5. Доверенна
сеть
я
WiFi
Адаптационный
период
Аутентификация
пользователя
Цифровая метка
устройства
Применение
корпоративной
конфигурации
Корпоративный AppStore
Банковские приложения
Автоматические политики
6. Доверенная
сеть WiFi
Политика с учетом
контекста
Применение
установленных
профилей
политики, исходя из:
типа устройства
пользователя
местоположения
приложения
7. Доверенная
с е т ь
W i F i
Политика с учетом
контекста
Доступ: ПОЛНЫЙ
Нет Да
Электронные досье клиентов
Мобильная технология
TelePresence / ВКС
Электронная почта
Мгновенный обмен
сообщениями
8. Доверенная
сеть WiFi
Результаты оценки
клиента Х уже
готовы?
Еще нет, но я дам
вам знать, когда они
поступят
9. Недоверенная сеть WiFi
Политика роуминга
Доступ: ограниченный
Нет Да
Электронные досье клиентов
Мобильная технология TelePresence
Электронная почта
Мгновенный обмен сообщениями
10.
11.
12. 3G/4G
Доступ:
Ограничен
Нет Да
Досье клиента
Mobile TelePresence
Email
Instant Messenger
18. Документы устарели морально
• РД «Концепция защиты средств вычислительной техники и
автоматизированных систем от несанкционированного доступа к
информации»
• РД «Средства вычислительной техники. Защита от
несанкционированного доступа к информации. Показатели
защищенности от несанкционированного доступа к информации»
• РД «Автоматизированные системы. Защита от
несанкционированного доступа к информации. Классификация
автоматизированных систем и требования по защите
информации»
• РД «Средства вычислительной техники. Межсетевые экраны.
Защита от несанкционированного доступа. Показатели
защищенности от несанкционированного доступа к информации»
19. и технологически
• Специальные требования и
рекомендации по
технической защите
конфиденциальной
информации (СТР-К)
– Одобрены решением
коллегии Гостехкомиссии
России от 2 марта 2001 г.
№ 7.2
– Введены приказом
Гостехкомиссии России от
30.08.02 №282
21. А есть ли у нас периметр?
• Все объекты, к которым предоставляется доступ, и все
субъекты, которые этот доступ получают, должны находиться в
контролируемой зоне
– Действия пользователей контролируются и ограничиваются
системой разграничения доступа
– Посторонние субъекты получить доступ в контролируемую зону
получить не могут
– Для борьбы с средствами электронной разведки используется
защита от ПЭМИН, виброакустика и т.п.
– При наличии нескольких распределенных контролируемых
зон, каналы связи между ними защищаются
сертифицированными СКЗИ и сертифицированными МСЭ
– Периметр контролируемой зоны – это наше все!
22. А кто у нас нарушитель?
• «В качестве нарушителя рассматривается субъект, имеющий
доступ к работе со штатными средствами АС и СВТ как части
АС»
– П.4.1 Концепции защиты СВТ и АС от НСД
• Внешний нарушитель не рассматривается в принципе
– Но он есть!
– Он атакует внешний периметр, который не бывает
непробиваемым, т.к. администраторы тоже люди и тоже
совершают ошибки при настройке и конфигурировании
– Внешний нарушитель попадает в DMZ, оттуда в ядро сети, затем
ЦОД и пользовательские сегменты
– Внутри периметра препятствий обычно уже нет, т.к. концепция
защиты ориентирована на контролируемого пользователя, а не
свободно разгуливающего хакера
23. СТР-К ориентируется только на внутренние угрозы
Внутренние угрозы Внешние угрозы
Ботнеты ВПО
ПРОБЛЕМА
Доступ из защищаемой Доступ из защищаемой сети Доступ извне к
сети к менее доверенной к такой же по уровню защищаемой сети
требует защиты не требует средств вообще не
сертифицированного МСЭ разграничения (кроме СКЗИ) регламентируется
24. А если нужен доступ из Интернет к защищаемому ресурсу?
ОТЕЛЬ
ОФИС
25. Как это сделано в Cisco: общий взгляд
Интернет
Демилитаризованная
зона (DMZ)
Основной сайт
26. Как это сделано в Cisco: анализ проникновения в DMZ
Злоумышленники могут захватить эти интернет-серверы
27. Как это сделано в Cisco: анализ проникновения внутрь
Возможно действие лишь некоторых основных атак
28. Как это сделано в Cisco: анализ веерной атаки внутри
Злоумышленник может проникнуть в случае, если он найдет
брешь, которую вы еще не устранили
29. Основной объект защиты - ПК
Мобильный
Мейнфрейм Мини ПК Интернет+ПК Интернет
Вычиления Вычисления Вычисления Вычисления Вычисления
1950-х 1960-х 1980-х 1990-х 2000-х
30. z
Приложения
ОС
пользователя
ОС
Сервера
Клиентские
устройства
32. А есть ли сертифицированные средства защиты не для
ПК?
Защищенный Незащищенный
33. А если платформа закрыта для разработчиков?!
Apple iOS
МСЭ IPS
33
34. Традиционный подход не справляется с
требованиями сегодняшнего дня
Мобильность Социальность Видео Виртуализация
Отсутствие поддержки Невозможно Низкое качество Ограничения в
мобильных устройств и взаимодействовать с и совместимость работе с голосом и
OC социальными сетями видео через VDI
X
X X
X
36. Традиционный периметр
Политика
Периметр
Приложения и
данные
Офис
Филиал
Хакеры Партнеры Заказчики
37. Мобильность и взаимодействие
растворяют Интернет-периметр
Политика
Периметр
Приложения и
данные
Офис
Филиал
Дом
Аэропорт
Мобильный Кафе
пользователь Хакеры Партнеры Заказчики
38. Cloud Computing растворяет
границу ЦОД
Политика
Периметр Platform Infrastructure
Приложения и as a Service as a Service
Software X
данные as a Service
as a Service
Офис
Филиал
Дом
Аэропорт
Мобильный Кафе
пользователь Хакеры Партнеры Заказчики
39. Пользователи хотят вести бизнес без границ
Политика
Периметр Platform Infrastructure
Приложения и as a Service as a Service
Software X
данные as a Service
as a Service
Офис
Филиал
Дом
Аэропорт
Мобильный Кафе
пользователь Хакеры Партнеры Заказчики
40. Нужен новый подход!
Политика
Политика 4 (Access Control, Acceptable Use, Malware, Data Security)
Data Center
Borderless
Периметр Platform Infrastructure
Приложения и
Software
as a Service as a Service
X
3
данные as a Service
as a Service
Офис
Borderless
Internet
2
Филиал
End Zones
Borderless
Дом
Аэропорт
1
Мобильный Кафе
пользователь Хакеры Партнеры Заказчики
What does this all really mean? It introduces a new chasm – the netherworld between trusted enterprise networks, and the wild world of the internet that is accessed while roaming hotspots, 3G/4G networks and home networks. Did you know that employee devices spend a full 50% of connected lives OFF the enterprise network? As never before, organizations must manage the transitions on and off different networks seamlessly, while protecting sensitive information.But this growth in wireless and mobility can also create new opportunities to increase efficiency and grow your business today. Just how can you take advantage of this market transition?What I’m going to do today is break it down into a very simple example. Let’s walk through a day in the life of Dr. Jack Thompson, something that is happening right now in hospitals across the country. [TRANSITION] Let’s see what a true seamless experience should be for Dr. Thompson, and the systems that make it happen.
Dr. Thompson buys a 3G iPad during lunch, walks back to the hospital and hands his new iPad to IT and says I want to use this for my work. Now what?[TRANSITION]
His IT manager tells him that using his username and password, he can “onboard” the device and the network will apply all the correct policies and approved apps automaticallyThe IT manager knows the importance of keeping the network secure, and complying with regulations to protect patient data. So things like remote wipe and data loss prevention are critical. [TRANSITION]
Luckily, his system can help him apply contextual policies based on things like device type, user or location automatically, without user intervention. We’ve kept it simple for this example, but as you all know you can apply polices based on many more attributes.That’s it, Dr. Thompson has now on-boarded his new iPad. Keep in mind, to enable this seamless experience the network needs to support certain things: First, you need an 802.11n Wi-Fi network which can withstand the challenges of Mobility including complex RF interference. Second, you need identity-based network control for the contextual policy we just touched on. Mobile Device Management is required for functions such as installing enterprise applications or remote wipe if the device is lost. Last but not least, Make sure you have a management system for the infrastructure and a service assurance manager for visibility into what’s going on in the network, and what you need to do if things start going wrong. If you have branches in the Hospital, WAN optimization will help help keep network resources available.[TRANSITION]
Let’s get back to Dr. Thompson…. He is now attending to patients in the OR. His contextual policy has been defined from an application perspective such that when he is at work, he has full access electronic medical records, mobile telepresence, email and IM. Again, we are keeping it simple here in terms of applications used. It’s key to note that you can tailor this policy for unique job and regulatory requirements, with the doctor only allowed to access sensitive patient records while in the office due to HIPPA regulations.It’s now 2 o’clock and Dr. Thompson needs his afternoon coffee, what happens when he leaves the Hospital? [TRANSITION]
Doctor goes to OR, pulls up EMR and xray imagesCommunicates with staff via IMWe know that literally billions of devices are pouring onto networks – at hospitals that presents doctors, administrators, patients, and visitors. Each has unique needs, and along with tablets and smart phones, healthcare has specialized medical equipment, and wireless tracking tags, connecting in increasing numbersA wi-fi network must be designed to meet these challenges, these changing device profiles, application profiles, and device density.Capacity and performance to support the influx of clientsPerformance to handle new applications, such as two-way TP with patients, and EMR data housed centrally for a medical group, and application data now residing in the cloud Acceleration for all client types, even the medical asset tags, slower tablets and smart phonesPROACTIVE protection against wireless interference from things like blanket warmers and light controlsLocation tracking for assets and peoplePlus, patient data is protected by HIPPA regulations, so IT must carefully govern when and how this can be accessed
He decides to visit the coffee shop next door, which has a Wi-Fi hotspot. Now, his contextual policy becomes a roaming policy defined by the Hospital. The policy says that Dr. Thompson will not have access to EMR while at the coffee shop, but he will be able to use email, telepresence and IM[TRANSITION] While there, he gets a paged from his nurse, and gets into a video chat session to have a two-way video chat about his patient.
Doctor goes to his child’s soccer game, still with iPad, on 3GAgain, his VPN has roamed from hotspot to 3G, preventing any interruption or interventionHe has full access to patient data, but his applications have been throttled to prevent overloading the 3G network and to prevent application performance issuesOur doctor pulls up his EMR application, checks for updates on patient status, all is well, watches game with ease
Doctor goes to his child’s soccer game, still with iPad, on 3GAgain, his VPN has roamed from hotspot to 3G, preventing any interruption or interventionHe has full access to patient data, but his applications have been throttled to prevent overloading the 3G network and to prevent application performance issuesOur doctor pulls up his EMR application, checks for updates on patient status, all is well, watches game with ease
Doctor goes to his child’s soccer game, still with iPad, on 3GAgain, his VPN has roamed from hotspot to 3G, preventing any interruption or interventionHe has full access to patient data, but his applications have been throttled to prevent overloading the 3G network and to prevent application performance issuesOur doctor pulls up his EMR application, checks for updates on patient status, all is well, watches game with ease
Doctor goes home – connects on home Wi-Fi, He has partitioned access – tunnel back to hospital, and a personal SSID for family accessDoctor calls in on his IP softphone to talk with a colleague about tomorrow’s operations[TRANSITION]
Doctor goes home – connects on home Wi-Fi, He has partitioned access – tunnel back to hospital, and a personal SSID for family accessDoctor calls in on his IP softphone to talk with a colleague about tomorrow’s operationsSon starts a Call of Duty “Modern Warfare 3” game – but his home router applies QoS and prioritizes this lower than his phone callHis call continues with perfect quality
The threat environment presents two challenges, protecting against attack targeted at or coming from internal users as well as protecting from attack from outsiders. As hackers become industrialized, meaning that they are organized and deliberate in their efforts, and that they operate from an actual for-profit business model, their efforts to break into and steal data, resources, personal information, and even electronic funds, goods, and services are becoming increasingly sophisticated. These threats are not only from the outside, but increasingly, are aided, or even initiated, by insiders.Traditional, legacy security solutions are poorly suited to address these new threats. They exist in siloed environments with no ability to see behaviors within a larger context, nor to leverage the network in order to better mitigate events. Signature-based solutions are becoming irrelevant as polymorphic threats are able to self-modify their code to avoid signature-matching security approaches. More often than not, these solutions also impede an organization’s ability to deploy new mobility or collaboration solutions because as the edges of the network blur these devices become even less effective.We need to have visibility into these inside and outside actions and apply greater context to effectively protect from successful attacks.
With users demanding access to data from anywhere, the choice for you is to either to keep your network very restrictive, which your business leaders do not like, or to fully open up access even if that makes your network more vulnerable.As an element of context, location can play an important role in determining whether the access request is legitimate or not. For example, if the CFO access the finance application from his laptop as well as iPad, maybe it is ok. However, the fact that the access from these two devices happened simultaneously from 2000 miles apart is a strong indication that one of the devices may be compromised.ASA CX allows you to create location-based policies. In the first release, you can create separate policies for local and VPN (AnyConnect) user traffic. As an example, you can allow access to a sensitive financial application from a local laptop, while denying access from a remote iPad.In future, the planned integration with TrustSec and Identity Services Engine (ISE) will allow you to set more granular policies based on where in the network you connected from. For example, if you are connecting from employee workstations in San Jose campus > Building H, you get a different level of access than if you were connecting from a lab environment.
To understand the first pillar in the borderless end zone, consider how a traditional Virtual Private Network works. <ENTER> Today, when a user is connected through a VPN, the user is fully protected from threats by corporate scanners, filters and firewall systems.However, if users aren’t VPN’d in there is no protection in place and they are completely exposed to threats, as well as acceptable use and data security violations. In this case the dollars that corporations have invested in security infrastructure doesn’t help them at all.So in the traditional model you are completely reliant on the end user and the limitations of their client-based security.<ENTER> Cisco’s vision is to extend the security perimeter by linking end points to an array of enforcement engines. This tether will monitor connections at the endpoint and intelligently redirect traffic to high-performance scanning elements in the network. Cisco devices like Adaptive Services Appliances, Integrated Security Routers, and Web and Email Security Appliances perform the policy enforcement. This makes it possible for customers to enforce consistent policies for any device, anywhere.
So let me walk you through the components that make up the architecture for borderless network security. Of course there are policy enforcement systems. These are Cisco devices located inside your corporate office and in distributed locations. We call this the Cisco Security Enforcement Array. Some are firewalls, some are email and web filtering systems, some are virtual services running on routers and switches. We’ll talk more about these in a moment.<ENTER>Part of our solution resides in the borderless end zones, covering mobile users, remote workers, partners and others.<ENTER>Part of our solution resides in the internet, in the Security Enforcement Array and in Cisco products globally.<ENTER>Part of our solution provides Single-Sign-On and secures the new cloud-based services from Cisco and other vendors, that make up the borderless data center.<ENTER>Finally, there is a layer of policy control over acceptable use, access control, malware and data security. These are the four pillars that define the reach and layout of the secure borderless network architecture.
