Welcome to this video. Today, we will talk about the best practices for policies when migrating from DNS to the web. So the 1st thing we are going to do is go to our dashboard.00:07And in the policy section, we go to what are the DNS policies. These policies will always be the 1st to be applied to our traffic going to the internet. We will always have a default policy, which is a default policy that applies to all identities. This default policy.00:20Is generally considered a catch all, meaning that unless we have a more specific policy, the traffic will fall under this policy.00:40This default policy ensures that all users and devices receive a minimum level of protection by blocking access to malicious domains and enforcing security measures at the DNS layer. Then we have a customized DNS policy where we can choose the identities to which we want to apply the.00:48This policy from the entire list that appears here. In this case.01:08The roaming computers. Next, for DNS policies, we have these security settings that are a best practice. We always recommend having at least these three defaults. Malware, command and control callbacks, and phishing attacks.01:13The rest of the DNS configuration when clients have web policies is up to the client's discretion. E.g., there are content categories used to filter and control access to various types of web content. There are categories that we definitely want to block, e.g..01:31Adult content or alcohol, so we can block them directly here in DNS since it is the 1st blocking phase that the traffic would pass through. If we want to be more specific and have greater visibility into what happens in these categories, then we can allow them here and later block it within web policy.01:47There are features, e.g., in web policies such as file analysis, intelligent proxy, SSL decryption, and enforce safe search that are recommended to be kept disabled when we have web policies available.02:08This is because intelligent Proxy is what we call a selective proxy, which only sends for inspection the domains that have been previously identified by Umbrella as risky domains. Therefore, the client does not have full visibility and control over what is sent for further inspec.02:24So when we have the option to have web policies, it is preferable to have it disabled to prevent it from being intercepted and thus be able to have greater visibility and control over web policies. It is very important to plan and design your policies before you build them.02:44For DNS policies, the redirection methods we have would be through the networks, which are the public IPs that we register on the dashboard. The traffic also passes through virtual appliances when we are inside the company, and in this case, also the roaming computers or the umbrella module that is installed on the computers.03:06Once the new policy is saved, it may take upwards of 5 min for the policy to replicate through umbrella's global infrastructure. Firewall policy provides visibility and control over internet traffic by logging all activities and blocking unwanted traffic using IP port and protocol rules. It is important to note that.03:26Firewall policy only applies to traffic coming from a VPN tunnel.03:46So unless we have a tunnel, we will receive this error here that says we need a tunnel, a tunnel connection. This firewall policy is a cloud firewall. This gives us an additional layer of protection for the traffic we send to the internet by controlling the network.03:50Traffic that passes through the umbrella cloud.04:10Now, if the traffic is allowed in this firewall policy, it would then move on to the web policies. Web policy gives your organizations web traffic a clear view, security and control. Remember, even though you can add your identities to any number of rule sets and rules, Umbrella will apply the 1st.04:14Just matching one and stop checking further.04:34If there isn't a matching rule set, Umbrella will use the default one, known as the default web policy. Make sure you set up the rule sets and rules correctly for each identity in your organization. By adding and configuring rule sets and rules, you determine when.04:37And how traffic is inspected and then allowed, blocked, restricted.04:57Or isolated. Here we can select the identities to which we want to apply these rule set settings. So we can choose any of these identities. An identity is an internet capable entity that Umbrella protects through policies and monitors through reports.05:01E.g., the block page tenant controls, which is only applicable for web policies, where we can decide which tenant we want to allow from our company, for Microsoft, Google G suite, Slack, and Dropbox. So here we can specify the specific tenant of the company.05:17File inspection examines files hosted on potentially dangerous domains for DNS policies. To umbrella, a dangerous domain is one that might pose a threat because little or NO information is available about it. File type control is also only available within web policies, which would allow blocking.05:37Documents based on file type. Umbrella also uses its internal detection engine to assess a file and figure out its type. Next, we have HTTPS inspection. This of course is fully controlled within the web policies. Here we have the option to enable it.05:57If enabled, a message will be displayed requesting the umbrella root certificate to be installed on the computer and to allow the decryption and inspection of HTTPS traffic. So.06:16That certificate applies both to the traffic being inspected via HTTPS and also in case the block page needs to be displayed to users. Also, for HTTPS inspection, here we can add a selective decryption list.06:31We can select different categories, applications, and domains from which we want to bypass and not analyze their traffic or send them for inspection. There is also the option to show a block page over HTTPS and to disable HTTPS inspection.06:54Then we have the safe search part, which would also be for Google, YouTube, Yahoo, and Bing. It is important to emphasize that these components, e.g., tenant controls.07:17File analysis, file type control, rely on HTTPS inspection. So if we want to take advantage of all the benefits they offer, we need the inspection to be enabled.07:32Then we also have the security settings here, which are similar to those of DNS, but of course, the recommendation is always to have them enabled. Since on the web, we will have greater visibility and control, not only of the domain.07:48Part of the complete URL to which the pages are going. So that is a recommendation and a best practice to have it enabled. Finally, this SAML depends on the redirection method we are using for web policies.08:04For web policies, we have four possible redirection methods. The 1st one would be the roaming computers, which works for both DNS and web, but it is not enabled by default for web.08:21Therefore, we need to enable the secure web gateway option for those users. Additionally, there is the option of virtual appliances used together with internal networks to forward DNS traffic to umbrella. There are also network devices.08:37Is like routers and firewalls to redirect DNS traffic to umbrella.08:57Lastly, we have the option of pack files directly in the user's browser. The SAML option works, e.g., for tunnels to have visibility on the active Directory user side and thus be able to apply policies and.09:03See them in the reports. Then 2nd part of web policies are what would be the rule set rules? Here we can create exceptions and more specific rules for different identities. So we can add a rule, give it a name.09:22These are the options that are shown to us depending on the licensing. We can set what we want to allow, block or isolate. Also, select identities like groups, users, networks, roaming computers among others. And we can choose the data.09:41Destinations.10:01Which in this case would be apps, content categories or destination lists. Furthermore, another functionality of the rule set rules is that we can set a specific time and schedule, so we can set it to apply, e.g., only from Monday to Friday.10:02Or only during working hours. The recommendation is that you can have up to 100 rules within the policy. For umbrella rule sets, define objectives, prioritize security, use category based filtering, customize for user groups, regularly review and update.10:22And monitor impact to enhance security and policy compliance. That's it for this video. Thank you very much.10:40
