Network Security Fundamentals

0:00[MUSIC PLAYING]

0:07Hello and welcome.

0:09My name is Keith Barker.

0:10And this set of videos, you and I.

0:12Get to discuss network security fundamentals, including

0:15the devices and components and ideas.

0:17That we should integrate at the beginning as part

0:20of our network overall designs to increase security.

0:22And a very prominent figure in the posture of security

0:26on networks today.

0:26Is a device called a firewall.

0:29So we'll continue our discussion in the next video.

0:31We will focus on the various types of firewalls.

0:33Their names and what some do and don't do.

0:36That can be critical to our security.

0:38So I'll see you, my friend, in the very next video.

0:00[AUDIO LOGO]

0:06In this video, you and I get to chat about firewalls, including

0:09some types and categories, and features that we really

0:12ought to be looking for when considering

0:14protecting our networks.

0:16And as we focus our attention here on firewalls,

0:19let me also just point out that a firewall doesn't always

0:22mean a network device.

0:24There's also the concept of a firewall that could be running

0:27on a server or on a computer.

0:30And that would be a software based firewall,

0:33that can protect and allow certain things to happen or not

0:35to happen.

0:36For example, a firewall in software

0:38running on this server, could prevent

0:40certain types of traffic from entering into the server.

0:43Or firewall software running on the server

0:45could prevent certain types or certain applications

0:48from running.

0:49However, for this video, specifically, I'd

0:51like to focus on network devices acting as firewalls.

0:55And here's a beautiful image of one right here.

0:57And when you think of a firewall, a network

0:59device that's acting as a firewall,

1:01think of something that's offering resistance.

1:03That's trying to stop something from happening.

1:06Maybe it's stopping certain traffic from going over here to

1:09over there, and part of that might

1:11be only allowing certain types of traffic

1:12through the firewall.

1:14And one of the earliest methods for controlling traffic

1:17through the network at a firewall,

1:19was to use a technique called packet filtering.

1:22And when you think of packet filtering,

1:24which can be done today on firewall interfaces and router

1:26interfaces-- and when I think of packet filtering,

1:29I think of a bodyguard.

1:31Let's say there's a establishment a building

1:33and there's a door right here, and then

1:35we have a bodyguard or a bouncer,

1:37I guess would be a better analogy.

1:38A bouncer who's standing by the door,

1:40and is looking at every who's trying

1:42to come in or out of that door.

1:44So maybe the bodyguard has been given a list saying,

1:46hey, people with orange hats aren't allowed in or out.

1:49So basically check everybody's hats

1:51and if you had an orange hat, it would not allow you in or out

1:53of the building.

1:54And with packet filtering, it was normally

1:56looking at layer 3 information like IP addresses, and/or layer

2:004 information, which could include things

2:01such as the actual protocol on used TCP or UDP

2:05and/or the ports involved.

2:07So if we had a server that was reachable

2:09or the public internet, here at the firewall

2:11we get a rule that says, OK, allow traffic

2:13if it's going to the IP address associated with this server,

2:16and if it's destined for TCP port 443, which is

2:21the well-known port for HTTPS.

2:23That's an example-- if we did it based

2:25on this port, that would be an example of packet filtering

2:28on a network security device.

2:30So if something on the outside try

2:31to come into a different port like TCP port 80,

2:34or some other port other than 443,

2:37the packet filtering rule could say, nope, not allowed.

2:40And packet filtering has been around for decades and decades,

2:43but it's not great all by itself.

2:46For example, let's imagine you have a user right here

2:48and let's call this user 1.

2:51And that user is going out to the internet.

2:54Now, what types of applications and services are they using?

2:57Are they using DNS?

2:58Yes they are.

2:59Are they using HTTPS?

3:01Yes, behind the scenes with TLS very likely.

3:04And with these application layer services,

3:06the client computer is using some high-numbered port.

3:09Let's say it's a 6784, for the UDP port with the DNS request.

3:14And maybe for HTTPS uses 6798, as the source port for the TCP

3:20used.

3:21And that would be at layer 4.

3:22And then, it'd be destined to the well-known port for the DNS

3:25service, which is 53, and for HTTPS it would be TCP port 443.

3:30So with packet filtering, I guess

3:31we could set up a packet filter some rules and said,

3:35please, allow traffic destined to UDP port 53.

3:39And destined to TCP port 443 to support these applications,

3:44and the traffic might be able to go out but what about the reply

3:46traffic coming back in?

3:47So when the replies come back in,

3:49the destination ports are going to be 6874 and 6797

3:52respectively.

3:55And if we have an access control list that's

3:56trying to control all that, how do

3:58we know what those ports are even going to be?

4:00So packet filtering is a function, however,

4:03it's not very efficient for the real traffic

4:06that we have going through our networks today.

4:08So here's what most organizations are going to do.

4:10They're going to take the networks

4:12that they trust the most.

4:13For example, their internal networks, and the firewalls

4:16that are connected to those internal networks,

4:18and they're going to associate those into what's

4:21known as a zone.

4:22So I'm going to call this the inside zone, which

4:25represents these networks, which I fairly trust.

4:27And I say fairly trust because we

4:29don't want to completely trust any networks,

4:31whether they're internal to our company or outside.

4:34However, from a comparison perspective,

4:36we might want to take the networks that we don't manage,

4:39for example, the internet, and associate all of those

4:42with the interfaces on our firewall

4:44to face those networks, and put that in a separate zone.

4:47For example, we could call that the outside zone.

4:49And with those zones in place, we

4:51could then set up policy to say, please, allow traffic

4:54that if it's initiated from devices and networks that

4:58are associate to the inside zone,

4:59and is trying to be routed out to the outside zone,

5:02please, allow that initial flow of traffic.

5:06So that users like user 1, can make DNS requests or HTTPS

5:10requests and go out to the internet.

5:12Now, the challenge is, what about traffic

5:14trying to come back from the outside zone,

5:17and being routed back to the inside?

5:19By default, our firewall is going

5:21to have a policy that says, any traffic that

5:23started that was initiated by a user

5:25out here on the outside that's trying to come to the inside,

5:28we're just going to go ahead and say no to that.

5:31Do not allow that traffic in.

5:32But at the same time, what about user 1,

5:35who's trying to get a response back in?

5:37And that's where we come into our next type of firewall,

5:40and it's called a stateful firewall.

5:44So only the word stateful, and I've also

5:46seen it listed as stateful filtering

5:49or stateful inspection.

5:51All those are great, but the major concept here's stateful,

5:54and here's how it works.

5:55When the user's traffic goes out because it's permitted--

5:58the initial flow goes out from the inside to the outside--

6:01the firewall is going to memorize and remember

6:05the state of that session.

6:06It'll know the ports involved, the source IP addresses,

6:09where it was going to.

6:10And if there's a response that comes back,

6:13that's exactly perfect based on what that client requested.

6:17Meaning, it's going back to that user,

6:19is going to the correct ports.

6:21The firewall because of the stateful table and remembering

6:24that session, will dynamically, allow that reply traffic

6:27to come back in.

6:28So the secret with modern-day stateful firewalls,

6:32is that we need to be able to control

6:34the initial flows of traffic because once that initial flow

6:37of traffic goes out, the reply traffic

6:40through the stateful nature of the firewalls, is dynamically,

6:43allowed back in.

6:44And most firewalls on the planet today are stateful in nature.

6:48They are going to remember the initial sessions going out,

6:50they maintain in memory a state of that connection, and then

6:54that dynamically, allows them to both recognize

6:56and allow that return traffic to come back in.

6:58And then beyond stateful, we have yet another category

7:01or two.

7:02I'm going to mush them together here,

7:03I'm going to call them application aware firewalls.

7:06Another term for this, which I'm also going to put here,

7:09would be a next-generation firewall.

7:13And this is the firewall that's not just

7:15looking at layer 3 and layer 4 information

7:18and doing stateful filtering, which most every firewall does,

7:21however, it also has the ability to take a look

7:23at the payload and the application layer,

7:25and then make decisions on that.

7:27So to really appreciate how a next-generation firewall

7:30or an app aware firewall can be leveraged,

7:32let's imagine we have a policy at our company that

7:34says clients can go out to Facebook

7:37and they can browse Facebook, but they can't use

7:39specifically, Facebook Chat.

7:41They can use Facebook general browsing but no Facebook Chat.

7:44Well, if we have a next-gen firewall that's

7:46application aware and it can tell the difference

7:48at the application layer about what is actually,

7:50going through, is it just Facebook or is it Facebook

7:53Chat, we could then have policy enforced at the firewall

7:56to allow certain types of traffic

7:58based on the applications that are being run,

8:00and then restrict others.

8:02So it's way above and beyond just

8:04looking at layer 3 and layer 4 information

8:05doing stateful filtering.

8:07And next-gen firewall with application awareness

8:09can now enforce policy based on the real applications that

8:13are being used.

8:14Other examples would include allowing a user

8:16to use Google services for searching,

8:18but maybe not Google Drive.

8:20And even though the ports may be identical for those,

8:22an application aware firewall can actually

8:24see what's happening at the application layer,

8:27and then either permit or deny that traffic based on policy,

8:30because it now has the visibility at the application

8:33layer.

8:33And it probably goes without saying

8:35but I'm going to say it anyway.

8:36The Palo Alto firewall, is absolutely,

8:39a very high-end, very capable next-gen firewall that

8:42can do packet filtering, stateful filtering,

8:45and yes, deep packet an application aware inspection

8:49of traffic, which makes it a very valuable resource

8:52as a security appliance in modern networks today.

8:55And since the firewall is actually,

8:57seeing the traffic is going between these zones,

8:59inside and outside, is there a possibility

9:01that a user either intentionally or accidentally,

9:05may try to download some malware or some harmful software

9:08to their system?

9:09Or could we have an attacker on the outside who's trying

9:12to break through the firewall?

9:13The answer is yes.

9:14That's all quite possible and very likely.

9:17And to help identify that that activity is happening

9:20and prevent it when possible, we are going to use a feature

9:22called the IDS or IPS.

9:25And the details of that, we'll cover in the very next video.

9:28So I'll see you in the next video for IPS and IDS

9:31in just a moment.

9:32Meanwhile, I hope this has been informative for you,

9:35and I'd like to thank you for viewing.

0:00[JINGLE PLAYING]

0:07Let's begin with a question.

0:08If there is an attacker who is maliciously

0:11trying to get through our firewall

0:13or compromise our systems, yes or no, do we

0:16want to know about it?

0:17And I'm hoping the answer is yes.

0:19Now, unfortunately, many of the times, do we know about it?

0:22The answer is no until there's a compromise or a breach.

0:25Now, to help us identify, and also protect,

0:27against attacks in our network, we

0:29can use a set of technologies known as IDS, Intrusion

0:32Detection Systems, and IPS, which is Intrusion Prevention

0:36Systems.

0:37And in this video, you and I get to chat about what those are

0:40and how they can work.

0:41So let's start off with the acronym

0:43IDS, Intrusion Detection System.

0:46And a key element here with an IDS

0:48is this part right here, Detection.

0:50The IDS, when implemented as an IDS,

0:53can shout and yell and send alerts

0:55and let us know that there is an attack that's happening.

0:58But it doesn't either do, or have the ability

1:01to prevent the attack from continuing.

1:04And there's many different ways of implementing an intrusion

1:06detection system.

1:08One is we could take our existing

1:09devices, like a firewall that supports IDS,

1:12and we just train it to pay attention.

1:15If the software or the firmware, the hardware,

1:17all supports it and it supports IDS,

1:19we could train it to set off alerts when

1:21it sees malicious activity.

1:23And then those alerts can be responded to and worked with

1:25by the administrators and by the security team,

1:28or another option, if we don't want to have it in line with

1:30the traffic doing the IDS functionality--

1:32we could have another device-- it could be a virtual device

1:35or a physical device--

1:37that supports looking for and identifying malicious traffic

1:40or attacks that are attempted against our systems.

1:42And what we could do is we could take the traffic on the network

1:45and copy it over to this device.

1:48So maybe we're copying all the traffic

1:50for the VLAN or all the traffic that's

1:52coming in or out of the router interface.

1:55And we copy it down here to the IDS device.

1:57It analyzes the traffic.

1:58And then it sends off alarms, indicating

2:00that it found something.

2:02So the key here with IDS, whether it's in line,

2:04like this firewall is, supporting IDS,

2:06or it's a device that's just getting copies of the traffic,

2:09if it's configured as IDS, intrusion detection only,

2:12it can set off alarms when it sees malicious activity.

2:15However, it's not going to prevent the attack

2:17from continuing.

2:18And one common thought that many people have

2:20is, well, if it can see the attack, why doesn't it stop it?

2:23And if we configure a device that can stop the attack,

2:26that would then be implemented as an IPS, Intrusion Prevention

2:32System.

2:33So if we were going to implement a system as an intrusion

2:36prevention system, it has to have the ability

2:38to not only see the attack that's happening,

2:40but also to go ahead and prevent it

2:42from getting any further in the network.

2:43So if we're doing IPS, we couldn't

2:46have just a copy of the data being sent to that device

2:48because, if we did, and it seems an attack,

2:51it's not in line with it.

2:52It can't stop.

2:53So IPS pretty much means it's in line with the traffic

2:57that it's analyzing.

2:58So if it sees an attack, it can stop an attack.

3:01So if we implement it here on the firewall with the IPS

3:04services-- let's imagine we have a hacker out here

3:06on the internet who's trying to compromise us.

3:09And maybe that attacker is trying to reach these servers.

3:11And we have IPS enabled.

3:13So it's looking at the traffic.

3:14And it sees, well, that's malicious.

3:16The firewall can then go ahead and stop the attack right there

3:19and not let it get through to the servers,

3:21hence doing intrusion prevention.

3:24And based on the vendor of the IDS or IPS system,

3:27they use a variety of methods for looking at and identifying,

3:31hopefully correctly identifying, malicious traffic or attack

3:34traffic.

3:35And sometimes, it gets it right.

3:37And sometimes, it gets it wrong.

3:39And when an IDS or IPS gets it right,

3:41it's called a true positive, which

3:45means it saw something malicious,

3:47it called it out as malicious, and it got it right.

3:50Also, if it sees traffic that is not malicious,

3:52like just innocent traffic, no harm done,

3:55and it doesn't send off an alarm, that would be

3:57an example of a true negative.

4:00And in a perfect world, which we don't yet live in,

4:03all we want is true positives and true negatives,

4:06to have the IDS or IPS device correctly

4:08identify malicious traffic and not

4:10accidentally label innocent traffic as malicious.

4:14So if we have a situation where it's not going quite as planned

4:18and it identifies innocent traffic as malicious,

4:21that would be called a false positive.

4:24And if there was a situation where we are being attacked,

4:27and yet the IDS or IPS didn't recognize it as malicious,

4:31that would also be bad.

4:32That would be a false reading, and that

4:34would be a false negative.

4:36And those are tougher because if your IDS or IPS isn't setting

4:39off alarms, you'd have to have some other indication

4:42that there's a compromise or that the attack is happening.

4:45And so with any IDS/IPS system, there

4:47is going to be some tuning and tweaking

4:49with the goal of getting in the true category, accurate

4:53identification of malicious traffic

4:54and not sending off the alarm when innocent traffic is going

4:58through the network.

4:59And if the question comes up in your mind, well,

5:01does the Palo Alto firewall support IDS and IPS services,

5:04the answer is a resounding absolutely yes.

5:08And it does a fantastic job, at that.

5:11So for the next video, what I'd like to do

5:13is talk about a situation where we've got a user,

5:16for example, here that needs to securely access

5:19corporate resources, or maybe we have the headquarter site here

5:23and we have a remote site here, and we

5:24want to have a secure communication path between them

5:27and leverage the internet.

5:28To pull that off, we're going to use

5:30some flavor of virtual private network, which is

5:33the topic for our next video.

5:35So I'll see you there, my friend, in just a moment.

5:38Meanwhile, I hope this has been informative for you,

5:41and I'd like to thank you for viewing.

0:07Over the past few years, the use of virtual private networks

0:11to protect traffic between two different sites

0:13whether it's a user at their home office,

0:15or at home going to a corporate resource,

0:17or protecting traffic going from site 1 of a company to site 2,

0:21the use of VPNs is just grown, and grown, and grown.

0:24And so, in this video I'd like to chat with you, about some

0:26of the terms, and technologies, and options, that we have

0:29when using virtual private networks.

0:32And there's a couple of broad categories regarding

0:34virtual private networks, and let's start off

0:36with a remote access VPN, Virtual Private Network.

0:41Now the virtual private network itself,

0:43is going to allow us to provide authentication,

0:46to verify who's at each end of this VPN tunnel,

0:48and also once that tunnel is established, this VPN tunnel,

0:51to protect the traffic that's going between the two

0:54endpoints of that VPN tunnel.

0:56So a remote access VPN is when we have an individual device.

1:00Let's go ahead and have a user out here on the internet,

1:03and that user's got a PC, and they're

1:05connected to the internet, and that user

1:07wants to build a tunnel and have access

1:09to our corporate resources.

1:11So what they do, they run some client software

1:13on their computer.

1:14And then that client software would initiate and build

1:17a logical path, and that logical path

1:20that's going over the internet would be the VPN tunnel,

1:23and it would terminate here, at the firewall,

1:25meaning the firewall would be the other end of that tunnel.

1:27And so the firewall's not just going allow anybody to connect,

1:30it's going to require authentication of that user

1:33to verify who it is.

1:34And then once it's all set up all the traffic that's

1:36going back and forth, including the traffic over the internet,

1:39is simply going to be encrypted.

1:40So somebody can steal that data but because they're not

1:43being able to decrypt that data, they

1:45won't be able to make sense of it.

1:46And that way we're protecting all that traffic, even

1:49over untrusted networks, because we're using the VPN.

1:52Now in a Palo Alto environment, the way

1:53we would implement this remote access VPN,

1:56is through a service called GlobalProtect.

1:58And I'll walk you through how to configure that

2:00as part of our PC NSA and PC NSC Course Ware.

2:04But for now, just be aware that that's

2:05the method that we can use to implement a remote access

2:08VPN between a user and a Palo Alto device,

2:11or our corporate VPN endpoint.

2:13And regarding the VPN itself, there's

2:16actually a couple of different technologies behind the scenes

2:18that can be used to pull that off.

2:20We could use a technology such as IPsec,

2:23which is a standard based protocol

2:25for encrypting VPN traffic, or we could also leverage SSL/TLS.

2:30The same technology we're using when

2:32we go to a secure web server, we can use that technology

2:35as well.

2:36So when we set the firewall, we set the client to connect,

2:39between the two they'll negotiate which options they

2:41want to use, and as traffic goes back and forth over the VPN,

2:44it's encrypted and protected.

2:46Now one other element when we're talking about remote access

2:49VPN, is let's imagine this whole network here is the 10 network.

2:53Let's just go ahead and do a 10.0.0.0 with an 8 bit mask.

2:56So it's the 10 network.

2:58And let's also imagine this user right here

2:59has established the VPN to the firewall.

3:02My question is, which traffic should go over the VPN?

3:06Traffic just to the 10 network, or should we also

3:09include all traffic from this computer that's

3:11going to the internet and send that over through the VPN

3:13as well?

3:14And it depends on a few factors, and let

3:16me share with you some of those considerations.

3:19If we're worried about this computer being compromised

3:22and being connected to remotely from the internet,

3:24we may want to force all the traffic-- when the VPN is

3:27up and running, we may want to force all the traffic

3:29through the VPN, so we can analyze the traffic here

3:32and make sure everything's safe and sound.

3:34However, if this user is going over to a web server over here

3:37on the internet, the traffic would

3:39have to go through the VPN, and then back out to the internet,

3:44and then that internet server would respond back here,

3:47and then the traffic would go back through the VPN

3:49to the client.

3:50So there's some extra traffic and extra utilization

3:53if we're tunneling everything.

3:55So there's another option that we can set up,

3:57and it's called split tunneling.

4:00And with split tunneling we can set up

4:01a policy that says when this VPN user connects,

4:04only send traffic through the VPN tunnel

4:06if it's destined for this 10 network.

4:08And that way if this user is going to this server

4:11up here, at 23.

4:12whatever the IP address is of the server,

4:14that traffic to that server can go ahead and just

4:16go naturally as it would out to the internet,

4:19while any traffic that is going to the 10 network

4:21would go via the tunnel.

4:23So that's an example of split tunneling and controlling

4:26which traffic is going to go through the tunnel,

4:28and which traffic just goes directly out to the internet

4:31and doesn't have to go through the tunnel.

4:33All right, so for remote access VPN,

4:35our technologies are IPsec as we mentioned and SSL/TLS,

4:40and we also mentioned that we could

4:41use split tunneling with that.

4:43And there's some other options that

4:45are vendor specific that we could

4:46use as well for tunneling.

4:48But generally speaking, that sums up remote access VPNs.

4:52So let me clean this up, and let's

4:53talk about the other major category for VPNs.

4:56And that would be a site to site VPN.

5:02And here's the idea behind that.

5:03So once again, here we have the headquarters network.

5:07That's HQ.

5:09And let's imagine this is our branch office.

5:12We'll call that site 1.

5:14And for this scenario, let's say that the only connectivity

5:16between the headquarters site here and site 1

5:19is the internet.

5:20So the headquarters is connected to the internet,

5:22site 1 is connected to the internet,

5:24and we want to have secure communications between users

5:28and devices at site 1 and users and devices over here

5:31at headquarters.

5:32So what we do is we have a VPN endpoint here.

5:36And once again, the Palo Alto firewall can do this handily.

5:39And we can set up an IPsec tunnel between the headquarters

5:42location and site 1.

5:44And for site to site VPN tunnels, like we're

5:46doing right here, the primary protocol

5:48we're going to use for that is a suite of protocols

5:51called IPsec.

5:52So that'd be an IPsec site to site virtual private network.

5:56And then we could also be very specific.

5:58So if this was the 10.1 network over here on the left with

6:02a 16-bit mask and over here at site 1 it was 10.2.0.0 with

6:08a /16 bit mask, we could configure the firewalls

6:11and the IPsec site to site tunnel to only forward traffic

6:14over that site to site VPN if it's going between 10.1

6:18and 10.2, between those two networks.

6:21So a user at computer 2 could access a device or a resource

6:25over at the branch office, and that communication path

6:27would go through the switch, through the router,

6:29through the firewall, then encrypted through the tunnel,

6:32at the branch office site it would decrypt that traffic,

6:35and then forward it on to its destination.

6:37For the reply back, it would go back

6:38to this device, who would then go ahead and identify, oh,

6:41I need to encrypt this and ship it over the tunnel,

6:43because going back to the 10.1 network.

6:45So it encrypts the traffic, ships it

6:46over to its peer who decrypts it,

6:48and then forwards it along the way down

6:51to the original client.

6:52So these are the two types that we're primarily

6:54working with when we're working with companies.

6:56We have remote access VPNs, as we mentioned, and site to site.

6:59And there is, of course, other labels for VPNs

7:02when they may be used.

7:03Some of those are for anonymity-- somebody's

7:05on the internet and they don't want their internet service

7:07provider to see what traffic they're sending,

7:09so they build a VPN to some service.

7:11And there's also The Onion Routing network, TOR.

7:14That's going to use multiple layers of VPN.

7:17Most of that also is for anonymity.

7:19However, when we talk about corporate VPNs,

7:22we're primarily talking about remote access VPNs,

7:25to allow an individual user to get to their stuff

7:27at a corporate resource, and site to site VPNs, which

7:31logically provides protection and encryption of all

7:34the data and all the traffic going between those two sites.

7:37Now another key point, I'd like to chat about is,

7:40if we have a user and that user has access to data,

7:42which many of our users do-- that's why we're trusting with

7:45log ins and authentications and everything else to have access

7:47to data--

7:48what is to prevent a user from taking some data which

7:51shouldn't be leaked out, and then forwarding it

7:54out the network to some other resource.

7:57And the answer is, in many environments,

7:59there's not too much stopping that.

8:00For example, a user just emailing a file to themselves,

8:04to a public email address, or to an email address

8:06that can be reached outside the corporate network.

8:09So hopefully our users will have security training,

8:12and they'll sign agreements regarding

8:13what they will and won't do.

8:15But what I'd like to do in the next video,

8:17is talk about what we can do, from a network security

8:19perspective, to prevent data loss.

8:22And that's with DLP, Data Loss Prevention.

8:26And that's the topic for our next video.

8:27I'll see you there in just a moment.

8:29Meanwhile, I hope this has been informative for you,

8:32and I'd like to thank you for viewing.

0:00[MUSIC PLAYING]

0:07In this video, you and I get to discuss DLP--

0:09data loss prevention-- and how network security appliances

0:13and devices can help us in preventing that data loss.

0:17So one of the first elements regarding data loss prevention

0:19is to make sure we identify what data we don't want to lose.

0:23For example, we may have IP, intellectual property,

0:26or company secrets that we don't want to reveal.

0:29Or we may have PII, personally identifiable information,

0:32like social security numbers, and credit card numbers,

0:36and other data that we don't want released into the wild.

0:38And so, one of our first steps in protecting

0:41that data is security training for our users to make sure

0:44that the users know exactly what data they're dealing with

0:47and what the security measures should be as far

0:49as their handling of that data.

0:51And also to let them know that there is some auditing going on

0:54and that they're agreeing to all of that.

0:56So what are some methods that a user--

0:58if that user is either disgruntled or they're

1:00blackmailed, what are some methods that a user could use

1:03to extract data from the organization

1:06and get it out to the wild?

1:08There's lots of options, including

1:10flash drives or just drives in general

1:12that they plug into their computer.

1:14And they just move the data to that flash drive.

1:16And they carry that flash drive out with them.

1:18So as a precaution to that, sometimes

1:20computers are set up in policy so that they

1:22don't accept USB devices.

1:24So in a corporate network with a corporate computer,

1:26if they set up the computer through policy so

1:28that it can't even accept the USB device-- not a physical

1:31lock perhaps, but rather just logically.

1:33You put in a USB drive.

1:34It just does nothing.

1:35That'd be one way to help protect against that.

1:37But other ways would be, as I mentioned earlier,

1:39they could just email it to themselves

1:42at a different address.

1:44Or they could reach out to an FTP or some other server that's

1:48doing file transfer services and just copy it out.

1:50And so, some measures that we can

1:52take in the interim with the security plans

1:54with data loss prevention is, first of all,

1:56we need to worry about encryption,

1:58because if a user has an encrypted session going out

2:01to a server on the internet, like HTTPS even, the firewall--

2:05if it's all encrypted traffic, it can't really

2:07look at the application layer and see what the heck is going

2:09on, or analyze the data, or look for credit card

2:12numbers, or things that look like social security numbers,

2:14or whatever the identifying numbers are

2:16in your part of the world.

2:17So one of the elements we need to do

2:19to help with data loss prevention

2:20is to do some decryption.

2:23So our next generation firewalls need

2:25to do decryption of the SSL/TLS traffic just for a moment,

2:30so they can look at the application layer data

2:32and see what is it that's going out.

2:34And so if we have our email server here behind the firewall

2:37and the firewall is doing that analysis,

2:39the firewall can say, whoa, whoa, whoa, whoa,

2:41we have some data here that looks like it's

2:43matching credit card numbers or the patterns for credit card

2:45numbers.

2:46Or here's a file that's trying to go through,

2:48and we're not allowing files to go through.

2:50And the ability for a next generation

2:51firewall to actually do that decryption--

2:54that is a double-edged sword because we may or may not

2:57want the firewall to be able to see some information.

3:01For example, if we've allowed this user here

3:02at this computer to go out to a banking website,

3:06it's very likely we are not going

3:08to want to decrypt that traffic and have the firewall be

3:12able to see information such as usernames,

3:14or passwords, or anything else that may be going on

3:16in that session.

3:18Or, if this client is accessing medical records,

3:21we probably don't want a firewall to decrypt that.

3:24So we'd have to set up in policy for some exclusions regarding

3:27what types of sites to not do the decryption on.

3:30But then, almost everything else, we'd want the decryption.

3:33And then we could start looking for specific patterns of data

3:36that represent sensitive information that should not

3:39be sent through the firewall.

3:40So once again, with decryption in place, if we enable that,

3:43that allows the firewall to do the application layer

3:45inspection, where it can see the data unencrypted

3:49and then look at the payloads in those packets.

3:52And then, because it's in line, it

3:53could actually stop it right there

3:55from continuing any further.

3:56And as we consider the security functions

3:58that a device can bring to the network--

4:01so far at this point, the Palo Alto Firewall,

4:03as a next gen firewall, can do everything we've

4:05talked about up to this point.

4:07And so if you have a device that can do many, many, many things,

4:10does that mean you should do everything on that device?

4:13And it boils down to, is that device powerful enough

4:16as far as CPU and resources to do all that analysis

4:20and not slow the traffic to a crawl?

4:22And if the hardware and firmware is up to speed

4:24and can handle it, then the answer is absolutely yes.

4:27We could do a lot of different types of inspections

4:30and analyses on the traffic, including

4:32IPS, data loss prevention, terminate

4:35a VPN tunnel, and more.

4:37And so when we have a device that can do multiple things,

4:39that's oftentimes referred to as a UTM,

4:42which is an acronym for unified threat management.

4:46And that, my friend, is the topic for our next video--

4:49unified threat management.

4:50So I'll see you there in just a moment.

4:52Meanwhile, I hope this has been informative for you,

4:55and I'd like to thank you for viewing.

0:00[AUDIO LOGO]

0:06I've always been amazed at multitasking.

0:08And I went to a show once where there was a performer,

0:11there was a juggler, and a comedian.

0:13He had like 5 things going on all at the same time,

0:15and telling jokes.

0:17It was fantastic.

0:18Well, if we have a security appliance that

0:20can do lots of different things at the same time,

0:23that's also pretty impressive.

0:24And that can be referred to as a UTM, a Unified Threat

0:29Management system.

0:30So in this video, let's take a closer look

0:32at some of the functions and features that

0:34might be incorporated into a single package.

0:37So the concept here with unified threat management

0:39is having one device do multiple things.

0:41And I also want to point out before we

0:43get too far into this, is that if we

0:45have a system that is overloaded,

0:47for example, CPU is through the roof,

0:49it's almost out of resources, it may not

0:51be able to perform well at even one or two things, let alone

0:54five or six.

0:55So if you ever have standalone devices, like one device that

0:59does IPS, and a separate device that does VPN services,

1:02and a separate device that does data

1:04loss prevention, and a separate device looking

1:06for email security, it's very likely from a performance

1:09perspective that having dedicated separate devices

1:12will have a greater capacity for that type of analysis and work.

1:17However, it also might take some more management,

1:19because you have multiple separate devices.

1:20And certainly, it would have more cost

1:22if you had separate appliances, either physical or virtual,

1:25for each of those functions.

1:27So what I'd like to do is just do a quick summary of many

1:30of the features that can be found on a unified threat

1:33management system.

1:34And a few of those we've already taken a look at,

1:36so it might be a little bit of a reminder for a couple of those.

1:38One of the elements that we'd want in a unified threat

1:41management system is looking for malware, and if it sees it,

1:44to go ahead and deny it.

1:46So that malware doesn't get through our network

1:48and to our computers.

1:50So we can call that anti-malware.

1:53And as part of anti-malware, we'll

1:55also throw into that viruses and stuff like that

1:57that we don't want to be forwarded through our network.

2:01Another great feature of a device, if it's a UTM

2:03would be anti-spam.

2:06Where it could identify correctly spam or at least 90

2:09plus percent of spam, and just drop it.

2:12So that way it never makes it to our users inboxes.

2:14So if we can stop the spam before it

2:16gets to the email server, we're going

2:18to prevent those email messages, which never made it

2:20to our email server, from actually, getting

2:22into the inbox on our clients.

2:24Another type of feature we might want in a unified threat

2:26management system, would be content filtering.

2:29And when I use the word content, I'm

2:31talking about fairly broad filtering.

2:33For example, do we want our users

2:35right here going to certain categories of websites?

2:38And the answer is, probably, not.

2:40We may have a corporate policy about what

2:42categories of websites are acceptable

2:44from corporate resources.

2:45So as an example, let's say we don't want our users

2:48to go to a gambling website.

2:50So we'll say, No gambling.

2:51So a unified threat management system

2:53with you URL filtering capabilities,

2:55could see a DNS request, for example,

2:58and through some intelligence from the cloud identify,

3:00whoa, this URL you're trying to go to

3:02is for a website that has been categorized as gambling,

3:05and then the firewall can say, nope, I'm

3:07not going to allow that traffic to go through.

3:09Or going back to our Facebook example.

3:10If we want to allow users to go to Facebook

3:12but we want to deny them the ability to Facebook Chat,

3:16we could specifically, based on application layer inspection,

3:19set up a policy that says, permitting Facebook the base

3:22services but we're not allowing Facebook Chat,

3:24and then our unified threat management system

3:26could enforce that policy.

3:28So they go and clean that up a little bit.

3:30Another example of a feature we might want on a unified threat

3:33management system would be DLP, Data Loss Prevention.

3:36We talked about that in the previous video.

3:38So with the UTM looking for strings of characters that

3:42look like sensitive information like birth

3:44dates or credit cards or identification numbers

3:46used by the country that you're in.

3:48If it's trained to look for those,

3:49it could then go ahead and stop that traffic,

3:51and not allow that traffic to be forwarded through the firewall.

3:54We'd also want our firewall to do stateful filtering,

3:57or sometimes called stateful inspection.

4:00And that's where we're allowing initial traffic

4:02to flow out, and then the reply traffic if it matches

4:06the correct reply traffic based on the client's requests,

4:08is dynamically, allowed back in.

4:11Well, at the same exact time, somebody on the outside who's

4:14trying to initiate a connection that's not a reply,

4:17would just be dropped by the firewall

4:19and not allowed further into the network.

4:21Other features on a UTM, would be

4:23features such as IDS, Intrusion Detection, and also

4:26Intrusion Prevention Services.

4:28And a lot of times when companies implement IDS and IPS

4:30, they'll start with the IDS.

4:32Even if it's in line, they'll start with IDS

4:34so they can just be aware of what's happening.

4:37And then they can start dialing it in,

4:38and tweaking and tuning it, and then they

4:40can enable the IPS functionality.

4:42And that way when they're actually dropping traffic

4:45that it identifies as malicious, hopefully, by that time

4:48they're not having false positives,

4:49and they're not dropping traffic that is actually, innocent.

4:52And that's how most organizations

4:53are going to move towards IPS.

4:55Is with IDS first, and then they simply flip a switch

4:57and say, OK, great now start dropping traffic

4:59if you see it as malicious.

5:01And another common element in the unified threat management

5:04system would be the support for VPNs, which we also talked

5:08about in a previous video.

5:10So one of the key elements to keep in mind

5:11is that, even if this device, A device,

5:13supports all those features, we only have so much CPU and RAM.

5:19And we want to be careful not to overload it

5:21with too many services and functions,

5:23especially, if a device is in line like this, where

5:26if it goes down or has a problem,

5:28he's just caused a problem for the entire network.

5:31So that's an overview of unified threat management systems

5:34that incorporate many security features in one device.

5:37And in the next video, you and I get

5:38to chat about endpoint security.

5:40So I'll see you there in just a moment.

5:42Meanwhile, I hope this has been informative for you,

5:45and I'd like to thank you for viewing.

0:00[MUSIC PLAYING]

0:07And welcome back.

0:08In this video, you and I get to chat about endpoint security.

0:11Now, we ought to start the conversation with,

0:13what exactly is an endpoint?

0:15An endpoint is some node that's attached to your network.

0:18It could be a Windows computer.

0:19It could be Linux.

0:20It could be Mac.

0:22It could be a server.

0:23It could be a mobile device, could be a printer, just

0:25the devices that are on your network

0:26and either providing or requesting

0:28or both services on your network.

0:30So what can we do to protect those devices?

0:33And the reason this discussion is important

0:34is because up to this point, we've primarily

0:37been talking about a network device that's

0:39standing in the middle between, for example,

0:41users and their computers and other network resources.

0:44But at the actual host, the endpoint,

0:47there are several things that we can do to improve security.

0:50So let's go ahead and jot down endpoint security.

0:53And one of those elements is to lock that computer down,

0:57meaning don't let users log on as root

1:00on Linux or as the administrator or with those equivalent

1:03rights on a Windows computer.

1:04You want to give them just enough rights

1:06so they can do everything they need

1:07to for their corporate responsibilities

1:09for the company, but no more.

1:11And that way, if they do get some malware

1:13or some other software, if they don't

1:15have enough rights to actually run or install the software,

1:17that's a great step towards preventing that machine

1:20from being infected with the malware.

1:22So limited rights.

1:24Another element we'd want on our computers would be to have some

1:28anti-malware software, which is looking for--

1:33both on the disk and also in memory--

1:35looking for viruses and malware with the intention

1:39of preventing it.

1:40And there's actually a whole nother level, or whole nother

1:42category of software that we can also use on our endpoints,

1:45including servers and workstations,

1:47and that would be host-based IPS.

1:50Now, sometimes, I've seen it as HIDS

1:53for Host-Based Intrusion Detection

1:54System, or host-based IPS.

1:57In either case, it is software that's

1:59running on that computer, and if we have a list

2:02of specific applications and services and calls that

2:05can be made, both to the registry on Windows,

2:08or to the file system on Linux, or to the network

2:11on either one, that host-based software that's running

2:14can enforce that policy.

2:16Another term for this type of protection

2:18would be a personal firewall or a software-based firewall,

2:21which could also identify and then permit or deny

2:23certain types of activities, whether it's to the file system

2:26or to the network, based on how that software is set up.

2:29And if there is malicious software that's

2:31identified on a computer, we then

2:33want to make sure we have the appropriate actions that can

2:35be taken against that system.

2:37And one of those is to do a quarantine, where,

2:39logically, the computer is removed from the network,

2:41so it can't damage or can't harm other systems until we can

2:44go over and take a look at it and see what's

2:46going on with that system.

2:47So that would be a network perspective regarding that host

2:50to quarantine it.

2:51Now, another option instead of a whole system quarantine

2:53is we could actually take the malware that's been identified

2:56and quarantine just the file, or we could delete the file,

3:00or we could set an alert.

3:02And hopefully, the alert would be associated

3:04with either of those activities, whether we're

3:05quarantining a file or deleting a file that

3:07was seen as malicious.

3:08And there's different methods that

3:10can be used to identify if software is malicious or not.

3:13And that same type of technology could

3:15be used on a network device looking

3:17for malware as well as software running on an endpoint.

3:20And one of those options regarding looking for malware

3:22would be signature-based, which has been around

3:24for a long time, and as vendors of security products

3:27identify new malicious software, they

3:30update their signatures so the software can check for it.

3:32However, that's not the only method

3:34that can be used to identify malware.

3:36There's also anomaly-based software,

3:38and with anomaly-based we're looking for exceptions

3:40like, hey, this is the norm from a firewall perspective.

3:43This is the normal traffic that we've seen over time,

3:45and now we're seeing this other type of traffic.

3:47That would be anomaly-based.

3:48Or in an endpoint, if a certain application

3:50makes specific calls all the time,

3:52and then all of a sudden out of blue

3:53it starts behaving differently, an anomaly-based system

3:56potentially could identify that difference

3:58and say, whoa, something's up.

4:00Another technique that can be used when looking for or trying

4:02to identify malicious software is

4:04to use container-based protection and analysis.

4:08So let's imagine a computer right here,

4:10and it's got some applications that are running.

4:12If one of those applications is malicious

4:14and tries to go rogue, it could affect and infect

4:17the whole system.

4:18But with a container-based model, what we could do

4:20is run each of those apps inside of its own protective little

4:23bubble.

4:24And if one of those apps starts to behave badly

4:27or is identified as malicious, we

4:28can go ahead and just shut down the bubble, and it is done.

4:31And that's how a container-based system, by keeping

4:33the applications separate and easy to completely shut down,

4:36can protect a system in the event

4:38we have a rogue application trying to run.

4:40And probably one of the toughest and most important endpoint

4:44devices that we would want to protect

4:46would be mobile devices.

4:48And some precautions and steps that we'd

4:50want to take regarding mobile devices

4:52is some type of a remote wipe feature.

4:54So if a device is stolen, we can basically

4:57send a self-destruct message, which

4:59it won't make smoke come out of it,

5:00but it can wipe off all the data on that device.

5:03So that way, we're protecting our sensitive data.

5:05Another great option from mobile devices to protect the data

5:08is full disk encryption on the mobile device

5:12and all of its storage.

5:14So that way, if a device is stolen,

5:16and if the attacker can't compromise the credentials

5:19to log in on that device, the actual media

5:22is just going to have a bunch of encrypted data

5:24that doesn't make sense to anybody, which

5:26protects any sensitive information from falling

5:28into the wrong hands.

5:29We'd also want some type of a mobile device management

5:32system.

5:33And with a mobile device management solution,

5:35we could implement our policy centrally

5:36and then have that pushed out and updated and maintained

5:39across all our mobile devices that

5:41are participating as part of that mobile device management

5:44system.

5:44And in the next video, I'd like to wrap up

5:46this set of videos with a discussion regarding

5:48the importance of identity and access management

5:51and also configuration management.

5:53So we'll handle that in our next video.

5:54So I'll see you there in just a moment.

5:56Meanwhile, I hope this has been informative for you,

5:59and I'd like to thank you for viewing.

0:06In this video, I'd like to chat with you

0:08about identity, access, and configuration management.

0:12And let's begin this with an analogy of you

0:14and I-- this is us, you and me-- walking into a bank,

0:17and we want to make a withdrawal.

0:19Let's think about what would be required to actually get

0:23some money from the bank, assuming we are legitimately

0:26withdrawing some money.

0:27The first thing they're going to ask us to do

0:29is to prove who we are.

0:32So that ID could take several different forms.

0:34It could be a state issued identity card,

0:37or a driver's license, or a passport, or something

0:39similar to that.

0:40And we can refer to that process as authentication.

0:43And then the next portion, if we're asking for a withdrawal,

0:46they would want to make sure that we're authorized

0:48to make that withdrawal.

0:49So they know who we are, are we authorized

0:51to take the money out, and do we have money in the account, all

0:53that good stuff, and then refer this step as authorization.

0:57So, let's imagine that we have some money in the bank.

0:59We are the authorized account holders.

1:01We're authorized to take it out, so they give us the cash.

1:04So, cha-ching, we have a couple of units of money in our hand.

1:07We've got the money, and what are they

1:09going to do when they give us that money?

1:11Are they going to remember that they gave it to us?

1:13And the answer is absolutely yes, they

1:15are going to account for that and have it detailed

1:18that they gave us that money, and that step

1:20is referred to as accounting.

1:22So, in the networking world, that's

1:23referred to as AAA, the authentication, authorization,

1:27and accounting.

1:28So, here is an example.

1:29Let's say we have a user at this computer,

1:31and that user wants to go out to an internet resource.

1:34So, in policy, we can have a policy that says,

1:36if you're a member of group A, and you're using SSL/TLS,

1:41and also let's just assume you're not

1:43going to some malicious site, then,

1:45in policy, we can specify that we're

1:46going to allow that initial flow of traffic to happen.

1:48And then the reply traffic coming back,

1:50would be dynamically allowed back to the user

1:52due to the stateful nature of the firewall.

1:54So, how do the AAA components apply here?

1:57Well, if this user's traffic-- let's say user's at 10.1.0.51,

2:01and that traffic shows up here.

2:03The firewall needs to have some way

2:05of knowing who that user is.

2:06And so, in the background, maybe we queried Active Directory,

2:10or we're using some feature like User-ID,

2:12which is really amazing on the Palo Alto firewall,

2:14and maybe it's using all those methods

2:15and yet it still doesn't know who the user is behind this IP

2:19address.

2:20So, we have a feature we could use

2:21called Authentication Portal.

2:24And it basically stops the user in their tracks,

2:26gives them a screen, says, hey, who are you?

2:28And then the user can put their username in and password in.

2:31The firewall can verify that on the back end with, like,

2:34an LDAP server, and then once it verifies who it is,

2:37it then says, OK, great, this matches policy,

2:39you're a member of that group, and I will allow your traffic.

2:42So, that would be an example of the authentication,

2:44the firewall making sure it knew who the user was behind the IP

2:47address, the authorization based on the policy saying

2:50that traffic is allowed, and then, in the accounting logs,

2:53it's going to have a wealth of information, such as this user,

2:57whatever their username is behind that IP address,

2:59that user went to this site and that site and used these apps,

3:02and that's all accounted for in the log files on the firewall.

3:06And the AAA isn't just applicable for end users

3:09going through the network.

3:10It's also super critical for administering the network.

3:14So, for you and I, if we're managing this firewall,

3:16we're logging on either directly to the firewall

3:18or to the Enterprise Management system

3:20Panorama for managing a bunch of firewalls.

3:22We want to make darn sure that the interface is allowing

3:26us access there, has done the authentication,

3:28they know who we are, it's going to check for authorization,

3:31are we allowed to make those changes, and, after we do so,

3:34have accounting records that specify what we did.

3:37And one of the common themes in Palo Alto is zero-trust,

3:42meaning don't trust anything.

3:44So, if an administrator wants to connect and manage a firewall,

3:47they're going to have to prove who

3:48they are, and without that authentication

3:50and subsequent authorization, we can protect

3:53unauthorized changes from happening

3:55or unauthorized activity from flowing through our networks.

3:58And also, a big part of identity is

4:01having some type of centralized identity services,

4:04and in many cases, companies are using Active Directory,

4:07Microsoft Active Directory.

4:09So devices such as firewalls can make queries

4:11into Active Directory or go into a server that's

4:14looking into Active Directory like LDAP.

4:16And having a centralized database of our user accounts

4:19is super helpful, because that way, if a user, like user 1,

4:22has to change the password, they don't

4:24have to do it at five different places.

4:25They can do it in Active Directory

4:27or that centralized database.

4:29And then, if everything else on the network

4:30is referring to that Active Directory

4:32or that centralized identity store,

4:34that makes it much more seamless and less prone to errors

4:37as opposed to having to go to five or six different devices

4:40and change your password on each and every one of those devices.

4:43And another great way to help control access

4:45is to base it on groups.

4:48So if we give a group permission to manage the firewalls

4:52or we give a user group permission

4:54to go through the firewall, it's a lot simpler

4:56to maintain our environment because we have,

4:58like, group 1 and group 2 and group 3.

5:01We can simply add or take away users out of those groups

5:06to give them the access they need.

5:08So, as an example, when we have a group for admins,

5:12we may have a group that's associated with users

5:14in HR, human resources, and we may

5:17have another group that's associated

5:19with users in engineering.

5:20So, if we have a new person that joins us

5:22and they're in engineering, we simply add them to that group,

5:25and then they get the inherited rights and permissions

5:27associated with that group.

5:28Or in the case of admins, if we have a new admin,

5:30we simply make that person a member of the admins group,

5:33and then they are now a member of the group.

5:35They get those inherited permissions.

5:37So, that's an example of using a concept called Role

5:40Based Access Control, where the role or the group

5:44has the permissions, and then we simply

5:45add users to those groups.

5:47And if we've set them up correctly,

5:49then the users in those roles have

5:51the access and the provisions they

5:52need to do their jobs in those roles.

5:55Another important element regarding access

5:57is the rule of least privilege.

6:01So if someone's in engineering, hopefully they

6:03have enough rights and permissions

6:04to do everything they need to do in their job responsibilities.

6:07But we don't want to give them King Kong or excessive rights,

6:11because then if they're compromised

6:12or if their user account is compromised,

6:14that would then lead to additional risk and more loss,

6:16or potential loss.

6:18Also, a really great practice is periodic account reviews,

6:22because here's what could happen.

6:23We might have a person who's in the HR department,

6:25and they've been studying, and they're going into engineering,

6:27and then all of a sudden we say, you know,

6:29we're going to make you part of the engineers group.

6:31But if the procedure and the protocols

6:33aren't set up to do it correctly,

6:35we may leave that user as a member of HR and engineering,

6:38which wasn't our intention.

6:39So, doing periodic account reviews

6:41are going to help us identify if we have something I'd

6:44like to call privilege creep.

6:48And that's where an individual, simply based on time

6:50and being added to multiple groups and more groups and more

6:53groups and not having it pruned at any point,

6:55simply is getting too many privileges above

6:57and beyond what they actually need to do their job.

7:00So a periodic account review, including

7:03accounts that haven't been logged on to for months,

7:05is a good idea to help control and maintain proper access

7:09in our environment.

7:10And the last piece I would like to chat about

7:12is configuration management.

7:14So, let me clean this up a little bit,

7:15and let's focus our attention now

7:17on configuration management.

7:18So, let's imagine that we have a new device being

7:21deployed in our environment.

7:22Maybe it's a new router.

7:24Maybe it's a new firewall.

7:25Maybe it's a new switch.

7:26Maybe it's a new server.

7:27Maybe it's a new PC.

7:28Maybe it's a new printer, et cetera.

7:30If we are going to configure those from scratch,

7:33there's a good opportunity to not implement the best

7:36practices for security.

7:38For example, we may have services

7:39that are running on this printer that we're not even using,

7:41maybe as SNMP enabled, using some default passwords,

7:46and if we put it in, we now have a vulnerability

7:49on that printer by an attacker, or a very curious person

7:52on the inside, who could then do a port

7:54scan, for example, against that printer,

7:56identify the open ports, and then start to try to leverage

7:59or use the SNMP services that are available.

8:02Or on a Windows computer or a Linux computer or a networking

8:05device, what we want to have on all

8:07these devices is a hardened system,

8:10meaning they're not just open and waiting for an attack

8:12to happen and very easy to take advantage of.

8:15We want to harden them, so if we have services

8:17or features or functions that we should tweak

8:19or tune or disable, we want to do those when we deploy it.

8:23And so configuration management is going to help us do that.

8:26We can have a configuration baseline for new devices.

8:29Maybe we have a baseline for mobile devices

8:31of a certain type.

8:33We have a baseline for new switches,

8:37new routers, new firewalls.

8:40We have a baseline for Mac, and for Windows, and for Linux.

8:45And by having those baselines, we can start off

8:48with a more secure posture, and hopefully we

8:50have a centralized location as a database regarding

8:54those configurations, because there's

8:56one thing I can tell you about mobile devices

8:58and PCs and laptops and such is that, over time, they

9:02will change if they're not enforced via policy.

9:05So we'd want a system that says, I

9:07know what the configuration is, and also

9:09a method to periodically check and see

9:11if there's drift, or change, based

9:13on those standards and baselines that have been implemented.

9:16And if there's ever a change, that change

9:19should go through change control.

9:20And that way it's not just one person saying,

9:22I think this is a good idea.

9:23It's a team of people who all care, who all are stakeholders

9:27who can then analyze the potential change,

9:30do testing against that potential change,

9:32and then integrate that as part of the baseline,

9:36and that change control process can reduce the risk involved

9:39in a change to a system.

9:41So thank you for joining me in this set of videos regarding

9:43Network Security Fundamentals.

9:45And in the next set of videos, what I'd like to do

9:47is walk you through the implementation of some

9:50of these security features that the Palo Alto

9:52next-generation firewall brings to the table.

9:54It's going to be a great set, so you don't want to miss it.

9:56I'll see you there soon.

9:58Meanwhile, I hope this has been informative for you,

10:00and I'd like to thank you for viewing.