MSP Training with DefensX - Part 2

Summary

In this deep dive into Defense X, Justin walks viewers through the platform's policy management features. From deployment options to advanced web filtering, risk scoring, and custom URL groups, he showcases how to tailor security policies for specific user needs. Key features include credential protection, file transfer controls, and ad blocking. The video also covers consent management, allowing users to enforce zero trust or less strict policies, as well as the creation of public templates for mass policy deployment. With easy-to-understand tools, Defense X enables precise control over network and user security.

Takeaways

• 😀 Deployment of Defense X policies is easy with RMM scripts and customizable deployment options, including silent install and anti-tamper features.
• 😀 The system allows for network-wide protection via the 'Manage IPS' feature, securing devices beyond just those with installed agents.
• 😀 Advanced deployment options include kernel drivers for blocking/allowing actions at the driver level, which improves compatibility with other software.
• 😀 The web filtering system offers over 200 categories to block or allow, with custom URL blacklists and whitelists to fine-tune access control.
• 😀 Websites are assigned risk scores, and actions (block, allow, isolate) are automatically taken based on the risk score, custom URLs, or category filters.
• 😀 Credential protection can be enforced by blocking password inputs on unknown websites, with users required to confirm their actions for low-risk sites.
• 😀 The file transfer system allows admins to block specific file types (e.g., MSI, EXE, ZIP) and set up pre-approved uploads and downloads for extra security.
• 😀 Users can enable or disable the ad blocker, which is applied at the DNS level to prevent websites from detecting the ad blocker's presence.
• 😀 The 'Consent' feature allows granular control over what users can approve, with 'Zero Trust' settings for highly restricted access to credentials or file transfers.
• 😀 Public templates simplify policy management by enabling admins to apply predefined settings across multiple customer accounts quickly, ensuring consistency.

Q & A

What is the purpose of the RMM script in Defense X?

The RMM script is used to deploy Defense X on client machines. It includes features like anti-tamper protection, silent installation, and the ability to remove Defense X from the AD remove program, making the deployment process streamlined and secure.

How does the kernel driver work in Defense X?

The kernel driver operates at the driver level on Windows machines. It ensures that the allows and blocks are enforced at a deeper system level, bypassing potential interference from software that changes DNS settings.

What are the key features of the web filter settings in Defense X?

Web filter settings in Defense X allow for domain lookup, custom URL blacklisting/allowlisting, and categorization of over 200 types of websites. Users can manage web access by blocking or allowing categories, or based on the risk score of a site.

How does the risk scoring system in Defense X work?

The risk scoring system categorizes websites by risk level (low, medium, high, unknown) and assigns specific actions (block, allow, isolate). Low-risk websites can be accessed, while high-risk sites are blocked. For unknown websites, an isolation feature is used.

What is the 'Policy Check' feature in Defense X?

The 'Policy Check' feature allows users to simulate and verify how specific policies would apply when a user visits a website. It helps ensure the correct actions (block, allow, or consent) are triggered based on the policy settings.

Can users override the blocking actions for websites in Defense X?

Yes, users can override blocking actions by granting consent for low-risk websites. This allows users to access certain websites after confirming that they understand the risks associated with visiting them.

How does Defense X handle file transfer protection?

Defense X allows for file transfer protection by blocking certain types of file uploads or downloads, such as MSI, EXE, and ZIP files. It can also prompt users for consent before uploading files, based on the risk level of the site they are interacting with.

What is the role of the custom URL groups in Defense X?

Custom URL groups in Defense X allow administrators to create specific URL lists for allowing or blocking websites. These can be set for credential protection, file transfers, or web filtering, offering fine-grained control over web and network access.

What are 'public templates' in Defense X and how are they used?

Public templates in Defense X are pre-configured policy settings that can be applied across multiple customer accounts. These templates allow administrators to standardize security policies and apply them automatically to new or existing customers.

How does the ad-blocking feature in Defense X work?

Defense X blocks ads at the DNS level, preventing websites from detecting the ad-blocking. This feature can be turned off by users, but it is enabled by default to enhance security and reduce distractions on websites.