Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Cisco Connect 2018 Thailand - Secure data center building a secure zero trust infrastructure-khun tanawin reinmanorom_cisco
Similar to Cisco Connect 2018 Thailand - Secure data center building a secure zero trust infrastructure-khun tanawin reinmanorom_cisco (20)
More from NetworkCollaborators
More from NetworkCollaborators (20)
Recently uploaded
Recently uploaded (20)
Cisco Connect 2018 Thailand - Secure data center building a secure zero trust infrastructure-khun tanawin reinmanorom_cisco
- 2. Building a Secure Data Centre with Tetration Tanawin Reinmanorom CCIE #19917 DC,R/S – Systems Engineer
- 3. ..but do you know them well enough to protect them? Your business runs on applications…
- 5. Using data
- 6. The security challenge Motivated and targeted adversaries Increased attack surface Increased attack sophistication • State sponsored • Financial/espionage motives • $1T cybercrime market • BYOD blurring perimeter • Public cloud services • Enterprise IOT • Advanced persistent threats • Encrypted malware • Zero-day exploits Scale too many alerts Complexity securing everything Sophistication Keeping up against attackers 60days Industry average time to contain a breach $3.8M Average cost of a data breach 200days Industry average detection time for a breach 100% Customers lack network segmentation at time of breach
- 7. The Three Pillars of a Secure Hybrid Cloud
- 8. (re)Introducing Tetration APPLICATION INSIGHT FLOW SEARCH & FORENSICS WORKLOAD PROTECTION v Open Access Web Rest API Event Bus Apps Meta-Data generated from every packet Data Analytics & Machine Learning Engine Analytics Cluster Appliance model On-Premise or Cloud Ingest Store Analyse Learn Simulate Act Sensors capture conversations and behaviours Host Sensor Network 01010101010 10101010110 BYOD
- 9. Application Insight Process Inventory Visibility and Forensics Cisco Tetration Platform Security Use Cases Cisco Tetration™ Platform Foundation Segmentation Advanced Security White-list Policy Policy Compliance Application Segmentation Process Security Software Inventory Baseline
- 10. Excellence in Threat Centric Security Secure Multi-Tenancy Industry Compliance Standards (PCI) Microsegmentation VM-Based Segmentation vm vm vm ACI Group Policy Deep traffic inspection Threat-Centric Protection APIC integration APIC Forensic Analysis Real-time Threat Intelligence Dynamic Workload Quarantine Advanced Threat Protection (NGFW, NGIPS, AMP, Stealthwatch) Security Foundation (ACI) Centralized Policy Automation
- 11. Introducing Cloud Workload Protection App Segmentation Zero-Trust App Behaviour Monitoring Vulnerability Detection • Automated whitelist policy based on application behavior • Policy enforcement to enable segmentation • Tracking of policy compliance • Outlier detection • Process hash, lineage, attributes • New command, new user • Account modification • Privilege escalation • Shell-code execution • Raw sockets • Installed package tracking • Weekly CVE tracking • Vulnerability scoring
- 12. How it work ?
- 13. Workload Protection – App Insight App Insight Understand your apps Cisco Tetration™ Systems with Intel® Xeon® Scalable processors
- 14. C97-739700-01 © 2018 Cisco and/or its affiliates. All rights reserved. Server Process and Process Details • Process details collected on a minute-by-minute basis • Process inventory: • Process • Process ID • User information • Process execution details • Process hash (Signature) • Search for inventory of servers with specific process or process hash • Process snapshot tree view to show full process hierarchy • Full time-series view to go back and visualize process hierarchy and behavior information
- 15. C97-739700-01 © 2018 Cisco and/or its affiliates. All rights reserved Software Package vulnerability – Policy Action • Setup filters to search for one or more vulnerabilities • Setup policy through UI or through API to take specific action: • Quarantine a host when servers are identified with the vulnerability Cisco Tetration Analytics™
- 16. Visibility with Context and Control Employee Employee Supplier Quarantine Shared Server Server High Risk Segment Internet Clear understanding of traffic flow with context Easier to create & apply policy based on such context 192.168.19.3 10.85.232.4 10.4.51.5 192.168.132.99 10.43.223.221 10.200.21.110 10.51.51.0/24 10.51.52.0/24 10.51.53.0/24 Internet With ISE & Tetration Integration
- 17. Workload Protection – APP Relationships App Policy Understand app relationships Cisco Tetration™ Systems with Intel® Xeon® Scalable processors
- 18. Workload Protection – Simulate Changes Simulation Act with confidence Cisco Tetration™ Systems with Intel® Xeon® Scalable processors
- 19. Workload Protection - Enforcement Enforcement Consistent protection
- 20. • Share group info to simplify policy management • Share classifications to reduce SecOps effort, deliver consistency and simplify audit • Multiple clouds with consistent policy Group Policy Connector Enterprise Security Groups APIC DC ACI EndPoint Groups VTS Groups AWS Security Groups Azure Network Security Groups Rackspace Security Groups OpenStack Security Groups ODL Groups Tetration
- 21. Workload Protection - Forensics Forensics Capture everything
- 22. Threat detection and hunting Application traffic modeling & visibility Access control policy discovery and audit Segmentation Anomalous behavior Integrated with other security solutions 1+1=3 Greater visibility and security together Cisco Tetration and Stealthwatch
- 23. Cognitive analytics Encrypted Traffic Analytics Expanded CTA dashboard view
- 24. App Insight Understand your apps App Policy Define app relationships Simulation Act with confidence Enforcement Consistent protection Forensics Capture everything