Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (17)
Destacado
Destacado (6)
Similar a Road show chile 2010 v2
Similar a Road show chile 2010 v2 (20)
Último
Último (20)
Road show chile 2010 v2
- 1. Security Roadshow Chile, Diciembre 2010
- 2. Agenda Institucional Logicalis Historia de la Seguridad de la Información Esquemas de redes Presentación Ironport BestPractices
- 3. Antonio Díaz Engineering Manager / Chile Institucional Logicalis
- 4. Acerca del Grupo Logicalis Proveedor global de soluciones y servicios integrados de Tecnologías de la Información y las Comunicaciones – TIC- con foco en Colaboración, Data Centers, Servicios gerenciados y profesionales. Casa matrizen UK y operaciones en Europa, EstadosUnidos, América Latina y Asia Pacífico*. Ventas mayores a 1.000 millones de dólares. Más de 1.900 empleados en el mundo Más de 6.500 clientes a nivel global: corporativos, de sector público y de telecomunicaciones. Fuertes partnerships globales con empresaslíderes del mercadotecnológico. * En diciembre de 2009 Logicalis completó la adquisición de NetStar, integrador de sistemas actuando en Taiwan, Hong Kong, Malasia, Australia y Singapur
- 5. Grupo Logicalis – Presencia Internacional 5 (1) Ingresos de PLLAL, joint venture entre el Grupo Logicalis y Promon S.A. (2) Representa 6 semanas de facturación en el FY2010 de Logicalis Group. 5
- 6. Cobertura en América Latina Joint venture del grupo Logicalis y el grupobrasileñoPromon. Brasil San Pablo Río de Janeiro Brasilia Perú Lima Paraguay Asunción Chile Santiago Uruguay Montevideo Argentina Buenos Aires Córdoba Rosario Oficinas con apertura en FY11
- 8. 12 años consecutivos como GoldPartner de Cisco.
- 12. Cisco Authorized SP Video Partner
- 13. Cisco Learning Solution Partner
- 14. Advanced Data Center Networking Infrastructure
- 15. Advanced Data Center Storage Networking
- 16. Advanced Routing & Switching
- 20. ATP - Cisco TelePresence Satellite
- 21. ATP – Data Center Unified Computing Satellite
- 22. ATP - Outdoor Wireless Mesh Satellite
- 23. ATP – WiMAX Satellite
- 24. ATP - Customer Voice Portal
- 25. ATP - Unified Contact Center Enterprise
- 26. ATP - Video Surveillance
- 27. WebEx Commission Pilot Program
- 28. Managed Services Certified Partner Advanced
- 30. LATAM Technology Excellence Partner of the Year – Virtualisation
- 31. LATAM Enterprise Partner of the Year
- 32. Brasil Technology Excellence Partner of the Year Virtualisation
- 33. Brasil Service Provider Partner of the Year
- 36. Visión y Posicionamiento Business and Technology Working as One PERSONAS PROCESOS INFORMACIÓN Aportar visión de negocios al proceso de toma de decisiones en el ámbito tecnológico
- 38. Visión consultiva del negocio
- 40. Monitoreo
- 41. Resolución de incidentes
- 43. Full operation
- 45. Training
- 46. Servicios profesionales y técnicos
- 47. Integración e implementación de soluciones- Project management
- 48. Nuestras Soluciones y Servicios El portfolio de Logicalis tiene como fin ayudar a nuestros clientes a utilizar la tecnología para acompañar y conducir sus procesos estratégico de negocio, a través de skills avanzados, productos líderes y experiencia comprobada. BUSINESS & TECHNOLOGY CONSULTING Access and Transport Technologies Information Security Networks & Systems Management Networking IT COMMUNICATIONS Collaboration, Voice and Video Data Centers ADVANCED SERVICES Managed Services, Training, Operations and Maintenance
- 53. Ambev (Argentina, Bolivia, Paraguay)
- 55. Banco Santander (Argentina, Uruguay, Brazil, Chile)
- 56. Red Clara (Argentina, Chile, Peru, Mexico, Brazil, Panama)
- 59. Ford Motors (Argentina, Chile)
- 62. Citibank (Argentina, Chile, Paraguay, Perú)
- 63. BHP (Chile)
- 64. Shell (Chile, Centro America , El salvador, Guatemala, Mexico, Honduras)
- 66. Asea Brown Boveri (ABB)
- 67. CelulosaArauco
- 68. Repsol YPF (Argentina, Peru, Brasil, Chile, Ecuador, Venezuela, Trinidad y Tobago, USA, Canadá)
- 69. General Motors (Argentina, Brasil)
- 70. Claro (Argentina, Brasil, Chile, Paraguay)
- 71. PetrobrasEnergía (Argentina, Brasil, Paraguay, Uruguay, Peru)
- 72. Telmex (Argentina, Brasil, Chile)
- 73. Telefónica (Argentina, Brasil, Chile, Uruguay, Peru)
- 74. HSBC (Argentina, Paraguay, Chile, Peru)
- 76. BancoItaú (Argentina, Brasil, Paraguay, Uruguay)
- 77. British American Tobacco (Chile)
- 84. Cerrando con llave donde se encontraba la computadora alcanzaba para brindarle seguridad
- 85. Los sistemas eran altamente complejos de operar
- 86. Comenzaron a producirse en 1946
- 87. En 1961 se instaló la primer computadora en Chile, un IBM 1401 para el servicio de Aduanas de Valparaiso18
- 89. Inicialmente conecto a las universidades de Stanford, Utah, UC Los Angeles y UC Santa Barbara (4 nodos)
- 90. En 1981 tenía 213 nodos
- 92. Se comenzó a compartir información desde una computadora a otra
- 93. Cambio nuevamente la problemática de la seguridad
- 94. Se comenzaron a usar VPN o Redes Privadas Virtuales
- 95. Se comenzaron a usar Concentradores de VPNs
- 97. También cambian los tipos de servicios que se quieren ofrecer por Internet
- 98. Cambian los vectores por los que se reciben los ataques
- 99. Cambia nuevamente la forma en que debemos defendernos
- 101. 23 Seguridad de la Información ¿Qué se debe garantizar? 1.- Confiabilidad Se garantiza que la información es accesible sólo a aquellas personas autorizadas. 2.- Integridad Se salvaguarda la exactitud y totalidad de la información y los métodos de procesamiento y transmisión. 3.- Disponibilidad Se garantiza que los usuarios autorizados tienen acceso a la información y a los recursos relacionados toda vez que lo requieran.
- 103. Conectividad aumentada con nuevos equipos que se conectan a las redes
- 104. Virtualización de los servicios en la nube (SaaS)24
- 106. Muchas empresas las usan para mejorar su funcionamiento
- 107. La llamada generación Y usa este tipo de servicios por sobre el email
- 108. Si una empresa decide restringir su uso, los empleados siempre encuentran la manera de acceder
- 109. Pero esto trae aparejado un nuevo problema de seguridad25
- 110. 26 Existen peligros nuevos?
- 111. Estadísticas
- 113. En Rusia, se usan las redes sociales como un mercado on-line de compra y venta de números de tarjetas de crédito
- 114. En el 2007 había un dispositivo conectado cada 10 personas. En 2010 hay 5 dispositivos conectados por persona en el mundo
- 115. El ataque de DDoS creció un casi un 23% desde el año pasadoFuente: IC3 2009 Annual Report on Internet Crime Released Cisco 2010 Midyear Security Report
- 119. Cantidad de ataques por mes
- 121. Increíblemente el siguiente método es la llamada de los clientes
- 123. Internet Esquema general de una red hace 10 años
- 124. 37 Esquema de una gran empresa
- 125. Arbor Networks
- 127. Arbor comercializa básicamente dos líneas de productos:
- 128. Arbor Peakflow
- 129. Arbor Ellacoya e-Series
- 130. Arbor Peakflow: esta línea de productos permite tener una visibilidad y seguridad de cualquier red global IP, basada en 3 fuentes de datos: X-flow, BGP, y SNMP. Permite brindar servicios de Clean Pipes a los ISP.
- 131. Su uso es principalmente para ISPs o grandes empresas donde es importante la visibilidad y defensa de la red, siendo la misma de grandes proporciones.
- 132. Arbor Ellacoya e-Series: son equipos para visibilidad a capa 7, permitiendo además, controlar los flujos que circulan por la red, controlando (restringiendo o anulando) el ancho de banda utilizado por los clientes.
- 135. Provee un sistema de protección de la red del ISP, eliminando amenazas salientes de Botnets.
- 136. Protege a los usuarios del ISP contra el uso de sus PCs por parte de botnets.
- 137. Provee una plataforma escalable que soporta los ataques de DNS, con una muy alta disponibilidad.
- 138. Elimina una gran parte del SPAM saliente desde la red del ISP.
- 139. Provee un filtrado de URLs completas para prevenir el uso de páginas infectadas por parte de los usuarios finales.41
- 140. Presentación Ironport Gerardo Buhler Systems Engineer / Chile CCSP
- 142. FronteraConvencional Policy Corporate Border Applications and Data Corporate Office Branch Office Attackers Customers Partners
- 143. Disolución de lasfronteras Policy Corporate Border Applications and Data Corporate Office Branch Office Home Office Airport Attackers Mobile User Coffee Shop Customers Partners
- 144. Cloud Computing esta “disolviendo”la fronterade la corporación Policy Corporate Border Applications and Data X as a Service Software as a Service Infrastructure as a Service Corporate Office Platform as a Service Branch Office Home Office Airport Attackers Mobile User Coffee Shop Customers Partners
- 145. La nueva red: sin fronteras Policy Corporate Border Applications and Data X as a Service Software as a Service Infrastructure as a Service Corporate Office Platform as a Service Branch Office Home Office Airport Attackers Mobile User Coffee Shop Customers Partners
- 146. Policy (Access Control, Acceptable Use, Malware, Data Security) 4 Policy Corporate Border Applications and Data X as a Service Software as a Service Infrastructure as a Service Corporate Office Platform as a Service Branch Office 1 2 3 Home Office Airport Attackers Mobile User Coffee Shop Customers BorderlessEnd Zones BorderlessInternet BorderlessData Center Partners Arquitectura para una seguridad sin fronteras
- 147. El desafiohoyesEquilibrarfuerzas…. Globalization Threats Mobility Enterprise SaaS Acceptable Use Collaboration Data Loss
- 148. Cisco Security Products OverviewComprehensive Security, Flexible Delivery Network Level Application Level Data Center / Campus FWSM ASA 5500 Network Admission Control IPS 4200 Cisco Security Intelligence Operations Corporate HQ Cisco IronPort S-Series Cisco IronPort C-Series ASA 5500 IPS 4200 Branch Office Centralized Management Cisco IronPort S-Series ISR ASA 5500 Teleworker Cisco AnyConnect VPN Client Clientless Network Access
- 149. Cisco IronPort Gateway Security Products Internet Internet IronPortSenderBase BLOCK Incoming Threats APPLICATION-SPECIFIC SECURITY GATEWAYS EMAIL Security Appliance WEB Security Appliance ENCRYPTION Appliance CENTRALIZE Administration PROTECT Corporate Assets Data Loss Prevention Security MANAGEMENT Appliance CLIENTS Web Security | Email Security | Security Management | Encryption
- 150. Cisco IronPort Email Security Appliances
- 151. Top Exploits Email Security Spam (+85% del tráficomundial de correo) Viruses False-positives Denial-of-Service (DoS) Attacks Misdirected bounces (Ataques de Rebotes) Impersonation scams (Phishing) Bot-Net Networks
- 152. IronPortConsolida la seguridad y arquitectura de la plataforma de Correo Antes de IronPort Despues de IronPort Internet Internet Firewall Firewall MTAs Anti-Spam Anti-Virus Policy Management Mail Routing IronPort Email Security Appliance Groupware Groupware Users Users
- 154. Antispam
- 155. Antivirus
- 156. Filtro de epidemia de Virus (protección preventiva antivirus)
- 157. ReputationFilters (protección preventiva antispam)
- 158. Encripción
- 160. Inspección de tráfico módulo x módulo
- 161. Activación de los módulos basada en políticas, configurados por usuario, dominio, IP o grupo.
- 162. Autenticación y políticas integradas con AD, LDAP y RADIUS.
- 163. Protección contra Email Marketing
- 165. SenderBaseEmail Reputation Database DomainBlacklist & Safelists Message CompositionData Other Data Global VolumeData Spam Traps ComplaintReports IP Blacklists & Whitelists Compromised Host Lists Web Site CompositionData IP Reputation Score - 10 +10 0
- 168. 3B daily web requestsEmail Security Solutions Web Security Solutions Firewalls IPS Devices
- 169. ArquitecturaAntispam Multi-layer Spam Defense SenderbaseReputation Filtering IronPortAnti-Spam Who? How? Score What? Where? >99% Catch Rate < 1 in 1 mil False Positives Block 90%of Spam
- 170. Arquitectura Antivirus Multi-layer Virus Defense Virus Outbreak Filters Anti-Virus T = 5 mins -zip (exe) files-Size 50 to55 KB T = 0 -zip (exe) files T = 15 mins -zip (exe) files -Size 50 to 55KB -“Price” in the filename
- 171. Control correosaliente Corporate Policies DLP HIPAA HIPAA PCI SB-1386 Encryption Trade Secrets DroppedAttachment Detection Remediation HR/LegalReview Encryption Company Reputation SMTP PCI Security Enforcement Array
- 172. CorreoSeguroFácil de utilizarpara el remitente 2 1 1 Message isEncrypted & Pushed to Recipient 3 TLS User OpensSecured Messagein Browser Key is Stored User Authenticates and Receives Message Key Automated key management No desktop software requirements No new hardware required Decrypted Message Is displayed
- 173. CorreoSeguroFácil de utilizarparadestinatario 1 2 3 Open Attachment Enter Password Send to Anyone no Certificates no Plug-Ins View Message
- 174. Visibilidad y ControlFacilpara el Administrador Guaranteed Read Receipt Guaranteed Recall
- 176. C370 – hasta 5000 users.
- 177. C670 – mas de 5000 y hasta 10000 o mas usuarios.
- 178. Licenciamiento por cantidad de usuarios.
- 179. No se vende sin soporte.
- 180. No se vende el software sin el appliance.
- 182. Mas de 250.000 mail/hora (C670) como MTA puro
- 183. Aproximadamente 110.000 mail hora con todos los servicios activos.
- 184. Mas del 80% del trafico spam es bloqueado en el borde sin entrar a la red del cliente
- 185. Soporta 2 engines AS (IPAS y Cloudmark)
- 187. ReputationFilters
- 188. Antispam
- 189. Antivirus
- 190. Filtro epidemia de virus (VOF)
- 191. Encripción
- 194. Desafios de la WEB Recursos e informacioncasiilimitados, pero no hay privacidad o seguridadgarantizada Acceptable Use Violations Data Loss Malware Infections Challenges
- 195. 20% del trafico es “facil de clasificar” Trafico predecible, Dominios conocidos 80% del trafico es “dificil de clasificar” 110M sitios, creciendo 40% anualmente Mezcla de sitios legitimos, spyware y malware Traffic Volume Big Head Long Tail # of Sites Web Traffic
- 201. Cisco IronPort S-SeriesA Powerful, Secure Web Gateway Solution Most effective defense against web-based malware Visibility and control for acceptable use and data loss High performance to ensure best end-user experience Integrated solution offering optimum TCO Management and Reporting Acceptable Use Policy Malware Defense Data Security AsyncOS for Web
- 203. Monitor de L4 (Analisis de los 65535 TCPports )
- 204. Inspección de trafico HTTPs
- 205. Cisco IronPort Web UsageControls (URLFilter)
- 206. Web Reputation
- 207. Anti-Malware
- 208. Applications ControlSoftwareas a Service Tunneled Applications Collaboration ftp://ftp.funet.fi/pub/
- 210. Web Proxy & L4 Traffic Monitor T1 & T2 used for L4TM P1/M1 used for Web Proxy Web Proxy Deployment Options L4 Traffic Monitor Deployment Options Explicit Forward Span Port off a Switch Transparent off an L4 Switch Simplex Tap Transparent off a WCCP Router Duplex Tap
- 211. Intelligent Scanning Known good sites aren’t scanned ANTI-MALWARE SYSTEM IRONPORT WEB REPUTATION FILTERS DECRYPTION ENGINE Unknown sites are scanned by one or more engines Requested URLs Known bad sitesare blocked IronPort Web Reputation technology determines need for scanning by - IronPort Anti-Malware System - Decryption Engine
- 213. Updated every 5 minutes
- 214. Powered by Cisco SIOReal-time Dynamic Content Analysis Engine accurately identifies over 90% of Dark Web content in commonly blocked categories URL Lookup in Database Gambling www.sportsbook.com/ URL Database Uncategorized URL Keyword Analysis Gambling www.casinoonthe.net/ Real-time Dynamic Content Analysis Uncategorized Dynamic Content Analysis Engine Gambling Analyze Site Content
- 215. Cisco IronPort Web Security Appliances on Customer Premises Security Intelligence Operations (SIO)Unmatched Visibility Drives Unparalleled Efficacy Updates published every 5 minutes Customer Administrators Uncategorized URLs URL Categorization Requests Cisco SIO Analysis and Processing Master URL Database External Feeds Crawler Targeting Traffic Data from Cisco IronPort Email Security Appliances, Cisco IPS, and Cisco ASA sensors Crowd Sourcing Manual Categorization Web Crawlers
- 216. Industry-leading AccuracyWith Multiple Verdict Engines Sophos WEBROOT &SOPHOS Best-of-breed signatures - Webroot & Sophos Broad coverage - Addresses full range of threats Complete signature set - URLs, domains, CLSIDs, binaries, checksums, user agents and more
- 218. S370 – hasta 5000 users.
- 219. S670 – hasta 10000 o mas usuarios.
- 220. Licenciamiento por cantidad de usuarios.
- 221. No se vende sin soporte.
- 222. No se vende el software sin el appliance.
- 224. 1900 a 2100 requestsseg. (aprox. 7M/hora)
- 225. 100 a 200 Mbps de throughput (depende de los módulos activos)
- 226. No in-line: baja latencia 5 a 15 ms
- 228. Monitor de L4
- 229. Inspección de trafico HTTPS
- 231. Web Reputation
- 233. Cisco IronPort Security Services
- 234. Cisco IronPort Email Security Services Cisco IronPort Hosted Email Security (No LDAP, No DLP) Cisco IronPort Hybrid Hosted Email Security (SaaS, LDAP y DLP) Cisco IronPort Managed Email Security (Managment delegado, mayor escalabilidad)
- 235. Opciones de Deployment FlexiblesPero el mismo lider del mercado en Email Security Cisco Security Operations Center En la “nube” (Cisco Datacenters) Customer Premise Equipment (CPE) Hybrid Hosted Email Security Hybrid Hosted Email Security Managed Email Security Hosted Email Security (SaaS) CUSTOMERPREMISE PoliticasUnificadas| Reporting Centralizado| ProteccionConsistente
- 236. Hosting dedicado - Email SecuritySolucion dedicada, reduccion de costos y rapido deployment Seguridad de Email en la “nube”, reduce la posibilidad de unafacilidentificacion Soluciondedicadaelimina los riesgos de contaminacionpor “compartirrecursos” Infraestructuraadministradaaseguracapacidadsi hay crecimiento de spam EliminaSpam & Malware Cisco Data Centers 1 Email “limpio” 2 Outbound Customer
- 237. Hosting Hibrido - Email SecurityMaxima Flexibilidad asegura un diseño optimo Diseñohibridopermite el control dividido, en la nube y en “casa del cliente” CPE- en el clientepermite el control avanzado con encripcion y soportepara DLP. EliminaSpam & Malware Cisco Data Centers 1 Email “limpio” 2 DLP& politicas de encripcion 3 Outbound Cliente
- 238. Managed Email SecuritySeguridad de correo “TOTAL” en manos de expertos Managed email provee la maxima reduccion de tareas y control La arquitectura del serviciopermiteaplicaciones del ladocliente o “en casa” Cisco SOC ofrece 24/7 management y monitoreoremoto Cisco Security Operations Center (SOC) Administracion Segurizada VPN Tunnel Cliente Email
- 239. Preguntas?
- 240. BestPractices
- 242. La seguridad debe evolucionar, como también lo hace todo el resto de la red, y en paralelo a esa evolución
- 243. La educación de los usuarios es fundamental para el éxito de la seguridad
- 244. Si se toman medidas bloqueando todos los accesos, los usuarios buscaran nuevas formas de acceder a Internet, lo cual es aun más riesgoso
- 246. Entrenar y concientizar a todos los usuarios
- 247. Testear permanentemente la red
- 248. Encriptar toda la información, no solamente en los Data Centers, sino también en los EndPoints
- 249. Controlar todos los accesos a la red
Notas del editor
- We now have 2 main offices for Latin America - based in Sao Paulo (Brazil) and Buenos Aires (Argentina)The Brazilian operation that has merged with Logicalis, is now part of a holding company for the whole Latin American business. The operations in Argentina, Bolivia, Chile, Ecuador, Paraguay, Peru and Uruguay trade under the name of Logicalis (they have dropped the Softnet brand). In Brazil, the operation trades as PromonLogicalis.Logicalis is now the single largest independent network integrator for this region.
- There is no question that the traditional corporate border is gone forever. In the past, applications, data centers and branch office networks were protected by perimeter devices such as firewalls and policy-based rule sets. The internet and attackers were outside the perimeter, although VPN and other technologies made it possible to grant controlled access for partners and customers. The perimeter was your line in the sand, where all your policies were set, and where your policy enforcement systems were located. Although it could be complex to manage this properly, this architecture was straightforward to understand and police. ------------------Cisco Promotion Points: Cisco Systems has about 350 partners with access through the perimeter. You can assume each partner has up to 350 partners of their own. Cisco had to move past the concept of the perimeter in order to secure its extranet.
- However, the traditional network borders are disappearing. The way companies do enterprise computing and access information has changed, and will continue to change over the next five years. The two biggest architectural changes are mobility and cloud computing. A key driver behind mobility is the latest generation of smart phones, iPhones and handheld devices. These are internet-enabled, so they can access WebEx, Skype and YouTube. They may have VPN or other access into corporate applications. The mobile work force can now use laptops from home offices and coffee shops, as well as computers in airport kiosks. This is not just about email access – the mobile users and devices can now have the same capabilities as office systems. The browser and a vast number of powerful applets have radically expanded the things that can be accomplished remotely, and productivity is climbing. This productivity jump is a direct result of the connectivity and data sharing provided by the network. Yes, the device may have local data storage. Yes, there are security issues. But the huge increase in efficiency means that this genie is not going back in the bottle. More and more companies are spending time and energy around handheld computing. IT departments want to support new operating systems like Google Android, and are being asked to support platforms besides Windows. Cisco’s Borderless Network architecture provides security in this mobile, multi-platform, multi-vendor, multi-location environment. -------------------------------------------------------------------------------------------------------------------Cisco Promotion Points: Cisco helped build the internet backbone and corporate connectivity that makes data sharing possible.Microsoft is providing a new VPN technology in Windows, called Direct Access. While this competes against Cisco’s current and future VPN clients, Cisco supports Windows, Macs, BlackBerries, smart phones, iPhones and more, while Microsoft Direct Access supports Windows 7 only. Cisco shines in this heterogeneous environment.
- The second big change is cloud computing. There are compelling reasons to move certain applications and services into the cloud. Cost savings and survivability are two main drivers, virtualization makes it easier to achieve and the network makes it transparent to users in any location. Typically the first wave of applications that we’ve seen move into the “cloud” included email. Email security is one of the apps that we’ve seen more of our customers, like you, having interest in.Another example is salesforce.com, a customer relationship management system. You can rent a Sun or Windows server for your own applications, and cut your management costs using Platform as a Service. Infrastructure as a Service could be a managed router environment, managed firewalls, or something else. These providers are specialists, and the savings from cloud computing can be substantial. But now you’ve got more users on more devices in more places in the network, and data residing in more places in the network. That’s a deadly combination for security. Consider what happens when your CFO uses a handheld to check your sales forecast at salesforce.com. That transaction, that connection never touches a firewall. It doesn’t touch a web proxy.
- This is a diagram of the new, Borderless network environment we live in. Users, devices, cloud-based services and head-office resources are all accessible, but without traditional network perimeters. Cisco’s new architecture to secure this borderless network is able to restore the auditing, logging, access control, verification, malware policy and threat prevention. We’ve had to rethink how security is done, and how to accommodate this dramatic shift. We can help customers migrate to a protected network without borders, but this kind of security has to be “baked in” to the architecture and the products. Security as an afterthought is much less likely to restore the traditional levels of control. ----------------------------------------------------------------------------------Cisco Promotion Points: There is no single best practice for securing a Borderless Network – instead, Cisco’s new architecture is flexible and adaptable.
- Cisco’s vision is around 4 pillarsFirst The borderless end zones – i.e. protecting the end user device from threats - whether it’s the smart phone, laptop, etc.Second is the Borderless Internet which is really the focus of this presentation. Central to this pillar is the cloud based as well as a unique “hybrid” deployment modelThe third pillar of the vision is the borderless data center where cisco’s vision is to provide security to the evolving data center. Aspects like inter-VM and intra-VM security are the areas where we are investigating.And finally the fourth pillar is that around policy. Our customers are telling us that regardless of the way information is accessed, they have to apply the same policies – whether it’s around access control, data security, acceptable use, etc.As you can see the cloud is the central to the strategy of Cisco’s SBN
- Challenges in today’s IT are vast and diverse. IT budgets are flat or shrinking and these challenges are ever growing. This is driving the Enterprise toward hard requirements for firewall.These requirements include:A clear understanding of the threat environment which means a continuous update to software and security content to keep up with the latest threatsHigh performance platforms that are capable of keeping up with today’s traffic needs and allowing for growth as the threat environment evolvesFlexible deployment options to assure coverage of threats anywhere in the networkThat same flexibility of options applied to the new mobile teleworker and remote enviromentsSecurity applied to the latest voice and video communicationsAnd tying it all together with an operational model that make management effective and efficient
- The CSIO piece that provides Cisco IronPort’s email security threat protection is Senderbase.It is the world’s first, largest and most thorough email & threat monitoring database. This chart illustrates some of the sources of senderbase information and the over 150 parameters we track in real time.- Global volume- Complaints, spamtraps- 3rd party blacklist and dynamic lists- Results of content filter scanning for spam and viruses- URLs with known risks of spamvertising, viruses, spyware- Website composition to look at suspicious payloads or known bad files- Domain registration information- Look at linking reputation of sites through hyperlinksBy having real time insight into this data we can see threats before anyone else in the industry and protect our customer base.Some of this information is available to the public at www.senderbase.org
- At Cisco, we pioneered the whole conceptof reputation filtering that relied on the depth of email security data collected from a wide deployment sensor.However as the threat landscape has evolved, so have our techniques. The result is CSIO – Cisco Security Intelligence Operations – industry’s leading threat data base that gathers information from a wide variety of threat sources and converts them into dynamic rules to protect our customers in real time from new and evolving threats.The reason why CSIO is industry leading is because of the breadth and depth of threat information that we harness through it.By leveraging the rich security portfolio that Cisco has – comprised of both network security and content security offerings – we have effectively converted this broad deployment into – what we call sensors.These sensors send us anonymous threat data that gives us the vast visibility into the threat landscape. These sensors include web security sensors, email security sensors, IPS devices as well as firewall devices – providing threat information from various parts of the layers in the networking stack.To give you a sense of the breadth and depth of this sensor netwrok – we have visibility into 30% of the global email data base, we have more than 700,000+ devices on the network security side.
- Lets shift gears from inbound email protection to outbound email controlCustomers today are faced with a number of different challenges Ensuring compliance with regulations like HIPAA, PCI, etcOr protecting trade secrets, confidential data, etcEmail is the primary vector of concern for organizations and hence it is important to discuss the variety of technologies that Cisco IronPort has for the email security infrastructure that help customers detect incidents and apply appropriate remediation to those incidents.That’s where the DLP and Encryption technologies from Cisco help. We are the industry’s first vendor that has a comprehensive DLP and Encryption solution available in the cloud only deployment model. This provides customers who’ve made the choice to move to the cloud a great solution to maintain regulatory compliance and adherence to company Acceptable Use Policies.The first step is one that allows customers to detect events.And on detecting events, the email security deployment can be configured to perform a number of different remediation options including encrypting the email, dropping the attachment, cc-ing to an HR/Legal inbox etc.
- To explain how easy our secure messaging solution is, we will first show you how simple it is for the senders, then the receivers. The first is sending a message. The thing you want to convey here is that customers can instantly deploy PXE with a simple feature key, no additional management overhead. An email that is detected is as being required to have encryption would automatically be enrolled into the key management system, which is provided via Cisco registered envelope service hosted in the Cisco cloud. Then that message is pushed to the end-user and that end-user would retrieve the key from the Cisco registered envelope service and render that message in their browser. This provides for a host of center controls, because the fact that that message’s key is stored in host fashion. The sender can log-in to the registered envelope service and deal with tracking, secure, reply, recall and so on. And what makes this really powerful is the fact that we, meaning Cisco, never actually store that email message. All we are doing is storing the key, making it a high-performance, high-secure model for managing secure email.
- HTTP is the New TCPOne can be reasonably sure that, no matter what the other firewall settings, Port 80 and Port 443 will be open. It’s the 24x7 path into and out of every enterprise.This is driven by business critical content and applications on the web. The secondary effect is that other applications, such as FTP, SOCKS, IM, P2P, and Video are also shifting to tunnel over HTTP to take advantage of the ubiquitous access.Result: HTTP now dominates at the enterprise edge, carrying numerous applications and types of information. In some cases, up to 90% of traffic traversing the enterprise edge is HTTP.This creates new security challenges for enterprise IT.ORFirst objective: establish the problem set and the concept of the Secure Web Gateway as the solution.Important to set this framework for the customer conversation: while we may not have the world’s best web proxy or the world’s best URL filtering, we do have the world’s best Secure Web Gateway. Establishing this framework helps qualify customer priorities vs our value prop, and helps position us for success relative to vendors focused on subsets of the problem space.Web has become the ubiquitous path into enterprises – and it’s overloaded with different applications and content that businesses want to handle differently.Saas applications like Saleforce and Netsuite; rich collaboration apps like WebEx; information discovery—researching prospects, learning about competitive products and market trends, or catching up on today’s news. The idea of locking down web access is unthinkable.And this has driven a second trend: taking advantage of that pipe in and out to tunnel apps over HTTP. A few years back, P2P apps like BitTorrent dominated Internet backbone traffic. Today that’s been replaced by HTTP-Video—the YouTube effect plus ubiquitous access. IM clients traversing the edge also tend to use HTTP more and more today, e.g. Yahoo releasing Yahoo Web Messenger. Legacy SOCKS applications transitioning to CONNECT.Result: HTTP now dominates at the enterprise edge, carrying numerous applications and types of information. In many ways, it has become the new TCP at the enterprise edge.
- While the challenge has become multi-dimensional, the policy issues remain the same:There is a need to apply access controls to ensure the right people have access to the right parts of the network and applications.Acceptable Use controls for compliance and productivity, to ensure employees are using the web resources appropriately. Threat Protection to block all the bad stuff like malware, botnets, intrusions and spam from coming into the network.And finally data protection to ensure that confidential information is not getting out into the open or into wrong hands, either inadvertently or with a malicious intent.
- Cisco IronPort Dynamic Vectoring and Streaming (DVS) engine
- For maximum efficacy, a Secure Web Gateway needs to examine traffic at both the network layer and the application layer. Furthermore, a Web security appliance needs to combine signature based analysis as well as traffic based or "reputation" analysis to distinguish legitimate traffic from hostile spyware or malware. And it needs to deliver this without introducing any degradation in the end user browsing experience.The IronPort S-Series represents the next generation of Web technology, leveraging techniques developed for Web proxy caching but built from the ground up for security. Built on IronPort's proprietary AsyncOS operating system, the S-Series appliance offers extremely high performance scanning of Web content at both the network layer and the application layer using both signature and reputation based filtering. The IronPort S-Series Web Security Appliance is the industry’s first and only Web security appliance to combine traditional URL filtering, reputation filtering and multi-vendor anti-malware filtering on a single platform. This squarely addresses the growing challenges of both securing and controlling Web traffic while enjoying a low Total Cost of Ownership (TCO). Enterprise-class management and reporting tools deliver ease of administration, flexibility and control, and complete visibility into policy-related and threat-related activities.
- Choice also takes the form of flexible deployment options leveraging the same market-leading email security technologyCustomers can now choose from hosted, hybrid hosted, managed appliances or self-managed appliances based on the form factor that they preferCisco can leverage our data center to host all or parts of the equipment, can out-task manage the devices on the customer premise, or divide the control between the cloud and customer premise.Regardless of the deployment option, customers retain co-managed access while maintaining a common policy, centralized reporting and consistent protection
- Let’s look at the various deployment optionsFirst is dedicated hosted email securityHere the email security devices reside in the Cisco data center minimizing the customer’s data center requirementsThe dedicated nature of the service ensures that the customer’s sensitive data is not leaked and eliminates the “shared fate” risk of critical outagesThe customer can be assured of spam growth headroom with future capacity assurance. Meaning that Cisco will take the necessary steps to scale the infrastructure behind the seems to provide the highest level of service for the rated user count.DIAGRAM: In the diagram you can see that both the inbound and outbound filtering is done on the appliances hosted in the Cisco data center. After removing inbound spam and viruses, the clean email is passed to the customer.
- Next, let’s look at the Hybrid Hosted email security offeringThis solution divides the control between the “cloud” and the customer premise. The inbound filtering is done in the Cisco cloud prior to the traffic entering the customer premise. Outbound control policies are applied on the customer premise where customers want to prevent the leakage of sensitive information or to encrypt the email traffic to ensure security and confidentialityNOTE: Emphasize what we are, best of both worlds. Scalability, consolidated reporting. First vendor to deliver – others make the claim but we are actually the first ones to pull it off.
- And lastly, let’s look at managed email security which provides the highest level of out-taskingThe Cisco Remote Management Services provides vigilant 24x7 remote management and monitoring on behalf of the customerProvides a predictable cost model that the CFO will appreciate.Email continues to flow through the on-premise infrastructure where both inbound and outbound filtering is applied. Cisco RMS accesses the on-premise appliance via a VPN tunnel delivered by the dedicated VPN router