• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
Ngn sec
 

Ngn sec

on

  • 462 views

 

Statistics

Views

Total Views
462
Views on SlideShare
462
Embed Views
0

Actions

Likes
0
Downloads
8
Comments
0

0 Embeds 0

No embeds

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment
  • Cable messaging could (conceivably) address their need to deliver wireless and quad-play ; Wireline messaging the need for a secure foundation over which to deliver managed security services …
  • Service Providers often have well-developed security management frameworks in place IP NGN Security relies on integration with these frameworks for Sec-Ops and Policy Development
  • Provides the foundation for proactive security services Allows the identification of end-node security posture, and the business context (roles, responsibilities, and capabilities) within which that node should be used Provides the basis for service differentiation (all services) Identification of malware Allows the implementation of white-lists for outbound services Implementation of traffic / security policies
  • Real-time macro and micro visibility into service and ip flows, network health Provides early trend warnings versus baselines to feed to mitigation processes Can provide input for archives / data retention / baselining / network modeling Provides input into capacity planning / SLA-reporting services Tight control over the revenue stream / operations
  • Adds context and intelligence to meta (raw) data collected during monitoring processes Allows the creation of behavioral baselines Abstraction of events to alarm instances
  • Maintains an appropriate security posture in real time versus a threat environment Creating a reliable infrastructure upon which to deliver services Provides dynamic protection against both known and Day-Zero threats
  • Limits collateral damage Prevents accidental data leakage / acquisition
  • Stopping attacks and non-compliant behavior.

Ngn sec Ngn sec Presentation Transcript

  • IP NGN Security Framework Mikhail Kader, Distinguished Systems Engineer, Cisco, Russia [email_address] ITU-T Workshop on “New challenges for Telecommunication Security Standardizations" Geneva, 9(pm)-10 February 2009 Geneva, 9(pm)-10 February 2009
  • Scott Borg, Dartmouth College, Institute for Security Technology Studies Mischief of course, but mostly money – a miscreant economy has evolved to steal or extort money from attractive targets IP NGN Security A Paradigm Shift in Miscreant Economy Geneva, 9(pm)-10 February 2009 Yesterday’s Threats
      • Geeks and adolescents
      • Operated alone or with a
      • small group of friends
      • Interested in demonstrating
      • Prowess, gaining notoriety
      • Targeted individual computers
      • or applications
      • Little or no business
      • Sophistication
    Today’s Threats
      • Professional hackers
      • Operating in syndicates or
      • cooperatives
      • Interested in extortion,
      • espionage, or economic gain
      • Targeting businesses,
      • governments, and networks
      • BotNets for Sale…
  • IP NGN Secure Platform What is IP NGN Security? A hierarchical model for framing security discussions with service providers Geneva, 9(pm)-10 February 2009 Security Principals Describes the primary Security Principals that are affected by security policies Visibility Control Security Actions Describes essential actions that enable Visibility and Control Identify Monitor Correlate Harden Isolate Enforce Business Relevance Describes customer-specific business goals , and the threats to goal attainment Business Goals and Objectives Threats to Goals and Objectives Security Policies Describes the iterative development and monitoring of security policies Threat and Risk Assessment Security Policies Security Operations
  • Security helps meet all key business goals and objectives for service providers: Business Relevance Business Goals and Objectives Geneva, 9(pm)-10 February 2009 Adherence to social and legal requirements for parental control, data retention, and service monitoring is mandated in many markets
    • Regulatory Requirements Adherence
    • Safeguard Brand
    Public disclosure of security or privacy breaches can destroy carefully managed marketing campaigns and brand reputation
    • Protect Service Revenue
    Business disruptions due to security events can result in both immediate and long-term loss of revenue
    • Meet Customer Expectations / Minimize Churn
    Customers expect safe, private, reliable services, and they’re willing to change operators to get them…
  • Migration to 3.5G or IP networks brings changes threat landscape hence a Risk Analysis is necessary. An example for Mobile: Illustrate the effects of the evolution from 2G to 3.5G Business Relevance Threats to Business Goals Leads to Risk Analysis Geneva, 9(pm)-10 February 2009 2G 3.5G Isolated  Highly Networked No IP  IP End-to-End Simple Devices  Sophisticated Devices Proprietary Services  Open Services Few Security Targets  Numerous Security Targets Little Risk  Much Risk
  • IP NGN Security requires the definition of security policies, but is agnostic to the methodologies needed to create them Developing Security Policies Risk Assessment Methodologies eTOM – enhanced Telecom Operators Map ITIL – Information Technology Infrastructure Library Geneva, 9(pm)-10 February 2009
  • Regardless of the risk assessment methodology utilized, the core steps are the same: These steps result in the creation of security policies and guidelines that define the acceptable and secure use of each device, system, and service Developing Security Policies Many Methodologies – One Goal Geneva, 9(pm)-10 February 2009 Threat Models How can the device, service, or system be attacked, disrupted, compromised, or exploited? Risk Assessments What impact would an attack have on my business? How important is the asset? Policy Development What entities, attributes, processes, or behaviors can be controlled to prevent or mitigate each attack?
  • IP NGN Security Principles Visibility and Control Security Policies always define a need or means to increase Visibility or Control
    • Visibility:
    • Identify subscribers, traffic, applications, protocols, behaviors…
    • Monitor and record baselines patterns for comparisons to real-time
    • Collect and correlate data from every source to identify trends, macro events
    • Classify to allow the application of controls
    • Control:
    • Limit access and usage per subscriber, protocol, service, packet…
    • Protect against known threats and exploits
    • Authenticate management- and control-plane access / traffic
    • Isolate subscribers, services, subnets
    • React dynamically to anomalous events
    Geneva, 9(pm)-10 February 2009 No visibility means no control; no control means no security 
  • IP NGN Security Actions Increasing Visibility and Control IP NGN Security defines six fundamental actions that apply defined policies, improving Visibility and Control These actions, properly taken, enhance service security, resiliency, and reliability – primary goals for subscribers and operators alike Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden
  • IP NGN Security Actions Identify Identifying and assigning trust-levels to subscribers, networks, devices, services, and traffic is a crucial first step to infrastructure security
    • Identify and authenticate subscribers and subscriber devices (where possible)
    • Associate security profiles with each subscriber and device
    • Associate network addresses and domain identifiers subscriber devices
    • Classify traffic, protocols, applications, and services at trust-boundaries
    • Inspect traffic headers and payloads to identify subscribers, protocols, services, and applications
    • Authentication, Authorization, and Accounting (AAA) Servers
    • Extensible Authentication Protocols
    • Deep Packet Inspection
    • Network-Base Application Recognition
    • Service Control Engines / Application Performance Assurance
    • DNS / DHCP Servers
    • Service / Subscriber Authenticators
    • Service Gateways
    • Signaling Gateways
    • Session Border Controllers
    Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden Principal Actions Relevant Technologies
  • IP NGN Security Actions Monitor Any device that touches a packet or delivers a service can provide data describing policy compliance, subscriber behavior, and network health
    • Gather performance- and security-relevant data inherent to routers and switches
    • Log transactional and performance data at access and service gateways
    • Link IP traffic with specific subscribers devices, and origins whenever possible
    • Deploy protocol-, traffic-, and service-inspection for reporting and detection
    • Develop behavior baselines for comparison to real-time measurements
    • Employ command / change accounting
    • Netflow
    • SNMP / RMON / SysLog
    • Network / Traffic Analysis Systems
    • Intrusion Detection Systems
    • Virus- / Message-Scanning Systems
    • Deep Packet Inspection
    • Packet Capturing Tools
    • SPAN / RSPAN
    • Authentication, Authorization, and Accounting (AAA) Servers
    • DHCP / DNS Servers
    Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden Principal Actions Relevant Technologies
  • IP NGN Security Actions Correlate Important macro trends and events can often go unrecognized until other numerous – seemingly unrelated – events are correlated
    • Assure time synchronization throughout network and service infrastructures
    • Collect and collate data from distributed, disparate monitoring services
    • Analyze and correlate data to identify trends and macro-level events
    • Security Information Management Systems (SIMS)
    • Netflow Analysis Systems
    • Event Correlation Systems
    • Behavioral Analysis Systems
    • Anomaly Detection Systems
    Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden Principal Actions Relevant Technologies
  • IP NGN Security Actions Harden Hardening is the application of tools and technologies to prevent known – or unknown – attacks from affecting network or service infrastructures
    • Deploy layered security measures – defense-in-depth
    • Authenticate control-, and management-plane traffic
    • Authenticate and limit management access to devices, servers, and services
    • Prevent Denial of Service (DoS) attacks – state attacks, resource exhaustion, protocol manipulation, buffer overflows...
    • Validate traffic sources to prevent spoofing
    • Access Control Lists
    • Authentication, Authorization, and Accounting (AAA) systems
    • Reverse-Path Forwarding Checks
    • Control-Plane Policing
    • Role-based control interfaces
    • Memory and CPU thresholds
    • Intrusion Detection Systems
    • High-Availability Architectures
    • Load Balancing
    Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden Principal Actions Relevant Technologies
  • IP NGN Security Actions Isolate Isolating is a critical design practice then helps prevent access to critical resources, protect data, and limit the scope of disruptive events
    • Limit and control access to (and visibility into) transport-, operations-, and service-delivery infrastructures
    • Prevent visibility and access between different services, customers…
    • Create network zones to isolate based on functionality – DNS, network management, service delivery, access…
    • Define strict boundaries between networks, operational layers, and services of different trust-levels
    • Encrypt sensitive traffic to prevent unauthorized access
    • Virtual Private Networks
    • Virtual Routing and Forwarding
    • Route Filtering
    • Routing Protocol / Transport Boundaries
    • Firewalls
    • IPSec and SSL Encryption
    • Out-of-Band Management
    • Demarcation / Functional Separation Zones
    • Access Control Lists
    Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden Principal Actions Relevant Technologies
  • IP NGN Security Actions Enforce Shaping the behavior of subscribers, traffic, and services, as well as the mitigation of detected security events are the primary goals of enforcement
    • Prevent the entry and propagation of known exploits – viruses, worms, SPAM
    • Identify and mitigate anomalous traffic, events, and behaviors
    • Detect and prevent address spoofing
    • Limit subscribers and traffic to authorized networks, services, and service-levels
    • Shape and police traffic the assure compliance with established service level agreements
    • Identify and quench unauthorized protocols, services, and applications
    • Firewalls
    • Intrusion Prevention Systems
    • Remotely Triggered Black Holes
    • Service Control Engines
    • Traffic Classifiers, Policers, and Shapers
    • Virus and Message Filtering Systems
    • Anomaly Guards / Traffic Filters
    • Quarantine Systems
    • Policy Enforcement Points (Routers, Access Gateways, Session Border Controllers)
    Geneva, 9(pm)-10 February 2009 Identify Monitor Correlate Isolate Enforce Harden Principal Actions Relevant Technologies
  • IP NGN Security Implementation and Operations IP NGN Security defines the actions and technologies to be implemented and operated by an organization The security of any given IP service depends greatly upon the network architecture, implementation, and organizational competence Geneva, 9(pm)-10 February 2009
  • IP NGN Security Summary Define a security model to reach operational excellence based on security policies and process gaining enhanced visibility, control and high availability. Geneva, 9(pm)-10 February 2009 Security Principals Describes the primary Security Principals that are affected by security policies Visibility Control Security Actions Describes essential actions that enable Visibility and Control Identify Monitor Correlate Harden Isolate Enforce Business Relevance Describes customer-specific business goals , and the threats to goal attainment Business Goals and Objectives Threats to Goals and Objectives Security Policies Describes the iterative development and monitoring of security policies Threat and Risk Assessment Security Policies Security Operations