All right, let's chat about a few other Cisco appliances.
The first of which is known as the email security appliance or the ESA.
One of the key parts about our security portfolio is, again, we have to think
about how malware
gets onto our endpoints.
And it's great to have AMP trying to protect our endpoints, but it would help
for us to
use a product like the email security appliance or the ESA in order to prevent
the malware
from ever even getting downloaded so that AMP even doesn't even have to deal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from ever even getting downloaded so that AMP even doesn't even have to deal
with it.
And so one of the primary ways our threat actors will get their malware out
there is
to send a phishing attempt.
Phishing spelled this weird way with the pH in front of it to differentiate it
is still
sort of representative of phishing for fish.
We're just casting our line out into the water and we're hoping somebody bites.
And so the reality is that usually the threat actor is sending these to a bunch
of different
places, but then we have our happy go lucky user who gets this email and the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
places, but then we have our happy go lucky user who gets this email and the
email has
a link in it that we end up clicking.
And because this link takes us out to a bad website, so this is a bad malicious
website,
the website then places malware downloads malware onto the device.
So this is one of the primary ways that our bad guys get malware out there and
we want
to address this from a couple of different perspectives. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to address this from a couple of different perspectives.
So first of all, the email security appliance or the ESA, it also has a new
name.
So it's worth noting this.
We have the secure email gateway.
Cisco again trying to make it very clear what it's doing.
And also they seem to like to start the word with secure the product name with
the word
secure.
So either way, we've got this appliance and this is actually a physical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So either way, we've got this appliance and this is actually a physical
appliance that
is intended to sit in line with our email server, meaning that the ESA actually
gets the
emails and passes the good ones onto the email server.
Now this does require us to have an on premise email server and these days more
and more
organizations are choosing not to deploy on premise email servers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
organizations are choosing not to deploy on premise email servers.
So we'll talk about that here in a moment.
But in this situation, we've got the ESA, we get a bunch of emails and we do
recognize
hey, there are some bad emails in here.
What is this looking for?
Well it's looking for anything suspicious.
It's looking for bad addresses.
It's looking for emails that have attachments that seem suspicious.
And of course, it's going to be looking for bad links, links that try to take WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And of course, it's going to be looking for bad links, links that try to take
you to a
malicious website.
And so we're going to be looking for these with our email security appliance
and ideally
we filter all of them out delivering only good emails to our somewhat oblivious
user over
here who might have clicked on a bad email.
Now a couple of things here.
First of all, when we're talking about hey, trying to track attachments and
files and
everything as we can probably imagine the ESA is going to pull information from
our
Talos cloud.
So this is great. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this is great.
We love Talos and we want to take advantage of it where we can.
Another great feature of this is that we might have another company down here
who's also
running an ESA.
And now we can actually support encrypted emails.
Emails are normally sent in plain text and that's really not great.
We don't want to send plain text emails, especially ones that have sensitive
information
in there.
And so now I can send encrypted emails to an organization that also has an ESA WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so now I can send encrypted emails to an organization that also has an ESA
or potentially,
let's say we send it to a corporation that doesn't have an ESA over here.
What can happen is the ESA will push this to Cisco's cloud service, still
encrypted
and then allow this user at this organization over here.
Yes, this is a user with a laptop.
Great art.
I know.
We can actually download this via HTTPS.
So effectively allowing us to maintain encryption end to end. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So effectively allowing us to maintain encryption end to end.
So even though they don't have an email security appliance, we can still send
sensitive information
via encryption.
Now we just mentioned that a lot of our organizations these days don't actually
deploy email servers
on-prem.
Instead, a lot of organizations are using Microsoft 365 if we're using Exchange
, for
example, and potentially other solutions for cloud email appliances. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
example, and potentially other solutions for cloud email appliances.
And we just said this is a physical appliance that must go in line.
So we can't use the ESA with Microsoft 365.
The ESA will not work as a solution.
However, Cisco does have a solution known as the email threat defense, which
looks a
little familiar.
We just talked about the firewall threat defense.
Email threat defense is going to integrate as a cloud software package with
Microsoft
365.
It's going to use APIs to communicate and it has, we'll say, rough parity with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's going to use APIs to communicate and it has, we'll say, rough parity with
the email
security appliance.
There will be some features that aren't included because we lose the inline
nature of the ESA.
So that's a conversation to have as far as whether you're deploying on-premise
or cloud
solutions for your email server, but either way, Cisco does have a solution to
offer.
Now let's go back here to talking about trying to prevent malware from getting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now let's go back here to talking about trying to prevent malware from getting
onto our happy
go lucky user here.
Remember one of the ways that this started was they clicked an email and they
sent a
request to a bad website.
Well how exactly does that request work?
Well we know this isn't a direct line.
In the networking world we are given a domain name, which takes the form of a
URL, and we
have to go through DNS, a DNS server. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
have to go through DNS, a DNS server.
And this DNS server is going to provide the IP address.
Let's make that arrow a little bit clearer.
We're going back to the user, we're providing an IP address.
And now we can go out to the IP address to that bad website.
So this is interesting and it creates an interesting question.
Why should we provide the IP address to a bad website? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Why should we provide the IP address to a bad website?
Why would we not just say, hey that's a bad website, you shouldn't go there.
Well that is going to require a smarter set of services on the DNS server, but
we have
that capability.
It's going to require Cisco's umbrella DNS security software package.
Umbrella came to Cisco via an acquisition known as Open DNS.
And Open DNS is more of a residential solution for this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And Open DNS is more of a residential solution for this.
However, we in the enterprise space would want to use umbrella.
So umbrella is going to give us a few different solutions here, which is pretty
cool.
It's going to, first of all, once again, tie into the Talos cloud so we know
what the
bad sites are.
Then when we have a DNS request, we're going to check our knowledge of the bad
websites
to make sure that this isn't a known bad website.
A lot of the websites, a lot of the URLs that are used are going to be known. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
A lot of the websites, a lot of the URLs that are used are going to be known.
Now bear in mind as well, the bad guys are, they're smart about this.
This might be a totally randomly generated website.
And I don't know, I'm just sitting here making up letters, right?
But it could be something like this that's randomly generated and it's not used
until
the malware triggers.
Well, that's fine, except remember, Talos brings in information from all over
the world.
But if we notice that this website then redirects to another location, another WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But if we notice that this website then redirects to another location, another
IP address that
we know is bad or suspect is bad, we can probably pretty well figure out that
this is
problematic.
And so we're going to track that and again, be able to be pretty successful at
blocking
us going to bad websites.
So it prevents malware from landing on the machine in the same way that the
email security
appliance does.
They're trying to prevent malware from landing on the machine to begin with.
However, this also opens up a whole new world to us for web filtering. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, this also opens up a whole new world to us for web filtering.
Organizations have long had to have sophisticated appliances and servers and
software packages
that prevent our users from going to websites with bad content.
This is where we like to control the content our users are able to go out and
see.
For example, we might want to block violence or other inappropriate topics that
exist on
the internet or people that are just on their lunch breaks and they're trying
to go out
to websites that we would deem against our corporate policies. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to websites that we would deem against our corporate policies.
Well now we can again block here not just the bad websites, the ones owned by
the malicious
folks, but also the inappropriate or otherwise the blocked content on our
network.
So we can now use umbrella for web filtering in addition to malware protection.
So between the email security appliance and umbrella, the theory here is that
yeah, we
might have AMP running here on the endpoint and that's great, but AMP doesn't WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
might have AMP running here on the endpoint and that's great, but AMP doesn't
know every
single file that is malware.
And so if we can block the malware from even landing on the machine to start
with, that's
going to prevent problems later that maybe AMP could resolve, but hey, this is
approaching
security from multiple different angles.
And this is a great way to start.