170 --> 07:30.520
from happening.

131
07:30.520 --> 07:33.440
So that's another pretty cool feature.

132
07:33.440 --> 07:38.840
There's another feature, interactive threat intelligence, which is Cisco

133
07:38.840 --> 07:40.640
umbrella investigate.

134
07:40.640 --> 07:46.110
And what this does is it gives us historical and real time view of different

135
07:46.110 --> 07:47.040
domains and

136
07:47.040 --> 07:49.400
IPs across the internet.

137
07:49.400 --> 07:54.870
And the cool thing is this allows us to predict, which is always an important

138
07:54.870 --> 07:55.880
feature, and

139
07:55.880 --> 07:58.080
prevent attacks.

140
07:58.080 --> 08:00.720
This is coming from insights.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

140
07:58.080 --> 08:00.720
This is coming from insights.

141
08:00.720 --> 08:04.740
And what's really important about that is to understand where these insights

142
08:04.740 --> 08:05.360
are coming

143
08:05.360 --> 08:06.800
from.

144
08:06.800 --> 08:12.560
Since umbrella is a cloud service and it's being offered by Cisco, it can

145
08:12.560 --> 08:14.240
actually leverage

146
08:14.240 --> 08:17.240
Cisco's global network.

147
08:17.240 --> 08:19.200
And what does that give us an advantage of?

148
08:19.200 --> 08:25.640
Well, it gives us fast and reliable protection without sacrificing performance.

149
08:25.640 --> 08:30.790
The way it's able to do this is by using this global network to be more
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
08:25.640 --> 08:30.790
The way it's able to do this is by using this global network to be more

150
08:30.790 --> 08:32.840
predictive and have

151
08:32.840 --> 08:38.440
a larger array of signatures of different types of attacks because it's using

152
08:38.440 --> 08:38.800
Cisco's

153
08:38.800 --> 08:44.010
global network, which of course has visibility into millions of different nodes

154
08:44.010 --> 08:44.800
and traffic

155
08:44.800 --> 08:46.200
types.

156
08:46.200 --> 08:50.960
And one final note here on the umbrella product, there are actually several

157
08:50.960 --> 08:52.320
different packages

158
08:52.320 --> 08:56.160
or bundles that are available for umbrella.

159
08:56.160 --> 09:00.260
There's a link down below to umbrella's product page so you can look at the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

159
08:56.160 --> 09:00.260
There's a link down below to umbrella's product page so you can look at the

160
09:00.260 --> 09:01.480
different offerings

161
09:01.480 --> 09:06.120
and such that Cisco has with the umbrella product.

162
09:06.120 --> 09:11.880
So in this video, we jumped in and just got an introduction to Cisco's cloud

163
09:11.880 --> 09:13.200
based security

164
09:13.200 --> 09:15.280
offering umbrella.

165
09:15.280 --> 09:19.570
Now, over the next couple of videos, we'll spend some time digging into these

166
09:19.570 --> 09:20.200
features

167
09:20.200 --> 09:25.400
a little bit more and taking a closer look at how this fits into the rest of

168
09:25.400 --> 09:26.360
our model.

169
09:26.360 --> 09:31.810
Part of that is also going to be understanding how the traffic flow through the
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

169
09:26.360 --> 09:31.810
Part of that is also going to be understanding how the traffic flow through the

170
09:31.810 --> 09:33.040
umbrella cloud

171
09:33.040 --> 09:35.200
offering actually works.

172
09:35.200 --> 09:38.520
So let's start by taking a look at that in the next video.