We hinted at this already when we
were talking about AnyConnect.
We said something about posture assessment.
But what is posture assessment after all?
You see, sometimes it's not enough to just know
who somebody is.
It's not enough to verify username and password
and then just let them in.
For instance, would you be OK with somebody plugging
into your network right now because they typed
in the right username and password
but maybe they were running Windows 2000?
Err, Maybe not.
That's where posture assessment comes into play.
So let's talk about how posture assessment can really WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's talk about how posture assessment can really
help us out.
In the last Nugget, we talked a lot
about how users can get authenticated to the VPN
when they're working remotely, when they're working from home.
But there's an OK chance that sometimes an end user
will be working from home from their personal computer.
Now, that poses a whole different mess of risks.
And sometimes just authenticating their username
and password isn't exactly the safest thing that we can do.
So what AnyConnect enables us to do WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what AnyConnect enables us to do
is check out their landscape, explore their computer
a little bit, and make sure it's up to our security standards.
What we're talking about here is assessing their posture,
the posture assessment.
Let's talk about how AnyConnect and some other appliances
can actually perform posture assessment for us.
So here I am.
I'm Knox, and I'm working remotely from my home computer,
and I'm trying to get connected in to AnyConnect one more
time so that I can access resources on the file
server that's in HQ. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
server that's in HQ.
And in a traditional way that we just described,
I would download the AnyConnect client.
I type in the URL, the username and the password,
and I'm good to go.
I'm off to the races.
Here's the thing.
Think about what I just said.
Is that the most secure thing?
Well, by default, you may be thinking, yeah, sure, why not?
He's probably got a newish computer,
and he's working from home.
What if I don't have a newish computer, though?
What if I'm running something like Windows 7,
which is no longer supported by Windows?
It's end of life. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's end of life.
It's deprecated.
They're not getting any new security patches.
What if I don't have an antivirus
or any form of anti-malware?
What if I was trying to play my favorite video
game using a headset and it didn't work so I turned off
my Windows Firewall entirely?
What if there's zero encryption or weak encryption
on my computer?
What if I haven't encrypted my disks?
Or I've only encrypted them with an ancient cipher
or an ancient protocol?
Now, all of a sudden, I'm downloading
files from this server all the way WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
files from this server all the way
onto my local computer, which is end of life,
is not secure with an antivirus, is wide open to the internet,
and has no form of encryption.
This is bad news.
One of the top ways that attackers attack end users
is because they bring work home with them.
One of the ways that a major credit bureau was recently
attacked a few years ago was because the software developer
took a backup of the production database home with them.
And next thing we know, all of these Social Security numbers WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And next thing we know, all of these Social Security numbers
and credit scores and everything like that are leaked out
onto the internet because the end user, the software
developer, who brought work home with them
didn't have a secure environment at home.
That's a big no-no, and we need to make sure
that someone who's connecting into our network remotely
meets our security standards and isn't just any Joe off
the street who happens to know a username and password.
So AnyConnect does a whole heck of a lot more than just
handling authentication for end users who are trying
to get access into the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to get access into the network.
AnyConnect, once it's installed on a computer,
can work with other pieces of the computer
to learn more about it.
It can check things like, what operating system are we
working with?
Is AMP already installed on this computer?
And if it's not installed, should we install it first?
Or should we immediately proxy information through AnyConnect
to the AMP service?
Yes, that's correct.
AnyConnect can act as an extension of our AMP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
AnyConnect can act as an extension of our AMP
environment that's located in HQ towards the end users who
are trying to connect into our network.
What type of network access do they have at home?
Are there any specific ports that we
need to close on this device because we've
got the firewall wide open?
And how is encryption handled locally on our computer
or within the bios itself?
Clearing the screen, let me bring AnyConnect back up
onto the pane.
Look at this.
This is what we're talking about.
First things first, we have web security.
This is what type of internet sites or practices WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is what type of internet sites or practices
are they trying to browse to in the first place.
This is now leveraging the Cisco Umbrella product, which
was purchased from OpenDNS.
So we can now control what type of websites
the end user is accessing when they're connected to the VPN.
We also have the ability to enforce policies
by scanning the system itself.
This is looking for things like the firewall
and the AV configurations and the encryption configurations.
Here goes the roaming security.
This is, again, a content filter that we're WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
This is, again, a content filter that we're
talking about that's leveraged by Cisco Umbrella.
And lastly, we have the AMP enabler.
This is where we can actually install or enable
AMP or work with the local AMP configuration within the VPN.
So our local AMP configuration can communicate and coordinate
with AnyConnect, information about the device itself
and the posture of the network.
So AnyConnect is so much more than just a secure way
to access the network by providing a username
and password and using DTLS. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and password and using DTLS.
We can actually assess the entire operating system,
the entire computer itself, and then
determine, using profiling, what kind of access or authorization
should be permitted, if any, in the first place.
So this is how posture assessment works, and this
is how the Cisco AnyConnect client can enable
us to actually assess the posture of all
of our remote workers who are trying to access
our corporate resources.
I hope this has been informative for you,
and I'd like to thank you for viewing.