One very effective way to protect endpoints is to stop external connections before malicious files can
be downloaded.
If a user cannot connect to bad sites then in theory they are secured even if their endpoint protection
software is not running while listing and blacklisting destinations can be used for this type of protection.
Centralized databases are used to maintain lists to identify if a network you are l or domain name is
good or bad.
So basically onepoint sends traffic on the network your security devices can check these lists to know
if it should permit or deny traffic to show you how whitelist and blacklist can be used to secure your
network will hop into the lab and I'll show you Cisco's security intelligence feature.
Ok so here we are in my Firepower management center in the lab.
First I'll show you how you can apply the security intelligence feature for waitlists and blacklists
by going to the Access Control Policy that ties everything together.
So here in my Access Control Policy you'll notice there's a security intelligence tab.
We're going to click on that right.
We have a whitelist and blacklist column.
If I add a list of IPs are your Elle's to the blacklist column that is going to tell firepower devices
on my network to block any destinations that match IPs or your L's that are blacklisted.
And if we want things to be excluded from being blocked from a blacklist then we would add those destinations
to a white list.
I've added some of the malicious categories in here but really just by adding the global blacklist or
a global white list you can dynamically block things that are considered to be bad out on the Internet.
So of Cisco's security intelligence database determine that some IP out on the Internet is sending out
malware or that there's been reports of attacks from a certain destination that no add that IP to their
blacklist which will be dynamically downloaded to firepower.
OK so now that you see how the white list and blacklist are applied with our policy now will take you
into our object page to show you where we can configure whitelist and blacklist objects.
So we'll go to the objects tab and object management and then we'll go to our security intelligence
objects and we have our network DNS and your Alphie.
So not only is my Firepower device using security intelligence to see what networks and IPs are blacklisted
out on the Internet but it will also check for blacklisted DNS entries.
And you are Elle's.
So here you can see I have the security intelligence feed that's pulling down any updates to my global
blacklist or whitelist so you can see here my feed was updated a little over an hour ago.
And if you want to make a custom blacklist maybe there is IPs out there that you've found to be malicious
that aren't updated to the dynamic feed and you can go to network objects.
And then I could create my own blacklist group of IPs we'll call us custom blacklist
and then any IPs that find are malicious I can just type and men here and click and maybe I want to
add networks
and save and then I can add this custom blacklist to our blacklist.
Security intelligence column and I'll go back to our Access Control Policy
good our security intelligence tab and then I can add my custom list over to the blacklist column telling
firepower to block anything that's on that list.
But really the primary purpose of the security intelligence whitelist and Blacklist is the dynamic feeds
that you're downloading from Cisco's security intelligence database.