- Welcome to Lesson 18, Given a scenario,
modify enterprise capabilities to enhance security.
In our first lesson, 18.1, we're gonna talk
about enhancing security with network devices.
In this lesson, we're going to be looking
at how we can use network devices to enhance our security.
But a number of these devices,
we've already talked about.
Firewalls, IDS/IPS, DLP, NAC, and UEBA.
So let's do a refresher on those.
And then we'll talk about some new devices
that we haven't talked about yet.
Web filters, file integrity monitoring, and EDR/XDR.
As a refresher, we use firewalls to enforce security policy
by controlling ingress incoming and egress outgoing traffic,
using rules and access controllers.
We use our IDSs and our IPSs to analyze
and monitor for suspicious traffic.
And then the IPS can also deny traffic access.
DLP, our data loss prevention,
we use to detect and prevent unauthorized transfer
and exfiltration of data.
Our NAC, network access control,
we use to enforce endpoint access privileges
based on pre-admission and post admission policies.
And UEBA is our automation tool
that models the behavior of humans and machines
to identify normal and abnormal behavior.
So again, all of those were covered in previous lessons.
In this lesson, we're gonna talk about web filters
that we use to enforce restrictions to websites
based on predefined criteria,
file integrity monitoring to detect
and report on changes made to system application
and configuration files, and then EDR and XDR,
which are advanced integrated platforms that monitor,
report on, and respond to security threats.
So starting with web filters.
Web filters are used to enforce content restrictions
to websites based on a predefined criteria.
Now web filters are often used to enforce
an acceptable use policy.
We haven't talked about that yet, but we will.
Also, to protect against malicious websites
and to regulate internet access.
Now web filters can set limits on sites
that consume bandwidth,
and web filters can reduce shadow IT
by monitoring and blocking the uncontrolled use
of cloud applications.
Now there are different approaches
and techniques to web filtering.
URL filtering, keyword filtering,
allow and block lists, content analysis,
category filtering, and time-based filtering.
In URL filtering, what we're doing is controlling access
to websites based on their URLs
by comparing their URL with a database of categorized URLs.
These are ones you can go to or you can't go to.
Keyword filtering controls access to websites
and content based on specific words, phrases,
or patterns that are found in the URL
or in the webpage itself.
Allow and block list control access based on a maintain list
of allowed sites and or block sites.
Here are the only sites we're gonna let you go to
or here are the sites that we're gonna block.
Content analysis is how we control access
based on an analysis of the site,
including text, images, and programming language.
So it's really a maturity of the keyword filtering.
Keyword filtering was just looking for keywords.
In content analysis, we're also looking at the text,
the images, and even underlying programming language.
Category filtering is controls based on a category.
So for example, you can't access adult content
or based on media type.
You can't access streaming media.
And time filtering controls access
during times of the day or days of the week.
There are different ways to implement filtering.
We can have, on the client side,
browser extensions or local software,
or we could have a centralized network proxy server
or we could do it in the cloud, have a cloud-based service.
The browser extensions,
sometimes referred to as plugins or add-ons,
are used on an individual device to filter internet access.
That's gonna be effective for personal use
or for really small scale use.
We can also have, on the client side, local software
and that is software that's installed
on the individual devices for internet filtering.
Once again, effective for personal use
or on a very small scale.
Now a centralized network proxy server
will process all requests that the user makes
and that gives the proxy server the ability
to filter the content or block or allow access
to the websites.
And then we have cloud-based solutions.
A cloud-based SaaS web filter
processes the internet request in the cloud.
Now DNS servers are configured to point
to the web filtering provider
and that's where the decisions are made.
Now of course, if we're not going through a proxy server,
maybe we're working at home
so we don't go through the proxy server,
it may require an agent
on those remote devices for remote workers.
Next up is FIM.
FIM stands for file integrity monitoring.
Now FIM tools are used to detect and report
on changes made to a system and application
or a configuration file.
And FIM can monitor just a really wide range of attributes,
including file size, permissions, modification,
access, and ownership.
So what does the FIM process look like?
Well, a baseline creation of the file is created.
Really, what we're doing is we're creating a hash.
Remember, a hash is just a visual representation.
We talked about how we created hashes early on.
We're gonna use a a hash calculator.
It could be online or local.
And we're going to take a variable length input
and we're gonna end up with a unique
one-way fixed length output called a hash
or a message digest.
So we're gonna create a hash of the file.
And then the FIM software who has created the hash
will monitor, either real-time monitoring
or periodic checks to see if anything has changed
in that file by looking at the hash, right, rehashing.
Doing a comparison, did anything change
or are they same, right?
If anything changed in the hash,
we know that that file was modified.
But if nothing's changed in the hash,
we know the file has not been modified.
But if there is a change,
then the FIM software will be able to send an alert.
This file has changed.
Could be a data file, could be a database file,
could be a registry file, could be a system file.
Next, we have endpoint detection and response known as EDR.
The endpoint detection and response solutions
continually monitor our endpoint devices,
or host devices, right, to detect and respond
to suspicious activity.
The EDR tools identify threats
using a variety of techniques,
including pattern recognition,
anomaly detection, and behavioral analytics.
And when a potential threat is detected,
then an alert can be sent.
The EDR tools can be configured to respond
to the event by isolating the endpoint.
So something's wrong, the EDR tool can be instructed
to isolate that device, right,
that endpoint from the network
or from any other surrounding systems.
Extended detection and response, XDR,
really takes EDR to the next level.
Extended detection and response, XDR,
is a unified platform that continuously monitors activity
across the enterprise.
Network traffic, cloud workloads, email,
and any other relevant security data for security threats.
The XDR tools collect and correlate data
across different security layers,
creating this really holistic view.
XDR systems also incorporate advanced analytics
and AI, artificial intelligence.
And our XDR tools can be configured to respond
to detected threats on multiple levels, isolate a system,
block malicious traffic, or disable a user account.
So this is really the way we're kind of heading.
This is an emerging technology and tool.
A little bit complex, a little bit expensive,
but really think about what it does.
This unified look, right,
at activity across our entire platform.
And that, my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do it.
Detects and reports on changes made
to system application and configuration files.
One, two, three.
It's gonna be file integrity monitor or FIM.
Number two, enforces content restrictions to websites
based on predefined criteria.
One, two, three.
It's gonna be web filtering.
Number three, solution that continuously monitors
endpoint devices to detect
and respond to suspicious activity.
One, two, three.
It's gonna be EDR, or endpoint detection and response.
Number four, unified platform
that continuously monitors activity across the enterprise.
One, two, three.
It's gonna be XDR, extended detection and response.
And lastly, number five.
Controls internet access during times of the day or week.
And this would be a type of web filtering.
What is it?
One, two, three.
Time-based filtering.
So that brings us to a security in action.
And this one is about internet access issues.
Now your organization's experiencing challenges
related to internet use in the workplace.
As workers have continued to work from home,
there's been an uptick in the amount
of non-work-related browsing.
Concurrently, there's been an increase in visits
to suspected malware distribution sites.
So your boss has called a meeting to discuss this issue
and he's asked you to be prepared
to share suggestions and recommendations.
Now he's also concerned about staffing shortage,
so he doesn't wanna have to put any additional burden
or minimal additional burden, at best, on our current staff.
So again, what's going on here, right?
We've got problems related to internet use in the workplace.
We've got an uptick in the amount
of non-work related browsing.
And concurrently, we've got an increase in visits
to suspected malware distribution sites.
So go ahead and put me on pause.
Think about what your recommendations are to your boss.
Well, web filtering would be a great recommendation
because web filtering can be used
to block access to websites and categories,
such as adult content, social media, personal email,
and online shopping during work hours,
as well as to streaming services.
It can also be configured to block known malicious websites
and those websites that are uncategorized,
as those could potentially pose a security risk.
Now if we're worried about staffing, right,
increasing their burden or their workload,
a cloud-based solution could be used
for both our on-premises and remote workers.
Our DNS servers would need to be configured
to point to the SaaS provider
and an agent installed on the remote devices.
That cloud-based SaaS solution, again,
offloads the work from the on-premise staff
while still allowing you to put in a solution
that's gonna specifically address the issues
that your company is facing.
Great recommendation to make.
I bet your boss is thrilled
and thinking that's security in action.
All right, there's your word cloud.
You know what to do.
I'll see you at the next lesson.