The role of ISP - VDC in promoting a culture of cybersecurity

Transcription

1 The role of ISP - VDC in promoting a culture of cybersecurity Presented by: Mr. Nguyen Chi Cong Information Security Department - VDC

2 Contents VDC Company Profile VDC and Information Security The role of VDC in promoting a culture of cybersecurity

3 VDC Company Profile

4 Introduction Vietnam Datacommunication Company A member of VNPT Group Largest Internet Exchange Provider (IXP) SI and application solution provider 50%+ Internet market share Unique service in 64/64 provinces Best Internet Services Provider since 2001 (award by PC World Vietnam Magazine) Partner with almost famous national & international corporations

5 A leading company 59,3% market share of Internet services 400K ADSL subscribers (50%+ market share) 450K Dial-up subscribers (50% market share) 3M VNN newsletter subscribers 16K icafe nationalwide under VDC licensing 90% market share of data communication 87.2% international Internet bandwidth 5Gbps International links Source: Business Department 5/2007

6 VDC positioning Ministry of Post and Telematics (MPT) Facility based operators VNPT group Viettel (Army) Saigon Postel (joint-stock) VP Telecom Hanoi Telecom Co. (under Power Co.) (under HANEL) Mobile operators MobiFone GSM 2.5G VinaPhone GSM 2.5G Viettel Mobile GSM 2.5G Sphone CDMA X Hanoi Telecom Co. CDMA 3G Internet Exchange Providers VDC FPT Communications Viettel Internet SaigonNet SPT Hanoi Telecom Co. Online Service, content Providers (About 12) VDC FPT Communications SaigonNet SPT NetNam

7 Where we are? VDC1- Hanoi VDC3 - Da Nang The largest Internet Exchange Provider VDC2 - Ho Chi Minh

8 Facts & figures 10 Mbps Taiwan International Gateway : 5 Gbps Domestic backbone : 3x 2,5 Gbps Hà Nội 2,5Gbps Đà Nẵng 665 Mbps 620 Mbps 8 Mbps 400 Mbps 1240 Mbps Japan China Malaysia USA Singapore Hong kong 620 Mbps TP HCM 155 Mps Korea

9 International links NTTCom Chunghwa Telecom Dacom KORNET ChinaNet Malaysia Telecom Intelsat PCCW FUSION SingTel KDDI T-systems SPT FPT VDC Vietel ETC STM4 STM1 xds3 E1 and below

10 VNN Network 64 POPs in Vietnam with dedicated and dial in access, almost with broadband Internet access

11 VDC Service provision App. Customer focused Managed IT Game, Video, Music, Finance, B2C, B2B, G2B , WWW, DNS, Netnews, FTP, Colocation, Hosting, Master Content Data voice VoIP Netfax Billing, Accounting, CRM, CSS, Payment, Post Solution, Security Managed network Frame Relay, VNN/Internet, VPN/VNN Network based Components Services IT & Digital content

12 VDC Service provision VNN/Internet Service Direct VNN/Internet Service Dial-up Access VNN/Internet Broadband Internet Service Service VPN/VNN Service VoIP 1717 Fone VNN Web Services Web Hosting Services Telehosting, Telehousing and IDC Service Online Advertisement Web Server ID E-learning Services Datacommunication Services Data Transfer Services VietPac Frame Relay Service

13 VDC Service provision E-Commerce VDC Super Market E-shop Service Mail Offline Mail Plus Web Mail IT Services Consultant for solution Solution Design Frame Relay, VNN/Internet, VPN/VNN Software Development Integration and Deployment Training and Support Security Services

14 Focused business Network services Basic services Security Digital content IDC (Internet Data Center) E- commerce IT & Integrated services Frame Relay, VNN/Internet, VPN/VNN WWW DNS Netnews FTP For ISP For Subcribers For Customers FOCUSED! Colocation Hosting Game Video Music Fortunetelling Finance B2C B2B G2B Billing Accounting CRM CSS Payment

15 A winning team Labor Sk il l st r uct ur e Percentage employees 80% university degree 3% Post-Graduated Young and skillful staffs with Microsoft, Oracle, Cisco, Nortel certificates 80.00% 70.00% 60.00% 50.00% 40.00% 30.00% 20.00% 10.00% 0.00% Level of education Post Graduated University degree Colleage Degree Intermediate level Vocational training Secondary level

16 VDC Partners TRANSIT Partner CUSTOMERS SOLUTION Partner

17 VDC and Information Security

18 Challenges Protection against attacks Secret Information Customer Information Accounts, Bill Business & Technical secret Keeping trust information Bill, network configuration Others business data Availability of system VDC always has to ensure

19 Damages Direct losses to economy Bill lost, Bill value changed Services Interrupted Indirect losses to economy Lose prestige Brand name

20 Risks VDC is attractive target Bigest ISP in Viet Nam Possibility of making benefit Cause of scandal Issues

21 Attackers Professional crime Seeking for economical benefit Other benefit Non-professional crime Almost is pupils, students, Curiousness, discovery Self-assertion Immediate benefit

22 Protection Methods Management methods Bulding up security staff In cooperation with appropriate authorities Policies, rules, processes Prevent from stealing 1260 account Technical methods Design Secure System Authentication Access control Multi-layer protection (Physical Access, Network Protect, App Protect, ) Supporting tools (Firewall, IPS, Web Filtering, ) Backup Carrying out by experts Monitoring, supervising and maintaining frequently (Firewall s warning, IPS, Logfile, network monitoring devices, other unexpected problems)

23 Protection Methods VDC s Firewalls Using multi-layer firewalls for protecting VNN network layers Firewall technologies: Cisco PIX Firewall for Internet gateways Cisco Firewall Service Modules on Catalyst 6500 for Data Centers Checkpoint Firewall for backend segments

24 Integrated Security Strategy: Protecting VDC Networks BUILD SECURE Networks with security fully integrated throughout the infrastructure cloud to strengthen the SP s ability to deliver all network services efficiently and safely DataProtection Clean Pipes NetFlow Filtering of packets and routes Rate limiting and other QoS enforcement techniques Classification and reclassification of traffic Redirection of traffic Traffic transit policies Intrusion detection and protection Analysis, profiling and monitoring of traffic Secure Connectivity Encryption Authentication System Protection Image and configuration archiving Selective management and configuration views Stack protection Thresholding Image verification Password access Control plane policing CPU/Memory Thresholding Routing Protocol validation Trust & Identity Address, source and route validation Secure address allocation Reporting & Remediation

25 Integrated Security Strategy: Protecting VDC Networks BUILD SECURE Networks with security fully integrated throughout the infrastructure cloud to strengthen the SP s ability to deliver all network services efficiently and safely Benefits: Network Reliability Securing network infrastructure for stable network operations Network Efficiency Removing improper traffic from flow to provide greater capacity and availability to legitimate traffic Cost Savings Ability to quickly respond to evolving security threats will minimize network disruption costs Service Assurance Increasing provider s ability to meet SLA requirements Customer Trust Through network reliability and service assurance, service providers can earn customer loyalty and decrease churn

26 VDC Infrastructure Security framework Endpt / CPE CPE(s) Broadband, Wireless (3G, ), Ethernet, FTTH, Leased Line, ATM, Frame- Relay ACCESS/AGGREGATION PE(s) PE L2 Agg. CORE P P P P DATA/SVC Center P P PEERING Peering: Policing Core Security Control Plane ISP / Alt. Carrier CPE: Firewall IDS IPSEC Control Plane Security Forwarding Plane Security Re-DHCP subscriber Diversion Access and aggregation: Basic infrastructure security role Control Plane Security Data Plane Security Firewall IDS IPSEC DHCP subscriber (dial) Diversion (quarantine, clean pipes) SSL Trust and Identity Data/Service Center Service Center: Remediation (quarantine) Intrusion Detection/Prevention Anomaly detection (Netflow+Arbor Peakflow DOS) Scrubbing Firewall Security Monitoring Core: Data Plane Mgmt/Access Plane Control Plane Core Security

27 Three VDC Security Directions Infrastructure Security Up to now, security on edge devices has focused on protection from reconnaissance, access, DDoS, etc. Infrastructure security is a mandatory requirement for service survival Security should be pervasive and consistent throughout every device - integral to every port, every interface, every medium, every switch, every router, every protocol, every service.. Clean Pipes Service Providers introducing infrastructure protection services SPs provide scrubbed traffic to users Managed Security Services (network and customer premise) Increases in service outsourcing (VPNs, firewalling, IDS, content hosting) drive security services into PE Devices MPLS VPNs driving other virtualised services Residential/SMB markets require network-based content and functionality

28 VDC Network Security Features Infrastructure Security Netflow QoS ACLs urpf Lawful Intercept Routing High Availability Authentication Content Networking Clean Pipes (DoS Scrubbing) Network Admission Control Dynamic Attack Mitigation IDS/FW NBAR Security Services Virtual Services VPN Firewalling IDS/ IPS Antivirus Web Filtering MANDATORY OPTIONAL + CUSTOMER CHOICES

29 Customers feedback Various services meeting requirements from subscribers Stable, reliable QoS Subscribers information secured

30 The role of VDC in promoting a culture of cybersecurity

31 Activities ISP s responsibilities Providing best services for customers Supporting 24/7 PR activities Provding Internet for Remote areas Project Providing Internet for Schools Project Vietnamese Talents Contest Many others sponsoring activities Reponsibilities for appropriate authorities Implementing Government s assignment Supporting (internet connection, investigation, ) In cooperation with VNCERT

32 Thank you!