![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-30.png\")
<\/a><\/figure><\/div>\n\n\nCisco Umbrella uses different types of models to track any potential harm\/threat.<\/p>\n\n\n\n
- \n
- Co-occurance model – Identifies other domains that is looked up in rapid succession of a given domain. An example is when a specific domain that is malicious also has other domains tied\/looked up with the malicious domain. In essense domain guilty by intereference.<\/li>\n\n\n\n
- Natural Language processing model – domain names that spoof terms and brands. <\/li>\n\n\n\n
- Spike rank model – detects domains with an unual high spike of traffic.<\/li>\n\n\n\n
- Predictive IP space monitoring – Analyses how servers are hosted to detect future malicious domains.<\/li>\n<\/ul>\n\n\n\n
Secure Web Gateway<\/h2>\n\n\n\n
SWG allows the user to protect the following:<\/p>\n\n\n\n
- \n
- Anti-Virus and AMP Malware scanning (Advance Malware Protection) – Scan and detect a broad range of malware and viruses which avoids infection and stops any attacks. AMP is another anti virus product for end points. Working together to make sure enterprises are secure twice.<\/li>\n\n\n\n
- File Type controls – Prevents downloads of specific files, .exe files etc, also provides visibility of file types.<\/li>\n\n\n\n
- SSL decryption – Decrypt HTTS traffic, without HTTPS decryption, you will not be able to see the URL. <\/li>\n\n\n\n
- Category and URL filtering for Content control – Content categories is used for ‘acceptable use policies’ for enterprises. You can filter based categories such as ‘adult, Alcohol, News etc’. SWQuses Cisco’s Talos category which is the biggest security group for online activity.<\/li>\n\n\n\n
- Threat Grid file sandboxing – Sandboxing is used when there is a new threat that has not been identified\/ categorised without much information will be sent to Cisco Umbrella Sandbox in the cloud to be tested and see what is happening. <\/li>\n\n\n\n
- App Visibility and control – Can block posts\/shares on Social Media, block attachments to webmail apps, and blocks uploads to cloud storage, collaboration, office productivity and content management.<\/li>\n\n\n\n
- URL reporting – Visibility for compliance, monitoring and investigations. You can view the URL details by network, user , device and date for : trends, monitor activities and investigate incidents.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-31.png\")
<\/a><\/figure><\/div>\n\n\nCloud-Delivered Firewall<\/h2>\n\n\n\n
This is an Outbound firewall, meaning this will only work on the egress side as it leaves Umbrella. If you had other services in a DC or HQ which also have servers and requires users coming inbound to access, Cloud Firewall will not work.<\/p>\n\n\n\n
It has the following capabilities:<\/p>\n\n\n\n
- \n
- L3\/L4 Firewall – L7 capabilities<\/li>\n\n\n\n
- DPI in NBAR<\/li>\n\n\n\n
- IPSec only – When you engage Cloud firewall etc then an IPsec tunnel is setup to Umbrella SIG.<\/li>\n\n\n\n
- Multi-geo DC support\/location<\/li>\n\n\n\n
- Auto failover should primary DC fail – This is done by setting a standby tunnel to another DC using Anycast.<\/li>\n\n\n\n
- Firewall logs are exported to AWS S3 bucket.<\/li>\n\n\n\n
- An example is SWG blocks MS Web traffic and the fierwall blocks it Voice\/video traffic.<\/li>\n\n\n\n
- Order of operation is also important with the same rule as when you configure ACLs.<\/li>\n<\/ul>\n\n\n\n
How this works……<\/h3>\n\n\n\n
Enterprises can choose which data center they wish to utilise Umbrella as their exit point, advantage of Umbrella is that you do not need to build backup IPSec tunnels as this is done automatically. So if a data center fails then the IPSec tunnel will automatically move with minimal down time. <\/p>\n\n\n\n
When Customers choose Umbrella, Cisco will provide a static Umbrella Egress IP from the range of 146.112.0.0\/16 and 155.190.0.0\/16. These IPs will be unique to one per customer.<\/p>\n\n\n\n
IPSec Capacity<\/h4>\n\n\n\n
Cisco offers a maximum of 250Mbps in each direction (Up and Down) IMIX, with ongoing development to increase the capacity.<\/p>\n\n\n\n
Multiple tunnels can be deployed to support higher capcity<\/p>\n\n\n\n
Failing over to secondary as well as a DR tunnel is done automatically should there be a failure to primary and secondary tunnels.<\/p>\n\n\n\n
For an up to date list of DCs and regions have a look on the link https:\/\/umbrella.cisco.com\/why-umbrella\/global-network-and-traffic<\/p>\n\n\n\n
You will notice that IPv6 is also supported.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-32.png\")
<\/a><\/figure><\/div>\n\n\nCASB – Cloud Access Security Broker<\/h2>\n\n\n\n
Definition of CASB – Providing a central location for policy and governance concurrently across multiple cloud servises and granular visibility into and control over user activites and sensitive data from both inside and outside the enterprise permieter, including cloud-to-cloud access. What the hell does this actually mean?<\/p>\n\n\n\n
Umbrella provides CASB in two ways:<\/p>\n\n\n\n
- \n
- Inline\/Real time which means that traffic to the SaaS provider is intercepted, and scanning\/policies are applied before it reaches the SaaS provider.<\/li>\n\n\n\n
- Out of band which essentially is SaaS API and this means that when activity goes from the user directly to the SaaS provider then then through an API connection. The CASB applies the policy to provide visibility, protects the user or control their activity.<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-33-1024x475.png\")
<\/a><\/figure><\/div>\n\n\nCloud malware scans data at rest (Data at rest is data that is not actively moving from device to device or network to network<\/strong> such as data stored on a hard drive, laptop, flash drive, or archived\/stored in some other way.) in the SaaS service. Cloud to Cloud scanning<\/p>\n\n\n\n
<\/p>\n\n\n\n
Real Time DLP scans outbound web traffic inline<\/strong> through our secure web gateway proxy for all cloud destinations, whereas SaaS API DLP scans outbound web traffic out-of-band <\/strong>while it\u2019s at rest in the cloud, via restful API, instead of it going through the secure web gateway proxy, but<\/strong> with near real-time <\/strong>enforcement.<\/p>\n\n\n\n
Remote Browser Isolation<\/h5>\n\n\n\n
Typically if you need to access a potental risky site or uncategorised URL for a legitimate reason, RBI can help. RBI isolates web traffic from the user device and the threat in a air gap enironment. Air gap meaning is the specific device or network is isolated behind closed doors essentially. <\/p>\n\n\n\n
RBI frees you from the need to know what’s bad or not. It lets users go where they need, without the risk of malware that hasn’t been detected yet. With RBI, customers can stop browser-based attacks, and users can get a safe browsing experience without sacrificing productivity. IT teams will spend less time dealing with resolving access issues. And since it\u2019s cloud-delivered, RBI is easy to scale on demand, and works with all devices, browsers, and operating systems.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-34-1024x462.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-35-1024x519.png\")
<\/a><\/figure><\/div>\n\n\nConfiguring Basic Umbrella<\/h2>\n\n\n\n
First of all you would need to change the DNS to Umbrellas DNS – I am using my laptop as an example and pointing the DNS Server <\/p>\n\n\n\n
208.67.222.222<\/p>\n\n\n\n
208.67.220.220<\/p>\n\n\n\n
Then test to make sure it has pointed to Umbrella using the URL https:\/\/welcome.umbrella.com\/<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/10\/image-36-1024x683.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image.png\")
<\/a><\/figure><\/div>\n\n\nWhen you login to Cisco Umbrella you will need to create a Network. A Network is what identifies the network or device you are protecting. In this example I chose my laptop which is NAT’d behind a Public Dynamic IP. Now you maybe wondering if it is Dynamic as not every Business may have a Static IP, then how would it work when IPs will change?<\/p>\n\n\n\n
With umbrella, you can install a lightweight agent which will continuously poll with umbrella so should there be an IP change it will sync with your Umbrella Network.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-1-1024x492.png\")
<\/a><\/figure><\/div>\n\n\nClick the add button then you can enter your Public IP and as I can only afford a single IP, I will choose \/32.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-2-1024x113.png\")
<\/a><\/figure><\/div>\n\n\nNext, go to DNS Policies<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-3.png\")
<\/a><\/figure><\/div>\n\n\nClick to add a new Policy<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-4.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-5.png\")
<\/a><\/figure><\/div>\n\n\nClick Next<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-6.png\")
<\/a><\/figure><\/div>\n\n\nScroll down until you see Networks, you will notice there is a 1 next to it. Remember on the earlier steps we had to add the Networks which was my laptop I wanted to protect?<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-7.png\")
<\/a><\/figure><\/div>\n\n\nNext again<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-8.png\")
<\/a><\/figure><\/div>\n\n\nThis is where you can block the types of content.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-9.png\")
<\/a><\/figure><\/div>\n\n\nAnd click next if you do not want to block L7 Applications<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-10.png\")
<\/a><\/figure><\/div>\n\n\nThis is where you can block URLs which in this example I will be configuring to block a specific URL.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-11.png\")
<\/a><\/figure><\/div>\n\n\nI have added a new list called New Destination List 2 and it contain the URL www.live-footballontv.com<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-12.png\")
<\/a><\/figure><\/div>\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-13.png\")
<\/a><\/figure><\/div>\n\n\nIf you wanted file inspection it is on by default then click next.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-14.png\")
<\/a><\/figure><\/div>\n\n\nNow, if the end user does access the blocked URL I configured before you can choose which display appearance it provides to the user.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-15.png\")
<\/a><\/figure><\/div>\n\n\nAnd finally, you can choose to name your new Policy.<\/p>\n\n\n
\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-16-1024x366.png\")
<\/a><\/figure><\/div>\n\n\nAs you can see my new Policy is complete. Let’s try the URL I have specifically blocked and see Umbrella work its magic!
<\/p>\n\n\n\n![\"\"](\"http:\/\/jaychou.co.uk\/wp-content\/uploads\/2023\/11\/image-17.png\")
<\/a><\/figure><\/div>","protected":false},"excerpt":{"rendered":"Before I begin to explain and go through what Cisco Umbrella is I’d like to briefly explain what SASE is so this helps to understand the need and why Cisco Umbrella. SASE is a different type of achitecture that brings Networking and Security servives as one solution. Designed for strong security from edge to edge, … Continue reading Cisco Umbrella<\/span>