good morning everybody
I like to welcome you to this webinar
where we're going to be discussing
improving security and defenses with
dynamic network segmentation and this is
a joint presentation between four Scouts
technologies and Palo Alto Networks so
just some introductions my name is rich
ager and I'm an a systems engineer here
at Foursquare technologies
good morning everyone my name's John
wood and I'm a systems engineer at Palo
Alto Networks so welcome everyone to the
call by the way we are recording this
like that's cool and if you have any
questions you should have a chat window
or questions window that you can type
them into and we'll go through questions
at the end of the session thank you John
so there's going to be three areas that
we're going to look at in a session
today one an overview of the security
challenges that organizations are facing
then we're going to look at the solution
will be a section they're looking at for
Scouts a section looking at Palo Alto
Networks and then a section on the
combined solution and then we'll look at
a couple of customer stories
so there are three trends that we're
seeing increasingly here at four Scouts
and apparel two networks first of those
are shown in the left hand side of the
screen here and that's the growth of
different devices joining the network
and the diversity of those different
devices so historically our enterprise
IT networks we saw managed desktops
manage servers and very few other kinds
of devices but increasingly we're seeing
multiple different kinds of devices
being joined to the network each of them
having different operating systems and
and presenting a challenge to
organizations in terms of how they
marriage those devices because typically
agent software can't be deployed on
those devices and that creates a
visibility gap a challenge for for
organizations and many of the vendors of
these devices don't provide security
patches and that introduces an
increasing risk and we're also seeing
rapid adoption of cloud-based services
so historically we would have all the
devices in an enterprise environment
sitting we did in that environment now
we're seeing a move to cloud some great
benefits of that move but that creates
some challenges in terms of visibility
and security and the third area we're
seeing is a convergence of traditional
IT networks and operational networks
coming together and we need to be able
to provide a solution that gives
visibility and control across that
converged infrastructure so there's a
quote here from Rob Joyce who is the
chief of tailored access operations at
the NSA and he says if you really want
to protect your network you really have
to know your network you have to know
your devices and the things connected to
your network
excellent so now we're going to talk
about video respective solutions that
both for scouts as well as Palo Alto
Networks offers and we start with Palo
Alto Networks so those who don't know
Palo Alto Networks we are a cyber
security company our aim is to protect
our digital way of life and we do this
by helping organizations prevent cyber
threats so the way we do this is using
our next-generation security platform
our platform consists of a number of
different elements that will work
together to provide consistent
protection regardless of the location
the form factor or any other things so
you can actually see the different
components of our solution on this
screen here we have the network security
components of course we're well known
for our next-generation firewall
technology which is a technology that
sits on the network and allows us to
identify and control network activity we
can extend the protection of the
next-generation firewall by using our
global protect as well as our global
protect cloud service is a new
technology that helps us to extend the
reach of our firewall security
technology to remote users and remote
sites in addition to the network
security components we offer an advanced
endpoint protection technology called
traps this is a an advanced protection
technology it sits on the endpoint and
it's designed to prevent cyber threats
from being able to compromise those
endpoint devices it works in a lot of
variety of operating systems including
Windows Mac OS Linux devices and it
works in some quite interesting ways we
focus very much on the exploit
protection side of things so for example
helping to prevent browsers or other
applications from being compromised in
order to deliver malware onto those
endpoints and then we have technologies
that allow us to secure in the
cloud as well so we have our firewall in
fact the next-generation firewall can be
delivered in a VM form factor so that
allows us to place that technology into
public and private cloud locations for
example Amazon Web Security Microsoft
Azure Google cloud platform but we also
have a technology that we call aperture
which provides protection against SAS
applications as well as as the IAS and
the pass
solutions so aperture actually works by
utilizing api's into these cloud
applications and that allows you to
provide security to your office 365 or
your Google G suite environments so
those components effectively function as
enforcement points and they are they
allow us to leverage our cloud services
on top so things like threat prevention
and wildfire to allow us to control
security threats whether they be known
or unknown threats in the network they
also function as information gathering
points as sensors if you'd like that
collect information and deliver
information into cloud by our technology
that we call logging service and this
allows the the user the administrator to
utilize that data in many different ways
we have some interesting new
technologies one of them is called
magnifier as a technology that allows us
to perform behavioral analytics on the
on but on the traffic on the data that
we're collecting from our sensor points
on the network so how do we secure and
prevent successful cyber cyber attacks
well it all starts with visibility and
it's a very important point especially
given the integration with for scale at
the end of the day if you can't see
something chances are you can't protect
against it
so our organization right across the
different components of the platform are
built with visibility in mind our
next-generation firewall is able to
identify applications users and content
as well as traditional firewall
components like IP addresses ports and
protocols we have visibility into
encrypted traffic as well and of course
into the identity of users on the
network so giving us that visibility
allows us then to effectively reduce the
attack surface it gives the
administrator the ability to pick and
choose and identify the applications and
the users that should have access to
components of the network and to
identify those applications that should
be restricted by the firewall so that
reduces the attack surface by
effectively removing undesirable traffic
from the network and next step is to
prevent known threats so by picking out
the easy target so in terms of things
like malware and vulnerabilities and
exploits that we're detecting on the
network and then finally that leaves us
with the unknown threat slightly more
complicated scenario where we're faced
with malware that has never been
observed before so using things like our
wildfire cloud service we can
effectively identify convict and
in-control
unknown threats on the network
thank you John so I'm going to provide
an overview overview now of for Scout so
there are three areas that for scale
operates in and they're shown on the
screen now as sea control and
orchestrates
they're specifically looking at see pool
Scouts counteract is able to provide
complete visibility of every IP
addressable device that exists on an
enterprise network and it can do that
without having to have any previous
device knowledge or any agent software
install on that endpoint so we do that
by discovering devices as they join the
network we gain information about the
MAC address the IP address will then do
some more detailed interrogation of the
device to find out what operating system
is running on it whether it's a member
of the domain etc etc so we classify
those devices as either a printer CCTV
camera an HVAC system and managed
desktop etc and that allows us to be
able to then apply granular policies
that do some further inspection of those
devices so for a managed device we could
reach into that device and get
visibility of all the applications and
services and processes that are running
on that device we can look at patch
status you can check and make sure that
security applications are installed
they're running and they're up to date
for for non managed devices like
security cameras we can classify those
we know what kind of device they are we
know how they should operate and we can
monitor those devices and for other
devices contractors devices guest
devices we can identify those and apply
access accordingly so this gives an
organization a good view of the security
posture of every single IP addressable
device that exists on their network
at once we have that were able to apply
some controls and those controls broadly
fit into three different areas
notice by comply and restrict so from a
notified point of view and we can we
could notify the user if they have a non
compliant device and if they're a guest
user we can redirect them to a guest
registration portal if they have a a non
compliant device we can notify the user
some organizations want to do that
others don't we can notify the helpdesk
we can open a tribal tickets but the
idea of notification really is to give
an organization visibility of the
security posture of every single device
that is connected to their network once
we have that visibility and we can move
on to some compliance policies those
compliance policies can rack controls
around different devices so to give you
an example CCTV camera will be
classified as a camera and that can be
assigned access just to a specific VLAN
or network segment relevant to its need
for devices that are non-compliant may
be a corporate managed device that's
been off the network for some time we
can automatically bring those devices
back into compliance by starting the
update process or stopping applications
that shouldn't be running installing
applications it should be pleasant and
making sure that they are up-to-date and
running and then from a restrict point
of view we can move devices to different
parts of the network based on need so we
can change the VLAN that a device is
connected to to either restrict its
access or provisionally access that it
needed for function we can remove
devices from the network altogether if
it's a completely non compliant device
if it's a rogue device and really just
being able to apply the access to the
network that is needed
and then the orchestration capabilities
take all the information that we know
about an endpoint so we've seen an ankle
enjoying the network we understand its
security context we understand which
user is logged into that device how its
operating on the network
that's quite a rich contextual database
of information and we can share that
with third-party organizations to enable
them to have a better view of the
devices that are connected to the
network and we can also become the
enforcement point for those devices and
we'll talk about that later on in the
presentation
so now we're going to talk about the
combined solution with full scale and
Palo Alto Networks so the four scale
platform has the ability to be able to
extend its functionality beyond its core
function and to integrate with a number
of different vendors products so for
Palo Alto we can integrate with the next
generation firewalls and we can
integrate with wildfire this allows
customers to be able to use those
combined solutions so contracts will
identify the user and some context about
the device they're using and be able to
push that to the firewall and that
enables a firewall to be able to
automatically segment the network based
on the information we know about the
endpoints and it enables the
organization to be able to automate
incident response and we'll see some
slides on this later on in the
presentation yeah that's absolutely
right rich so yes so there's two key
components here and it really allows for
a kind of information exchange between
the full-scale solution and the Palo
Alto Networks next-generation firewall
effectively you know for Scout can
identify devices on the network pass
that information to to the next
generation firewall and then the next
generation firewall can use things like
identity information so you know user ID
for example as well as information games
about the nature of that device in order
to enforce security policy so
effectively segment the network by
deciding dynamically what devices should
be able to should be able to you know
reach the various resources on the
network reach out to the internet for
example this is very very important
especially in the IOT era when there
were many many devices on the network
that aren't necessarily conventional
devices and and of course the other side
of that is the insight that's gained
from Palo Alto Networks wildfire service
so as I mentioned before wildfire is a
technology that allows effectively us to
convict now
even if it's of an unknown nature so if
we've never seen it before the palette
that the next generation firewall cannot
to send data send files to wildfire
wildfire can do a variety of different
techniques
pull the file apart in the process that
we call static analysis to understand
the nature of the fire what it looks
like essentially and then can do things
like detonate the file in a controlled
environment you know a traditional
sandbox to identify what the file does
when it's executed so this process
allows wildfire to identify or convict
that file is essentially being malicious
or benign but in addition to doing that
wildfire also collects a lot of
information that we call IOC s or
indicators of compromise that indicate
the behavior of that malware when it's
running in a network so for example what
does the file look like in terms of hash
values what connections does it make to
the Internet what DNS request does it
make and all of this information can
then be passed back to counter acts in
order to identify what the where where
that affected clients may be on the
network
thank you John so we're going to go
through as I mentioned earlier we're
going to go through three different
areas where there's integration between
for scam counter example on two networks
and so the first here we're going to
look at how the component solution can
enforce identity and context-aware
policies so when the device joins the
network can chat will immediately
discover that Network it will classify
the device and it will assess the
security posture of that device when
it's done that is able to send
information through to the Palo Alto
Networks next-generation firewall and/or
wildfire and that information can
include user ID to IP mapping so the
firewall has context of the user that is
using that device rather than just the
IP address and as I mentioned before we
can do that without having to have any
software installed on the endpoints we
can pass on device security tags we can
give the firewall some information about
the kind of device that's connected HVAC
system CCTV camera and use a desktop
guest machine contracting machine etc
and then we can also pass on some device
posture and compliance information
through to the firewalls that it can use
that to make decisions about the access
there should be provisioned absolutely
and then finally the Palo Alto Networks
next-gen firewall can use the
information that's gathered from four
Scout to apply policies effectively to
control access of that device so looking
at some of the information that for
Scout is gathering here user ID enter IP
mapping well that's fundamental for us
to be able to to be able to identify and
apply user information to traffic so
rather than just making decisions about
based on things like client IP addresses
we can apply policies effectively based
on Active Directory groups and other
bits of user information in addition for
of course it allows our reporting to
become that much richer because the user
information will effectively superseded
client IP as a source condition and in
addition the security tags can be used
dynamically by the firewall to to
enforce policy so effectively for Scout
is telling us which devices it leaves to
have various characteristics those
characteristics are configured into the
firewall and they allow us to
effectively apply the correct policy to
a particular class of device or
particular type of device based on the
observation that for Scout has made
around that device so that's the first
use case there the ability to enforce
identity and apply context aware
policies thank you John
so now we're going to look at a use case
where we have devices connecting to the
network and the ability to be able to
dynamically segment the network so as I
mentioned before different types of
devices in this instance these are IRC
devices so devices that can't be managed
by traditional techniques they join the
network counteracts call them
automatically detect classify and
categorize those devices based on the
information it learns about them and
then it takes that information and send
that information through to the firewall
absolutely right so having received that
information on the firewall we then have
the capability of delivering that
information as before to provide access
to predefined policies so for example
you can see that this is obviously a
medical environment that's kind of built
into this you station can see that there
were a number of IOT devices on the
network some of them have been
classified
I buy for scout as MRI machines and
obviously MRI machines need to talk to
particular device other devices on the
network and we have a case there of a an
MI like server but of course we don't
necessarily want to give that MRI
machine access to other devices on the
network
the thing about IOT devices is you can't
necessarily be sure that they're always
free from compromise so that's why be
the segmentation of the network is so
important in this particular case there
having identified the type of machine
that's operating on the network the
correct policies that applies the
firewall level to effectively determine
what other devices that particular
component has access to you can see the
untrusted devices in this particular
circumstance and has been flagged up as
such by for scale and then that means we
can apply a suitably rigorous policy to
prevent that device from being able to
access other components as well as being
able to reach out to the Internet so
effectively with Wisc we're dividing the
network up based on the the type of
devices and the policy that dictates
what what communication is permissible
from that particular device so that's
the second use case they're dynamically
segments in the network the third use
case is where our wildfire service comes
in and that's the process by which we
can automate incident responses so in
this particular example we have a
network that includes devices that are
managed and one of these devices becomes
compromised so in this particular
scenario that device may be you know
they become victim to a phishing attack
and click the link in an email whatever
whatever the approach there's now live
malware being downloaded to that machine
across the network now obviously if that
malware is a known threat if it's a kind
of you know the garden-variety piece of
malware the firewall be able to identify
that as such on the fly and effectively
blocks that transaction from from
that's for making its way to the client
however if the threat is unknown if
we've never seen it before we need to
take some extra steps using wildfire to
convict and identify the malicious
intention of that file so when that file
is downloaded the firewall is obviously
sitting in line and receives that file
as part of the connection between the
client and the server that is delivering
that threat the firewall determines that
the the file being downloaded should be
submitted to wildfire for further
analysis so it does two things
it's forwards the file to the Clyde as
taking the assumption that it's clean
but it also sends it to wildfire for
full analysis so once wildfire receives
that file it will be analyzing that file
and understand try to understand the
intentions of the fire whether it's
malicious or benign now in the
circumstance that wildfire is malicious
it can then share the information report
back to the firewall which then in turn
sends an alert to counter apps and
provides counter that information about
the nature of the threat as well as the
endpoint that's been affected by that
particular threat thank you John
so so when when wildfires analyze the
file and has been that to be a malicious
file I can send some information through
to counteract to identify that that is
indeed a malicious file now that doesn't
necessarily mean that the end point has
been compromised it just means that
there has been an attempted compromise
of that endpoint so can travel in query
wildfire for the specific indicators of
compromised associated with that threat
and then based on that information based
on that information cancer
is able to scan that specific device and
work out whether it was compromised if
it was compromised cancer I can isolate
that device and can initiate some
remediation actions on that device
there's two important points there were
isolating that device if it has been
compromised so it's not able to to
spread that threats laterally across the
network and it initiates a process to be
able to remove that threat from that
specific device counter app will then
take that IRC and it will start to scan
the remainder of the network again
without having to have any agent
software installed it will scan the
devices and it will look to see whether
any other devices have been compromised
and if they have it will provide
isolation based on policy and will
initiate that remediation for other
devices that may be compromised and then
once the devices have been remediated
and they are deemed to be clean those
endpoints are then allowed back on the
network and can function as required so
now we're just going to summarize some
of the benefits of the full scale and
the Palo Alto network solutions so from
a full-scale point of view we discover
every IP addressable device on the
network and we do that without the use
of agents and then we share that
information with the Palo Alto Networks
firewall so every single device that
joins the network will be profiled and
classified and then we provide that
information through the firewall it's
important to emphasize that that's every
single IP addressable device on the
network so there's no need to have any
agent software it would be any kind of a
device that's on the network and then
from a from a bi-directional point of
view as we were just talking about we're
sharing information with the firewall
but we're also becoming the enforcement
point for that firewall so when when
wildfire detects a threat were able to
autumn
a clear app controls around that
infected endpoint to be able to reduce
the risk of that threat spreading across
the network over to you John
absolutely so on and from the Palo Alto
Networks perspective we're obviously a
threat protection technology so we
utilize technologies like wildfire to
help to test those advanced threats and
provide the feedback effectively
indicators are compromised back to
ourselves as well as the four Scouts of
mission we can enwrap our policy
controls to block outbound communication
and of course block into network
communication building that segmentation
that we talked about the policy can be a
force based on characteristics learn
from four Scouts such as the users the
precise nature of the devices that have
been classified by full scale as well as
things like the applications and natural
network transactions that they are using
and this is a much more effective way of
controlling network traffic than just
relying on traditional stateful firewall
conditions such as IP addresses ports
and protocols so yes using this
technology we dynamically segment the
endpoints based on the information we
learn from for scale and of course we
also gather the hip information that
host information profile so information
that for Scout learns about the device
such as the the nature of the operating
system patch levels antivirus protection
levels and various other bits of
information all of this other stuff can
also be used to to effectively dictate
firewall policy and control the level of
access that that device how to the wider
the wider network
so now we're going to look at a couple
of customer stories look at a couple of
scenarios where these technologies have
successfully been used together to help
secure our customers the rich if you
want to start us off with healthcare yes
the lovely so there's a specific
challenge in in healthcare regarding
medical devices there are many different
devices that get deployed within
healthcare that are there for a specific
function and they're built they have to
go through rigorous Quality Assurance
processes to make sure they are are fit
for purpose now that makes cracking of
those devices quite quite challenging so
typically we will see many medical
devices deployed in healthcare
environments that are unpatched and have
been on patched for many years critical
of course that they are available and
operators they should do so the
network's in healthcare tend to be flat
network and that can make segmentation
difficult so organizations don't tend to
know where devices are to be able to
provide that that segmentation so
working with for scale and with power up
to networks we provide visibility of
those medical devices we see that when
they join the network we categorize them
and we we allow the through the
integration with power up the networks
using our extended module we allow the
firewall to be able to apply that
segmentation to make sure that those
devices can communicate as they should
but they are in a restricted part of the
network so the benefits of that really
are automatic identification of medical
devices tagging those devices and
providing that information through to
the firewall so we can increase the
protection around around those devices
John's there going to talk about a use
case in the government space excellent
thank you very much rich so yes this is
another example of for Skelton and Palo
Alto Networks working together this time
in government this is actually a federal
age
see within the United States and they
had a number of challenges they had a
very large Weis Network very complicated
Network and they obviously security was
very high on their agenda they wanted to
ensure that they had visibility of each
and every network device and they wanted
this to be very comprehensive and to
include not just the domain join
traditional clients that you imagine but
also the increasing number of IOT type
devices that were sitting on the network
in addition to this they wanted a
solution that could identify as rapidly
as possible emerging threats on the
network and allow them to mitigate those
threats and take remediating actions to
isolate and control the endpoints so the
solution for them which was actually
quite clear the addition of four Scout
counteract along with Palo Alto Networks
firewall and wildfire technology
provided them the flexibility to be able
to identify devices coming onto the
network quickly classify and policy
around those devices to to control what
sort of access they had to various
device to other devices and servers and
services running but they also wanted
the ability to collect information about
the threats that were being observed
obviously being a very high profile
government agency this particular
customer was particularly exposed to
advanced threats and targeted attacks
and so they wanted obviously that the
ability to get to communicate the IOC s
learnt about the particular attacks that
they were seeing and to take action and
remediate the devices on the network and
of course the force gap solution
provided them with the technology to be
able to quickly isolate and provide
controls around affected endpoints so
they were able to very effectively find
solutions to their to their issue
so to summarize them we've obviously got
the collaboration of
our respective technologies which I
think you going to talk through the
identity piece here yes thank you John
so as you mentioned before John it's not
possible to secure a device that you
can't see if you don't know a devices on
your network there's nothing you can do
to to protect that device or to protect
other devices from it so the starting
point really is to be able to have
visibility to identify those devices and
the applications that are running on
those devices once you have that you're
able to decide how you want to respond
it's important to to bring out a point
here that we're not just talking about a
an assessment when a device joins the
network the the combined solution is
continuously assessing the security
posture of devices as they're on the
network and that is true for both
traditional IT devices and agentless
visibility of other devices such as IOT
medical devices operational technologies
etc excellent
so having gained the information
collected during that particular process
we can implement dynamic segmentation on
the network based on policies to
effectively control different devices on
the network and where they have access
to but in addition to that we also have
the ability to proactively prevent
threats from from penetrating the
network and getting to those devices
identifying the advanced threats and
providing indicators of compromise that
can then be utilized by four Scouts in
the response phase thank you John and so
yes when when a device has been
identified as being being compromised
through integration between Palo Alto
Networks and poor Scout counteract we
are able to also make that threat
response and immediately isolate that
device on the network as we can do that
by by connecting to the edge device the
access switch or the wireless access
points at isolating that device though
it's not possible for that device to be
able to communicate with anything or we
can allow a limited communication that
isolation is based on our on corporate
policy and of course once we've done
that we will notify admin users that
that happens and we can start the the
process of remediating that device
excellent so that just about sums up the
the partnership that we have between
four Scouts and Palo Alto Networks we'll
take some of your questions in just a
moment but before we do that I just want
to talk about an event that we're
running next week in London which is the
Palo Alto Networks cybersecurity summit
this is actually a very good way for
those of you who are interested to
further this conversation wither we have
some we have two events taking place on
the one on the 20th of March so that's
next Tuesday that's going to be for our
end user customers and we have an event
on the 21st of March the Wednesday for
the partners we have some some pretty
interesting speakers actually we have MS
Duke who is the founder and CTO of Palo
Alto Networks he's going to be talking
about how we can disrupt the
cybersecurity status quo and we have a
number of other interesting speakers on
the on the event on the day including I
think rich I think you'll be doing a
presentation about this partnership live
at the event
I really do John yes Lincoln excellent
so yes they come and see yet cover be
rich from presenting live and we look
forward to seeing you on the day
invitations and links to more
information on this event will be sent
out in the email that follows this
presentation and that being said let's
move on to questions we've got a few
questions here on me on the screen if
you have any questions but you haven't
yet typed them in just a reminder you
can type in a question and if we have
time we'll take a look and see if we can
go about answering it how about I pick a
question that's relevant to a Palo Alto
so question here what does the next
generation
I will do with identity data collected
by four Scouts that's a good question so
there's a couple of bits of informations
that that we collect during that kind of
that kind of analysis phones first of
all there's use of identity so what we
call use of identity - IP mapping and
this is a technique that can help Palo
Alto Networks understand who the user is
it's associated with the machine on the
network so without doing some kind of
user ID all we're going to be able to
see is client IP addresses and the
coordinate in a modern network that's
not going to help us out very
effectively both in from a visibility
but also a kind of enforcement
perspective so getting the user identity
and allowing the firewall to effectively
be able to map that user to the
transactions we see on the network is
very effective but what also happens and
it's a process called tagging the four
Scout device can actually send
information to Palo Alto Networks about
the nature of the devices on the network
so going back to that scenario with the
with the hospital you saw for example a
number of different types of devices
that had been identified by four Scout
there was an MRI scan of example if we
can identify that on the four Scout side
that can then be passed across to the
next generation firewall for a tag and
that allows us to update that the that
device within what we call a dynamic
address group so then we can apply
policy seamlessly to that traffic as if
it was known to be known to the firewall
in advance I hope that answers your
question there
come on so John I've got a question here
relating to full scale so the question
is how does full scale provides
contextual information without requiring
an agent and so we do that a number of
different techniques as I mentioned
previously when any device joins the
network we immediately discover that
device and we classify it and categorize
it that we may categorize that as a
Windows desktop CCTV camera a smart TV a
smart phone etc but for managed devices
Enterprise managed devices and we can
identify that if it's a Windows system
we can identify that using a protocol
called WI from Microsoft if it's a Linux
or a Mac system then we can connect to
it via SSH now either of those
techniques give us admin access to that
end points so we can reach into that end
points we can query and we can look for
patch status applications that are
running that shouldn't be any
applications that should be running
there are not security applications that
are requiring updates etc and so to
manage devices we just reach straight
into those with us protocol for
unmanaged devices this could be a guest
machine could be a contract could be an
IOT device and we have two different
techniques that we use and we can use
active monitoring those devices or
passive monitoring so with active
monitoring we will launch a port scanner
that device will see what ports are open
and then we can connect to those ports
and we'll see what information we get
presented back from those systems so one
example of that would be an IP Phone the
web server on a Cisco IP Phone will
announce its particular mobile number
and its serial number contract can then
query that against an existing database
to see if that is a corporate IP phone
if it's a networked device we can
connect to that via SNMP and look for a
particular SNMP community string
awesome information embedded within SNMP
positive monitoring and we can look at
the traffic that the device generates
and we can look within that traffic for
particular types of communications so
going back to the IP phone that should
only ever be communicating with the web
server or another IP phone we can look
at things like HTTP headers IOT devices
tend to use HTTP so we can look into
those HTTP headers and we think a TCP
session see how they're being
established and a combination of all of
those techniques and gives us a very
powerful view of the device that is
connected to the network and of course
we can send that information once we've
categorized that device appropriately we
can send all about contextual
information through to the
next-generation firewall so it can
assign address right excellent weather
rich so another question I think that's
relevant to Palo Alto does the solution
work with HTTP traffic and that's a good
and deep question the short answer to
that is yes the solution that can work
with HTTP what I think you're saying
there is where the threats being
downloaded onto a compromised device can
does it make a difference if the traffic
is being sent across a plaintext
protocol like HTTP or does that or is
there an impact if the traffic the
threat has been downloaded via SSL
encryption through HTTPS and the answer
is yes the Palo Alto Networks firewall
has the capability of intercepting SSL
encrypted traffic and of course that's
quite important in this day and age we
we reckon at the moment there's probably
upwards of 50 percent of web traffic is
now SSL encrypted a lot of the large you
know providers of web services you know
likes of the Google's you know as well
as the you know people like Facebook
that the biggest websites in the world
are all moving entirely to to HTTPS
actually by 29
we predict that they'll be upwards of
80% of of web traffic is SSL encrypted
and the course attackers love SSL
encryption because it's a it's an easier
way of getting threats into an
organization they know that the less
organizations have the capability of
protecting with SSL well it would when a
technology like SSL inspection you can
actually use the next-generation
firewall as an enforcement point for
encrypted traffic and effectively that
will give you visibility to be able to
identify the malware as it's coming in
over that channel and at that point in
time it goes it's exactly as before we
will then use wildfire to to identify
the threat share that information with
four Scout to help isolate the affected
end points and provide remediation
control to the network so I hope that
answers your question
rich thank you John
so got a question here that says how can
four Scout help bring non-compliant
hosts back into compliance and so this
is just kind of a follow-on question I
guess to the previous question so when
we have remote admin access to a managed
device we have full visibility of all
the applications processes and services
running on the end points and we can
query the registry with look at the file
system we can pull back patch levels etc
another link to of course the security
builder application status that's
running on that end point so we can take
that information we can work out that
there are some patches missing on our
endpoints and we can automate the
process of starting updates on that
machine if there's a specific
application that should be installed but
it's missing we can also mate installing
that application if it's there but it's
not up-to-date we can automate bringing
that device of today's and we've also
because we've got visibility of the
applications running on the endpoint we
can look for vulnerable applications
that exist and when we see those we can
stop
the ring we can uninstall them and we
can automate the process of installing
the correct version of that application
excellent exit well that's that's all
the questions that we have on our on our
list there if you have any any further
questions that you suddenly think of
after this presentation there's a couple
of places that you can go to get
answered one of them is Corso I'll put
another a plug in for our cybersecurity
summit taking place next Tuesday in
London and we'll follow up with
information more information there
there's also some email addresses
there's UK app for Scout comm feel free
to send any questions relating to the
four Scout side there we also have sales
at Palo Alto Networks comm for the wall
that's read by our organization within
Palo Alto Networks so thank you very
much for your time today I hope everyone
enjoyed the presentation thank you in
particular to Richmond for assisting on
this presentation with alongside me and
I hope you have a good rest of your day
and I look forward to speaking to you
again soon thank you