I love it when a good policy comes together and works
as intended.
I mean, who doesn't, right?
So in the previous video, we created several elements
that can go into a policy, but they're not applied to a policy
yet.
So in this video, we'll create a custom policy.
And we'll take all those components,
like those shopping cart items, and place them
in that shopping cart as part of a policy
that we can then enforce on either a roaming user,
or a group of network devices, based on where
we want that policy applied.
So as a quick sanity check, I'm going to check my destination WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So as a quick sanity check, I'm going to check my destination
list for our custom list.
There it is.
The content categories, there's our custom content category.
Application settings, security settings, and blog page.
We made custom elements for each one of those.
So let's go up to policies, and click on All Policies.
Here's our default policy.
Now, we could modify the default,
or I recommend we create a new policy,
and place it in front of or on top of the default policy.
These are processed in a top down order.
So when there's a match based on the identity of who WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So when there's a match based on the identity of who
are trying to enforce policy on, then that policy
will be implemented.
So let's click on Add.
And now it's asking right out of the gate,
it's like, who would you like to protect
with this policy, AD groups, AD users, AD computers, networks?
Now, at the moment, I have not installed the roaming client
on Bob's computer.
He is currently using the DNS servers from Umbrella,
but he's not associated with our policy yet.
So for the moment, for this brand new policy,
I'm going to leave this unselected.
And then before we try it with Bob, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then before we try it with Bob,
we'll associate this with Bob.
And that'll give me a chance to also show you
how to do that as well.
So for the first step, I'm going to say
don't worry about applying this policy to any entities yet.
Let's click on Next.
And now it's asking, what should this policy do?
And I'm going to go ahead and accept everything here.
And if we click on Advanced Settings, check this out.
This is so stinking cool.
We can enforce saved search.
And what that means is if we go to a search engine,
if a user goes to a search engine
and they're searching for something,
saved search can be turned on or off. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
saved search can be turned on or off.
And if we check this checkbox, it's
going to verify that that user is only
allowed to go to search engines where saved search is enabled.
Otherwise, they won't be allowed to go to that search engine.
And again, that can be enforced by a DNS,
because Talos in the cloud has all that information.
The other amazing option here is under Intelligent Proxy,
which you have to have the proper license to use it.
But if we enable Intelligent Proxy,
and we do SSL decryption, and enable IP layer enforcement,
here's what it means.
So here's Bob.
And Bob is going to be sending his request either WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And Bob is going to be sending his request either
through the local virtual appliance, which then goes up
to the Umbrella cloud DNS servers.
And then we'll get a response back.
Let's imagine that Bob is going to www.ifffy.com Ifffy,
it's Ifffy.
Let's imagine that Talos doesn't know for sure whether that's
a malicious site, or based on our policy for filtering
alcohol sites, maybe it doesn't know yet,
or it's not sure what type of site that is.
If Talos is not sure, the category or the application WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If Talos is not sure, the category or the application
services and so forth that are associated with this,
it can direct Bob so it builds effectively
a TLS session up to the servers as part of Umbrella.
And then what they can do, they're
terminating that TLS session.
And then they can make their own request out to that server.
Another benefit is it's encrypted between--
let me change my colors--
it's encrypted between here and here, and here and here.
But for a moment in time, that traffic
if it was TLS on both sides, it's not encrypted right here.
And that's what intelligent proxy, along with SSL
decryption is doing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
decryption is doing.
So it involves two steps proxying, meaning
we're doing a proxy service between Bob
and the server he's going to, and this SSL decryption allows
us to go ahead and identify what's really going on
on the application layer so that the Umbrella cloud server can
identify correctly what's going on at the application layer,
and then enforce policy based on that.
So this part right here does require
one of the more advanced licenses, because it's so cool,
because we're not taking chances.
We're erring on the side of caution
by proxying them up to the cloud,
and then down to that site, and being
able to see the details of what's really going on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
able to see the details of what's really going on
on the Umbrella servers.
And as we continue down here in this policy,
here's a cool option regarding logging.
So do you want to log all requests?
Do you want to log only security events?
Or do you not want to log any requests?
And also, as part of our security settings right here--
let me change that color again--
those are also specified.
So in this wizard, it's walking us through all these options.
But whatever we specify here can be overridden
by what we select when we choose the security
settings that we want to use.
And I think we did create a custom security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I think we did create a custom security
setting that we can apply.
So as we continue with the wizard, we'll click on Next.
So it's showing us here the categories to block.
And this is representing the security settings.
So if we want to take the default,
it has malware, command and control callbacks,
and phishing attacks.
But I believe we created a custom security setting.
So we select it right here, Our Custom Security Setting.
We enabled all of them.
So here are all of the shields lit up, indicating all of them
are part of this policy.
We'll accept that.
Click on Next.
Now it's asking us about content access.
And that would be this category right here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that would be this category right here,
what URL categories.
So we could say high, moderate, low, or custom.
If we say custom, it's going to go ahead and let
us choose our custom content filtering that we created.
And that was over here under the components.
Or if we didn't have one created and we wanted to say,
hi, that just blocks most of the risky stuff
out there on the internet.
But because we created the custom content categories,
let's go ahead and select it.
And that's just blocking alcohol.
And we'll click on Next.
And now this next section in this wizard
is regarding application settings.
So we can use the defaults, or we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we can use the defaults, or we
can go ahead and use our custom app setting
right here, which we created.
And I think we blocked a whole bunch of drive options.
So if we open up cloud storage by expanding that, sure enough,
A drive, Amazon drive.
And I guess I could search for this as well.
And sure enough, there's all the ones that we selected.
So we're just going to pull that from our list,
and click on Next.
And then it's showing us the defaults for blocking.
This is the destination list.
So we created a custom destination list.
And we could just add it.
We just put a check in that box to add it.
And now it's part of our block list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now it's part of our block list.
And we'll click on Next.
Then it's going to ask about additional file analysis, which
is using Cisco Advanced Malware Protection, or AMP.
That sounds great.
We'll use it.
We'll click on Next.
And it's asking us about Block page settings.
And because we created a custom Block page, let's go ahead
and we'll choose it right here.
So in this wizard, we have the opportunity
to modify, and create, and tweak.
So whether we want to create the policy components beforehand
or do it during, either way is great.
But the goal would be to implement the policy that's
intended by your organization. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
intended by your organization.
So we'll go ahead and use our custom Block
page, click on Next, and then we'll give it a name.
So we'll call it our custom policy.
And here is an overview of it.
So under the identities, we haven't yet
applied this to any identity in our environment.
We'll do that in the next video.
So for our custom policy, we're using our custom settings
regarding security settings.
We're using our custom content filtering, which is right here.
For application filtering and settings,
we're using our application settings we created. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we're using our application settings we created.
For the destination lists, we actually
created one additional destination list
for that one domain.
So that bad boy is right there.
We modified the Block page.
And we also enabled file analysis.
Also, here if we click on Advanced Settings,
here we have the options for the intelligent proxy,
whether or not we ought to enable the SSL decryption.
So if we made some decisions earlier,
we could change it here.
And also here in under Policy Settings,
we have the options, once again, for logging.
Logging everything, logging only security
events, or don't log any requests.
So let's go ahead and click on Save.
And now we have our custom policy first, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now we have our custom policy first,
which is not going to match on anybody until we
tell it to, which we'll do in the next video.
And then following that, we have the default policy, which
we'll match on everybody else.
So we definitely want to have our custom policy
match on at least one identity so we can actually test it.
So in the next video, that's exactly what we'll do.
So I'll walk you through that process in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.