Protecting Your Enterprise Networks: A Comprehensive Approach for End-to-End Security

Transcription

1 Protecting Your Enterprise Networks: A Comprehensive Approach for End-to-End Security Network security is mission critical for Multinationals to succeed in today s e-business environment without losing the trust of customers, employees or partners Security Issue mp-tb001-01

2 Network Security: An Important Part of Your Global Business Planning IT security today typically is under the jurisdiction of IT managers who oversee the hardware, software and networking components of multinational corporations. However, based on the importance of enterprise applications like enterprise resource planning (ERP), supply chain management (SCM), customer relationship management (CRM) and other critical Webbased applications and how these applications impact overall business strategy decisions about security issues have escalated to key corporate decision-makers. CXOs recognise that protecting their company s assets greatly enhances their ability to execute on critical e-business initiatives. Whether network security concerns are confined to the intranet (for internal applications), extranet (for communications with business partners, suppliers and clients), or Internet (for browsing and e-commerce) it is an integral component of any global organisation s business planning and execution.

3 Network Security Factors Affecting Today s Security Choices Successful implementation of a business strategy typically implies providing information to targeted communities. These communities can exist over a private intranet (e.g., via an ERP application), over an extranet (via an SCM application) or the Internet (via a CRM application). For each of these target audiences, applying the appropriate level of security is key. The security plan should balance the mix of specific applications, the environment, the systems and processes in place and user requirements. Security is typically considered a broad topic. Areas such as access control, encryption, authentication and repudiation need to be addressed without excess expenditures or measures. In light of that need, the security plan should balance the mix of specific applications, the environment (intranet, extranet, Internet), the systems and processes in place and user requirements. E-business initiatives typically promote a collaborative approach among members of a business ecosystem; yet, in juxtaposition, there is a need to ensure high transaction integrity. The goal is to provide the right level of cost-effective security without hampering or delaying the transactions beyond a satisfactory point. While security policies typically target external communities, protection against intentional or unintentional actions from employees should also be part of a well thought-out plan. All too often this problem is overlooked until a breach occurs. Whether a security incident occurs due to an internal or external cause, the cost of that event ultimately includes: business downtime, repair, recovery and loss of credibility to the business ecosystem of partners, suppliers, and most valued, the customer. 3

4 Business Needs to Consider for Your Security Policy Regardless of the nature of your multinational business, your security policy should provide an overall layer of protection while meeting your company s specific needs. The flexible and customisable nature of the network security that Infonet provides enables our clients to build a solution that best suits their needs. To begin the process of upgrading an existing security plan (or creating an entirely new policy) there are decisions, based on business objectives, that will impact your security options.

5 How much security is available for my network? Complete application analysis Avoid the over/under-provisioning of your security Pro-actively plan for future security needs If your network is based on the public Internet, your options are very different than if you use a private network or a combination of public and private. You ll need to consider the specific needs of your applications (e.g., speed, limited user access, etc.), and plan for security accordingly. You may find that when you examine your business strategies you may be using insufficient networking technology. It s important to "right-size" your security plan to avoid over- or under-provisioning your needs. What s the best insurance for business continuity? Geographic diversity of critical network operation and data centres Disaster planning Infrastructure built on redundancy The most stringent security policy is ineffective if the network continually experiences downtime. High-quality network performance, resiliency and an infrastructure built on redundancy in line with disaster planning are important contributions to a sound security policy. Geographic diversity that protects critical network operation centres (NOCs) and data centres is also an important consideration. How do I determine the most cost-effective method of providing security for my multinational company? Outsource expert security management Leverage up-to-date technology Outsourcing your security and network management automatically frees up your internal networking resources to work on your core business needs. Outsourcing (via partnering), to address your security requirements, ensures that the expertise, staff and tools you need for cost-efficient, up-to-date technology is available to you 24/7/365 along with the management of your security solution. Once my security policy is in place, what s the best way to manage it? World-wide security guidelines Vigilant 24/7 monitoring Many multinational corporations have IT departments that oversee the daily maintenance of corporate security policies. Typically they represent the expertise to manage desktop and Local Area Network (LAN) security practices. A key benefit, however, of outsourced network services is that you can rely on that partner, focusing on the edge of the network, to maintain a vigilant watch for potential problems globally and enforce corporate security guidelines worldwide. 5

6 Employing a unique consultative approach allows Infonet to gain insight into the communication needs of our clients. Infonet s goal is to offer secure communication options that best support the business needs of our clients.

7 A Consultative Approach The Infonet Approach To Security Infonet employs a unique consultative approach that enables us to gain insights into the communications needs of our clients. Our customised security services are also designed to be integrated into our value-added network solutions. Drawing upon a long heritage of reliable, quality service, we provide security for multinational corporations (e.g., private sector finance, software and pharmaceutical) and government agencies around the globe. Our goal is to continue to offer the communications options that best support the business needs of our clients. Consulting Services Towards this mission, Infonet offers Consulting Services designed to assist multinational enterprises in more closely aligning their IT investment with the business goals of their companies. As part of the Assessment stage of our network lifecycle approach, we offer a Security Risk Assessment service. We analyse your specific business requirements, data confidentiality, integrity and availability, and provide a baseline for the effectiveness of your security position in order to make recommendations leading to a comprehensive security plan for your organisation. With this service we address your physical security environment, access control, security policies and procedures, training, personnel behaviour and overall enterprise-wide security awareness. This service also benchmarks your current environment against "best practices" for your industry. Infonet Security Tools Depending on your network infrastructure (whether your corporation operates mainly over intranets, extranets, or the public Internet), Infonet offers layers of the latest security technology that are tailored to your needs. We can create customised and integrated solutions that include encryption (IPSec), authentication (Public Key Infrastructure [PKI] and digital certificates) and dial back-up options that integrate Cisco CPE and VeriSign Certificate Authority services that are available globally. These security services are available for IP VPNs, Internet-based VPNs, ATM and Frame Relay VPNs. Infonet Expertise Our people are our first line of defence. Infonet employs full-time CISSPs (Certified Information Systems Security Professionals) and CISAs (Certified Information Systems Auditors). Security training for all employees is mandatory, frequent and ongoing. Our CERT (Computer Emergency Response Team) ensures immediate global emergency response to security threats following standardised procedures. We employ third-party ISO9001 and SAS70 audit organisations to validate our global information security policies and procedures and to validate our ongoing internal and Internet security audits. Infonet offers layers of the latest security technology that are tailored to your needs. In executing on their e-business initiatives, multinationals typically have enterprise applications like ERP, SCM, and CRM operating globally, while providing various members of their business community with access to these applications. This community can include employees, business partners, vendors and customers. While all of these community members can access the information they need over both private (intranet) and public (Internet) infrastructures, security recommendations typically follow a pattern as shown in the following table. 7

8 Application/Security Measure Intranet 1 Extranet 2 Internet 2 ERP X SCM X CRM X Other Applications X X X Security Type (Optional) (Recommended) (Critical) - Data Integrity (via Encryption) - Authentication (via Digital Certs) - Repudiation (via Digital Certs) - Access (via Firewall) 1 The World Network, by Infonet, is certified by independent auditors, trusted by thousands of multinationals today and judged as being highly secure. As such, while Infonet s security services are available as an option, they are typically only used for ultracritical data and information flows such as financial transactions, product development and government communications. 2 Since Infonet operates as a Tier One Internet Transit provider, we can supplement both our extranet and IP VPN Internet services with additional security, particularly for unsecured destinations over any public infrastructures. Infonet Resiliency The foundation for our fully-managed network services is Infonet s global project management and ongoing support. Our award-winning client support helps businesses run more smoothly. We provide a single point of contact to manage your network performance and deliver Web-based performance reports for you to view your network in real time.

9 Network Services Case Study Swedish Match Extranet Infonet Builds Managed Extranet with End-to-End Network Security for Swedish Match To strengthen its position as a leading, global player in tobacco products, Swedish Match decided to build an extensive business-to-business community or "extranet." The purpose of the extranet was to give the manufacturer s partners, customers and employees located in remote offices, access, via the Internet, to mission-supporting applications. With a portfolio of services including its Internet Virtual Private Network (IVPN) and end-to-end Network Security Services (NSS), Infonet became Swedish Match s first choice for building the company s extranet. NSS enables Infonet to build extranets by supporting end-to-end encryption using a variety of network infrastructures including Private IP, Global Frame Relay and an Internet Transit (public Internet) backbone. Infonet designed NSS using standards-based IPSec 3DES hardware encryption in Cisco CPE and PKI, a result of its partnership with VeriSign, a certificate authority. Infonet enables Swedish Match to determine who can access their extranet and enables the company s partners to securely and reliably share information. "We see VPN technology as a way to leverage the Internet so we can connect offices and factories that otherwise would be hard to justify in terms of the cost of traffic patterns and geographical location," said Michael Winberg, Corporate IT Infrastructure Manager of Swedish Match. The Swedish Match extranet is state-of-the-art: it combines a high performance global VPN over a fully-managed infrastructure and end-to-end security over the public (Internet) network. The extranet service extends the Swedish Match network globally and provides the management, efficiency, security and infrastructure the company needs to provide applications to a broad base of strategic business partners. 9

10 Problem Infonet Resiliency + Security Product Availability Matrix Solution How do I assess my current situation? I n t r a n e t E x t r a n e t I n t e r n e t Do I have adequate back-up? Dial Dedicated Dial Dedicated Dial Dedicated I n f o n e t C o n s u l t i n g Resilency / Security Audit Is my network protected? Do I know who accesses my systems? N/A Dial B-U Options N/A Dial B-U Options N/A Dial B-U Options Redundancy M a n a g e d F i r e w a l l S e r v i c e s Firewall Can I ensure data integrity? SecurID TACACs, User ID/Password User ID/Password Digital Certs User ID/Password Digital Certs Authentication L2TP Tunneling MPLS, PVCs SOCKS NSS N/A NSS Tunneling / Encryption DialXpress Professional GFR, ATM, IP VPN Secure Managed Extranet Services IP VPN Offnet DialXpress Internet Dedicated Internet Access I n f o n e t S e r v i c e N a m e Infonet s security services can be added as an option for any of our networking services clients. Some of Infonet s value-added security services include: - Dial Back-up Options - Disaster Recovery Services - Remote Access SecurID Services - Managed Firewall Services (premises or network-based) - Network Security Services (IPSec, 3DES Encryption and digital certification) Infonet uses best-of-breed partners to support our line of security services including Check Point, Cisco, Controlware, ISS, NetIQ, RSA Security, VeriSign and Websense. Summary Security is a necessary and strategic part of business planning for multinational corporations. As a leading provider of global communications solutions, Infonet is uniquely positioned to offer a complete range of security solutions that help fortify the business strategies of today s multinationals. We offer analysis and assessment services that help strengthen your security policies and the latest technology, making Infonet your ideal sole-source partner to help you run critical business systems more efficiently. For more information, contact your Infonet representative.

11 Outsourcing your security and network management automatically frees up your internal networking sources to work on your core business. By outsourcing network security services, you can have a partner who will maintain watch for potential problems. 11

12 About Infonet Infonet Services Corporation is a leading provider of value-added global communications services to over 2,600 multinational clients, providing innovative network-based solutions to support the business needs of our clients. Using a unique consultative approach to gain insight into the needs of our clients, Infonet offers solutions that optimise the relationship between enterprise applications and network infrastructures. Our global capabilities are the foundation for the services that constitute our solution offerings (broadband, Internet, intranet, multimedia, remote and local access, provisioning, application and consulting services), positioning Infonet as the ideal single-source partner for multinationals. Worldwide Headquarters Asia-Pacific 391 A Orchard Road #13-08 Ngee Ann City Tower A Singapore Tel: Fax: Europe, Middle East & Africa 350/358 Avenue Louise Box 3 B-1050 Brussels, Belgium Tel: Fax: Latin America Mardoqueo Fernandez 128 Piso 7 Providencia, Santiago, Chile Tel: Fax: North America 2160 East Grand Avenue El Segundo, California USA Tel: Fax: An ISO Registered Firm Infonet, DialXpress, Global Connect and The World Network are registered trademarks of Infonet Services Corporation. DialXpressway, PerspeXion and Insight Matters are trademarks of Infonet Services Corporation. SecurID, Checkpoint, Verisign and other product names that may be used herein are for identification purposes only and may be trademarks of their respective companies. Copyright 2002, Infonet Services Corporation. All rights reserved. 02/02 MP-TB