In this video, you and I get to talk about how
we could deploy the WSA.
It's going to be an on-prem device.
And some of the benefits it's going to bring to the table
once it's deployed and used in our environments.
And let's turn our attention to this typology,
with the user Computer Two, and that user is going to be Bob.
And let's imagine that Bob goes out to a website,
and we'll put that site out here.
And we'll call this www.whatever.com.
Now behind the scenes, Bob's computer
is going to do a DNS request to resolve WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to do a DNS request to resolve
that URL, that name of that website to an IP address.
And then he's going to forward a packet.
So it'll be sent to the switch, swivel there to switch it over
to the default gateway, and then the router
will make a layer three routing decision.
And each layer three device on the path
will forward it towards that server.
And once Bob reaches that server,
and they do their three way handshake,
the server is going to respond back
and they're going to have a session.
So now Bob can communicate with that server.
And that leads us to the very first problem
that the web security appliance solves.
Now, that server.
Is it malicious?
Was it just put up?
Does it have a bad reputation? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Does it have a bad reputation?
How would Bob know?
Bob doesn't know.
He's just resolving the name to an IP address and going at it.
And hopefully when he gets the responses,
he's not clicking on inappropriate things
to compromise his system.
Now at the workstation, we definitely
want to have it locked down.
Our end user should not have admin privileges,
and that way if they click on something, hopefully
they won't have the rights to have that malware installed
on their system.
Hopefully, they will also have anti- malware software
running on that local computer.
But, it would be better.
Someone once said that an ounce of prevention
is worth a pound of cure. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is worth a pound of cure.
It'd be way better if we could prevent
that conversation with that malicious site
from ever happening.
And that's where the web security appliance, the WSA,
can have an important role.
So if we were to deploy a web security appliance.
This can be deployed as a physical appliance
or as a virtual machine.
That's a good starting point.
And have basic configuration on it.
So I've got an interface right now
that can be reached, and use that .155 on the network.
Then, we would either train Bob's computer
to use a proxy that would send all web request out to the WSA WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to use a proxy that would send all web request out to the WSA
instead of going out to the server itself,
or we capture that traffic as it's going up to the server,
and we redirect it to the web security appliance.
And the cool thing about having that traffic stop at the web
security appliance is now this web security appliance
can now act as a proxy, but a proxy with a really serious
attitude and lots of policies.
Some of those policies could include
who we're trying to match on.
Are we matching on traffic coming from a certain subnet?
Or is that traffic coming from a specific user
in Active Directory?
Or that user is a member of a group, a specific group WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Or that user is a member of a group, a specific group
in Active Directory.
Or with the proxies set up to go to a specific port,
we could match on that as well.
And then at the WSA, the cool part
is, we can now do some analysis and prevention of Bob
the user going to a less than favorable,
or a less than safe, website.
So we could block on URL.
So perhaps Bob's traffic is trying
to go to a URL that's marked in a category
that we don't want to allow that traffic to.
Maybe it's alcohol, or gaming, or something else
that's against company policy.
We can identify that at the WSA, and if Bob's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can identify that at the WSA, and if Bob's
trying to go to a URL in that category that we've denied,
it can stop it right there at the WSA.
It simply won't propagate the request out to the internet.
Another aspect is reputation.
Now one question might be, how is the web security appliance
going to know about the reputation of a website
that Bob is trying to go to?
And that boils down to Talos.
And because Talos has literally millions of sensors and devices
out there on the internet that are collecting data,
it can correlate that data, and then
educate our devices regarding the reputation of a site.
So if the site has a reputation of being malicious, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if the site has a reputation of being malicious,
the web security appliance can block that traffic
based on our comfort level with how much of a risk
we want to take.
Or if Bob is trying to go to a site that's uncategorized,
the security intelligence with Talos is educating our WSA,
can make a decision based on all the factors it does have,
and the information it does have,
whether to allow that traffic or not.
Even if the website that Bob's trying to go to
is not specifically categorized as alcohol- based, or gaming,
or some other category that we've previously identified
as being undesirable to go to.
We can also filter based on apps. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can also filter based on apps.
So if we have certain types of applications,
whether it's Facebook or Google or what have you,
our web security appliance can identify
that's the type of service or function
that's being requested, and it can stop it
from happening right here.
Also, the WSA can be used for DLP, data loss prevention.
So somebody is trying to sneak out or send out
information that is sensitive, like credit card
information, social security numbers,
details like that that shouldn't leave the company,
or at least shouldn't leave it from Bob's computer.
With data loss prevention, we can
look for that type of traffic, and then stop it right here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
look for that type of traffic, and then stop it right here
at the web security appliance.
Another huge benefit of the web security appliance
is dealing with malware.
By looking at file types, again, having
the intelligence from Talos to identify
malware, if it's trying to go through.
And certainly preventing that type of traffic
if it's identifiable from getting back to the user.
Now, a common question that comes up
when I talk about these really cool security
features for web security appliances are, wait a sec,
Keith.
Those same features, like, URL filtering,
reputation-based filtering, all the rest,
those features are available on FTD,
the firepower threat defense systems. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the firepower threat defense systems.
And the answer is, yes, they are.
So you probably don't need to buy licenses for firepower
threat defense and also for a web security appliance,
and have them both doing the exact same functionality.
But you would want to have these features at least
somewhere in the path between your end
users and the internet.
And the web security appliance is definitely
one of those options that can make that work.
Now, one of the cool things about the web security
appliance is that we can set up policies
based on a subnet the user is coming from,
or the user him- or herself based on their identity
or group membership. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or group membership.
And so to really leverage that in a corporate environment,
we need to link or marry the web security appliance
with Active Directory, where we have
those users and those groups.
So in the next video, I'd like to walk you
through how we can integrate the web security
alliance with Active Directory, which
is really important for the ability
to identify Bob or Joe or Mary or Sam
or whoever the user is, when their traffic shows up
at the web security appliance so we
can apply the correct policy.
So we'll do the integration between Active Directory
and web security appliance in the next video.
Meanwhile, I hope this has been informative for you, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.