TSM Solution Terminal Security Management

Transcription

1 According to the statistics from third-party authorities, such as CSI/ FBI, IDC, and CNCERT/CC, most security events originate from the intranets. Therefore, intranet security is becoming a headache in enterprise IT security management. Enterprises suffer from losses regarding security and availability events, such as information leakage, unauthorized access, slow operating or shutdown, core service interruption, and network paralysis. The traditional desktop management or terminal security management solution fails to enable the forcible deployment of the client and is vulnerable to malicious damages. As a result, IT administrators find it difficult to deal with so many issues. Under this background, enterprises are eager to seek for a solution allowing forcible client deployment. Meanwhile, they have to deal with such difficulties: Complex access environment (covering hubs, wireless access, VPN, remote branch, NAT, and devices of multiple manufacturers): How to select a NAC solution delivering good adaptability to network environments and excellent scalability to subsequent network upgrade and expansion? Changeable terminal security requirements: How to adapt to such changes at a low cost? Limited IT administrators and skills: How to select a terminal security management solution applying easy-to-deploy and easyto manage NAC and bringing no pressure on operation? hardware. Besides good adaptability to network environments and friendly experiences, the T solution delivers following features: Requires no user network adjustment and device replacement, affects no network performance and reliability, provides refined design which is easy to deploy and manage. This optimizes user experiences by simplifying management. Provides flexibly scalable policies and reports or updates from the cloud knowledge database, meeting continuous security O&M requirements. Delivers sound service continuity, fast express on the subnet for file delivery, and real-time intelligent system operating status monitoring platform to provide users with secure and reliable performance. Offers access control, security management, and desktop management modules, meeting requirements of terminal security. Huawei T solution provides users with a reliable and integrated intranet security management solution coming with excellent adaptability to network environments, easy management, excellent scalability, high availability, and all-around functions. Thanks to abundant experience in the terminal security management field, Huawei launches the T solution based on the carrier-class Product Description The T system integrates with access control, security management, and desktop management. Specifically speaking, identity authentication lays the basis, security management serves as the guarantee, and access control acts as the measure. It applies an integrated system for enterprises, as well as reduces construction and O&M costs, maximizing return on investment (ROI). The T system delivers hierarchical and in-depth defense based on the terminal, network, and application. Regarding user identity (such as the guest, partner, and employee) and compliance (such as security assessment and system configurations), the T system limits access to terminals, networks, and core resources, prevents unauthorized or illegitimate terminals from accessing protected resources. This secures the core services of enterprises to the maximum extent. The T system protects enterprises against information leakage, malicious code spreading, network or service interruption, compliance violation, and asset loss, optimizes terminal, network, and application performance, as well as reduces the costs of asset management and O&M. In this way, the T system achieves IT availability and security, reduces intranet security management costs, and improves intranet management efficiency. HUAWEI TECHNOLOGIES CO., LTD.

2 Policy ID authentication Compliance check Authorization access Monitoring Audit P: Customize a policy Recovery D: Check/Repair C: Audit the result Remote employees A: Adjust a policy Sensitive information resources On-site employees Visitors External illegal users repair Core information resources General information resources Preventing unauthorized users Isolating and repairing untrusted users Authorizing users access range Providing audit results of behavior monitoring Act Plan PDCA Check Do The T system falls into five components, namely, T Management Center (TMC), Security Agent (SA), Security Manager (), Security Controller (), and Security Access Control Gateway (). TMC Upper system administrator WAN T node 1 Pre-authentication T node n Pre-authentication Post-authentication Service server 1 Service server 2 Service server 1 Service server 2 Post-authentication Core Network Patch Server Core Network Patch Server AV Server AV Server File repair Server File repair Server Isolation Isolation Province A Province B

3 Component TMC SA Description Software: The T Management Center (TMC) is employed for hierarchical management. It makes security policies, delivers the policies to T Managers, and monitors the implementation. Software: The SA is installed on the terminal host for assisting identity authentication and security check and for collecting the asset information and security status of the terminal. The SA uses a small amount of terminal and system resources. The CPU usage is about 2%, and the maximum memory usage is 15 MB. Software: The is the core of the T. It provides many service management functions including asset management, software distribution, patch management, log auditing, terminal security policy management, identity management, and reporting. The adopts the B/S architecture and enables the system administrator to manage the system through Web UI. The can be deployed in distribution mode. An can manage multiple s. The and compose the system server of the T. Software: The manages the SA based on the data configured by the. The implements the management functions of the. The sends the instructions and then the coordinates the related components to implement the instructions. After the user is authenticated by the SA, the sends instructions to the to assign the access permission. Hardware: As a network layer device, the controls the network access permission of terminals and allocates different permissions to terminal users with different IDs and of different security statuses. s are Huawei Eudemon series products built on carrier-class hardware platforms. Different s, such as Eudemon200E-B/C/F and Eudemon1000E-U2/U3/U5/U6 are prepared for the scenarios with different numbers of concurrent users. The can be deployed both in centralized and distributed modes, and it supports the dual-system hot backup. Product Features NAC's Robust Adaptability to Environments, Providing Unified and Friendly User Experiences Deploys the NAC in complex access environments such as wireless access, wired access, VPN, and dial-up, by the power of and host firewall access control modes. The installation requires no network adjustment and device replacement, and affects no network performance and reliability, and subsequent network upgrade and expansion. Supports three modes, that is, client, ActiveX, and Web authentication, which flexibly resolves access control problems in Windows/non-Windows terminals, employees/partners/guests, and enterprise/non-enterprise terminals. By applying functions including friendly notification of guest access, automatic or guiding repair of illegitimate terminals, and automatic granting access permissions to legitimate terminals, the T system enables terminal users to experience unified and friendly access environments. Easy Management Supports multi-phase deployment, so that terminal users can flexibly master the deployment process if desired; pushes the client download page through the to implement the rapid deployment of the client. Delivers centralized configuration and management pages to facilitate daily maintenance and management; automatically identifies non-pcs such as IP printers, IP phones, IP scanners, and distributed servers, freeing from registration and maintenance of such devices one by one before and after the NAC deployment. Applies anonymous authentication and guest management to enable guests or partners to make good use of intranet resources, reducing the administrator workload. Provides the automatic notification of terminal violations, automatic or guiding one-click repair, enabling self-management; identifies the locations where terminal users reside automatically and selects proper security policies accordingly, facilitating remote access and office. Offers user-based management and scores terminal compliance, and performs quantitative assessment on terminal security status. Excellent Scalability and Updates from the Cloud Knowledge Database Adds log databases to departments or branches, dealing with onerous log auditing.

4 Supports user-defined check policies, specifies check items, customizes terminal display information and violation report information, defines automatic repair actions, and responds to new requirements requiring no upgrade, such as clearing malicious code, patching application programs, configuring application programs, and repairing software or environment anomalies. Pre-defines massive security policies and reports for daily management, defines or obtains diversified policies and reports from Huawei cloud security center, meeting personalized and continuously developing security requirements. Assists various fields in learning about intranets by using intelligent analysis and in-depth exploration, thereby providing sufficient O&M and decision-making support for IT management. Security and Reliability Employs the carrier-class dedicated hardware device for the, avoiding inherent vulnerabilities in other software control technologies such as low reliability and easy-to-evading; supports dual-system hot backup and automatic escape, ensuring service continuity. Adopts distributed storage and subnet fast express technologies for the delivery of large files on the intranets, implementing low bandwidth occupation and high delivery efficiency. Provides the platform monitoring tool for prewarning and fault alarming, so that administrators can master the operating status in a timely manner even left unattended; Offers the online diagnosis function to troubleshoot client faults in a centralized way. All-Around Functions Combines network identity identification, access control, terminal security enhancement, office & network access behavior management, network protection, asset management, software deployment, remote assistance, and message announcement to set up a three-dimensional and complete T system. Integrates document security with portable storage device management, forming a perfect and E2E solution. Application Scenario Core server Internet Pre-authentication Remote user Border router Intranet Post-authentication Anti-virus server Border router Border router... SA SA SA Node A... SA SA SA Node B

5 In distributed networking, the and are deployed together, the is deployed at location (core router or switch) where subordinate traffic is converged, and the s are deployed at nodes A and B with numerous terminals. In so doing, access control remains when the links between the subordinate nodes and the headquarters are interrupted; guests, partners, and illegitimate terminals are prevented from directly accessing core resources; terminal access compliance and control are safeguarded through the NAC. The T solution enhances the terminal security defense capabilities of enterprises, reduces the intrusions of viruses, Trojan horses, spyware, and other malicious software, reduces information leakage risks, ensures legitimate use of network resource, improves the working efficiency, as well as guaranteeing compliance. Product Specifications Network identity identification Access control Security management Desktop management Policy management O&M report System management Specifications Anonymity Local account AD Third-party LDAP PKI/CA Compliance check Authorized access range One-click automatic repair Security enhancement Office behavior management Information leakage defense Network defense Patch management IP asset auto-discovery Asset management Software distribution Remote assistance Message announcement Authority- and -based management Policy template Location awareness Defining a policy or obtaining a policy from the security center Presetting statistics reports Presetting trend reports Defining or obtaining a report from the security center Server platform monitoring Client online fault diagnosis Remote database backup Support or Not

6 Networking mode Specifications working mode: routing, transparent, and composite HA: active/standby and active/active Centralized networking Distributed networking Hierarchical management Support or Not Copyright Huawei Technologies Co., Ltd All rights reserved. General Disclaimer The information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There are a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice. HUAWEI TECHNOLOGIES CO., LTD. Huawei Industrial Base Bantian Longgang Shenzhen , P.R. China Tel: Version No.: M C-1.0