1 1 00:00:00,120 --> 00:00:01,740 In this lesson, we're going to focus 2 2 00:00:01,740 --> 00:00:04,170 on three main types of network architectures, 3 3 00:00:04,170 --> 00:00:06,300 physical networks, virtual private networks, 4 4 00:00:06,300 --> 00:00:08,220 and software-defined networks. 5 5 00:00:08,220 --> 00:00:09,960 When we talk about physical networks, 6 6 00:00:09,960 --> 00:00:12,870 we're referring to the cabling, switch ports, router ports, 7 7 00:00:12,870 --> 00:00:14,280 and wireless access points 8 8 00:00:14,280 --> 00:00:16,530 that supply cabled and wireless network access 9 9 00:00:16,530 --> 00:00:19,050 and connectivity to our organizations. 10 10 00:00:19,050 --> 00:00:20,460 This is what you traditionally think of 11 11 00:00:20,460 --> 00:00:21,750 when you think of a network. 12 12 00:00:21,750 --> 00:00:23,460 It includes all the physical infrastructure, 13 13 00:00:23,460 --> 00:00:25,710 such as the switches and wireless access points, 14 14 00:00:25,710 --> 00:00:28,320 as well as all the cabling involved in a network. 15 15 00:00:28,320 --> 00:00:29,970 When you're dealing with physical networks 16 16 00:00:29,970 --> 00:00:31,050 one of the main concerns 17 17 00:00:31,050 --> 00:00:32,430 is somebody break into your network 18 18 00:00:32,430 --> 00:00:34,410 and intercepting your communications. 19 19 00:00:34,410 --> 00:00:35,280 For example, 20 20 00:00:35,280 --> 00:00:37,410 if somebody can access one of your network switches, 21 21 00:00:37,410 --> 00:00:39,720 they can actually set up port monitoring on that switch 22 22 00:00:39,720 --> 00:00:41,310 and be able to see all the network traffic 23 23 00:00:41,310 --> 00:00:43,530 that's going across that network switch. 24 24 00:00:43,530 --> 00:00:45,150 To prevent this, you need to ensure 25 25 00:00:45,150 --> 00:00:47,400 there are proper physical security controls in place 26 26 00:00:47,400 --> 00:00:51,390 such as doors and walls, cameras, guards, and fences. 27 27 00:00:51,390 --> 00:00:53,520 This will help keep people from accessing the network 28 28 00:00:53,520 --> 00:00:54,960 and the communication closets, 29 29 00:00:54,960 --> 00:00:57,990 and helps to keep your physical network architecture secure. 30 30 00:00:57,990 --> 00:00:59,910 For example, an attacker can use a device 31 31 00:00:59,910 --> 00:01:01,380 like a Wi-Fi pineapple 32 32 00:01:01,380 --> 00:01:03,540 that can easily be used to penetrate your network 33 33 00:01:03,540 --> 00:01:05,190 by connecting it to an open switch port 34 34 00:01:05,190 --> 00:01:06,420 on your network switch 35 35 00:01:06,420 --> 00:01:08,310 and then this will provide the attacker full access 36 36 00:01:08,310 --> 00:01:11,160 to your entire network over a wireless connection. 37 37 00:01:11,160 --> 00:01:13,740 This essentially expands your organization's wired network 38 38 00:01:13,740 --> 00:01:15,180 into the wireless domain, 39 39 00:01:15,180 --> 00:01:17,070 and then the attacker could then access your network 40 40 00:01:17,070 --> 00:01:19,590 from outside of your building, such as from the parking lot, 41 41 00:01:19,590 --> 00:01:22,920 if they can access that wireless signal from that distance. 42 42 00:01:22,920 --> 00:01:24,390 The next area we need to discuss 43 43 00:01:24,390 --> 00:01:27,540 is known as VPNs or virtual private networks. 44 44 00:01:27,540 --> 00:01:29,040 These are essentially secure tunnels 45 45 00:01:29,040 --> 00:01:30,690 that are created between two endpoints 46 46 00:01:30,690 --> 00:01:32,760 that are connected over an unsecure network, 47 47 00:01:32,760 --> 00:01:35,640 and most commonly this is done over the internet. 48 48 00:01:35,640 --> 00:01:37,800 This would allow a user to extend their corporate network 49 49 00:01:37,800 --> 00:01:40,320 to a remote location such as a hotel room 50 50 00:01:40,320 --> 00:01:42,210 or some kind of remote office. 51 51 00:01:42,210 --> 00:01:43,920 When somebody connects over a VPN, 52 52 00:01:43,920 --> 00:01:46,500 that user is going to be able to extend the corporate network 53 53 00:01:46,500 --> 00:01:48,300 from the headquarters into whatever room 54 54 00:01:48,300 --> 00:01:50,880 they're actually accessing that VPN from, 55 55 00:01:50,880 --> 00:01:53,730 including a hotel room or their home office. 56 56 00:01:53,730 --> 00:01:56,520 This creates a secure and encrypted tunnel over the internet 57 57 00:01:56,520 --> 00:01:59,670 from that user's endpoint, like a laptop or desktop, 58 58 00:01:59,670 --> 00:02:02,160 all the way back to your organization's network. 59 59 00:02:02,160 --> 00:02:03,510 Whenever you're using a VPN, 60 60 00:02:03,510 --> 00:02:05,430 it's important to always use authentication 61 61 00:02:05,430 --> 00:02:08,670 and authorization mechanisms to control your access. 62 62 00:02:08,670 --> 00:02:10,140 as a cybersecurity analyst, 63 63 00:02:10,140 --> 00:02:11,670 this is an important area to monitor 64 64 00:02:11,670 --> 00:02:13,140 to ensure that your access to the network 65 65 00:02:13,140 --> 00:02:14,700 is tightly controlled as well, 66 66 00:02:14,700 --> 00:02:16,350 to help protect your network from attacks 67 67 00:02:16,350 --> 00:02:18,570 over a VPN-based connection. 68 68 00:02:18,570 --> 00:02:20,250 Now, one of the things that we have to worry about 69 69 00:02:20,250 --> 00:02:21,720 when we're dealing with a VPN 70 70 00:02:21,720 --> 00:02:23,280 is that we're actually tunneling our connection 71 71 00:02:23,280 --> 00:02:26,460 over the internet, which is considered an unsecure network, 72 72 00:02:26,460 --> 00:02:28,770 into our corporate private network. 73 73 00:02:28,770 --> 00:02:29,910 Now, when we do this, 74 74 00:02:29,910 --> 00:02:32,070 what do you think the vulnerability is here? 75 75 00:02:32,070 --> 00:02:33,660 If you're thinking it's the internet? 76 76 00:02:33,660 --> 00:02:36,390 Well, it's actually not that big of a vulnerability for us 77 77 00:02:36,390 --> 00:02:38,220 because we are using end-to-end encryption 78 78 00:02:38,220 --> 00:02:41,430 between our device and our organization's network. 79 79 00:02:41,430 --> 00:02:44,010 Instead, the real vulnerability that I worry about 80 80 00:02:44,010 --> 00:02:46,500 as a cybersecurity analyst when I'm dealing with a VPN 81 81 00:02:46,500 --> 00:02:49,260 is that the remote computer being used by that end user 82 82 00:02:49,260 --> 00:02:51,690 is in some kind of unsecure place. 83 83 00:02:51,690 --> 00:02:52,800 This is because what we've done 84 84 00:02:52,800 --> 00:02:55,170 is we've now extended the physical boundary of our network 85 85 00:02:55,170 --> 00:02:57,660 from our corporate presence across the internet 86 86 00:02:57,660 --> 00:03:00,210 to some other location like a hotel room. 87 87 00:03:00,210 --> 00:03:01,860 So if I'm sitting in a hotel room 88 88 00:03:01,860 --> 00:03:03,240 all the way across the country 89 89 00:03:03,240 --> 00:03:05,970 and I'm accessing my corporate network over a VPN, 90 90 00:03:05,970 --> 00:03:08,130 I'm actually extending that corporate network 91 91 00:03:08,130 --> 00:03:09,750 into the hotel room. 92 92 00:03:09,750 --> 00:03:12,270 Now, everything that I'm doing from my computer 93 93 00:03:12,270 --> 00:03:15,030 all the way back to the servers are going to be secure 94 94 00:03:15,030 --> 00:03:16,500 because I'm going through this encrypted 95 95 00:03:16,500 --> 00:03:18,330 and secure VPN tunnel. 96 96 00:03:18,330 --> 00:03:20,220 But the real vulnerability here 97 97 00:03:20,220 --> 00:03:22,230 is that I'm still sitting in a hotel room, 98 98 00:03:22,230 --> 00:03:24,240 and if I take the information from the corporate network 99 99 00:03:24,240 --> 00:03:27,120 and I'm reading it in an unsecured place like a hotel room, 100 100 00:03:27,120 --> 00:03:29,460 or maybe a coffee shop or something like that, 101 101 00:03:29,460 --> 00:03:30,293 there's a good chance 102 102 00:03:30,293 --> 00:03:32,040 that somebody could see what I'm doing. 103 103 00:03:32,040 --> 00:03:33,930 So if I'm sitting in the coffee shop 104 104 00:03:33,930 --> 00:03:35,160 or I'm in the lobby of the hotel, 105 105 00:03:35,160 --> 00:03:36,870 or even in my room in the hotel, 106 106 00:03:36,870 --> 00:03:39,390 how do I know somebody's not looking over my shoulder 107 107 00:03:39,390 --> 00:03:41,850 and looking at the information on my laptop? 108 108 00:03:41,850 --> 00:03:44,040 This is really the big concern here. 109 109 00:03:44,040 --> 00:03:46,050 Now, as far as your corporate network is concerned, 110 110 00:03:46,050 --> 00:03:48,750 my laptop is now part of the corporate network. 111 111 00:03:48,750 --> 00:03:51,720 It's just as if I'm sitting there inside of my office. 112 112 00:03:51,720 --> 00:03:54,150 So I'm authorized to see all that information. 113 113 00:03:54,150 --> 00:03:56,040 But anybody else who's sitting in the room 114 114 00:03:56,040 --> 00:03:58,410 that might be looking over my shoulder at my laptop, 115 115 00:03:58,410 --> 00:03:59,250 they aren't. 116 116 00:03:59,250 --> 00:04:01,440 And so this is one of the big areas that I worry about 117 117 00:04:01,440 --> 00:04:03,030 as a cybersecurity analyst 118 118 00:04:03,030 --> 00:04:05,550 when I'm using VPNs in an organization. 119 119 00:04:05,550 --> 00:04:06,990 VPNs are a great thing. 120 120 00:04:06,990 --> 00:04:08,940 They give us a lot of remote capability. 121 121 00:04:08,940 --> 00:04:10,320 But they are dangerous for us 122 122 00:04:10,320 --> 00:04:12,480 because we are now extending our corporate network 123 123 00:04:12,480 --> 00:04:14,250 and all the information it contains 124 124 00:04:14,250 --> 00:04:15,750 outside of our corporate building 125 125 00:04:15,750 --> 00:04:18,720 into some area outside of our physical boundaries. 126 126 00:04:18,720 --> 00:04:20,010 The next thing we're going to talk about 127 127 00:04:20,010 --> 00:04:22,950 is software-defined networks or SDN. 128 128 00:04:22,950 --> 00:04:24,450 Now, software-defined networks 129 129 00:04:24,450 --> 00:04:25,980 and software-defined networking 130 130 00:04:25,980 --> 00:04:29,370 is a technology that uses APIs and compatible hardware 131 131 00:04:29,370 --> 00:04:31,980 to create programmable network appliances and systems 132 132 00:04:31,980 --> 00:04:34,890 that allow us to virtualize our physical networks. 133 133 00:04:34,890 --> 00:04:38,010 SDNs can create complex networks with expanded sizes, 134 134 00:04:38,010 --> 00:04:41,220 scope, and the ability to rapidly change themself. 135 135 00:04:41,220 --> 00:04:43,650 One of the best things about software-defined networks 136 136 00:04:43,650 --> 00:04:45,840 is that they can automatically be changed by the network 137 137 00:04:45,840 --> 00:04:48,600 using automation technologies and orchestration 138 138 00:04:48,600 --> 00:04:50,910 instead of having humans having to do it. 139 139 00:04:50,910 --> 00:04:53,640 But this rapid change can be really difficult for us 140 140 00:04:53,640 --> 00:04:55,890 as system administrators, cybersecurity analysts, 141 141 00:04:55,890 --> 00:04:57,660 and humans to keep up with. 142 142 00:04:57,660 --> 00:04:59,310 If you're dealing with SDNs, 143 143 00:04:59,310 --> 00:05:01,410 there are really three planes that you need to consider 144 144 00:05:01,410 --> 00:05:03,330 when you're thinking about how to secure them. 145 145 00:05:03,330 --> 00:05:05,490 This is the control plane, the data plane, 146 146 00:05:05,490 --> 00:05:07,080 and the management plane. 147 147 00:05:07,080 --> 00:05:09,780 The first plane we have is known as the control plane. 148 148 00:05:09,780 --> 00:05:11,160 The control plane makes decisions 149 149 00:05:11,160 --> 00:05:13,020 about how traffic should be prioritized, 150 150 00:05:13,020 --> 00:05:14,610 secured, and routed. 151 151 00:05:14,610 --> 00:05:16,050 Basically, the control plane 152 152 00:05:16,050 --> 00:05:19,230 is focused on how traffic is moving across the network. 153 153 00:05:19,230 --> 00:05:21,570 The second plane is known as the data plane. 154 154 00:05:21,570 --> 00:05:23,400 The data plane handles the actual switching 155 155 00:05:23,400 --> 00:05:24,420 and routing of traffic 156 156 00:05:24,420 --> 00:05:27,630 and the imposition of access control lists for our security. 157 157 00:05:27,630 --> 00:05:29,100 Basically, the data plane 158 158 00:05:29,100 --> 00:05:31,890 is focused on moving the data around the network. 159 159 00:05:31,890 --> 00:05:33,030 And the third plane we have 160 160 00:05:33,030 --> 00:05:34,770 is known as the management plane. 161 161 00:05:34,770 --> 00:05:35,790 The management plane 162 162 00:05:35,790 --> 00:05:38,160 monitors traffic conditions and network status, 163 163 00:05:38,160 --> 00:05:40,410 allows for configuration changes in oversight, 164 164 00:05:40,410 --> 00:05:41,850 and things like that. 165 165 00:05:41,850 --> 00:05:43,320 Basically, the management plane 166 166 00:05:43,320 --> 00:05:45,510 is all about configuration and administration 167 167 00:05:45,510 --> 00:05:47,490 of the network and its devices. 168 168 00:05:47,490 --> 00:05:49,050 So all three of these planes 169 169 00:05:49,050 --> 00:05:50,970 are always going to be working together. 170 170 00:05:50,970 --> 00:05:53,400 The management plane is used to define the policy decisions 171 171 00:05:53,400 --> 00:05:55,860 that are going to be controlled by that control plane. 172 172 00:05:55,860 --> 00:05:58,080 The control plane is going to tell the the data where to go 173 173 00:05:58,080 --> 00:05:59,700 and the data plane is going to move the data 174 174 00:05:59,700 --> 00:06:01,200 from place to place. 175 175 00:06:01,200 --> 00:06:03,060 Now, one of the best things about SDNs 176 176 00:06:03,060 --> 00:06:05,700 is the ability for these fully automated deployments, 177 177 00:06:05,700 --> 00:06:07,530 including the provisioning of network links, 178 178 00:06:07,530 --> 00:06:09,450 appliances, and servers. 179 179 00:06:09,450 --> 00:06:11,430 This makes them critical for high velocity 180 180 00:06:11,430 --> 00:06:13,290 or high availability architectures 181 181 00:06:13,290 --> 00:06:15,270 as well as for disaster recovery. 182 182 00:06:15,270 --> 00:06:18,300 Additionally, because all of this stuff is just software, 183 183 00:06:18,300 --> 00:06:20,130 it's really easy to collect security data 184 184 00:06:20,130 --> 00:06:21,900 across the entire network too, 185 185 00:06:21,900 --> 00:06:24,960 making it even easier to detect unusual traffic patterns 186 186 00:06:24,960 --> 00:06:27,630 that may be an indication that you're under attack. 187 187 00:06:27,630 --> 00:06:29,370 The last thing we need to discuss in this lesson 188 188 00:06:29,370 --> 00:06:31,650 is the concept of SASE, 189 189 00:06:31,650 --> 00:06:34,440 which stands for Secure Access Secure Edge. 190 190 00:06:34,440 --> 00:06:37,380 Now, Secure Access Secure Edge, or SASE, 191 191 00:06:37,380 --> 00:06:39,300 is a new type of network architecture 192 192 00:06:39,300 --> 00:06:42,180 that combines both network security and wide area networks 193 193 00:06:42,180 --> 00:06:45,360 or WAN capabilities into a single solution. 194 194 00:06:45,360 --> 00:06:47,130 The Secure Access Secure Edge 195 195 00:06:47,130 --> 00:06:48,720 is seen as a way to address the challenges 196 196 00:06:48,720 --> 00:06:50,940 of securing and connecting users and data 197 197 00:06:50,940 --> 00:06:53,310 that's being distributed across multiple locations 198 198 00:06:53,310 --> 00:06:56,490 such as branch offices, remote workers, and mobile users, 199 199 00:06:56,490 --> 00:06:58,350 as well as into the cloud. 200 200 00:06:58,350 --> 00:07:00,870 a key aspect of SASE technology 201 201 00:07:00,870 --> 00:07:03,930 is that it's using software-defined networking, or SDN, 202 202 00:07:03,930 --> 00:07:06,750 to provide security and networking services from the cloud 203 203 00:07:06,750 --> 00:07:09,750 rather than from traditional hardware-based appliances. 204 204 00:07:09,750 --> 00:07:12,240 This allows for more flexibility, scalability, 205 205 00:07:12,240 --> 00:07:13,470 and cost efficiency 206 206 00:07:13,470 --> 00:07:16,050 than using a traditional network solution. 207 207 00:07:16,050 --> 00:07:19,080 SASE or Secure Access Secure Edge solutions 208 208 00:07:19,080 --> 00:07:20,040 are typically going to include 209 209 00:07:20,040 --> 00:07:22,050 a wide variety of security services, 210 210 00:07:22,050 --> 00:07:24,540 including things like firewalls, VPNs, 211 211 00:07:24,540 --> 00:07:26,160 zero-trust network access, 212 212 00:07:26,160 --> 00:07:30,210 and Cloud Access Security Brokers, which are known as CASBs. 213 213 00:07:30,210 --> 00:07:32,160 These are all going to be delivered through a common set 214 214 00:07:32,160 --> 00:07:34,110 of policy and management platforms as well 215 215 00:07:34,110 --> 00:07:36,420 to achieve your networking goals. 216 216 00:07:36,420 --> 00:07:38,880 SASE is going to help to address the challenges 217 217 00:07:38,880 --> 00:07:40,830 of the modern distributed enterprise, 218 218 00:07:40,830 --> 00:07:43,320 which is increasingly composed of mobile, cloud-based, 219 219 00:07:43,320 --> 00:07:45,540 and multi-cloud applications and services, 220 220 00:07:45,540 --> 00:07:47,670 and a large number of our users and devices 221 221 00:07:47,670 --> 00:07:49,230 are constantly growing and moving 222 222 00:07:49,230 --> 00:07:51,900 into larger and more distinct locations. 223 223 00:07:51,900 --> 00:07:55,200 SASE is used to provide a more secure and efficient way 224 224 00:07:55,200 --> 00:07:57,420 of connecting all these users and their devices 225 225 00:07:57,420 --> 00:07:59,880 to the applications and services they want to use 226 226 00:07:59,880 --> 00:08:01,230 regardless of the location 227 227 00:08:01,230 --> 00:08:03,330 or the type of device they're using. 228 228 00:08:03,330 --> 00:08:05,010 Now, all the major cloud providers, 229 229 00:08:05,010 --> 00:08:07,710 including Amazon Web Services, Microsoft Azure, 230 230 00:08:07,710 --> 00:08:09,480 and the Google Cloud Platform, 231 231 00:08:09,480 --> 00:08:11,730 all offer solutions that align with the concepts 232 232 00:08:11,730 --> 00:08:13,830 of Secure Access Secure Edge, 233 233 00:08:13,830 --> 00:08:16,650 but they do refer to them by different names or acronyms, 234 234 00:08:16,650 --> 00:08:18,480 depending on the specific service or product 235 235 00:08:18,480 --> 00:08:19,830 that you're referencing. 236 236 00:08:19,830 --> 00:08:23,430 For example, in Amazon Web Services, known as AWS, 237 237 00:08:23,430 --> 00:08:26,190 the service that most closely aligns with SASE 238 238 00:08:26,190 --> 00:08:29,610 is known as a VPC or Virtual Private Cloud. 239 239 00:08:29,610 --> 00:08:31,860 Now, a Virtual Private Cloud provides a secure 240 240 00:08:31,860 --> 00:08:33,600 and flexible network infrastructure 241 241 00:08:33,600 --> 00:08:35,250 for your applications and data, 242 242 00:08:35,250 --> 00:08:38,640 and AWS VPC enables us to be able to create virtual networks 243 243 00:08:38,640 --> 00:08:41,400 in the cloud and connect it to our on-premise datacenters 244 244 00:08:41,400 --> 00:08:45,810 or other AWS services to achieve that SASE capability. 245 245 00:08:45,810 --> 00:08:48,690 Microsoft Azure actually has lots of different services 246 246 00:08:48,690 --> 00:08:51,060 that will align with the SASE concept, 247 247 00:08:51,060 --> 00:08:52,980 including Azure's Virtual WAN, 248 248 00:08:52,980 --> 00:08:55,380 which provides secure, global, and efficient connectivity 249 249 00:08:55,380 --> 00:08:59,130 between branch offices, datacenters, and Azure resources, 250 250 00:08:59,130 --> 00:09:01,110 as well as using Azure ExpressRoutes, 251 251 00:09:01,110 --> 00:09:03,630 which enables you to create a dedicated private connection 252 252 00:09:03,630 --> 00:09:05,130 between an Azure datacenter 253 253 00:09:05,130 --> 00:09:07,680 and your on-premise network infrastructure. 254 254 00:09:07,680 --> 00:09:09,840 If you're using the Google Cloud Platform, 255 255 00:09:09,840 --> 00:09:12,360 they call their SASE-aligned service 256 256 00:09:12,360 --> 00:09:14,190 Google Cloud Interconnect. 257 257 00:09:14,190 --> 00:09:15,420 Google Cloud Interconnect 258 258 00:09:15,420 --> 00:09:17,610 allows you to connect your on-premise infrastructure 259 259 00:09:17,610 --> 00:09:20,340 to the Google Cloud Platform, known as GCP, 260 260 00:09:20,340 --> 00:09:22,440 over a dedicated private connection. 261 261 00:09:22,440 --> 00:09:24,930 They also have a service known as Google Cloud VPN, 262 262 00:09:24,930 --> 00:09:26,310 which allows you to securely connect 263 263 00:09:26,310 --> 00:09:27,840 your on-premise infrastructure 264 264 00:09:27,840 --> 00:09:29,640 to your virtual private cloud network 265 265 00:09:29,640 --> 00:09:32,130 through an IPsec VPN tunnel. 266 266 00:09:32,130 --> 00:09:34,050 Now, it's important to realize that these services 267 267 00:09:34,050 --> 00:09:36,660 are not exclusively SASE providers, 268 268 00:09:36,660 --> 00:09:39,540 and the definition of SASE here is not completely aligned 269 269 00:09:39,540 --> 00:09:41,400 with all the features and functionality 270 270 00:09:41,400 --> 00:09:44,460 of any single cloud service from these cloud providers, 271 271 00:09:44,460 --> 00:09:48,150 but they do provide a lot of the aspects of SASE for you, 272 272 00:09:48,150 --> 00:09:49,920 such as having secure, flexible, 273 273 00:09:49,920 --> 00:09:51,660 and global networking capabilities 274 274 00:09:51,660 --> 00:09:53,520 by using these different services. 275 275 00:09:53,520 --> 00:09:55,050 Now, as you're preparing for your exam, 276 276 00:09:55,050 --> 00:09:57,060 there's a couple of important pieces of information 277 277 00:09:57,060 --> 00:09:58,350 you need to keep in mind 278 278 00:09:58,350 --> 00:10:00,600 when it comes to the protection of your networks. 279 279 00:10:00,600 --> 00:10:02,670 Remember, physical boundaries and controls 280 280 00:10:02,670 --> 00:10:06,000 such as locks, doors, walls, guards, and fences 281 281 00:10:06,000 --> 00:10:07,860 are going to be crucial for ensuring the security 282 282 00:10:07,860 --> 00:10:09,390 of your physical network. 283 283 00:10:09,390 --> 00:10:12,570 However, if you're using a virtual private network, or VPN, 284 284 00:10:12,570 --> 00:10:13,770 it's always important to remember 285 285 00:10:13,770 --> 00:10:16,170 that you can create a physical extension of your network 286 286 00:10:16,170 --> 00:10:18,570 outside of your normal protective boundaries, 287 287 00:10:18,570 --> 00:10:20,670 and because of this deperimeterization, 288 288 00:10:20,670 --> 00:10:22,920 this means that you may have all your logical protections 289 289 00:10:22,920 --> 00:10:25,650 in place, but you no longer have the same level 290 290 00:10:25,650 --> 00:10:27,030 of physical protections, 291 291 00:10:27,030 --> 00:10:27,863 and so you have to worry 292 292 00:10:27,863 --> 00:10:29,460 about people looking over your shoulder 293 293 00:10:29,460 --> 00:10:31,230 at the data you're using. 294 294 00:10:31,230 --> 00:10:32,670 Another important thing to keep in mind 295 295 00:10:32,670 --> 00:10:35,970 is that if you're using SDN or software-defined networking, 296 296 00:10:35,970 --> 00:10:37,830 you're going to be able to do automatic deployment 297 297 00:10:37,830 --> 00:10:39,180 and disaster recovery, 298 298 00:10:39,180 --> 00:10:41,070 which is great for gathering security data, 299 299 00:10:41,070 --> 00:10:42,870 because everything is software code, 300 300 00:10:42,870 --> 00:10:44,280 and so it's all just ones and zeros 301 301 00:10:44,280 --> 00:10:45,180 going across the network, 302 302 00:10:45,180 --> 00:10:47,970 so you can actually capture it really, really easy. 303 303 00:10:47,970 --> 00:10:49,920 However, it can be challenging for us 304 304 00:10:49,920 --> 00:10:51,420 as technicians and administrators 305 305 00:10:51,420 --> 00:10:53,100 to fully understand what we're seeing 306 306 00:10:53,100 --> 00:10:54,960 inside of a software-defined network 307 307 00:10:54,960 --> 00:10:57,960 because it is changing rapidly all of the time. 308 308 00:10:57,960 --> 00:11:00,210 Additionally, if you're using virtual devices, 309 309 00:11:00,210 --> 00:11:01,380 they can easily be placed 310 310 00:11:01,380 --> 00:11:03,060 inside the network without detection 311 311 00:11:03,060 --> 00:11:04,530 because they're simply pieces of code 312 312 00:11:04,530 --> 00:11:07,680 inside of the SDN or SASE architecture, 313 313 00:11:07,680 --> 00:11:09,060 and this makes it even more difficult 314 314 00:11:09,060 --> 00:11:11,520 to locate and identify potential security threats 315 315 00:11:11,520 --> 00:11:13,740 as compared to using a physical network 316 316 00:11:13,740 --> 00:11:15,630 that you can hand over hand the cables 317 317 00:11:15,630 --> 00:11:18,210 and look at what devices are in your networking cabinets 318 318 00:11:18,210 --> 00:11:20,610 to identify any rogue devices that may be there.