With AMP, we saw this scenario where a user goes out through our edge to a server
because we clicked a bad link or something like that. We are following this URL
and so now this file is being sent down and so we've got all of these ways of trying to figure out that there's
bad things happening. We have our intrusion prevention system. We've got our AMP and
we have even potentially the ability to decrypt this using TLS and SSL proxy.
So all of this is great, but notice where it all started.
Right here. The fact that I was able to click on this link via the URL and
my communication out to the server succeeded.
Well, that's all in good except we kind of left out a step here, didn't we? We have some kind of DNS server
involved with this transaction.
And so maybe we have a local server and it has to reach out to a regional server, but the reality is that the
PC with this URL can't do anything unless we get an IP address.
So what do we do? We forward the URL to the DNS server and the service eventually returns an IP address.
So now we want to talk about,
as we mentioned before, the concept of let's just stop all of this before it even begins.
Right. I mean when we talk about security by layers, this is what we're talking about. We're saying, okay,
we've got AMP running on the PC,
but maybe we could prevent the file from getting to the PC to start with. And so we
throw IPS and AMP onto the edge, and then we make the edge be able to see it.
But can we even go a step further and say let's not even allow the
host to request the file to begin with. And so when we're adding this layer of security on,
we're essentially saying that, hey, what I want to do is completely stop this part.
Why even deliver a bad IP address, an evil
threat actor based IP address, to this PC? Because if it doesn't have it, then it can't even initiate this
communication to begin with.
This is what's known as
DNS security.
And this became a thing a long time ago when Cisco went out and acquired a company known as OpenDNS.
Now if you go out and search for OpenDNS, this concept still exists, and
Cisco took the OpenDNS concept and said, hey, we're going to allow OpenDNS to continue to run as a residential service.
I have run this in my own home because it allows me to perform this level of protection
to the PCs in my own house at a residential level.
And it does allow for some basic URL filtering as well based on category and reputation and such.
But Cisco also took this and said, hey, we're going to make
or leverage the enterprise side of this and
we're going to change the name. We're going to call this Umbrella.
So if you've heard of Cisco's Umbrella security suite, this is what it is.
It's DNS focused security. Now to be clear, we're not talking about encrypting our DNS messages back and forth.
That's not our focus. Our focus is trying to say, let's not
resolve essentially threat actor based URLs.
So hopefully we stop this attack from
triggering from the very beginning when we first clicked on that link.
So how does this work from an SD-WAN integration perspective? Well, as we might imagine, this is going to be an edge
conversation. We're going to deploy this onto our edge and
the edge is going to have something known as the umbrella connector.
The umbrella connector is an agent
that's going to run on the edge and it's going to perform the DNS inspection as it comes in.
So what happens here
as
we send our DNS requests is
again, the edge running this agent here on the edge is going to see this request and
one of two things is going to happen to start with. If it's an internal
request, meaning I'm trying to get to a local resource, it's just going to pass that through. It automatically gets a pass.
We know that we're going to internal servers. So that's perfectly fine.
If we don't trust our own internal servers, then we've got all kinds of other problems.
But this security system isn't going to help us in those situations anyways.
So then the question, of course, is what happens if it's an external request, meaning I'm going out to the Internet?
Well, at this point we are going to forward this to a Cisco cloud product
that is known as the umbrella resolver.
The umbrella resolver is
going to try to figure out what to do with this request. Furthermore, we're going to add a bunch of information.
This is known as an extended
DNS record
or an extended DNS query. Either way,
we're including additional information, things like the the client IP address, which is kind of interesting.
So we might include that. We might include the endpoint identifier, the organization ID, all kinds of things that might help
provide some context into this DNS request.
And by the way, this request is encrypted
because it's got sensitive information in there. So just in case there's security concerns there.
Now our resolver is going to take a look at a number of things. For example, it's going to look at reputation of
the site that we're going to. It's going to look at blacklisting and whitelisting. It's going to look at category.
I mean, on some level this is performing, again, basic URL filtering because we're able to do that.
But very importantly, this is also tied into Cisco's Talos cloud.
We are tracking
known IP addresses or known URLs
that go to bad IP addresses. We track whether a bunch of URLs are going to the same IP addresses.
And so certain IPs and certain URLs can be known to be bad.
And so at this point the resolver is going to respond in one of two ways, as we can imagine.
It's either going to respond back
with the IP address saying, hey, we're good to go, or it's going to in some way block this as a result.
It'll send it to a blocked page that says
yeah, we're not allowed to go to this website.
So when we consider the responses, we have those two responses, but we actually have a third as well, which is really worth exploring.
So again, if the domain is intended to be blacklisted, or we'll just say it's a bad website,
then it's going to be blocked. We're going to get redirected to an IP address
that exists out there on the web that says this website is not allowed.
If it's good,
then yes, we get the real IP address and we can go out there and we can surf that page or download that file
or whatever it is that we're trying to do.
So this is known as the whitelisted concept. This is known, whoops, I got that backwards.
This is known as the blacklisted version of a response. This is known as the whitelisted version of a response.
There's one other response that we need to be aware of, and this is known as the graylisted response,
which basically says that it's unknown, but also it's a little bit suspicious.
This is kind of interesting. What do you think we should do with this? Should we allow it because it's, you know,
it's something that we're trying to go out to with intentionality in theory.
Yeah, it's a little suspicious, but what if we're blocking good traffic? We could end up
preventing people from doing their jobs. So Cisco actually has a really cool solution for this.
It's known as the Intelligent Proxy option and
we're going to respond with the Intelligent Proxy IP address.
The Intelligent Proxy IP address essentially inserts
umbrella, the umbrella process, into the middle of
the communication, meaning we don't actually provide, notice, we don't provide the real IP address,
we provide the proxy IP address. And so what the proxy IP address is doing, draw it out over here,
so here's the edge with the umbrella process, the host thinks it's going to the website,
but it's really going to this umbrella process, and then the umbrella process is going out to the website.
So what does this accomplish? Well, here's what it accomplishes. Notice back over here
that Talos is running as part of this and Talos is constantly being updated.
So if we all of a sudden find out that that website is bad, what we can do is we can cut it off.
Remember how, think about just how the web
concept works. I mean if we provide the real IP address,
then this host is just going straight to the server and there's really not much more we can do about it at that point.
But if it's in the middle of the process, then we can cut it off in the middle.
And that's thanks to the Intelligent Proxy IP address and the Intelligent Proxy process
that is part of this graylisted or suspicious concept. So again, our primary takeaway is understanding that umbrella is
going to form this DNS security aspect.
We're trying to prevent us from even accessing a potentially bad website that could potentially send us malware.
And yes, we've got all the security mechanisms in place to find that malware, detect that malware, detect suspicious activity,
but wouldn't it be wonderful if we just could never go there to start with? And that's exactly what our DNS security framework is
going to do.
Keeping in mind that we have these three different responses as far as what's going to happen with the graylisted response being kind of an
interesting one.