In this video, you and I get to chat about something
that computers do hundreds of times every single day,
and is absolutely treacherous if it's not handled correctly.
And let's use this typology as a backdrop.
And let's imagine we have Bob, which
could represent any user on our computer networks,
and he is at this computer.
And the thing that Bob and Bob's computer
is likely to do hundreds of times a day,
is access some type of resource out on the internet.
And so it goes something like this.
Bob brings up his favorite browser. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Bob brings up his favorite browser.
He types in www.mfs.com.
I'm just going to use an acronym there-- myfavoritesite.com
And then presses Enter.
And then magically that website content appears on his page.
Now behind the scenes, what's happening
is Bob's computer is using DNS, which
is an acronym for Domain Name System.
It's basically the way that Bob's computer can
take this name, like www.mfs.com,
and what they call resolving it, or figuring out what WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and what they call resolving it, or figuring out what
the IP address is behind that.
And we can think of an IP address
were like the street name and house number for how
to reach that device.
So Bob does the DNS request.
He gets the DNS response from a DNS server.
That DNS server could be here locally in its network,
or here, or out on the internet.
And then once Bob has the IP address of that server,
Bob then forwards his packets, which
get routed across the network, and then reach that server.
So we'll say this is the server that Bob was trying to reach.
And then the response comes back all the way to Bob's computer. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then the response comes back all the way to Bob's computer.
So that's the basic mechanics of resolving a name to an IP
address with a DNS server, but let's talk
about what mischief and treachery
can happen if somebody is malicious
and they're trying to harm either Bob's computer,
or harm our network.
The first negative piece that can come out of this
is bad information.
And what I mean bad-- for example,
it could be incorrect information.
If somebody has compromised the DNS server that Bob is using,
and the information gets sent back to Bob-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the information gets sent back to Bob--
let's say the server is at 1.2.3.4,
but the DNS response that comes back says, oh, that's it--
3.4.5.6.
Bob could be going to a completely different computer,
which could be a malicious website--
I'll just draw angry eyes there--
that maybe is made to look like the website
that Bob was trying to go to.
And maybe it's prompting him now for information,
or trying to run scripts on his computer.
But the result of Bob going to the incorrect,
or a malicious website because of having incorrect DNS
information, that could compromise Bob's system. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
information, that could compromise Bob's system.
And other challenges we could have malicious websites
that Bob's trying to go to.
So maybe Bob goes to www.badsite.com,
and he presses Enter.
And DNS does its resolution, provides
of an IP address of 6.42.9.9, or whatever
the IP address might be.
So even if the IP address that's being returned via DNS is
correct, we don't-- we really in our company don't want Bob
going to a malicious site that intentionally is going to harm WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to a malicious site that intentionally is going to harm
Bob's computer.
So even if Bob wanted to go there,
ideally we wouldn't want him to go to a malicious site.
But there's nothing by default that's
stopping Bob from resolving that name,
and going to that IP address, and then hitting that website.
So up here I'll put bad/incorrect information
could be returned to us.
And the third, which is really, really bad, is tunneling.
So DNS.
When Bob makes a query, it's using at Layer 4
in the TCP/IP protocol suite.
It's using a protocol called UDP, User Datagram Protocol, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's using a protocol called UDP, User Datagram Protocol,
and the well-known port for a DNS
request is going to Port 53.
And then unfortunately, because attackers know that UDP Port 53
is being allowed through our networks,
an attacker actually could do tunneling using UDP:53,
so that if we looked at the traffic going in and out from
Bob's computer, it looks like it's UDP Port 53, no problem.
But inside the packets, the attacker
could be exfiltrating or exporting
information about reconnaissance in Bob's network.
So if this computer has a virus or malware that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if this computer has a virus or malware that's
collecting data, or even locally on Bob's computer,
a malicious app could be taking that data
and tucking it piece-by-piece into what
looks like, on the outside, DNS information,
and allow that traffic to be forwarded out.
And then we'd have some attackers DNS server,
or a device listening on that port, which
is collecting the information.
Or another problem with DNS tunneling
which is also very, very real, is
that if there's some malicious software
here that is trying to make Bob's computer a bot, as part
of a botnet, and we have to say we have a command WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of a botnet, and we have to say we have a command
and control center out here.
So a command and control center, like the hackers'
central command, where you can issue commands and tell
all these bots what to do.
If we've compromised the system and we're tunneling DNS,
we could actually have command and control information
from this command and control server
from the attacker, that's able to communicate back
to these bots inside our network because the traffic simply
looks like DNS requests and responses.
And if we're not paying closer attention,
we could effectively allow the attacker
on the outside to be controlling a bot on the inside WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the outside to be controlling a bot on the inside
by tunneling their commands in what looks like UDP traffic.
So the next question we might ask ourselves
is, OK, what can be done to help this?
And the answer to that, or one of the answers to that,
is a product called Cisco Umbrella.
Let me share with you how that can help protect
Bob and all the other computers in our environment
from these types of attacks.
And here's how Cisco Umbrella comes to the rescue.
We have Cisco, and they have this group
in the cloud referred to as Talos, which
is their security intelligence.
And they are looking at and have a database WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And they are looking at and have a database
of billions and billions and billions of DNS requests.
They also know the reputation of websites and servers
out there on the internet, and they're
keeping all of that in their databases in the cloud.
So if somebody is trying to go to this server, or that server,
or that server, Cisco has knowledge
regarding the cloud, regarding the reputation of those sites.
Let's imagine this guy is bad news.
And this guy is bad news.
And this one's OK.
So these two have a really bad reputation,
this one has a good reputation, meaning it's safe. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this one has a good reputation, meaning it's safe.
So Talos has all that information in the cloud.
Now, if we have Bob over here still, how do we protect Bob?
What we do is, we tell Bob hey, instead of just using
a normal DNS server, let's go ahead
and use a DNS server that's managed by Cisco, as part
of Cisco Umbrella.
And so Bob's computer now makes requests up to the Cisco DNS.
And then instead of this DNS server just willfully
responding with anything Bob's asking for, if there's a site,
or in our policy, for restricting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or in our policy, for restricting
certain types of sites, like alcohol, or hate sites,
or other things, that can all be identified in policy.
And then when Bob makes the request,
and based on Cisco knowing exactly
what the categories are, and the reputation are,
and the mannerisms of these different websites,
the response can actually come back and say, yep, here you go.
Here's the IP address that you wanted,
or it can simply say this--
sorry, Bob.
And it can give him back a notification
saying, you know what, that website you're trying to go to
is malicious, or is restricted by policy,
or whatever the condition is that's stopping it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or whatever the condition is that's stopping it.
And the key here is, we're stopping Bob from ever getting
to these servers over here.
Because if the DNS gives back a negative response and says,
sorry, this isn't safe, Bob's computer
will never try to connect to those servers,
and we're preventing those types of attacks
in the tunneling and everything else, even before they begin.
It's sort of like a kid who wants to go shopping,
and he's asking an adult or a parent about which store
they should go to, store A, or store B. Now
if the parent knows that hey, store A is risky,
it's bad news, it's high-priced, and everything
else, the parent can simply say no, don't go to that store, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
else, the parent can simply say no, don't go to that store,
and prevent the child from going to that store the first place.
Or at the same time, that parent can talk to the child
and say, yeah, the store B is great.
Go there.
So if the kid later, like two days later, says,
I want to go to store A, the parent could consistently
say, nope, store A is bad, and prevent the child,
just like preventing Bob, our user,
from ever going there in the first place.
So that's the big picture, the overall broad view
of Cisco Umbrella.
And as we continue going through these videos,
I'd like to share with you how you
can use the basic services of Umbrella for free. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can use the basic services of Umbrella for free.
And then we'll take a look at the paid services for Umbrella,
and how we can start to implement additional policy
to protect our users on our local area networks,
and as they travel, and everywhere in between
by leveraging the tools within Umbrella.
So we'll continue the story in this journey
as we continue in the next video, and I'll see you there
in just a moment.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing.