NGFW is yesterdays news what is next in scope for the firewall in the threat intelligence age

Transcription

1 NGFW is yesterdays news what is next in scope for the firewall in the threat intelligence age Dynamic Threat Protection for Enterprise Edge and Data Center Rasmus Andersen Lead Security Sales Specialist North & RESE 1

2 Agenda Threat landscape: challenges Evolution of network security Juniper s security intelligence solution Use cases 2

3 3

4 Challenges with Evolving Threat Landscape Advanced threats require dynamic and adaptive security approaches that can be managed consistently across distributed firewalls without affecting firewall performance 4

5 Evolution of Network Security Next-Gen Firewall ü Application Visibility and Control ü Web filtering services L7 Next-gen firewall ü Antivirus ü User-based Controls ü Intrusion Prevention Services ü Reputation feeds L3 Traditional firewall Static Dynamic 5

6 Challenges with Existing NGFW Security solutions Important for layered security, but primarily reactive IPS effective primarily against known, network-based vulnerabilities NIST publish 500 new vulnerability every month can IPS keep up? Antivirus protection effective at detecting known bad files What about Polymorphic? Sandbox effective at detecting SW with malicious behavior What about Evasive Threats? 6 IP reputation feeds effective at blocking know malware sites How about known hackers?

7 5 of Gartner top 10 for information security in So&ware- defined Security 2. Big Data Security Analy:cs at the Heart of Next- genera:on Security PlaBorms 3. Machine- readable Threat Intelligence, Including Reputa:on Services 4. Pervasive Sandboxing (Content Detona:on) and IOC Confirma:on 5. Security Gateways, Brokers and Firewalls to Deal with the Internet of Things 7

8 Evolution of Network Security SRX as a Dynamic, Intelligent Firewall ü Open intelligence platform for diverse needs L7 Next-gen firewall Dynamic intelligent firewall ü Raw, curated and customized feeds ü Scalable, with centralized control ü Built for expansive data capacity ü Adaptive / tunable L3 Traditional firewall Static Dynamic 8

9 Juniper s Approach to Security Intelligence Dynamic protection against new threats Juniper adds continuous value to security intelligence feeds Juniper threat feed has the following characteristics: Compilation of data feeds from Juniper s own malware research team and 3 rd parties Data feed sets include IP addresses, domains and URLs Highly focused on Command and Control (C&C) traffic related to malware and botnets C&C data is refreshed hourly to ensure it is current and blocking only the latest threats Threat severity rating for each feed entry enables writing policy based on threat severity to fine-tune solution to your own needs, for fewer false positives and increased efficacy 9

10 Security intelligence Solution Architecture Spotlight Secure Space H/W Space Fabric ESX Firefly Perimeter Log Analytics Junos Space Security Director Spotlight Connector GA 1 st week of October Customer- provided or 3 rd Party Threat Data Local A]acker Details 10

11 Security Intelligence use cases Descrip0on Details Related SecIntel Feed Command & Control Disrup:on, Compromise Detec:on Block command & control connec:ons Block botnet ac:vity on network Iden:fy and isolate internal infec:ons Spotlight C&C Geo- based traffic shaping Block traffic from specified countries Balance load by sending only specified traffic through addi:onal security services Spotlight GeoIP ID a]ackers with Precision ( Beyond the IP ) Rapid Incident Response & 3 rd Party Threat Intelligence Integrate web app protec:on with firewall Reduce FPs and stop roaming a]ackers by using non- IP iden:fier U:lize data in firewall policy that is licensed from 3 rd par:es, consor:a Enable rapid incident response Spotlight Fingerprints Custom Threat Feeds 11

12 What s Different? Open Open intelligence framework supports feeds and services combined with customer control for more tailored policies Scalable Robust, scalable architecture supports single point of intelligence management for >1,000s of firewalls High capacity Capacity for >1M data feed entries on HE SRX firewall, including IPs, URLs, and domains Adaptable Policy engine supports fine grained controls for prioritization and categorization of threats. Supports reputational (e.g. C&C) and informational feeds (Geo IP) 12

13 Thank You