Downloaded 64 times
Uploaded byLancope, Inc.
Data center webinar_v2_1
The document discusses securing data centers from cyber threats. It describes how attacks have evolved from manual to mechanized to sophisticated human-led attacks. It advocates employing segmentation, threat defense and visibility measures like firewalls, IDS/IPS, and NetFlow. The Cisco Cyber Threat Defense solution places these tools at the access, aggregation and core layers, including the ASA firewall, Nexus switches, and StealthWatch for network monitoring and analytics. This provides visibility into network traffic across physical and virtual infrastructure to detect threats and policy violations.
More Related Content
Similar to Data center webinar_v2_1
Data center webinar_v2_1
- 1. Securing the DataCenter Matt Robertson - Lancope Technical Marketing Engineer David Anderson – Cisco Principal Solution Architect, Data Center Security
- 2.
- 3. Evolution of CyberConflict War Dialing, Phone Phreaking … Manual Attacks (1980s) Viruses, Worms … Mechanized Attacks (1988) Google, RSA … Talented Human / Mechanized Attackers (2009) Cyrptocurrency Ransoms, Store-bought Credentials ... DIY Human / Mechanized Attackers (2011) Intelligence Driven Human Defenders Manual Defenses Unplug Mechanized Defenses Firewall, IDS/IPS Targeted Human/Mechanized DefendersReputation, App-aware FirewallAPT, Multi-Step Attacks… Target, Neiman Marcus …
- 4. Security Buckets Segmentation • Establishboundaries: network, compute, virtual • Enforce policy by functions, devices, organizations, compliance • Control and prevent unauthorized access to networks, resources, applications Threat Defense • Stop internal and external attacks and interruption of services • Patrol zone and edge boundaries • Control information access and usage, prevent data loss and data modification Visibility • Provide transparency to usage • Apply business context to network activity • Simplify operations and compliance reporting
- 5. Internet Partners Application Software Virtual Machines VSwitch Access Aggregation and Services CoreEdge IP-NGN Backbone Storage and SAN Compute IP-NGN Application Control (SLB+) Service Control Firewall Services Virtual Device Contexts Fibre Channel Forwarding Fabric Extension Fabric-Hosted Storage Virtualization Storage Media Encryption Virtual Contexts for FW & SLB Port Profiles & VN- Link Port Profiles & VN-Link Line-Rate NetFlow Virtual Device Contexts Secure Domain Routing Service Profiles Virtual Machine Optimization Virtual Firewall Edge and VM Intrusion Detection PhysicalVirtual Security As A System Unified Policy
- 6. UCSVirtual AccessStorage Data CenterSecurity Control Framework Multi-Layer, Distributed Model Data Center Core Layer DC Service Layer DC Access Layer Services • Initial filter for DC ingress and egress traffic. Virtual Context used to split polices for server-to-server filtering • Additional firewall services for server farm specific protection Infrastructure Security • Infrastructure Security features are enabled to protect device, traffic plane and control plane • 802.1ae and vPC provides internal/external separation Services • IPS/IDS provide traffic analysis and forensics • Network Analysis provide traffic monitoring and data analysis • Server load balancing masks servers and applicationsData security authenticate & access control Port security authentication, QoS features Virtual Firewall Real-time Monitoring Firewall Rules ACLs, Port Security, VN Tag, Netflow, ERSPAN, QoS, CoPP, DHCP snooping Security Management • Visibility • Event correlation, syslog, centralized authentication • Forensics • Anomaly detection • Compliance AD, ASDM CSM, VNMC, ACS DC Aggregation Layer
- 7. Visibility Challenges inthe Data Center High value assets and data Large, high volume throughput Multiple layers and levels of communication Virtual hosts
- 8. NetFlow 8 10.2.2.2 port 1024 10.1.1.1 port 80 eth0/1 eth0/2 StartTime Interface Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent TCP Flags 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 SYN,ACK,PSH 10:20:12.871 eth0/2 10.1.1.1 80 10.2.2.2 1024 TCP 17 28712 SYN,ACK,FIN Start Time Interface Src IP Src Port Dest IP Dest Port Proto Pkts Sent Bytes Sent TCP Flags 10:20:12.221 eth0/1 10.2.2.2 1024 10.1.1.1 80 TCP 5 1025 SYN,ACK,PSH
- 9. Network Devices StealthWatch FlowCollector StealthWatch Management Console NetFlow Users/Devices Cisco ISE NBARNSEL StealthWatch Solution Components StealthWatch FlowSensor StealthWatch FlowSensor VE NetFlow StealthWatch FlowReplicator Other tools/collectors
- 10.
- 11. Behavior-Based Attack Detection HighConcern Index indicates a significant number of suspicious events that deviate from established baselines
- 12. StealthWatch: Alarms 12 Alarms • Indicatesignificant behavior changes and policy violations • Known and unknown attacks generate alarms • Activity that falls outside the baseline, acceptable behavior or established policies
- 13. 13© 2013 Lancope,Inc. All rights reserved. Suspect Data Hoarding Unusually large amount of data inbound from other hosts Default Policy
- 14. 14© 2013 Lancope,Inc. All rights reserved. Target Data Hoarding Unusually large amount of data outbound from a host to multiple hosts Default Policy
- 15. Custom Security Events Timerange Object conditions Peer conditions Connection conditions
- 16. Custom Security Events HighLevel Use cases: • Check policy • Check for known bad conditions Examples: • IOC specific to environment • Audit compliance (ex. Users to PCI servers) • VM-to-VM communication • Inappropriate access or applications
- 17. 17 Cisco Cyber ThreatDefense Solution for the Data Center Design
- 18.
- 19. CTD Data CenterValidated Architecture Nexus 1000v Nexus 7000 StealthWatch FlowCollector StealthWatch Management Console https NetFlow Cisco NGACisco NGA Cisco ASA SPAN SPAN
- 20. Edge: ASA 20 NetFlow SecurityEvent Logging: • Provides visualization into policy enforcement points Monitor communication between branches • Efficient event reporting mechanism: • Syslog - Verbose, text based, single event per packet: ~30% processing overhead • NetFlow - Compact, binary, multiple events per packet: ~7-10% processing overhead • Context rich: • Event driven: Flow Created, Denied, tear-down • Network Address Translations • User-ID
- 21. ASA NSEL Configuration 21 ! flow-exportdestination management <ip-address> 2055 ! policy-map global_policy class class-default flow-export event-type all destination <ip-address> ! flow-export template timeout-rate 2 logging flow-export syslogs disable !
- 22. ASA Flow Table 22 Insidelocal Outside global Server User
- 23. Core: Nexus 7000& NGA 23 Nexus 7000 Cisco NGA SPAN NetFlow Generation Appliance: • 4x10 G monitoring interfaces • Non-performance impacting 1:1 NetFlow generation • NetFlow version 5, 9 and IPFIX • 80M Active Flow Cache • 200K NetFlow record export per sec
- 24. Nexus 7004 Configuration 24 ! interfaceport-channel8 description <<** NGA SPAN PORTS **>> switchport mode trunk switchport monitor ! monitor session 1 description SPAN ASA Data Traffic from Po20 source interface port-channel20 rx destination interface port-channel8 no shut
- 25.
- 26. Alternative: Physical FlowSensor 26 Nexus7000 StealthWatch FlowSensor SPAN StealthWatch FlowSensor • Multiple hardware platforms up to 20 Gbps throughout • Non-performance impacting 1:1 NetFlow generation • Recognition of over 900 Applications • URL capture • Additional statistics: • Server Response Time • Round Trip Time
- 27. Access: Nexus 1000v 27 Nexus1000v Nexus 1000v: • NetFlow as close to access as possible: complete visibility • Visibility into VM-to-VM communication (across the 1000v) • Up to 256 NetFlow interfaces; one flow monitor per interface, per direction • Cache: 256 to 16384 entries - default is 4096.
- 28. Nexus 1000v NetFlowConfig 28 feature netflow ! flow exporter nf-export-1 description <<** SEA Lancope Flow Collector **>> destination 172.26.164.240 use-vrf management transport udp 2055 source mgmt0 version 9 option exporter-stats timeout 300 option interface-table timeout 300 ! flow monitor sea-enclaves record netflow-original exporter nf-export-1 timeout active 60 timeout inactive 15 ! port-profile type vethernet enc1-3001 ip flow monitor sea-enclaves input
- 29. 29 Optional: StealthWatch FlowSensorVE capture SERVICE CONSOLEVM VM lightweight packet capture and IPFIX generation Visibility & Context: • Flow records include: • VM name • VM server name • VM State • vMotion aware • Host Profiled in terms of VM name • Application, SRT, RRT (same as physical)
- 30. 30 FlowSensor VE: VMVisbility
- 31. 31 FlowSensor VE: VMVisbility Provide VM-to-VM Policy Monitoring within the same VMware server
- 32. Summary 32 More Information: • http://www.lancope.com/ •http://www.cisco.com/go/securedatacenter • http://www.cisco.com/go/threatdefense NetFlow and the Lancope StealthWatch System provide actionable security intelligence in data centers Visibility into Data Center traffic has historically been difficult
- 33. THANK YOU 33© 2013 Lancope,Inc. All rights reserved.