In every environment, we're going
to have lots of devices that are connecting to our network.
Some are mobile devices.
Some are, like, laptops and roaming devices.
Others may be desktops, Internet of Things, et cetera.
So in this video, I'd like to share with you about why
it's so darn important when we have the option to do so,
to implement endpoint security on our devices.
So let's imagine we have our end user at one
of these machines over here.
We'll call that end user Bob.
Now, hopefully, we've done some things beforehand
to help make our network more secure,
including training, so that Bob is aware of what a phishing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
including training, so that Bob is aware of what a phishing
attack looks like, and also aware of social engineering
and good practices, for example, locking their screen when
they're not at their computer, and so forth.
Also in our environment, we may have
put between Bob and the rest of the world,
we may have email security appliances or web security
appliances, which could be either on-prem or services up
in the cloud.
We're probably doing some protection regarding
DNS with Cisco Umbrella.
And at the edge of our network, we
might have some next-generation firewall services
with next-generation IPS looking for malicious traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with next-generation IPS looking for malicious traffic
and controlling what can go through,
including application visibility and control
to enforce our policy.
But at the end of the day, we still
want on these computers that are end users are using,
we still want to have some endpoint security
at those devices because there may be attacks.
Maybe somebody compromises the building
and they get on that local device.
We want to make sure we have information at that device.
Or if our security appliances didn't pick up on something,
we want to get alerts and notifications
if something malicious or abnormal WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if something malicious or abnormal
is happening at the computer.
And when we implement endpoint security,
we're not just improving the security
of our overall network, we also may be doing it
for our compliance reasons or as part of our risk management
strategy.
Because in a layered approach, we're
less likely to be compromised if we're doing multiple checks,
for example, with all these devices, with these devices,
and at the end station.
So we might ask, what are some techniques
we could use to help improve the security of this device?
Well, we'd want to have some anti-malware or antivirus
software on that system.
With Cisco, we have AMP, the Advanced Malware Protection. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
With Cisco, we have AMP, the Advanced Malware Protection.
We'd also want to make sure that the definitions were
being updated periodically.
We'd also want to make sure we have limited rights
at that computer.
So if Bob logs in, Bob's got the ability to do his job.
But he does not--
I repeat, does not-- have admin rights on this computer.
And in addition, before we let a computer on the network,
we also might want to go ahead and check their posture.
Now, posturing is a fancy way of saying,
let's check this machine out, make
sure it meets our minimum requirements--
minimum requirements regarding the OS-build. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
minimum requirements regarding the OS-build.
Maybe there's a patch from Microsoft
that we want to make sure is in place, or a hotfix.
Or maybe we want to verify that the antivirus,
anti-malware software has been updated within a certain number
of days and is fairly current.
Or maybe we want to look in the registry for a certain entry.
Or we want to look for a certain file in a certain location
to verify this is one of our machines
before we let it on the network.
And the big part of implementing that is having an agent that
can run on this device, either permanently or temporarily,
and then have some type of a central server that's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and then have some type of a central server that's
being checked with to verify that device
has those installed components.
And one of the most popular ways of doing that
is to use AnyConnect from Cisco.
And you might think AnyConnect?
Isn't that like the VPN software?
Well, AnyConnect has a whole bunch of modules,
including a posture module that when
it's running on this machine can interrogate and look
for certain versions of OS, or look
for certain versions of antivirus and updates,
or look for certain entries in the registry
or for a certain file.
And then based on meeting those requirements, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then based on meeting those requirements,
the system can be allowed on the network.
Or if they don't meet those posture requirements,
we can quarantine them.
We can not give them full access.
We can give them partial access so they can correct or remedy
the problem that they currently have before
giving them full access.
So the AnyConnect client is a very popular way of doing that.
It can also act as 802.1x supplicant,
which is convenient as well.
And then for the server, we're going
to use ISE, the Identity Services Engine, which
we'll talk more about.
And I'll give you an example of that
as we continue going through this set of videos. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as we continue going through this set of videos.
Now, one of the tricky aspects of implementing
good security, especially for mobile devices,
is to have a good inventory of what
is connecting to our network, what are the operating
systems that are running?
And then once we know that, how do we control those devices?
And that's going to be done through some really
effective mobile device management strategy.
And we'll take a closer look at that in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.