1 1 00:00:00,000 --> 00:00:01,020 In this lesson 2 2 00:00:01,020 --> 00:00:03,180 we're going to discuss two important concepts 3 3 00:00:03,180 --> 00:00:05,880 known as block listing and allow listing. 4 4 00:00:05,880 --> 00:00:07,710 First, block listing. 5 5 00:00:07,710 --> 00:00:10,560 Block listing is the process of blocking known applications, 6 6 00:00:10,560 --> 00:00:13,080 services, traffic or other transmissions 7 7 00:00:13,080 --> 00:00:14,790 to and from your systems. 8 8 00:00:14,790 --> 00:00:16,410 Now, the idea with block listing 9 9 00:00:16,410 --> 00:00:18,450 is that this is a security configuration 10 10 00:00:18,450 --> 00:00:19,890 where access being permitted 11 11 00:00:19,890 --> 00:00:22,590 unless the entry appears on a block list. 12 12 00:00:22,590 --> 00:00:24,030 Let me give you an analogy. 13 13 00:00:24,030 --> 00:00:25,500 Let's say you and I decide we want to go 14 14 00:00:25,500 --> 00:00:26,670 to the nightclub tonight. 15 15 00:00:26,670 --> 00:00:27,810 We show up at the front door 16 16 00:00:27,810 --> 00:00:29,400 and the bouncer looks at his list. 17 17 00:00:29,400 --> 00:00:30,300 He looks up and down 18 18 00:00:30,300 --> 00:00:31,890 and he doesn't see our name on the list 19 19 00:00:31,890 --> 00:00:34,020 which means we've never caused any trouble before. 20 20 00:00:34,020 --> 00:00:36,000 And so he lets us in the building. 21 21 00:00:36,000 --> 00:00:37,710 That's the idea of a block list. 22 22 00:00:37,710 --> 00:00:39,060 Since our name wasn't on the list, 23 23 00:00:39,060 --> 00:00:41,580 we were considered okay and we were allowed in. 24 24 00:00:41,580 --> 00:00:43,470 But if one of our names was on the list, 25 25 00:00:43,470 --> 00:00:44,610 he wouldn't have let us in 26 26 00:00:44,610 --> 00:00:47,310 and he would've stopped us or blocked us from entering. 27 27 00:00:47,310 --> 00:00:48,990 Now that's the whole idea with a block list. 28 28 00:00:48,990 --> 00:00:50,550 You know what's bad and you're looking 29 29 00:00:50,550 --> 00:00:52,830 for those bad things so you can block them. 30 30 00:00:52,830 --> 00:00:54,840 Now, block lists are quite useful to us 31 31 00:00:54,840 --> 00:00:56,430 especially an incident response 32 32 00:00:56,430 --> 00:00:58,200 because we can block the source of malware 33 33 00:00:58,200 --> 00:01:00,360 from able to communicate into our network. 34 34 00:01:00,360 --> 00:01:01,830 So if I know something's bad 35 35 00:01:01,830 --> 00:01:03,270 and I know what I'm looking for, 36 36 00:01:03,270 --> 00:01:05,280 I can then say that this particular IP address 37 37 00:01:05,280 --> 00:01:06,810 is part of a C2 network 38 38 00:01:06,810 --> 00:01:08,430 and we can put all those IP addresses 39 39 00:01:08,430 --> 00:01:10,470 that are known bad into a block list 40 40 00:01:10,470 --> 00:01:13,170 and we can then block them from accessing our network. 41 41 00:01:13,170 --> 00:01:14,793 Here you can see that I have a total band list 42 42 00:01:14,793 --> 00:01:18,240 of 3,903 IP addresses in my list. 43 43 00:01:18,240 --> 00:01:20,760 These are all the systems with known bad IP addresses 44 44 00:01:20,760 --> 00:01:22,740 and therefore I want to show anything in my network 45 45 00:01:22,740 --> 00:01:25,080 isn't reaching out to those bad IP addresses. 46 46 00:01:25,080 --> 00:01:27,840 So I would block them using my firewall. 47 47 00:01:27,840 --> 00:01:29,430 Now, that's great except for the fact 48 48 00:01:29,430 --> 00:01:30,780 that there are millions and millions 49 49 00:01:30,780 --> 00:01:33,510 of other IP addresses out there that aren't on my list 50 50 00:01:33,510 --> 00:01:35,910 and some of those could potentially be bad as well. 51 51 00:01:35,910 --> 00:01:38,580 And so if I miss something by not putting in my block list, 52 52 00:01:38,580 --> 00:01:39,867 people can still access it 53 53 00:01:39,867 --> 00:01:42,300 and our networks can still get infected. 54 54 00:01:42,300 --> 00:01:44,580 So what are some limitations we have to think about 55 55 00:01:44,580 --> 00:01:46,110 when we're using block lists? 56 56 00:01:46,110 --> 00:01:47,580 Well, first we have to think about 57 57 00:01:47,580 --> 00:01:49,200 the risk of false positives 58 58 00:01:49,200 --> 00:01:51,390 that could actually block legitimate traffic. 59 59 00:01:51,390 --> 00:01:53,280 Let's say we had a false positive that showed up 60 60 00:01:53,280 --> 00:01:55,260 and said this IP address is bad 61 61 00:01:55,260 --> 00:01:57,150 so we go ahead and we block it. 62 62 00:01:57,150 --> 00:01:59,550 Well, that IP address may not have been bad 63 63 00:01:59,550 --> 00:02:02,790 and if we put it in our block list, we now can't access it 64 64 00:02:02,790 --> 00:02:05,580 and we're denying legitimate users to be able to access it. 65 65 00:02:05,580 --> 00:02:07,050 This actually happened to my own company 66 66 00:02:07,050 --> 00:02:08,790 when we first launched our website. 67 67 00:02:08,790 --> 00:02:10,170 When we first launched our website, 68 68 00:02:10,170 --> 00:02:12,840 we were issued an IP address from our service provider 69 69 00:02:12,840 --> 00:02:16,320 but that IP address apparently used to be used by a spammer 70 70 00:02:16,320 --> 00:02:18,840 and so it was on a lot of different block lists out there. 71 71 00:02:18,840 --> 00:02:20,280 And when people tried to get to our site, 72 72 00:02:20,280 --> 00:02:21,390 some of them were getting blocked 73 73 00:02:21,390 --> 00:02:24,060 by their service providers saying don't go to that site, 74 74 00:02:24,060 --> 00:02:26,460 it's spam, it's bad, it's malicious. 75 75 00:02:26,460 --> 00:02:28,620 And so we had to go out and get a new IP address 76 76 00:02:28,620 --> 00:02:29,760 so we could not be blocked 77 77 00:02:29,760 --> 00:02:31,860 by these other service provider systems 78 78 00:02:31,860 --> 00:02:32,970 even though we weren't the ones 79 79 00:02:32,970 --> 00:02:34,650 who originally had the problem. 80 80 00:02:34,650 --> 00:02:37,020 And so legitimate traffic can actually be blocked 81 81 00:02:37,020 --> 00:02:39,660 because of a false positive when you're using a block list 82 82 00:02:39,660 --> 00:02:41,070 as you could see here. 83 83 00:02:41,070 --> 00:02:42,600 Now, the second thing you have to think about 84 84 00:02:42,600 --> 00:02:44,160 is that you don't always know everything 85 85 00:02:44,160 --> 00:02:45,720 that should be blocked. 86 86 00:02:45,720 --> 00:02:46,800 Now this is a big problem 87 87 00:02:46,800 --> 00:02:48,180 because you're dealing with block listing. 88 88 00:02:48,180 --> 00:02:50,190 You have to know exactly what is bad 89 89 00:02:50,190 --> 00:02:51,930 so you can add it to your block list. 90 90 00:02:51,930 --> 00:02:53,700 And if you don't know exactly what you need to block 91 91 00:02:53,700 --> 00:02:56,520 because the bad folks keep moving to different IP addresses 92 92 00:02:56,520 --> 00:02:59,070 then your block list isn't going to do you any good. 93 93 00:02:59,070 --> 00:03:01,140 And so this is one of the big issues you have to think about 94 94 00:03:01,140 --> 00:03:03,060 when you use block listing. 95 95 00:03:03,060 --> 00:03:04,650 Now, on the other side of the coin though 96 96 00:03:04,650 --> 00:03:06,930 we have this thing known as allow listing. 97 97 00:03:06,930 --> 00:03:08,610 Now, allow listing is the process 98 98 00:03:08,610 --> 00:03:11,100 of allowing only known applications, services 99 99 00:03:11,100 --> 00:03:14,580 traffic and other transmissions to and from your systems. 100 100 00:03:14,580 --> 00:03:17,700 Essentially, you get a list with all the allowed things 101 101 00:03:17,700 --> 00:03:19,530 and this is a security configuration list 102 102 00:03:19,530 --> 00:03:21,150 and access is always going to be allowed 103 103 00:03:21,150 --> 00:03:22,590 to anybody on the list, 104 104 00:03:22,590 --> 00:03:25,380 but if you're not on that list, you are going to be denied. 105 105 00:03:25,380 --> 00:03:27,750 So let's go back to our nightclub example. 106 106 00:03:27,750 --> 00:03:29,190 You and I get to the front door, 107 107 00:03:29,190 --> 00:03:32,130 we get up to the bouncer and we say, "Hi, my name's Jason." 108 108 00:03:32,130 --> 00:03:33,720 He looks as list, he sees my name 109 109 00:03:33,720 --> 00:03:36,180 and let's me in because I'm on his allow list. 110 110 00:03:36,180 --> 00:03:38,970 You go up next and you say, "Hi, my name is Susan" 111 111 00:03:38,970 --> 00:03:41,250 and they look and they say, "Nope, no, Susan on the list. 112 112 00:03:41,250 --> 00:03:43,110 Go away. You're not allowed in." 113 113 00:03:43,110 --> 00:03:44,790 That's how allow listing works. 114 114 00:03:44,790 --> 00:03:47,490 If your name is not on the list, you're not getting in. 115 115 00:03:47,490 --> 00:03:49,380 When we do block listing, it's the opposite. 116 116 00:03:49,380 --> 00:03:50,580 If your name is on the list, 117 117 00:03:50,580 --> 00:03:53,040 we are going to block you and not allow you in. 118 118 00:03:53,040 --> 00:03:54,660 That's the concept here. 119 119 00:03:54,660 --> 00:03:56,220 Now, when you're using allow listing, 120 120 00:03:56,220 --> 00:03:58,860 this can be really effective as a fallback posture 121 121 00:03:58,860 --> 00:04:00,990 especially during an instant response. 122 122 00:04:00,990 --> 00:04:03,150 Let's say your network has come under attack, 123 123 00:04:03,150 --> 00:04:05,460 you want to get back online as quickly as possible 124 124 00:04:05,460 --> 00:04:07,440 and cut off all the bad communication. 125 125 00:04:07,440 --> 00:04:08,580 What can you do? 126 126 00:04:08,580 --> 00:04:11,040 Well, you can move to an allow list. 127 127 00:04:11,040 --> 00:04:13,470 You might have a preset allow list that says, hey 128 128 00:04:13,470 --> 00:04:16,080 here are the 10 websites that I truly trust. 129 129 00:04:16,080 --> 00:04:18,720 I trust Gmail, I trust Diontraining.com 130 130 00:04:18,720 --> 00:04:20,730 I trust Facebook, whatever it is. 131 131 00:04:20,730 --> 00:04:23,880 Then anything that's not in that list you're going to block. 132 132 00:04:23,880 --> 00:04:25,140 that would be a good allow list. 133 133 00:04:25,140 --> 00:04:27,210 Now, you might not want to use that every single day 134 134 00:04:27,210 --> 00:04:29,400 but you can use it as a fallback posture 135 135 00:04:29,400 --> 00:04:30,900 during an instant response. 136 136 00:04:30,900 --> 00:04:33,690 So you might have some things on there like your banking, 137 137 00:04:33,690 --> 00:04:36,240 your email, and some basic functions like that 138 138 00:04:36,240 --> 00:04:38,850 but you can cut off a lot of things that you don't need 139 139 00:04:38,850 --> 00:04:41,490 and that's the idea of this as a fallback posture. 140 140 00:04:41,490 --> 00:04:42,960 Now, let me give you a quick warning here 141 141 00:04:42,960 --> 00:04:44,430 when you're dealing with a allow list, 142 142 00:04:44,430 --> 00:04:47,250 especially when you're doing 'em in this fallback posture. 143 143 00:04:47,250 --> 00:04:49,620 Allow lists are incredibly restrictive. 144 144 00:04:49,620 --> 00:04:51,930 They can prevent users and systems from transmitting data 145 145 00:04:51,930 --> 00:04:53,790 to new or changed recipients. 146 146 00:04:53,790 --> 00:04:55,260 So let's say you had me 147 147 00:04:55,260 --> 00:04:57,720 on your allow list as DionTraining.com 148 148 00:04:57,720 --> 00:05:02,190 but I now just changed my website to www.DionTraining.com. 149 149 00:05:02,190 --> 00:05:03,210 And if I do that 150 150 00:05:03,210 --> 00:05:05,910 and you don't have www.DionTraining.com 151 151 00:05:05,910 --> 00:05:06,833 listed in your allow list, 152 152 00:05:06,833 --> 00:05:09,210 you are not going to get to my website. 153 153 00:05:09,210 --> 00:05:10,500 You're not going to be able to get to me anymore 154 154 00:05:10,500 --> 00:05:12,900 because of that minor change of going from 155 155 00:05:12,900 --> 00:05:16,770 DionTraining.com to www.DionTraining.com. 156 156 00:05:16,770 --> 00:05:18,240 So you always need to make sure 157 157 00:05:18,240 --> 00:05:20,370 you're constantly fine tuning these allow list 158 158 00:05:20,370 --> 00:05:22,890 to avoid interference with business operations. 159 159 00:05:22,890 --> 00:05:25,320 Similarly, if you're using IP addresses on your allow list 160 160 00:05:25,320 --> 00:05:27,180 this can also cause issues for you 161 161 00:05:27,180 --> 00:05:29,520 because many servers use multiple IP addresses 162 162 00:05:29,520 --> 00:05:30,810 and do load balancing. 163 163 00:05:30,810 --> 00:05:32,100 So if you only have an IP address 164 164 00:05:32,100 --> 00:05:33,540 for one of those four servers, 165 165 00:05:33,540 --> 00:05:35,130 you're actually going to have a decline in performance 166 166 00:05:35,130 --> 00:05:37,287 because now you can't load balance across four servers 167 167 00:05:37,287 --> 00:05:39,390 and you're only going to be using one. 168 168 00:05:39,390 --> 00:05:42,300 This again is another issue when you're using allow list. 169 169 00:05:42,300 --> 00:05:43,770 Now, in a lot of the organizations 170 170 00:05:43,770 --> 00:05:46,410 I've worked with in the past, we have kept an allow list 171 171 00:05:46,410 --> 00:05:48,960 as a backup as I said, so we can use it 172 172 00:05:48,960 --> 00:05:50,670 when we have an instant response. 173 173 00:05:50,670 --> 00:05:53,730 But in general, we instead use a block list method 174 174 00:05:53,730 --> 00:05:55,320 on a day-to-day basis. 175 175 00:05:55,320 --> 00:05:56,760 This way, if we got attack 176 176 00:05:56,760 --> 00:05:58,650 or we need to go to a more restrictive method 177 177 00:05:58,650 --> 00:06:00,930 we can switch over to our allow list at any time 178 178 00:06:00,930 --> 00:06:03,060 because we have this allow list ready to go. 179 179 00:06:03,060 --> 00:06:04,830 But again, keep in mind that allow list 180 180 00:06:04,830 --> 00:06:06,240 can be very hard to keep up to date 181 181 00:06:06,240 --> 00:06:07,740 because there's always new challenges 182 182 00:06:07,740 --> 00:06:09,390 and changes that are occurring. 183 183 00:06:09,390 --> 00:06:11,340 For example, let's say you just started working 184 184 00:06:11,340 --> 00:06:13,080 with a new supplier and you need to go 185 185 00:06:13,080 --> 00:06:14,820 to some other site to pay your bill. 186 186 00:06:14,820 --> 00:06:16,740 Well, it's not on your allow list. 187 187 00:06:16,740 --> 00:06:18,150 You're not going to be able to get to that site 188 188 00:06:18,150 --> 00:06:19,230 and pay your bill 189 189 00:06:19,230 --> 00:06:21,390 and that now becomes another issue for you. 190 190 00:06:21,390 --> 00:06:22,830 Now, this isn't to say that allow lists 191 191 00:06:22,830 --> 00:06:24,150 are all bad or all good. 192 192 00:06:24,150 --> 00:06:25,950 There is a really good place for them 193 193 00:06:25,950 --> 00:06:27,510 and one of the best places I see them 194 194 00:06:27,510 --> 00:06:30,630 is inside the world of application allowlisting. 195 195 00:06:30,630 --> 00:06:32,790 Now, when we talk about application allowlisting 196 196 00:06:32,790 --> 00:06:36,120 we have to first look at the concept of execution control. 197 197 00:06:36,120 --> 00:06:38,430 Execution control is the process of determining 198 198 00:06:38,430 --> 00:06:40,230 what additional software may be installed 199 199 00:06:40,230 --> 00:06:42,720 on a client or server beyond its baseline. 200 200 00:06:42,720 --> 00:06:45,300 So let's say I gave you a workstation in your office 201 201 00:06:45,300 --> 00:06:47,010 and it has some basic programs on there. 202 202 00:06:47,010 --> 00:06:49,860 You've got Microsoft Office, you've got Adobe Acrobat, 203 203 00:06:49,860 --> 00:06:51,930 you've got Microsoft Edge and Google Chrome 204 204 00:06:51,930 --> 00:06:53,887 but you don't have anything else and you're like, 205 205 00:06:53,887 --> 00:06:56,490 "Hey, I want to install Google Earth on this machine." 206 206 00:06:56,490 --> 00:06:57,750 So you try to download it 207 207 00:06:57,750 --> 00:07:00,450 and install it and it won't install, why? 208 208 00:07:00,450 --> 00:07:02,910 Well, that might be because of my execution control 209 209 00:07:02,910 --> 00:07:04,440 and the way I've set this up. 210 210 00:07:04,440 --> 00:07:06,780 Now with execution control, I can actually prevent you 211 211 00:07:06,780 --> 00:07:08,520 from being able to install new software 212 212 00:07:08,520 --> 00:07:10,980 or from able to run software that's been installed 213 213 00:07:10,980 --> 00:07:12,900 if it's not on my allow list. 214 214 00:07:12,900 --> 00:07:13,890 For example, in Windows 215 215 00:07:13,890 --> 00:07:15,780 you could do this a couple of different ways. 216 216 00:07:15,780 --> 00:07:17,730 One of the ways is to use SRP 217 217 00:07:17,730 --> 00:07:20,070 which is software restriction policies. 218 218 00:07:20,070 --> 00:07:22,260 Now, this is available for most versions of Windows 219 219 00:07:22,260 --> 00:07:23,130 and it can be configured 220 220 00:07:23,130 --> 00:07:25,440 as part of your group policy objects. 221 221 00:07:25,440 --> 00:07:26,850 This creates an allow list file 222 222 00:07:26,850 --> 00:07:28,350 for different system locations 223 223 00:07:28,350 --> 00:07:29,850 where your executables and scripts 224 224 00:07:29,850 --> 00:07:31,590 are allowed to be launched from. 225 225 00:07:31,590 --> 00:07:33,990 For example, if you use a block list method 226 226 00:07:33,990 --> 00:07:35,940 you can actually say that no executables 227 227 00:07:35,940 --> 00:07:37,950 can be run from the temp directory 228 228 00:07:37,950 --> 00:07:40,320 or you can use an allow list methodology 229 229 00:07:40,320 --> 00:07:41,850 where it says you can only run things 230 230 00:07:41,850 --> 00:07:44,670 out of the System directory and the Program Files directory. 231 231 00:07:44,670 --> 00:07:45,570 This would allow you to do this 232 232 00:07:45,570 --> 00:07:47,940 by creating this application allow list. 233 233 00:07:47,940 --> 00:07:49,950 Now, another way you can do this is by setting up rules 234 234 00:07:49,950 --> 00:07:52,590 configured by hash files on those programs. 235 235 00:07:52,590 --> 00:07:55,950 So if I install Microsoft Word and I take a hash of that, 236 236 00:07:55,950 --> 00:07:57,930 I can add that to my approved list, 237 237 00:07:57,930 --> 00:08:00,000 and then this will allow me to run anything 238 238 00:08:00,000 --> 00:08:01,770 that has the approved hash. 239 239 00:08:01,770 --> 00:08:03,660 Alternatively though, if you wanted to 240 240 00:08:03,660 --> 00:08:05,550 you could use software restriction policies 241 241 00:08:05,550 --> 00:08:07,470 to block things based on a block list 242 242 00:08:07,470 --> 00:08:09,060 instead of an allow list. 243 243 00:08:09,060 --> 00:08:12,120 Personally, I prefer to allow list my applications 244 244 00:08:12,120 --> 00:08:15,270 and that way I can control exactly what's on my baseline. 245 245 00:08:15,270 --> 00:08:17,280 But a block list is another valid way 246 246 00:08:17,280 --> 00:08:19,890 of doing it too in some organizations. 247 247 00:08:19,890 --> 00:08:21,990 Now, another way you can do this is by using something 248 248 00:08:21,990 --> 00:08:24,480 known as AppLocker inside of Windows. 249 249 00:08:24,480 --> 00:08:26,790 AppLocker is used to improve the configuration options 250 250 00:08:26,790 --> 00:08:28,950 and defaults of the SRP. 251 251 00:08:28,950 --> 00:08:31,980 And basically, AppLocker policies can be applied to a user 252 252 00:08:31,980 --> 00:08:34,950 or group accounts instead of just on a single computer. 253 253 00:08:34,950 --> 00:08:37,170 And so it gives you a little bit more granularity. 254 254 00:08:37,170 --> 00:08:39,000 Now, the downside of using App Locker 255 255 00:08:39,000 --> 00:08:41,280 is you can only use it if you're using the enterprise 256 256 00:08:41,280 --> 00:08:43,140 or ultimate editions of Windows, 257 257 00:08:43,140 --> 00:08:45,540 and not if you're using a home version. 258 258 00:08:45,540 --> 00:08:46,980 The next one we have is what's known 259 259 00:08:46,980 --> 00:08:51,060 as Windows Defender Application Control or WDAC. 260 260 00:08:51,060 --> 00:08:53,640 This allows you to create a code integrity policy 261 261 00:08:53,640 --> 00:08:54,990 and this can be used on its own 262 262 00:08:54,990 --> 00:08:57,270 or in conjunction with AppLocker. 263 263 00:08:57,270 --> 00:08:59,430 Now, all of these policies can allow the computer 264 264 00:08:59,430 --> 00:09:00,960 and the users to be affected, 265 265 00:09:00,960 --> 00:09:02,700 and they can be based on a version aware 266 266 00:09:02,700 --> 00:09:05,280 or digital signatures for a particular application 267 267 00:09:05,280 --> 00:09:07,680 using their image hash or file path. 268 268 00:09:07,680 --> 00:09:09,330 So they're really good at doing this 269 269 00:09:09,330 --> 00:09:11,880 and they also allow you to prevent administrative accounts 270 270 00:09:11,880 --> 00:09:13,620 from disabling execution options 271 271 00:09:13,620 --> 00:09:16,770 and this forces them into having these controls as well. 272 272 00:09:16,770 --> 00:09:19,350 Now, all that's great, but what if you're running Linux? 273 273 00:09:19,350 --> 00:09:20,700 Do you have a solution for that? 274 274 00:09:20,700 --> 00:09:21,663 Well, yes, we do. 275 275 00:09:21,663 --> 00:09:24,120 With Linux we also have execution control 276 276 00:09:24,120 --> 00:09:26,250 and we do this with one of two methods. 277 277 00:09:26,250 --> 00:09:29,190 This is either the mandatory access control known as MAC 278 278 00:09:29,190 --> 00:09:33,210 or we can use the Linux security modules known as LSF. 279 279 00:09:33,210 --> 00:09:34,920 Now, in Linux, we have something known 280 280 00:09:34,920 --> 00:09:36,570 as SELinux and AppArmor 281 281 00:09:36,570 --> 00:09:39,090 and these are probably two of the most well known programs 282 282 00:09:39,090 --> 00:09:41,520 that provide Linux security modules for us 283 283 00:09:41,520 --> 00:09:44,040 and they're pretty heavily used inside enterprise networks 284 284 00:09:44,040 --> 00:09:45,990 if you're running Linux servers. 285 285 00:09:45,990 --> 00:09:47,790 Now, the last thing we need to talk about here 286 286 00:09:47,790 --> 00:09:50,310 in terms of allow listing and block listing 287 287 00:09:50,310 --> 00:09:52,890 is how are you going to manage all the configuration changes 288 288 00:09:52,890 --> 00:09:53,820 that you're going to do 289 289 00:09:53,820 --> 00:09:56,370 in terms of these allow list and block lists? 290 290 00:09:56,370 --> 00:09:57,630 Well, the way we do that 291 291 00:09:57,630 --> 00:09:59,970 is by doing configuration management. 292 292 00:09:59,970 --> 00:10:01,470 Configuration management will allow us 293 293 00:10:01,470 --> 00:10:03,870 to have a process in place of how we're going to update 294 294 00:10:03,870 --> 00:10:05,610 all of our block lists and our allow list 295 295 00:10:05,610 --> 00:10:06,930 for any of those changes. 296 296 00:10:06,930 --> 00:10:09,120 And we'll do this in response to user requests, 297 297 00:10:09,120 --> 00:10:10,710 in response to business operations, 298 298 00:10:10,710 --> 00:10:13,710 and in response to incident responses as well. 299 299 00:10:13,710 --> 00:10:15,540 So as you're doing all of these 300 300 00:10:15,540 --> 00:10:17,880 there's lots of different changes that have to occur 301 301 00:10:17,880 --> 00:10:19,770 and you're going to have to make sure that you're keeping track 302 302 00:10:19,770 --> 00:10:21,690 of all these changes and pushing them out 303 303 00:10:21,690 --> 00:10:25,110 to all of your machines to keep that baseline consistent. 304 304 00:10:25,110 --> 00:10:27,030 Now, if you're going to go through a large change, 305 305 00:10:27,030 --> 00:10:28,890 you're going to have to make sure you do a risk assessment 306 306 00:10:28,890 --> 00:10:30,450 and a business impact analysis 307 307 00:10:30,450 --> 00:10:32,190 to ensure you're not going to break anything. 308 308 00:10:32,190 --> 00:10:33,990 And we're going to talk more about risk assessments, 309 309 00:10:33,990 --> 00:10:35,970 change control, and business impact analysis 310 310 00:10:35,970 --> 00:10:38,790 later on in this course as we move into later sections 311 311 00:10:38,790 --> 00:10:40,233 and into other domains.