Dynamic Attack Protection and Access Control

Transcription

1 Security Revolution: F5 BIG-IP Dynamic Attack Protection and Access Control

2 2 How the Static Data Center Falls Short It started simple More user types, services Application issues Security woes What s the answer?

3 3 Dynamic Data Center Reconfigure dynamically Manage applications, not objects Context-aware policies ADC manages application services

4 4 Dynamic Attack Protection and Access Control Adaptive Protection for Web 2.0 Applications across All IT Environments Advanced Dynamic Services for Unified Access Control Scalable and Controlled DNS Infrastructure with DDoS Attack Mitigation

5 5 BIG-IP Advanced Acceleration Overview Adaptive Protection for Web 2.0 Applications

6 Hackers Attacking Websites With DDoS 6 60% of (orgs.) respondents rely on their websites for at least 25% of their annual revenue. Merrill Research, 2011

7 Recent Application and Network Attacks 7 And the hits keep coming: Indeed in today s world, acts of terror could come not only from a few extremist in suicide vests but from a few key strokes on the computer... Barack Obama, President of the USA Source:

8 8 Defend Against Cyberattacks Ongoing storm of cyberattacks is preventable, experts say Preventable with technology that exists today! Need to educate all IT organizations how to protect networks Many are blind to Layer 7 attacks Experts note that network firewalls are not enough Need comprehensive layered network and application security architecture unique to F5

9 9 Anonymous Attack Anonymous targeted customer with bots Traffic attack melted legacy systems Solution: Implement BIG-IP BIG-IP Attack Protection: Greater connection management LTM to mitigate network DDoS ASM to mitigate application DDoS irules for agility and extensibility

10 Optimize Traffic Management and Offload Application Server with BIG-IP Local Traffic Manager (LTM) 10 BIG-IP LTM Physical Virtual Public or private cloud OPTIMIZED APPLICATIONS & DATA Application Intelligence Load Balancing TCP Optimization Rate Shaping Server Offload RAM Caching Intelligent Compressing Health Monitoring SSL offload Session Persistence SECURE APPLICATIONS & DATA Application Proxy Transaction Assurance Resource Cloaking Secure Network Address Translation Port Mapping Selective Content Encryption Denial of Service (DoS) protection

11 11 Secure Applications and Data with BIG-IP Local Traffic Manager (LTM) SECURE APPLICATIONS & DATA Application Proxy Transaction Assurance Resource Cloaking Network and protocol attack protection Secure Network Address Translation Port Mapping Selective Content Encryption Denial of Service attack protection BIG-IP LTM Security at the application, protocol, and network levels Meet compliance requirements (PCI, HIPAA, etc.) Protect data without interrupting legitimate traffic

12 12 Leading Web Attack Protection BIG-IP Application Security Manager Protect from latest web threats Meet PCI compliance Out-of-the-box deployment Quickly resolve vulnerabilities Improve site performance

13 13 Quickly Resolve Application Vulnerabilities Request made BIG-IP ASM security policy checked Server response Enforcement Secure response delivered BIG-IP ASM applies security policy Vulnerable application Maintain security at application, protocol, and network levels Launch secure applications protected from vulnerabilities

14 Protection From Top Web App. Vulnerabilities (Open Web Application Security Project) OWASP Top 10 Web Application Security Risks: 1. Injection 2. Cross-Site Scripting (XSS) 3. Broken Authentication and Session Management 4. Insecure Direct Object References 5. Cross-Site Request Forgery (CSRF) 6. Security Misconfiguration 7. Insecure Cryptographic Storage 8. Failure to Restrict URL Access 9. Insufficient Transport Layer Protection 10. Unvalidated Redirects and Forwards 14 Source:

15 15 Meet PCI Compliance Easily comply with audits PCI reporting provides: Requirements with details Current compliancy state Steps to become compliant

16 16

17 Securing Disperse Web Applications 17 No virtual WAF option for private cloud apps Replication of production environment complicated and cost-prohibitive Data Center

18 18 F5 Innovative Protection for Web 2.0 Apps Automatically share policies between devices Quickly deploy BIG-IP ASM VE in private clouds Data Center

19 19 Unable to Secure Latest Web Apps Support AJAX apps or JSON payloads Unable to parse and secure JSON payloads Same attack vectors as http apps Policy violation renders no blocking signal Example:

20 20 Easily Secure JSON Payloads BIG-IP Application Security Manager Protect from JSON threats Render unique blocking message for AJAX widgets User informs admin with support ID for resolution Display a Blocking Message in AJAX Widget Example:

21 Protection from Vulnerabilities Enhanced Integration: BIG-IP ASM and WhiteHat Sentinel 21 Customer Website Finds a vulnerability Virtual-patching with one-click on BIG-IP ASM WhiteHat Sentinel Vulnerability checking, detection and remediation Complete website protection BIG-IP Application Security Manager Verify, assess, resolve and retest in one UI Automatic or manual creation of policies Discovery and remediation in minutes

22 Improve Site Performance and Security CASE STUDY 22 Challenge: Third-party network solution unstable Keeping people out of network Difficult to pinpoint app security problems Poor performance led to downtime Benefits of BIG-IP LTM and ASM: Improved site performance by 2 3 Cut downtime from 4 hours per week to 0 hours Fewer false positives, more legitimate traffic Eliminated 8 hours per week in support calls The improvement in functionality, performance, security, and support with F5 has been outstanding. Brad Tran kina, Director of Network and Information Systems, Human Kinetics

23 23 Adaptive Protection for Critical Applications BIG-IP Application Security Manager Secure latest Web 2.0 applications Support for AJAX widgets and JSON payloads New platforms for All IT Environments BIG-IP ASM VE in virtual and private cloud Isolated resource allocation: vcmp support for ASM F5 s BIG-IP Application Security Manager Winner of the SC Magazine Reader Trust Award Best Web Application Security Solution 2010 BIG-IP ASM on = high throughput; 1600 = budget conscious Enhance management and reporting Vulnerability assessment and mitigation in the SDLC w/ WhiteHat Auto policy sync between devices iapp for integrated security services

24 24 BIG-IP Advanced Acceleration Overview Advanced Dynamic Services for Unified Access Control

25 25 Problem: Who, What, Where? What devices are requesting access? Who is accessing? What applications were accessed? Where did the user navigate?

26 26 Context = Access Control BIG-IP Access Policy Manager v11 Unify All Access Fast Authentication and Manage Access Single Sign On Based on Context Powerful Custom and Built-in Reporting Access and Application Analytics

27 27 Enable Simplified Application Access with BIG-IP Access Policy Manager (APM)

28 28 Authentication All in One and Fast SSO F5 BIG-IP Access Policy Manager Dramatically reduce infrastructure costs; increase productivity = BIG-IP v11

29 29 Auto-Connect to the VPN At Home (wireless) Auto-Connect! On the Way to Work (Aircard) Always Connected Application Access In the Office (docked LAN connection) In the Cafe (wireless) Presenting (corporate wireless)

30 BIG-IP Edge Client Web-Delivered and Standalone Client Mac, Windows, Linux iphone, ipad, itouch, Android Drive Security Endpoint inspection Full SSL VPN 30 Enable Mobility Smart connection roaming Uninterrupted application sessions Accelerate Access Adaptive compression Client-side cache Client-side QoS

31 Easily Design Access for ipad BIG-IP Edge Client Connection, Statistics and Settings 31

32 32 Configure ios Access to Applications with BIG-IP Edge Portal

33 33 Secure, Accelerated Remote Access with BIG-IP APM in Edge Gateway Edge Gateway includes: Access Control, Web Acceleration, WAN Optimization

34 34 BIG-IP Edge Gateway Secures and Accelerates Access to Applications Next generation remote access solution Converges SSL VPN access security, application acceleration and availability Optimize access for mobile users and remote offices BIG-IP Solution for the Network Edge Multiple Platforms: 1600, 3600, 3900, 6900, 8900, (Licensed concurrently) Includes BIG-IP Edge Client solution Exponential Performance, Capacity, and Scalability Up to 10 Gbps, 600 log-ins per second, 60,000 users

35 BIG-IP Edge Gateway will Power New Managed Services 35 Access Requirements Easy / cost effective access scaling Advanced, secure VPN with fast deployment Custom look and feel per customer Virtualized solution to maximize investment Enable secure collaboration between 3 rd parties BIG-IP Edge Gateway Delivered Superior Lowest cost Acceleration technology with LAN speed performance Improved manageability and security with unified access Customized domains for personalized experience Virtual routing services with lower opex

36 Advanced Dynamic Services for Unified Access Control: BIG-IP APM 36 IPsec optimized site-to-site tunnels Dynamic Webtop: with Application Tunnels Access: External Dynamic ACLs, Flash patching, Oracle Access Manager 11g Hosted VDI: Microsoft Remote Desktops, Expanded Citrix VDI support (Proxy and Portal mode) EndPoint Inspection: Protected Workspace, Machine Info Inspector Powerful reporting/analytics: Custom & built-in reports, Access and Application Analytics for remote access solution Scale for Global enterprise: Series: ^60k users, w/1.2 TB of storage SSO enhancements: SSO across multiple domains, Kerberos auth. (CAC cards, etc)

37 37 BIG-IP Advanced Acceleration Overview Scalable, Adaptive and Secure DNS infrastructure

38 38 xxxxxx Nr Network Solutions hit 6/2011. D o m a i n R e g i s t r a r Network Solutions hit with a large denial of service attack targeting their DNS servers. Large DNS DoS attacks. World News DNS DoS Attacks continues to cost businesses millions of dollars each year G o G r i d, T h e P l a n e t, Register. com, UltraDNS, Network Solutions were all hit during March/April 2009 causing websites to be offline a n d c o s t i n g c u s t o m e r s DoS Attack Affects Global DNS Service inc. Amazon

39 39 DNS Attacks Are Common

40 Cost of No DNS-based Attack Protection 40

41 Scale and Consolidate Your DNS Fast ROI with F5 Solutions 41 10x DNS Express BIG-IP GTM 70%

42 42 F5 Solution: Easily Handle All DNS Requests F5 BIG-IP GTM Scalability CMP Enabled, 130K qps per core (~ 6 Million on VIPRION) F5 DNS Express Authoritative DNS in Memory, 10 s of Millions of Records F5 IP Anycast Integration Obscures DNS Servers and Distributes Load DNS Express in GTM Queries in Millions 6 Answer 3 DNS Query 0 Answer Low Query DNS Query Answer DNS Query Answer Query DNS Growth Query Query Spike DNS Server Exponential DNS performance Answer survives attack DNS Query OS Query Decline NIC Manage DNS Records Max DNS Admin Auth Roles DNS Queries w/ddos Valid DNS Queries Dynamic DNS DHCP

43 Secure Your DNS Infrastructure 43 Simple DNSSEC compliance: Implement BIG-IP GTM in front of existing DNS servers Ensure trusted DNS queries with dynamically signed responses Reduce management costs

44 DNS Infrastructure with DDoS Attack Mitigation BIG-IP Global Traffic Manager Deliver high speed "DNS Offload and Secure DNS DNS Express and DNSSEC 44 Maximum capacity DNS Geographically distribute to nearest GTM (IP Anycast Integration) Support both IPv6 and IPv4 hybrid environments DNS v6 to v4 translation and gateway Deliver industry leading, scalable, and flexible performance GTM on and VIPRION (CMP and vcmp) Cost effective, virtualized and globally dispersed datacenters GTM Virtual Edition GTM Standalone and module on LTM 1600

45 45 F5 Integrated Security No other vendor has a comprehensive solution Application Presentation Session Transport Network Data Link Physical XSS, SQL Injection, Data Leaks, SPAM SSL, XML Encryption, Images Sockets, RPC, NetBIOS Auth, SNMP SYN/ACK Attacks, Port Scans, MitM Port filters, IP Frag, Spoofing, Smurfs VLANs, ARP Poisoning Management Interface Segmentation

46 46 Delivers Dynamic Attack Protection and Access Control Adaptive Protection for Web 2.0 Applications Unified Access Control Scalable, Adaptable and Secure DNS

47 47 Q & A

48 2011 F5 Networks, Inc. All rights reserved. F5, F5 Networks, the F5 logo, BIG-IP, ARX, FirePass, icontrol, irules, TMOS, and VIPRION are registered trademarks of F5 Networks, Inc. in the U.S. and in certain other countries

49 TMOS Architecture The foundation of BIG-IP LTM and a unified system for application delivery 49