Downloaded 31 times
Uploaded byChris Sparshott
FaceTime Web 2.0
The document discusses how the internet has become more complex with the rise of unified communications, collaboration tools, and social networking. It notes that information leakage is a top concern for IT professionals. The document also outlines requirements for securely enabling new internet applications, including visibility and control of real-time apps, comprehensive malware protection, and granular policy enforcement. FaceTime's unified security gateway aims to meet these requirements through application identification, inspection, policy enforcement, and archiving capabilities.
More Related Content
![[Infographic] Data Loss Prevention](https://cdn.slidesharecdn.com/ss_thumbnails/dlpinfographicseqrite-171201072326-thumbnail.jpg?width=640&height=640&fit=bounds)
![[Infographic] 7 Cyber attacks that shook the world](https://cdn.slidesharecdn.com/ss_thumbnails/7cyberattacksthatshooktheworldpdf-170811112633-thumbnail.jpg?width=640&height=640&fit=bounds)
FaceTime Web 2.0
- 1. Enable and Securethe New Internet
- 2. The Internet hasChanged and getting more Complex (from text & file sharing to Unified Communications and Collaboration) Capabilities Network Behavior IM IM Aggregators Public IM VoIP Web Conferencing File Sharing Video Multimedia Text Chat Evasive Good Anonymizers Unified Communications Social Networking
- 3. The Social Generation:Networking or Not Working Survey conducted in May/June 2009 Focus on Web2.0 with emphasis on social networking Target: IT Professionals (Email, Social Networks) 1199 respondents 43% represented organisations with greater than 1000 employees 65% of respondents use Social Networking at least once or twice per week Less than 15% don’t use it at all
- 4. Key Findings –your biggest concern Biggest concern is Information Leakage
- 5. The Internet hasChanged Actual customer traffic history (~80 USGs) Representing all Internet activity from over 100K end users IT is underestimating application use by employees
- 6. Social Networking atWork 39% log into Social Networks at least once a day But 13% never use sites such as Twitter, Facebook and LinkedIn Nearly 40% believe their employees are using Social Networking sites for between 1-5 hours/week 46% of respondents view Social Networking as having some business value. 73% view virtual worlds (such as Second Life) as having “no business value” – 58% feel same about IPTV and 45% about iTunes
- 7. Concerns and Attitudesabout Social Networking It should only be allowed if it can be controlled (43%) It is critical to business (3%) It should be banned in the workplace (10%) Benefits cited 1. Better employee communications 2. Faster decision times due to collaboration 3. Improved marketing communications 4. Improved customer service and support 5. Lead generation for sales 6. Increased productivity 7. More efficient recruiting 8. Effective analyst relations
- 8. These Applications areHighly Evasive IM Sessions P2P Sessions 13 unique networks 25,000+ connections 19GB of Traffic 9 applications Nearly 10,000 sessions 20 GB of Traffic Proxy bypass apps Goal: Enable ubiquitous access to create a positive end-user experience Port Hopping Yahoo runs over port 23 when the native port is blocked Port/Protocol Tunneling MSN/Yahoo/AIM over HTTP, WebEx, etc. P2P/Onion Routing MSN Peer to Peer for file sharing, Skype/TOR use Onion Routing Encryption Skype, GoogleTalk, AIM Pro encrypt their payload contents Random Session Behavior Skype
- 9. Which Present SignificantRisks When Unmanaged Information Leakage Increasingly Complex Viruses, Malware, SPIM Inappropriate Content Commercially Motivated Intellectual Property Credit Card #, Personal Data, Social Security / NI # Employee Productivity Corporate AUP SEC 17a, FSA, HIPAA, SOX, GLBA, NASD, MiFiD Compliance and eDiscovery Bandwidth Explosion / Cost
- 10. Key Requirements forSecuring the New Internet Visibility and control of all real-time applications Detect and control network evasive applications Web, IM, P2P, VoIP, social networks Comprehensive malware protection against new threats Rootkits, worms, spyware, adware, botnets Automated updates and Day Zero capabilities Web and URL filtering Monitor and control employee web use High efficacy with minimal latency “ URL Filtering will be cannibalized by a broader Secure Web Gateway Market.” - Peter Firstbrook, Gartner, July 2008 “ FaceTime is an outstanding choice for organizations looking for fine-grained Web communication application controls”
- 11. Unified Communications Today– Heterogeneous Silos Workspace Client IM Client Email Client VoIP Client Conf Client Identity (Active Directory) Presence Policy Reporting Presence Policy Reporting Presence Policy Reporting Presence Policy Reporting Presence Policy Reporting Ad-hoc
- 12. FaceTime’s Vision ofUnified Communications Security Presence, Identity & Federation Policy & Management Reporting Compliance
- 13. Regulatory Compliance NASD,SEC, FERC regulations mandate archiving and review of all communications PCI, HIPAA regulations mandate tight control over confidential information eDiscovery allows all ESI to be discoverable in courts Information Control Control information flows across myriad channels such as IM, P2P, Web 2.0 Enforce communication boundaries in contact centers, on trading desks, etc. Security Block malware and SpIM especially across multiple channels and federation boundaries “ Must-Have” Requirements for UC and Web 2.0
- 14. Key Requirements forSecure Web Gateway Application Control Granular, policy-based control of applications, such as IM, P2P, public voice over IP (VoIP), blogs, data-sharing portals, Web conferencing, chat, etc. Selectively block or manage features of applications based on numerous policy parameters and the presence of pre-developed policies to simplify deployment. URL Filtering Databases of known Web sites categorized into groups to enforce acceptable usage and productivity and to reduce security risks. Malware Filtering Filtering malware from all aspects of inbound and outbound Web traffic using signature-based malware filtering and non-signature-based techniques as well as the range of inspected protocols, ports and traffic types. End-point management Identification of infected PCs and the infection by name and enable prioritized remediation Manageability/Scalability Mature management interface, consolidated monitoring and reporting capability, and role-based administration capability. Source: Gartner Secure Web Gateway Magic Quadrant, June 2007
- 15. Unified Security Gateway- Secure & Enable the New Internet Unified Comms Web 2.0 URLFiltering Application Control Engine Enablement Visibility, Application Control & Enforcement Malware SocialNets Over 2000 Applications IM P2P Streaming Social Networking. Gateway Prevention Gateway Detection Enterprise class URL database Level 10: Extremely dangerous Management and Reporting
- 16. Web Filtering &Anti-malware Application Control (>2,000 apps) Social Networking Control UC Enablement: Sec, Mgmt & Compliance Granular Policy Control: By User / Group Time of Day Time Quota Bandwidth Pass-by Deployment Ensures Zero Latency Unified Security Gateway End Users Egress Switch Internet LDAP/AD Anti-Virus Archiving
- 17. USG Architecture –Security and Enablement Pg. SSH Access Dedicated Mgmt/Proxy port services 2/3 Port Options Cent OS Locked down services Common Scripting Attack tested High Fidelity Greynet Enforcement and Enablement Signature/Behavior based analysis Control Clear or Encrypted traffic Day Zero, SpIM, Content Filtering User/Group level policies with inheritance User Authentication LDAP integration with auto-synchronization Physical Port Security/Flexibility Hardened FT OS State-of-the-art Application Inspection IM P2P Malware Web Hierarchical User/Group Policy
- 18. The USG Family– Small Business to Large Enterprise USG1030 USG220 USG320 USG530 Performance 250 1,000 5,000 Max Users Corporate Headquarters Max Throughput 100Mbps 200Mbps 400Mbps 10,000 600Mbps Small Business & Remote Offices
- 19. FaceTime’s Mission Helpbusinesses realize the benefits of The New Internet by delivering enterprise solutions that provide Unified Security, Management and Compliance across the broadest set of applications and modalities. Block worms, viruses, spIM, malware Protect intellectual property Security Complete visibility over network traffic Apply powerful and granular policies Visibility & Control Tamper-proof archiving and auditing Detect and prevent data leakage Compliance
- 20. About FaceTime CommunicationsFocus: Secure and Enable the New Internet Longest track record in securing Internet apps such as IM, P2P Ranked No.1 in IM Security for 5 consecutive years by IDC Partner with Microsoft, IBM, Skype, MSN, AOL, Google, Yahoo Visionary in Gartner Web Security Quadrant Global operations USA, EMEA, India, Asia Pacific Supporting major global enterprises 9 of the top 10 US banks More than 5m managed users in over 1,500 organizations Natural progression to Web 2.0 applications From IM & P2P to social networking, microblogging etc. FaceTime Security Labs 8 years experience in real-time applications research Widest coverage available for Internet applications
- 21. FaceTime is MissionCritical for Today’s Enterprises Over 1,500 customers and 7+ Million seats deployed Financial Services & Insurance Manufacturing & Consumer Technology & Telecommunications Energy & Healthcare
- 22.
- 23. Real Time CommunicationsApplications – Masters of Evasive Techniques Goal: Enable ubiquitous access to create a positive end-user experience Methods (exhibited by most real-time applications): Port Hopping Exhibit a non-deterministic behavior by altering application port usage Bypass access-control policies that look for applications on “well-known” ports Examples: Yahoo runs over port 23 when the native port is blocked Port/Protocol Tunneling Masquerade IM/P2P traffic over common protocols such as HTTP, FTP Examples: MSN/Yahoo/AIM over HTTP, WebEX, etc. P2P/Onion Routing Enables pseudonymous (or anonymous) communication Messages travel from source to destination via a sequence of proxies ("onion routers"), which re-route encrypted messages in an unpredictable path Examples: MSN Peer to Peer for file sharing, Skype/TOR use Onion Routing Encryption Prevents content visibility and control Examples: Skype, GoogleTalk, AIM Pro encrypt their payload contents Random Session Behavior Alters anticipated session content information such as payload/packet size/rate Examples: Skype
- 24. USG: Purpose-builtfor the New Internet Identification Inspection Enablement Application Control Engine™ Application Identification Uses well-defined port/ protocol for IM Application Activity User traffic For User: Joe in Sales Allow only native MSN & within IM allow only PDF file transfers after AV scanning However, uses P2P protocol for file transfer within IM Policy Enforcement & Logging Packet Assembly Granular Policy Control Application Activity Identifier Signature Analysis Behavioral Analysis Port/Protocol Analysis
- 25. USG: Management, Security& Compliance For Greynets Web Filtering Support for 3 URL databases Integration with AD & LDAP Role Based Access Control Policies at global, group, user levels Pre-defined and custom reports Reporting and integration with 3 rd party reporting apps Malware Control Day Zero worm blocking Enhanced SPIM blocking and challenge/response capabilities Real-time content leakage prevention Targeted remediation of infected endpoints AV scanning of file transfers Standardization on EIM/UC Archival & Compliance Selective or global archival of messages and files in database Full Capture of Meta Data and Rich Text Full binary message capture Message anti-tampering checksums Easy identification and retrieval of specific IM conversations Strict archiving into email/WORM storage Rich reporting and workflow, including audit reports Application Control Support for 600+ greynet applications Management of OCS & Sametime Granular controls for Skype Integration with AD & LDAP Role Based Access Control Policies at global, group, user levels Group level ethical boundaries File transfer restrictions Web Filtering Malware Control Application Control Archival & Compliance
- 26. USG: Optimized ForSkype Identification Inspection Enablement Application Identification Port hopping Random session behavior Application Activity User traffic For User: John in Marketing Allow Skype only for users in marketing group Policy Enforcement & Logging Greynet Dissector Packet Assembly Granular Policy Control Application Activity Identifier Signature Analysis Behavioral Analysis Port/Protocol Analysis Identify users
- 27. USG: Optimized ForGreynets – Public IM Application Identification Uses well-defined port/ protocol for IM Application Activity User traffic For User: Joe in Sales Allow only native MSN & within IM allow only PDF file transfers after AV scanning However, uses P2P protocol for file transfer within IM Policy Enforcement & Logging Identification Inspection Enablement Greynet Dissector Packet Assembly Granular Policy Control Application Activity Identifier Signature Analysis Behavioral Analysis Port/Protocol Analysis
- 28. Granular Policy andReporting Enhanced Policy Framework Policy Objects Create a policy once, apply it many times to Groups/Employees Time of Day Policies Block all IM, P2P and Web access for the “Entertainment” and “Sports” categories except during lunch hours from Monday to Friday Time based User Quotas Allow access to Proxy IM, and Web traffic for only X hours per week Bandwidth based User Quotas Allow access to Passby IM, P2P, Greynet and Web traffic as long as traffic is within the bounds specified by IT Enhanced reporting Browse time reports for URL Filtering Sorting reports by Hits and Byte Counts Central Aggregation of reporting data from multiple geo-diverse USGs
- 29. Example Policies forInternet Apps Application / Policy Allow/ Block Groups Content Control Time of Day Quota Max Bandwidth MSN Allow ALL AV, ILP, Logging ALL ALL ALL GoogleTalk Allow LEGAL AV, ILP, Logging 8am - 6pm All ALL All other IM Block NONE N/A N/A N/A N/A Skype Allow SALES N/A ALL ALL 1% BitTorrent Allow IT N/A ALL 4 hours 2% All other P2P Block NONE N/A N/A N/A N/A IPTV Block NONE N/A N/A N/A N/A Anonymisers Block NONE N/A N/A N/A N/A Webex Allow ALL N/A 8am - 6pm 4 hours 2% All other Web Conf Block NONE N/A N/A N/A N/A
- 30. Unified Security GatewayDeployment Topology Unified Security Gateway LDAP WORM Archive Policies Audit DMZ Egress Switch FaceTime Security Labs Block Unauthorized IM/P2P Gateway Malware Prevention Web Filtering IM Security & Compliance User Policy Enforcement Logging & Auditing Greynet Protocols Malware Signatures Auto Updates of Greynets Database P2P LAN/WAN Perimeter Internet Public IM! Spyware/ Adware Unauthorized Public IM VoIP http://badurl.com/ Network Greynet Database Enterprise IM
Editor's Notes
- #3 Facebook. Adding 1000 apps per month; 2000 are messaging related A major investment bank customer of ours estimates over 50% have a facebook acct Bell Canada has over 2000 employees using FaceBook
- #4 New generation of Internet users are coming into our organization. A recent Survey
- #5 When speaking to key administrators during the survey the following were of concern: Brand awareness Productivity of Staff – to much social activity Security – backdoor attacks via Malware / Worms – unsecured P2P and IM channels Information Leakage biggest concern
- #10 Inbound Threats: Productivity Loss Broad new vectors for Malware distribution (Viruses, Worms, Spyware & Rootkits) Outbound Threats: Information Leakage Create holes for corporate & user information leakage Intellectual property loss User privacy concerns Corporate and Regulatory Non – Compliance Exposure : Invisible information channels Legal & Financial Risks
- #11 Gaps in other security products – talk here
- #16 FTOS: Purpose built for greynet applications Hardening the Linux shell Regulating the use of ports Preventing remote connections to the OS Greynet Traffic Detection: HTTP and real-time communication applications Detect applications that are port/channel agnostic, tunnel through HTTP, etc. Total visibility of all Internet traffic Policy Enforcement Engine Set, enforce polices and manage access for all channels Set and enforce policies at company, group and user levels for HTTP Centralized Management and Reporting Easy to use browser based management interface for all Internet channels Pre-defined and custom report generation capability Integration with 3rd party reporting applications
- #18 09/08/09
- #24 Port Tunneling Enables the masquerading of IM/P2P traffic over popular protocols such as HTTP, Telnet, FTP which are typically allowed through Firewalls for business applications Application Level Firewalls can perform limited inspection for basic IM and P2P protocols, but keeping up with proprietary implementations is a challenge Random Session Behavior / Port Hopping Exhibit a non-deterministic behavior to bypass access-control policies on traditional security devices that look for applications on “well-known” ports Security administrators need complete knowledge of all the ports on which the application can “hop” over, and keep up with the increasing sophistication of these applications Onion Routing The goal of Onion Routing (OR) is to protect the privacy of the sender and recipient of a message, while also providing protection for message content as it traverses a network. Onion Routing accomplishes this according to the principle of Chaum's Mix Cascades : messages travel from source to destination via a sequence of proxies ("onion routers"), which re-route messages in an unpredictable path. To prevent an adversary from eavesdropping on message content, messages are encrypted between routers. The advantage of Onion Routing (and Mix Cascades in general) is that it is not necessary to trust each cooperating Router; if one or more routers are compromised, anonymous communication can still be achieved. This is due to the fact that each Router in an OR network accepts messages, re-encrypts them, and transmits to another Onion Router. An attacker with the ability to monitor every Onion Router in a network might be able to trace the path of a message through the network, but an attacker with more limited capabilities will have difficulty even if he or she controls one or more Onion Routers on the message's path. Encryption Ensures privacy of message contents between end-points Bypasses traditional security measures
- #25 Incoming traffic packets are captured and reassembled for further analysis by the Traffic Analyzer. (This part is similar to any network security device) Once reassembled, the traffic goes through the App Dissector Engine – this is our secret sauce. This engine includes two processes: The traffic goes through signature, behavioral and protocol analyses to identify the application. This is where app is identified based on ports/protocols and the behavior it exhibits on the network. Since greynets are highly evasive on the network, a combination of signature and stateful inspection of the traffic is necessary to accurately id the application. For e.g. Skype, a P2P application may use port 80 or any other port. Understanding the behavioral aspect (port hopping, packet alteration/sequencing, etc.). Once the application has been identified, the dissector then identifies the actual activity of the application – whether it is a file transfer happening over IM or just plain IM conversation. This is important as some of the IM apps like MSN use P2P protocol for file transfer – different than the native protocol used for IM conversation. Following the identification of the app activity, the appropriate policy for it is applied based on user that initiated that traffic resulting in allowing (with controls) or blocking the traffic.
- #26 Incoming traffic packets are captured and reassembled for further analysis by the Traffic Analyzer. (This part is similar to any network security device) Once reassembled, the traffic goes through the App Dissector Engine – this is our secret sauce. This engine includes two processes: The traffic goes through signature, behavioral and protocol analyses to identify the application. This is where app is identified based on ports/protocols and the behavior it exhibits on the network. Since greynets are highly evasive on the network, a combination of signature and stateful inspection of the traffic is necessary to accurately id the application. For e.g. Skype, a P2P application may use port 80 or any other port. Understanding the behavioral aspect (port hopping, packet alteration/sequencing, etc.). Once the application has been identified, the dissector then identifies the actual activity of the application – whether it is a file transfer happening over IM or just plain IM conversation. This is important as some of the IM apps like MSN use P2P protocol for file transfer – different than the native protocol used for IM conversation. Following the identification of the app activity, the appropriate policy for it is applied based on user that initiated that traffic resulting in allowing (with controls) or blocking the traffic.
- #27 Incoming traffic packets are captured and reassembled for further analysis by the Traffic Analyzer. (This part is similar to any network security device) Once reassembled, the traffic goes through the App Dissector Engine – this is our secret sauce. This engine includes two processes: The traffic goes through signature, behavioral and protocol analyses to identify the application. This is where app is identified based on ports/protocols and the behavior it exhibits on the network. Since greynets are highly evasive on the network, a combination of signature and stateful inspection of the traffic is necessary to accurately id the application. For e.g. Skype, a P2P application may use port 80 or any other port. Understanding the behavioral aspect (port hopping, packet alteration/sequencing, etc.). Once the application has been identified, the dissector then identifies the actual activity of the application Following the identification of the app activity, the appropriate policy for it is applied based on user that initiated that traffic resulting in allowing (with controls) or blocking the traffic.
- #28 Incoming traffic packets are captured and reassembled for further analysis by the Traffic Analyzer. (This part is similar to any network security device) Once reassembled, the traffic goes through the App Dissector Engine – this is our secret sauce. This engine includes two processes: The traffic goes through signature, behavioral and protocol analyses to identify the application. This is where app is identified based on ports/protocols and the behavior it exhibits on the network. Since greynets are highly evasive on the network, a combination of signature and stateful inspection of the traffic is necessary to accurately id the application. For e.g. Skype, a P2P application may use port 80 or any other port. Understanding the behavioral aspect (port hopping, packet alteration/sequencing, etc.). Once the application has been identified, the dissector then identifies the actual activity of the application – whether it is a file transfer happening over IM or just plain IM conversation. This is important as some of the IM apps like MSN use P2P protocol for file transfer – different than the native protocol used for IM conversation. Following the identification of the app activity, the appropriate policy for it is applied based on user that initiated that traffic resulting in allowing (with controls) or blocking the traffic.
- #31 BEST PRACTICES DEPLOYMENT 1: Deploy FTEE to ensure compliance and security Guarantee compliance with TrueCompliance TM Stop worms and viruses and block SPIM Stop rogue IM & P2P and block circumvention at the perimeter 2: Monitor and analyze usage patterns Who is using what networks? What features are being used? File transfer, VoIP, app sharing, etc. How much and what P2P usage is going on? 3: Formulate usage policies By user, network and capabilities 4: Implement and enforce policies IMA for logging and audit workflow RTG to control non-compliant use