Cisco Identity Services Engine

Transcription

1 Cisco Identity Services Engine Secure Access Stefan Dürnberger CCIE Security Sourcefire Certified Expert

2 Most organizations, large and small, have already been compromised and don t even know it: 100 percent of business networks analyzed by Cisco have traffic going to websites that host malware. Cisco 2014 Annual Security Report

3 The Security Problem - Impact of a Breach The security problem Changing Business Models Dynamic Threat Landscape Complexity and Fragmentation 60% data in breaches is stolen in hours 54% of breaches remain undiscovered for month Information of up to 750 million individuals on the black market over last three years

4 How would you do security differently if you knew you were going to be compromised?

5

6 Attack Continuum

7 Cisco ISE is not just a single product. It is a system, securing your wired, wireless and RA VPN infrastructur including guest services and more [SD]

8 Cisco Secure Access Enabled by ISE Secure Access on wired, wireless and VPN Control with one policy across wired, wireless and VPN XYOD Users get safely on the network fast and easy Guest Access It s easy to provide guests limited time and resource access TrustSec Network Policy Rules written in business terms controls access

9 ISE / TrustSec How-To Guides

10 ISE Hardware

11 Cisco ISE Appliance Based on the Cisco UCS C220 M3 Server Virtual Appliance based on VMWare Hypervisor

12 SNS-34x5 Appliances- Specs Platform Secure Network Services Appliance SNS-3415-K9 Secure Network Services Appliance SNS-3495-K9 Processor 1 - QuadCore Intel Xeon 2.4 GHz 2 - QuadCore Intel Xeon 2.4 GHz No. of Cores per CPU 4 (4 total cores) 4 (8 total cores) Memory 16 GB DDR (4 x 4GB) 32 GB DDR (8 x 4GB) Hard disk Inch 600 GB SAS 10K RPM Inch 600 GB SAS 10K RPM RAID No Yes - RAID 1 (600 GB Total Storage) Ethernet NICs 4 (2 on board; 2 on NIC) 4 (2 on board; 2 on NIC) Power Supplies 1 x 650W 2 x 650W Trusted Platform Module Yes Yes SSL Acceleration Card No Yes Concurrent Endpoints 5,000 (PSN function) 20,000 (PSN function)

13 ISE Architecture

14 Cisco ISE Architecture Logging Monitor View Logs/ Reports Logging Admin View/Configure Policies Policy Service Query Attributes External Data Request/Response Context Logging Endpoint Access Request Enforce Resource Access Resource

15 Distributed Topology Deployment Admin (P) PAN Monitor (P) MnT Policy Services Cluster PSN PSN PSN PSN Admin (S) Monitor (S) PAN MnT Distributed Policy Services PSN PSN ASA VPN AP HA Inline Posture Nodes IPN IPN WLC 802.1X Data Center A Switch 802.1X AD/LDAP (External ID/ Attribute Store) Switch 802.1X DC B AD/LDAP (External ID/ Attribute Store) WLC 802.1X AP Branch A Branch B PSN Branch C PSN AP Switch 802.1X AP Switch 802.1X AP Switch 802.1X

16 ISE Software - Functional Description -

17 Secure Access: Classification Attributes Who? Employee Attacker Guest What? Personal Device Company Asset How? Wired Wireless VPN Starbucks Headquarters When? Week Days Weekends 8:00 AM 6:00 PM (8:00am 5:00pm) PST

18 ISE- Identity Stores Identity Store OS / Version ISE RADIUS Active Directory LDAP Servers Token Servers Internal Endpoints, Internal Users RFC 2865-compliant RADIUS servers Microsoft Windows Active Directory 2003, 32-bit only Microsoft Windows Active Directory 2003 R2, 32-bit only Microsoft Windows Active Directory 2008, 32-bit and 64-bit Microsoft Windows Active Directory 2008 R2, 32-bit and 64-bit Microsoft Windows Active Directory 2012 (ISE 1.2) SunONE LDAP Directory Server, Version 5.2 Linux LDAP Directory Server, Version 4.1 NAC Profiler, Version or later RSA ACE/Server 6.x Series RSA Authentication Manager 7.x Series RADIUS RFC 2865-compliant token servers SafeWord Server prompts

19 Cisco ISE X Authentication

20 PEAP/TLS with Windows/MAC/Linux PEAP/TLS is supported on all OS and compatible with compliance module Compliance module is supported on Windows & MAC

21 Cisco ISE- MAC Authentication Bypass

22 Cisco ISE- Profiling Profiling Database is filled up with endpoint information Using these information in policies will consume licenses

23 Cisco ISE- Profiling

24 Cisco ISE- Compliance State of compliance with the company s security policy Is the system running the current Windows patches Do you have anti-virus software installed? Is it up to date Do you have anti-spyware software installed? Is it up to date Services, Applications/processes & Registry Keys

25 Cisco ISE- Compliance AC get s security product information out of the scan. These information are available in DART as well.

26 Cisco ISE- Policy Enforcement VLANs DACLs SGTs

27 Cisco ISE- Policy Enforcement Downlink Encryption

28 Sponsor & Guest Local users or Active Directory Users/Groups are allowed to generate guest accounts Different types of Guests (daily weekly monthly user defined) Sponsors can create single, a bunch of guests with one click or can import from a.csv file

29 Sponsor & Guest cont. Different sponsor portals can be configured. Fully customizeable (HTML, CSS) Concept of sponsor all accounts, group accounts and own accounts Locallobby user can just see and manage their own created guest accounts Sponsor can manage guest accounts like reset password, extend the account...

30 Sponsor & Guest cont. Priviliges like VLAN, DACL, etc. can be different for wired/wireless guests. ios/android profiles can be dynamically created by ISE to onboard private devices. Not shown in the POC Guest Flow All unknown Endpoints (wired or wireless) are treated as guests. This make your network a closed infrastructure

31 Sponsor & Guest cont. More Options for Guest Guest self-registration- SMS, Guest self-registration with sponsord approval Daily code for trainings Hotspot

32 ISE Syslog & Prime integration cont. ISE brings identity & endpoint information to Cisco Prime E.g. posture information. Use magnifier to drill into the event

33 ISE troubleshooting options Click here to get output below

34 ISE troubleshooting options cont. Get your.pcap directly from ISE. No need for SPAN during troubleshooting. Other tools available on the left pane.

35 ISE troubleshooting options cont.

36 Cisco ISE- REST API

37 Cisco ISE is not just a single product. It is a system, securing your wired, wireless and RA VPN infrastructur including guest services and more [SD]

38