- [Instructor] With the continuous and varied threats
that come against our networks these days,
network security design continues to be
an ongoing challenge.
Lots of companies are looking for that single
one-size-fits-all solution that's going to provide this.
But in truth, that's just not a realistic expectation.
So rather than focusing on a single product solution,
Cisco has created a security model framework
called Cisco SAFE and that's designed to address
our modern network needs.
SAFE uses a model to organize our network into logical areas
referred to as places in network or PINs for short.
Each PIN has its own specific business use case
that requires certain security capabilities.
You can see that SAFE breaks down our networks
into several common PINs found in the center of the key
to the right.
Those are the Branch, the Campus, the WAN,
the Data Center, the Edge and the Cloud.
Now each of these PINs are foundational areas
in most of our common enterprise networks.
Here we would find authentication, routing, switching
wireless capabilities, firewalls, intrusion detection
and many, many other things.
These are essentially the core of our networks
some of our most valuable assets that we want to protect.
Right in the center of that, you can see the internet.
This PIN connects all of the other PINs together.
So for example, the Campus PIN,
would likely communicate with the Cloud PIN
via the Internet PIN in the center.
So that internet PIN is kind of like the glue
that holds everything together.
Each of these PINs have their own challenges
in regard to security, so let's look at each one of those.
First we'll look at Branches.
Branches are typically less secure than say a Campus
and that's primarily due to financial reasons.
If we have dozens or hundreds of Branches
it becomes cost prohibitive to duplicate
our security controls from the main office
to each and every Branch location.
That's the characteristic that makes Branches
a prime target and more susceptible to breaches.
Some of the top threats that you want to mitigate
in the Branch PIN would include, endpoint malware.
You want to make sure that every endpoint has protection
such as an anti-virus.
You want to think about wireless infrastructure
protection as well, you want to have safeguards against
things like rogue access points
so that you can avoid man-in-the-middle attacks
and trust exploitation attacks.
If an attacker can gain control of a trusted system
in the Branch, then they may be able to use
the already established trust relationship
to pivot throughout the network
and really common way for them to enter
is through wireless infrastructure,
especially guest networks if they're not properly protected.
Campuses usually contain a very large user population
and they'll have a wide variety
of devices connected into there.
This, coupled with the fact that a Campus usually requires
a large amount of subnets and VLANs for proper segmentation
that makes for more difficult network administration.
In the Campus, secure segmentation becomes our challenge.
Some of the top threats that you'll want to mitigate
in the Campus include things like phishing
and web-based exploits, network malware propagation
and botnet infestations.
And there's lots of other types of attack
similar to these that can leverage user weaknesses
in order to gain access.
So when we have a really large user base
as we would see here in the Campus
you have much more danger of someone falling prey
to these types of attacks.
And that's because our attack surface is really large here.
Also we want to be aware of BYOD,
bring your own device policies.
Those also pose a greater risk because again,
we're increasing the attack surface of our network,
the more devices that we have connected
the more potential entry points an attacker will have
into our network.
So that BYOD policy while that's a really great
cost-saving measure these days, won't be aware
that it is increasing the potential entry points
for malware and botnets and other types of attacks.
Data Centers commonly contain a large number
of our informational assets.
You would find things like proprietary information
or maybe intellectual properties there
and they can consist of either physical or virtual servers
or it can be a mixture of both.
The threats that you want to think about in the Data Center
for mitigation include of course malware propagation.
We want to think about unauthorized user access as well
since we have valid users accessing our sensitive resources
there's always the potential for unauthorized parties
to gain access.
And reconnaissance attacks are very troublesome as well.
This is when someone gains access to the network
and simply sits in the network gathering information
from the Data Center and they would maybe gather
trade secrets, financial information, employee records
and so on.
Perhaps the highest risk PIN is the Edge.
This is going to be the primary ingress and egress points
for our network.
So traffic between our network and the public internet
is gon' cross through our edge devices.
Now it's often said, that this might be the most critical
business resource in our modern internet-based world.
If you've ever supported a company
or even worked for a company
who experienced an internet outage
then you completely understand what I mean here.
Losing the internet can grind a company
to a complete halt.
The threats that we want to think about
in regard to mitigation in the Edge include
web server vulnerabilities.
So if we have web-facing servers of any kind
we want to make sure that those are properly secured
by making sure unnecessary services
and unnecessary ports are closed down.
Otherwise, we've left the door open into our network.
Also Distributed Denial of Service attacks.
There are many ways to help mitigate these
ranging from quality of service rules
to choosing a DNS provider
that offers DDoS detection services.
So CloudFlare for example. they use machine learning
to discover and adapt to DDoS patterns.
And man-in-the-middle attacks, again are a threat
to be aware of.
Anyone gaining access to an Edge device
they have the potential of intercepting
all of the traffic that's being passed between
our network and the public internet.
Cloud services continue to grow in popularity
due to cost and convenience.
Now the downside to that,
is that security is often largely out of our hands
and that's because we're relying almost solely
on the cloud provider to protect us.
And so when we're thinking about
protecting our Cloud environment,
one of the main things to be aware of
especially if we're using an external Cloud provider
is we won't be aware of the SLA,
the service level agreement.
That's going to dictate the strength of our security
that's going to dictate things like
where the information is stored,
who can access the information,
when can it be accessed,
what are the guaranteed up times
and what are the data recovery policies
and lots, lots more but that SLA
that service level agreement
that's something that you definitely want to read over
carefully and consider when you're choosing
a Cloud provider.
And the last PIN we want to look at is the WAN,
the wide area network connection.
The WAN connects all of our company locations together
in order to provide access to all of our resources.
Some of the threats we want to think about mitigating
at this PIN include, unauthorized application access.
This can give an attacker the potential
for deleting sensitive files, planting a virus
or even overwhelming system resources
in a denial of service attack.
Malware propagation is really big here as well.
This is the primary entry point for most malware
to enter our network.
And of course, data exfiltration or data loss.
This can be from an outside party
performing data exfiltration
maybe someone who's gained access to our network
in a man-in-the-middle type of attack
or it can be theft from an internal employee
taking our proprietary data.
The final parts of the framework
that I want to point out are the secure domains.
These represent the operational components for the framework
and they're separated by function.
The innermost layer, is the management of devices
and systems.
This is going to include policy creation,
change management tracking and system patching.
Next is security intelligence.
This is achieved through services
such as next-generation firewalls, email security
and much, much more.
The main goal here, is to provide intelligence
about emerging malware and threats in order to provide
accurate and timely protection.
The compliance layer, addresses internal
and external policies.
For example, if you work in the healthcare industry
you would be responsible for following HIPAA regulations
which is an external policy.
That could also be something like PCI
if you process payment cards in any way
you would fall under that policy
or maybe SOX compliance, if you're a company
that's publicly traded on the stock market
and that would also include any internal policies
that you've designated or designed
such as BYOD, bring your own device policies.
The segmentation layer establishes boundaries
for users and data.
Now traditionally, we've performed this with VLANs,
subnets and firewalls but more and more we're moving toward
more advanced solutions for that.
We're starting to leverage next-generation firewalls.
We're starting to leverage things like
Cisco's trust SEC which we'll discuss in a future video
and we're using identity awareness capabilities
and network automation in order to make sure
that we can enforce these policies better.
Threat defense uses tools such as IPS, IDS,
anti-malware and web application firewalls
just to name a few.
This is used to provide visibility into our network traffic
using contextual information, file reputation
and network telemetry.
This allows us to assess threats or suspicious activity
that we see in our network, so that we can take
the appropriate actions.
And again, many next-generation devices
like next-generation firewalls
they're going to allow us to inspect the traffic
at layers two all the way through seven
so we're going to get a much deeper look into the traffic
and be able to see that type of contextual information.
And finally, the outermost layer is Secure Services.
We think of this mostly at our WAN and Cloud levels.
This is where we would employ things like VPNs
and encryption to protect our traffic.
We also want to be aware of secure services
for internal applications for things like
wireless or collaboration.
So that's a look at Cisco's SAFE security model
which provides us with general guidelines about
best practices for network threat defense.