Uploaded byAEC Networks
F5 Networks: architecture and risk management
The document outlines the challenges in application delivery and security, emphasizing the need for better understanding and utilization of optimization solutions across IT disciplines. It discusses various security challenges, including DDoS attacks, and the evolution of threats like hacktivism, while also detailing F5's offerings in mitigating risks and enhancing application security. Additionally, it introduces advanced technologies, such as context-aware access controls and IP intelligence, to improve overall security management in network systems.
More Related Content
Similar to F5 Networks: architecture and risk management
F5 Networks: architecture and risk management
- 1. Architecture and Risk Management HugoTovar Systems Engineer México, Central America & the Caribbean
- 2. Agenda • Application Delivery Challenges • Unified Architecture • Security Challenges • Data Center Firewall • Security Use Cases • Contextual Access Control for Mobility and BYOD • Vulnerability assessment & Application Security • Call to action 2 © F5 Networks, Inc.
- 3. “ • Application delivery and optimization solutions are underutilized and poorly understood in many IT organizations. • The skills required to fully utilize these solutions are broad and touch on multiple IT disciplines. 2011: Mark Fabbi, Distinguished Analyst “Three Phases to Improve Application Delivery Teams” 3 © F5 Networks, Inc.
- 4. Edge Gateway –Manager(GTM) – F5 Network Diagram Global Traffic Provides SSL VPN remote Automatically routes access security with applicationbest performing data acceleration connections to the Manager GatewayProvides secure, VPN remote Access Policy closest or (APM) – – Provides SSL Edge and optimization servicespolicy-based of theAscontrol. center in Local Traffic access edge accessoraother at the the eventand Manager (LTM)with application acceleration security – context-aware, of an outage, overload, full proxy between network, allusers and simplifies authentication, authorization, in one efficient, scalable, and times for users disruption. The and applicationresponsebrowsersuser connections Centralizes result is faster servers, spreads from Web Accelerator (WA) – Stops web services at the edge of the and optimization cost effective solution(AAA)clustered servers using a the BIG- across of Manager – Manager (ASM) broad Enterprise Security content Applicationnetwork, is a centralized and optimal use multiple management directlythe – An range of needlessly re-requesting dataall in one efficient, and accounting multiple pagecenters from on scalable, and techniques to secure, optimize and load devices management appliance for F5 BIG-IP® balance IP systemadvanced web applicationsolution that WAN webcost effective firewall users of server. Enables Optimizationto handle (WOM) – Speeds data servers traffic userModule more application you a applications and their data that givescritical consolidated, real-time to 10 and increases interactive performance up view protects over the enable you to dramatically simplify F5 ARX File Virtualization devicesWAN and provides high performance, transfers your entire F5 against application-specific application delivery by defending and high availability for application traffic times data management and reduce storage costs. By introducing intelligent encryption, infrastructurebypass conventional firewalls attacks that storage infrastructure, ARX eliminates the file virtualizationbetween file into the BIG-IP devices Data Manager Software – file system discovery, data profiling, disruption associated with storage administration and automates many and powerful reporting give organizations a detailed look inside storage management tasks. The result is a dramatic improvement in the environment so that better management policies can be cost, agility, and business efficiency created for a more efficient and cost-effective storage environment 4 © F5 Networks, Inc.
- 5. Top Issues forRetail Bank IT Executives… Issue Ratings: 5 = Very Important 5,00 4,50 4,00 3,50 3,00 2,50 2,00 1,50 1,00 0,50 0,00 Payments Reg impact on Core Multichannel Mobility Cloud Computing Compliance Systems Delivery Source: CEB TowerGroup; N = 11 banks, November 2011 …Align with the top IT Initiatives 5 © F5 Networks, Inc. Exhibit #: Issue 356-E1
- 6. Traditional Approach SecurityArchitecture Unified DDoS WEB APP LOAD FIREWALL PROTECTION FIREWALL BALANCER ACCESS MANAGEMENT DNS SECURITY 6 © F5 Networks, Inc.
- 7. Unified Security Architecture DNS WEB ACCESS LTM 7 © F5 Networks, Inc.
- 8. F5 – BestAlternative for SSL Acceleration Emerging security risks with 512 and 1024 length keys Support for Large SSL Keys (2048 & 4096) Cumulative Cumulative Key Size 32 Bit Commodity 64Bit Commodity Performance Slowdown Performance Slowdown 512 2,357 TPS N/A 8008 TPS N/A 1024 525 TPS 4.5x 1570 TPS 5.1x 2048 96 TPS 5.5x 273 TPS 5.8x 4096 15 TPS 6.4x 38 TPS 7.2x Key Size PB100/200 11000 Series 8900 Series 1024 58,000 TPS 120,000 TPS 58,000 TPS 2048 12,000 TPS 24,000 TPS 12,000 TPS 4096 1800 TPS 3500 TPS 1800 TPS 8 ** Note: These numbers are initial performance results © F5 Networks, Inc.
- 9. Security Challenges 54% A Denial of Service tool… using SSL/TLS showed the of hacking breaches potential for an everyday laptop in larger organizations on an average connection to occur happen at the take down an enterprise web web application server Anonymous proxies… have Threat detection today… hinges on two steadily increased, more than We still see elements: identifying suspicious activity quadrupling in number as SQL Injection as a choice point of among billions of data points, and compared to three years ago. entry for attacker refining a large set of suspicious incidents down to those that matter The most significant change we saw in 2011 was the rise of “hacktivism” against larger organizations worldwide 9 © F5 Networks, Inc.
- 10. What happened toWikiLeaks • Several companies stopped the service for WikiLeaks although it is not proven that WikiLeaks violates the existing law • Amazon removed all WikiLeaks content from their servers • EveryDNS switched off the DNS resolution for wikileaks.org • Several financial institutes locked up donation accounts 10 © F5 Networks, Inc.
- 11. Finally… • Thousand ofinternet users unloaded their accumulated anger starting 7th Dec 2010 • Web servers of Swiss Postfinance bank were down for several hours • Credit card companies like Mastercard and VISA where not accessible for several hours/day over several days • Paypal’s transaction network were slow but not taken down completely 11 © F5 Networks, Inc.
- 12. Behind the scenes • Operation Payback admitted to this attack. They are also known as Anonymous from previous attacks • They used a modified version of the tool called LOIC • Originally developed for load tests • Nearly 50,000 people downloaded it to “join voluntary botnet” • It performs a DoS or DDoS on a target site by flooding the server with TCP packets, UDP packets or HTTP requests to disrupt the service of a host 12 © F5 Networks, Inc.
- 13. How did customersleverage their ADC to address the DDoS problem? http://youtu.be/VGDN5xAHCak 13 © F5 Networks, Inc.
- 14. Slowloris, Slow POSTattack How to choke a web server slowly... Takes down a web server with minimal bandwidth Slowloris begins by sending a partial HTTP request... ...Followed by subsequent HTTP headers… …One at a time ..Very slowly... ...and never ends... Slow POST attack The data is sent very slow Server holds connection open and runs out of available connections Result – server is unavailable with no errors in the logs 14 © F5 Networks, Inc.
- 15. Everyone is vulnerable http://www.whitehatsec.com/home/resource/stats.html Data were collected from 3000 websites in 2010 The average number of serious* vulnerabilities per website, the percentage of reported vulnerabilities that have been resolved (Remediation Rate), and average the number of days a website is exposed to at least one serious vulnerability 15 (Window of Exposure). © F5 Networks, Inc.
- 16. What Has BeenMissing? BIG-IP Now Certified as Network Firewall User Access Data Protection App Security 16 © F5 Networks, Inc.
- 17. The World’s Fastestand Most Extensible Data Center Firewall 17 © F5 Networks, Inc.
- 18. What’s a DataCenter Firewall? How is it different from Conventional and NGFW? Conventional NGFW DCFW • Layer 3, 4 • Layer 7, AppID, UserID • Layer 3-7, In-bound • Mostly In-bound • Out-bound Analysis • Application Delivery • Management, • Who is doing what? • In-bound User Context Reporting • Broad but Shallow: • SSL Termination • Unaware of users, 1000 users connecting applications, context to 20,000 sites, 40,000 • Narrow but Deep: 1M protocols users 100 applications, • Used everywhere, but 6 Protocols unintelligent, ancient • Used primarily in technology Enterprise to monitor • Used by Consumer users within Banking, Social media 18 © F5 Networks, Inc.
- 19. SYN flood DC Firewall User Geolocation protection and many others Security External Users The Internet Data Center image cannot be display ed. The image cannot be displayed. Your computer may not have enough memory to open the image, or the The image cannot be The image cannot be displayed. Your computer have been corrupted. image may may not have enough memory to open the your computer, and then open Restart displayed. Your computer may not F5.com image, or the image may have been corrupted. the file again. If the red x still appears, have enough memory Restart your computer, and then openyou may have to delete the image and the file to open the image, or again. If the red x still appears, you may have to it again. then insert delete the image and then insert it again. the image may have been corrupted. owa.f5.com Restart your computer, and then DevCentral.F5.com open the file again. If Internet the red x still appears, you may have to delete the image and then insert it again. websupport.f5.com Router ihealth.f5.com High Concurrent Connection downloads.F5.com capacity • F5 helps you to mitigate DDoS and flood based attacks • Stateful, Default Deny Behavior • High Concurrent Connection and conn/sec capacity • User Geo-location awareness • SSL (HW accelerated encryption/decryption) • IPsec site to site • Packet Filtering • Flood protection mechanisms 19 • Carrier Grade NAT (NAT, NAT64) © F5 Networks, Inc.
- 20. Mitigating DoS Attacks Protect Against: Protect With: Network Based Distributed Denial Of Service (DDOS) VIPRION BIG-IP LTM DoS Protections • Packet Filtering • Syn Cookies (L4 DoS) • Dynamic Reaping (L4 DoS) • TCP Full Proxy (L4 DoS) • Rate shaping (L4->L7 DoS) • iRules (e.g. SSL DoS protection) • Very High Performance • Very large connection tables 20 © F5 Networks, Inc.
- 21. Securing and ScalingDNS Services 21 © F5 Networks, Inc.
- 22. Authoritative DNS Security Basic GSLB Securing DNS Servers Delegation Overview • Traditional firewall • DNS server farm • Global Server Load Balancing DNS Servers Limitations • Vunerable to DNS Attacks • No response validation • Inability to scale GTM 22 © F5 Networks, Inc.
- 23. Authoritative DNS Security GTM Inline or Securing DNS Infrastructure slave Overview • Consolidated Device • Firewall Service • DNS Service • Anycast DNS Server Benefits • High Performance DNS • Scalable DNS GTM • Dynamic DNSec Signing • DDoS Resistent 23 © F5 Networks, Inc.
- 24. DNSSec Wrapping http://youtu.be/566EmH3H32A 24 © F5 Networks, Inc.
- 25. Context Based AccessControl For Mobility And BYOD 25 © F5 Networks, Inc.
- 26. Context leverages informationabout the end user to improve the interaction Who • Who is the user? What • What devices are requesting access? Where • Where are they coming from? • When are they allowed to access? When • How did they navigate to the page/site? How 26 © F5 Networks, Inc.
- 27. Securely Manage Access The image cannot be displayed. Your computer may not have enough memory to open the image, or the DMZ image may have been corrupted. The image F5 Access Policy Manager Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and canno then insert it again. t be displa yed. Your comp Hypervisor 4,000 Remote Users Internet Virtual Desktops The image cannot be displayed. The image cannot Your computer be displayed. may not have Your computer enough memory may not have enough memory to open the image, or the image may have The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and The image cannot be 1,000 Wireless Users then open the file again. If the red x still appears, you may have to delete the image and then insert it again. displayed. Your computer may The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your Internal LAN The image computer, and then open the file again. If cannot be VLAN 1 the red x still appears, displayed. Your The computer may image not have cannot enough be memory to displayed open the . Your image, or the compute image may r may have been not have corrupted. enough memory Utilize existing user directory 15,000 Corporate Users Internal LAN • High performance – 26,000 users at $7+ per user VLAN 2 The • Scale up to 100,000 users Th imag ee im cann ag ot be • Flexible and centralized security policy management displ ayed. Your • Integrated endpoint security checking 6,000 Corporate Branch Users • Secure Single Sign-on 27 © F5 Networks, Inc.
- 28. BYOD Trust Model • The trust level of a mobile device is dynamic • Identify and evaluate the risk of personal devices • Review the value of apps and data • Define remediation options • Notifications • Access control • Quarantine • Selective wipe • Set a tiered policy 28 © F5 Networks, Inc.
- 29. Use Case Access with baseline security, no MDM APM/ASM Kerberos SSO þ Certificate Resources Check þ UUID Check Request ticket Exchange Active Directory 29 © F5 Networks, Inc.
- 30. Use Case Normal access with MDM, VPN on-demand two-factor authentication APM/ASM Kerberos SSO þ Certificate Check þ UUID Check Request ticket Active Directory Two factors: • Pin • Certificate MDM (Mobile Device Management) (Mobile Iron, Airwatch, Silverback and Zenprise) 30 © F5 Networks, Inc.
- 31. Use Case Managed and BYOD access combines UUID check with ACLs ACLs APM/ASM Unmanaged devices get limited access þ Certificate Check ý UUID Check Managed devices get full access MDM Active Directory 31 © F5 Networks, Inc.
- 32. Use Case –BBC (BYOD Project) First access with MDM, new enrollment with self-service APM/ASM Verify credentials ý Certificate Check AAA þ Username/ SSO Password Device data When cert check fails, APM Optional OTP Certificate will proxy access to MDM’s (One Time Password) registration registration page Provisioning OTP sent via SMS or email; • Apps MDM adds two-factor security • Certificates (Mobile Device • Profiles Management) Provisioning via MDM “phone home” 32 © F5 Networks, Inc.
- 33. Vulnerability Assessment andWeb Application Security 33 © F5 Networks, Inc.
- 34. IP Intelligence Reputation Scanners Deny access to infected IPs Probes, scans, brute force Windows Exploits Denial of Service Known distributed IPs DoS, DDoS, Syn flood Web Attacks Phishing Proxies IPs used for SQL Injection, CSRF Phishing sites host BotNets Anonymous Proxies Infected IPs controlled by Bots Anon services, Tor 34 © F5 Networks, Inc.
- 35. IP Intelligence: DefendAgainst Malicious Activity and Web Attacks Enhance automated application delivery We need to approach decisions adding better intelligence and stronger security different security based on context. Layer of IP threat protection delivers context to identify and block IP threats using a dynamic data set of high-risk IP addresses. Visibility into threats from multiple sources leverages a global threat sensor network Deliver intelligence in a simple way reveals inbound and outbound communication Evolving Threats Real-time updates keep protection at peak performance refreshing database every five minutes. 35 © F5 Networks, Inc.
- 36. IP Intelligence • Fast IP update of malicious activity • Global sensors capture IP behaviors • Threat correlation reviews/ blocks/ releases Key Threats Sensor Techniques IP Intelligence Service: Threat Correlation Internet Semi-open Proxy Farms Dynamic Threat IPs Web Attacks every 5min. Exploit Honeypots Reputation Windows Exploits Naïve User Simulation IP Intelligence Botnets Web App Honeypots Scanners Network Attacks Third-party Sources DNS BIG-IP System 36 © F5 Networks, Inc.
- 37. IP Intelligence Botnet IP Intelligence Service IP address feed updates every 5 min Attacker Custom Application Financial Application BIG-IP System Anonymous requests ? Geolocation database Anonymous Internally infected Proxies devices and servers Scanners • Use IP intelligence to defend attacks 37 • Reduce operation and capital expenses © F5 Networks, Inc.
- 38. Unknown Vulnerabilities inWeb Apps • Unable to find or mitigate vulnerabilities • Very expensive to fix by recoding • Difficult to include scanner assessments • Need assurance that app sec. is deployed properly Web Application Vulnerabilities as a percentage of all disclosures in 2011 H1 Web Applications: 37 percent Others: 63 percent Source: 1BM X-Force Research and Development 38 © F5 Networks, Inc.
- 39. Leading Web ApplicationAttack Protection BIG-IP Application Security Manager Users o Protect from latest web threats Web Application o DDoS, SlowLoris, & more BIG-IP ASM Security o Quickly resolve vulnerabilities o Meeting PCI compliance Web Applications Private Public Physical Virtual Multi-Site DCs Cloud 39 © F5 Networks, Inc.
- 40. Protect Applications fromThreats Adaptive and unique attack protection Gain visibility Understand Take action into application session context and mitigate sessions and apply policy offending clients 40 © F5 Networks, Inc.
- 41. Automatic DOS AttackDetection and Protection o Accurate detection technique – based on latency o 3 different mitigation techniques escalated serially o Focus on higher value productivity while automatic controls intervene Detect a DOS condition Identify potential attackers Drop only the attackers 41 © F5 Networks, Inc.
- 42. Open Web ApplicationSecurity Project (OWASP) OWASP Top 10 Web Application Security Risks: 1. Injection 2. Cross-Site Scripting (XSS) 3. Broken Authentication and Session Management 4. Insecure Direct Object References 5. Cross-Site Request Forgery (CSRF) 6. Security Misconfiguration 7. Insecure Cryptographic Storage 8. Failure to Restrict URL Access 9. Insufficient Transport Layer Protection 10. Unvalidated Redirects and Forwards 42Source: www.owasp.org © F5 Networks, Inc.
- 43. Out-of-the-Box Deployment No false positives Fast web application Learning mode implementation • Gradual deployment • Rapid deployment • Transparent or semi- policy transparent • Pre-configured • Manual or automatic application policies • Full blocking policies 43 © F5 Networks, Inc.
- 44. Meet PCI Compliance Easily comply with audits PCI reporting provides: • Requirements with details • Current compliancy state • Steps to become compliant 44 © F5 Networks, Inc.
- 45. 45 © F5 Networks, Inc.
- 46. Solution: Quickly ResolveApplication Vulnerabilities Request made BIG-IP ASM security policy checked Server response Enforcement Sensitive information, application cloaking Secure response BIG-IP ASM applies Vulnerable delivered security policy application • Maintain security at application, protocol, and network levels • Launch secure applications protected from vulnerabilities 46 © F5 Networks, Inc.
- 47. “ F5 BIG-IP products enabled us to improve security for an existing application instead of having to invest time and money into developing a new, more secure application. Application Manager, Global 500 Media and Entertainment Company TechValidate 0C0-126-2FB 47 © F5 Networks, Inc.
- 48. Integrated Vulnerability Scanning Customer Website Vulnerability Scanner • Finds a vulnerability • Virtual-‐patching with one-‐click on BIG-‐IP ASM • Vulnerability checking, detecDon and remediaDon BIG-‐IP ApplicaAon Security Manager • Complete website protecDon • Qualys • IBM • WhiteHat • Cenzic • Verify, assess, resolve and retest in one UI • AutomaDc or manual creaDon of policies • Discovery and remediaDon in minutes 48 © F5 Networks, Inc.
- 49. Free App ScanService to Mitigate Vulnerabilities • Free application vulnerability scan: • Cenzic Cloud in ASM UI • 3 free scans • Configure vulnerability Data Center policy in BIG-IP ASM • Protection from web app attacks BIG-IP Application Security Manager Web 2.0 Apps Attacker Internet Private BIG-IP Application Security Manager Cloud Apps Virtual Edition Clients 49 © F5 Networks, Inc.
- 50. The most flexiblesolution 50 © F5 Networks, Inc.
- 51. F5 Value toFSI Employ Using F5’s intelligent approach to IT as a Service application delivery Simplify your infrastructure through F5’s ability to streamline and automate existing network investments. Reduce threats and simplify security by taking advantage of F5’s unified security capabilities. Get world-class business continuity through Transform IT F5’s built-in disaster recovery and high availability capabilities Secure 51 Agility © F5 Networks, Inc.
- 52. Call to action The load balancer is dead - leverage your ADC as a strategic Point of Control http://youtu.be/Sh8mNjeuyV4 52 © F5 Networks, Inc.
- 53. © 2012 F5Networks, Inc. All rights reserved. F5, F5 Networks, the F5 logo, and IT agility. Your way., are trademarks of F5 Networks, Inc. in the U.S. and in certain other countries. Other F5 trademarks are identified at f5.com. Any other products, services, or company names referenced herein may be trademarks of their respective owners with no endorsement or affiliation, express or implied, claimed by F5.
- 54. 54 © F5 Networks, Inc.