Using Tetration for application security and policy enforcement in multi-vendor environments.
•Descargar como PPTX, PDF•
1 recomendación•717 vistas
Network engineers increasingly must view the network as one big software system, which streams telemetry data from software sensors and network devices to an analytics engine. To implement the whitelist-based segmentation and zero-trust policy model generated from the data analysis, automation is a requirement when dealing with tens of thousands of workloads and complex rules. This session examines how Cisco Tetration Analytics combined with automation can be used to implement a zero-trust policy model on multi-vendor network fabrics, firewalls and application delivery controllers.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a Using Tetration for application security and policy enforcement in multi-vendor environments.
Similar a Using Tetration for application security and policy enforcement in multi-vendor environments. (20)
Más de Joel W. King
Más de Joel W. King (14)
Último
Último (20)
Using Tetration for application security and policy enforcement in multi-vendor environments.
- 1. Using Tetration for application security and policy enforcement in multi-vendor environments. Joel W. King Engineering and Innovations Network Solutions
- 2. Network engineers increasingly must view the network as one big software system, which streams telemetry data from software sensors and network devices to an analytics engine. To implement the whitelist-based segmentation and zero-trust policy model generated from the data analysis, automation is a requirement when dealing with tens of thousands of workloads and complex rules. This session examines how Cisco Tetration Analytics combined with automation can be used to implement a zero-trust policy model on multi-vendor network fabrics, firewalls and application delivery controllers. Using Tetration for application security and policy enforcement in multi-vendor environments.
- 3. Joel W. King Principal Architect World Wide Technology Research Triangle Park, NC Experience AMP Incorporated, Network Architect Cisco, Cisco Validated Designs (CVDs) NetApp, Big Data: Video Surveillance Storage Contact Info linkedin.com/in/programmablenetworks @joelwking joel.king@wwt.com DevNet Create 2018
- 4. …. Very topical for us -- talk on implementing Zero Trust with automation and Tetration … … Personally, I think ZT will replace perimeter security model within 5-7 years, and already we're hearing customers ask about it. … ----------------------------------------------- Gene Geddes | Chief Scientist, Security Solutions | World Wide Technology
- 5. #SILICONVALLEYINSTL Deploy Sensors Inventory Tetration Network Policy Publisher Under the Hood Resources
- 6. SHARE ACT TRACE HUNT BEHAVIORS THREATS TRIAGE DETECTION TELEMETRY INVENTORY Can you collaborate with trusted partners to disrupt adversary campaigns? Can you deploy proven countermeasures to evict and recover? During an intrusion, can you observe adversary activity in real time? Can you detect an adversary that is already embedded? Can you detect adversary activity within your environment? Who are your adversaries? What are their capabilities? Can you accurately classify detection results? Can you detect unauthorized activity? Do you have visibility across your assets? Can you name the assets you are defending? What is it doing? Should it? What’s on my network?
- 7. Automated whitelist policy Zero-trust, application segmentation Cisco Tetration Analytics Illumio VMware vRNI
- 9. Data Collection Layer Cisco Tetration Analytics™ NETWORKING [TELEMETRY ONLY] Data Consumption Layer REST API KAFKA MESSAGE BUS
- 11. Deploy Software Sensors setup_tetration_sensor.yml Dynamic Inventory inventory/sensors.py Network Policy Publisher library/tetration_network_policy.py PLUGINS MODULES ANSIBLE PLAYBOOK DATA REST API https://github.com/joelwking/ansible-tetration
- 13. Data Collection Layer Cisco Tetration Analytics™ 39-RU 8-RU SaaS 25,000 | 5,000 | 1,000 NETWORK INFRASTRUCTURE NetFlow | ERSPAN VM Appliance COMPUTE or virtual appliance
- 14. Extensive matrix of Windows | Unix | Linux Package and version dependencies e.g. rpm (even in Ubuntu/Debian) Different agent RPMs for … o Agent type, e.g. enforcement, visibility o Target system, e.g. CentOS 6.0 vs 7.0 o Latest version covers 34 RPMs Agent downloaded from GUI
- 15. Rather than PDF … ./setup_tetration_sensor.yml [administrator@centos-ansible-1 ~]$ uname Linux [administrator@centos-ansible-1 ~]$ -r -bash: -r: command not found [administrator@centos-ansible-1 ~]$ uname -r 3.10.0-862.el7.x86_64 command: uname -r value: 3.10.0-862.el7.x86_64 command: cat /etc/shells value: /bin/sh command: dmidecode -V value: 3.0 command: openssl version -a value: OpenSSL 1.0.2k-fips command: cpio --version value: cpio (GNU cpio) 2.11 command: sed --version value: sed (GNU sed) 4.2.2 command: awk --version value: GNU Awk 4.0.2 command: flock -V value: flock from util-linux 2.23.2 command: iptables --version value: iptables v1.4.21 command: ipset --version value: ipset v6.29, ansible-tetration/setup_tetration_sensor.yml
- 17. ANSIBLE AUTOMATION ENGINE CMDB INVENTORY HOSTS NETWORK DEVICES PLUGINS CLI MODULES PUBLIC / PRIVATE CLOUD PUBLIC / PRIVATE CLOUD CORE NETWORK COMMUNITY NOW.PY EC2.PY VMWARE_FACTS ANSIBLE PLAYBOOK Cisco Tetration Analytics™ SENSORS.PY ansible-tetration/inventory/sensors.py
- 18. $ ansible-inventory --host centos-ansible-1 -i ./inventory/sensors.py { "agent_type": "ENFORCER", "auto_upgrade_opt_out": false, "cpu_quota_mode": 1, "cpu_quota_usec": 30000, "current_sw_version": "2.3.1.41-1-enforcer", "data_plane_disabled": false, "enable_forensics": false, "enable_pid_lookup": false, "host_name": "centos-ansible-1", "interfaces": [ { "family_type": "IPV4", "ip": "10.255.40.139", "mac": "00:50:56:b9:62:58", "name": "ens160", "netmask": "255.255.255.0", "vrf": "Default", "vrf_id": 1 }, [snip] ], "last_config_fetch_at": 1537905092, "last_software_update_at": 1535054507, "platform": "CentOS-7.5", "uuid": "965e77504bf605d62c575231fa3d56463aed38bf" } ansible-inventory --host centos-ansible-1 -i ./inventory/sensors.py
- 19. #SILICONVALLEYINSTL Tetration Network Policy Publisher
- 20. 3policy enforcement iptables | firewall publisher kafka NETWORK DEVICES INFRASTRUCTURE
- 21. BROKER ADD TENANT ADD VRF AGENT CONFIG ENABLE ENFORCEMENT CREATE INTENT ADD SCOPE CREATE APP START ADM RUN ENABLE ENFORCEMENT VERIFY DATATAP CREATION DOWNLOAD CERTIFICATES ./producer-tnp-12.cert/ ├── kafkaBrokerIps.txt ├── KafkaCA.cert ├── KafkaConsumerCA.cert ├── KafkaConsumerPrivateKey.key └── topic.txt 10.253.239.14:9093Tnp-12 NETWORK PROGRAMMABILITY DEVELOPER ADM ANALYST
- 22. Network Policy Publisher ANSIBLE PLAYBOOK aci_create_filters.yml BROKER message publisher policy subscription MODULES tetration_network_policy.py Alerts every minute for enforcement Released in 2.3.1.41 April 2018
- 23. - name: Tetration Network Policy tetration_network_policy: broker: "192.0.2.1:9093" topic: "Tnp-2" cert_directory: "{{ playbook_dir }}/files/certificates/producer-tnp-2.cert/" https://github.com/joelwking/ansible-tetration/blob/master/aci_create_filters.yml 262
- 25. … designed to deal with millions of firehose-style events generated in rapid succession… … clients will never receive messages automatically. They have to explicitly ask for a message … https://thenewstack.io/apache-kafka-primer/ … Protocol Buffers are a way of encoding structured data in an efficient yet extensible format. … Google open source and supported for popular programming languages Fast and efficient (than JSON or XML) https://codeclimate.com/blog/choose-protocol-buffers/
- 27. UPDATE_START UPDATE UPDATE_END Tetration Network Policy Kafka message(s) topic partition offset key value Google Protocol Buffer len( value ) == 8 EARLIEST LATEST
- 28. Also know as: “GPB” or “protobufs” What are they? Method of serializing structured data XML | JSON uses strings to identify the key Protobufs uses integers to represent the key Sender and receiver share a .proto definition file Why Use Protocol Buffers? Performance: Smaller and faster than XML More compact (smaller packets, messages) Faster, less CPU to encode / decode https://developers.google.com/protocol-buffers/docs/pythontutorial protoc Define Compile Import
- 31. AnsibleFest 2018: Using Ansible Tower to implement security policies and telemetry streaming for hybrid clouds https://github.com/joelwking/ansible-tetration DevNetCreate 2018: Applying a whitelist policy generated by Cisco Tetration to an ACI network fabric. https://www.wwt.com/all-blog/devnet-create-2018/ Cisco Tetration Light-board: Cloud Workload Protection https://youtu.be/Hd56GVVr_AE Cisco Code Exchange https://developer.cisco.com/codeexchange/#search=tetration
- 32. David Goeckler, EVP / GM of Cisco's Networking and Security … turning the whole network into essentially a big software system where you define your policy in one place … That policy gets translated into what you want the network to do, and then you have an automation layer that activates all of those changes across your network fabric. https://www.networkworld.com/article/3280959/lan-wan/cisco-s-david-goeckeler-talks-security-networking-software-and-sd-wan-outlook.html
- 33. Traditional Firewalls as perimeter security are becoming obsolete Future is white-list segmentation, Zero Trust model View the network as a software system, use automation to apply policy https://www.wwt.com/all-blog/ansible-tower-implementing-security-policy/
Notas del editor
- AN EXCITIING TIME TO BE A NETWORK ENGINEER Network engineers with an interest in Linux administration, DevOps, the ability to code and think like a computer scientist, along with a familiarity with big data and analytics platforms, will be a valuable resource and important to the success of the business.
- View the network as a single, software system. Now we look at the network as a whole being one system, with automation to implement policy on the network.
- WWT aligning Networking and Security practices. Focus on the foundational components of the pyramid: Inventory, Telemetry … One goal of segmentation is to minimize east-west movement of adversary Segmentation can be achieved across hybrid data center (on premises and in the public cloud)
- What does Tetration mean? Tetration is used for the notation of very large numbers. Automated whitelist policy for segmentation - Zero-trust using application segmentation
- Automated policy enforcement is performed through the Cisco Tetration Analytics™ software sensors running on the workload itself. The software sensors orchestrate the stateful policy enforcement using operating system capabilities such as ipsets and iptables in the case of Linux servers, and the Microsoft Windows advanced firewall in the case of Microsoft Windows servers. https://www.cisco.com/c/en/us/products/data-center-analytics/tetration-analytics/index.html
- Software sensors for telemetry and enforcement. Embedded hardware sensors in Cisco Nexus 9000 Series Switches running in Cisco ACI mode By using IPFIX data from load balancers - Netscalar or F5
- View the network as a single, software system. Now we look at the network as a whole being one system, with automation to implement policy on the network.
- Ansible is an framework Share data (variables) through modules / plugins and the APIs, databases, files, and Kafka
- Embedded hardware sensors in Cisco Nexus 9000 Series Switches running in Cisco ACI mode By using IPFIX data from load balancers - Netscalar or F5 What does Tetration mean? Tetration is used for the notation of very large numbers.
- https://www.cisco.com/c/dam/en/us/td/docs/data-center-analytics/tetration-analytics/sw/install/cta_install_guide_for_sensor_agents.pdf
- Inventory is the base of the security pyramid Name the assets you are protecting
- https://www.cisco.com/c/dam/m/en_sg/dc-innovation/assets/pdfs/enhanced-security-and-operations-with-real-time-analytics.pdf https://<tetration>/documentation/ui/openapi/api_userannotations.html?highlight=tags#set-inventory-tag
- Implement security policy - Enforcement on software sensor - Using Ansible to implement policy on network devices.
- Prior to release 2.3 in April 2018 – ADM policy is exported and implemented. ADM discovers security groups and policies for the members of this application using the observations in the selected time range.
- 2.3.1.41 Introduced April 2018, provides application whitelist policy information through Kafka message bus. Northbound systems can subscribe to this policy information and use it for enforcement through other mechanisms. https://www.cisco.com/c/en/us/td/docs/data-center-analytics/tetration-analytics/sw/release-notes/cta_rn_2_3_1_41.html
- View the network as a single, software system. Now we look at the network as a whole being one system, with automation to implement policy on the network.
- https://thenewstack.io/apache-kafka-primer/
- https://thenewstack.io/apache-kafka-primer/
- Kafka messages are comprised of a topic, partition, offset, key and value.
- https://blogs.cisco.com/sp/streaming-telemetry-with-google-protocol-buffers
- https://en.wikipedia.org/wiki/Unified_Modeling_Language
- View the network as a single, software system. Now we look at the network as a whole being one system, with automation to implement policy on the network.
- Dave Goeckler, the Executive Vice President and General Manager of Cisco's Networking and Security Business. FY19 imperatives: Mass adoption of Automation and Intent-based Networking. … the future is driving simplicity … https://www.networkworld.com/article/3280959/lan-wan/cisco-s-david-goeckeler-talks-security-networking-software-and-sd-wan-outlook.html