Network as an Sensor & Enforcer

Transcription

1 Network as an Sensor & Enforcer Leveraging the network to control threats Jaromír Pilař May, 2016

2 Agenda Overview of Network as a Sensor and Enforcer Network as a Sensor Network as an Enforcer Summary and resources

3 Network as a Sensor and Enforcer Overview

4 Security Challenges Growing Attack Surface Dynamic Threat Landscape Complexity and Fragmentation

5 How Data Breaches Happen Malware dropped via backdoor Reconnaissance Victim clicks phishing link Lateral Movement to find Admin Escalate Privilege to become Admin Data Exfiltration using Admin privilege Information monetized after breach

6 You Can t Protect What You Don t See 60% 85% 54% of data is stolen in HOURS of point-of-sale intrusions aren t discovered for WEEKS of breaches remain undiscovered for MONTHS 51% increase of companies reporting a $10M loss or more in the last 3 YEARS A community that hides in plain sight avoids detection and attacks swiftly - Cisco Security Annual Security Report

7 A Threat-Centric Security Model Attack Continuum Before Discover Enforce Harden During Detect Block Defend After Assess Contain Remediate Network as a Sensor Network as an Enforcer

8 Network with Only Perimeter Visibility Many devices in your network without visibility Visibility available for traffic transiting through perimeter / / / Internet

9 Enabling Visibility Inside Your Network Cryptic network addresses that may change constantly Difficult to manage policy without any context / / / Internet

10 Context based Visibility and Control Allowed Traffic Denied Traffic Employee Clear understanding of traffic flow with context Supplier Server Easier to create & apply policy based on such context Quarantine Network Fabric High Risk Segment Shared Server Internet Employee

11 Network as a Sensor - Cisco ISE, Netflow and visualization and mitigation tools Context Information NetFlow Cisco ISE Mitigation Action Real-time visibility at all network layers Data Intelligence throughout network Assets discovery Network profile Security policy monitoring Anomaly detection Accelerated incident response Integration options Cisco Platform Exchange Grid (pxgrid) open to 3 rd party API/script for example APIC-EM and Flowmon integration

12 access-list 102 permit tcp lt gt 1462 access-list 102 permit tcp gt lt 4384 access-list 102 permit icmp eq eq 878 access-list 102 permit ip gt eq 467 Network as an Enforcer Traditional Security Policy with TrustSec Security Control Automation Simplified Access Management TrustSec Security Policy Improved Security Efficacy software defined segmentation Network Fabric Switch Router Wireless DC FW DC Switch Flexible and Scalable Policy Enforcement

13 Network as a Sensor

14 Introduction to NetFlow Switches Routers NetFlow provides Trace of every conversation in your network An ability to collect record everywhere in your network (switch, router, or firewall) Network usage measurement An ability to find north-south as well as east-west communication Light weight visibility compared to SPAN based traffic analysis Indications of Compromise (IOC) Security Group Information Flow Information Packets SOURCE ADDRESS DESTINATION ADDRESS SOURCE PORT DESTINATION PORT 443 INTERFACE IP TOS Gi0/0/0 0x00 IP PROTOCOL 6 NEXT HOP TCP FLAGS 0x1A SOURCE SGT 100 APPLICATION NAME : : NBAR SECURE- HTTP Internet

15 Cisco Network Empowers NetFlow in Scale Comprehensive view into all activities Usage Packet count Byte count Source IP address Destination IP address From/To Unsampled NetFlow on Cisco devices allows all traffic to be collected Time Start sysuptime End sysuptime Packet count Byte count Application Fundamental capabilities built-in to Cisco Routers and Switches plus UCS vnic Even on routers full 1-to-1 NetFlow introduced little overhead, typically around 5% but upwards of 15% in the worst case depending on prior CPU utilization Port Utilization QoS Input ifindex Output ifindex Type of Service TCP flags Protocol Next hop address Source AS number Dest. AS number Source prefix mask Dest. prefix mask Routing and Peering

16 NetFlow Terminology Flow Traffic set defined by a set of KEY fields Ex. Source IP, Destination IP, Source Port, Destination Port, Protocol, TOS, Interface Flow Record NetFlow Protocol Data Unit exported from a NetFlow generator Contains a collection of KEY and NON- KEY fields relating to a flow Non-KEY fields Ex. Bytes, Packets, TCP Flags, AP MAC and Client MAC Flow Collector A device that receives NetFlow records from a NetFlow generator Flow Template A flexible (v9) feature that advertises the record format to the collector Flow Exporter A NetFlow configuration of where (Collector) the flows are going to be sent, including IP address and protocol/port NetFlow Generator A NetFlow enabled network device

17 Myths about NetFlow Generation Myth #1: NetFlow impacts performance Hardware implemented NetFlow has no performance impact Software implementation is typically significantly <15% processing overhead Myth #2: NetFlow has bandwidth overhead NetFlow is a summary protocol Traffic overhead is typically significantly <1% of total traffic per exporting device 17

18 NetFlow in Motion Source NetFlow Generator Destination NetFlow Key Fields 1 Source IP Address Destination IP Address Source Port Destination Port Destination Port TOS byte (DSCP) 3 2 NetFlow Cache Flow Information Address, ports Packets Bytes / packet Input Interface FlowCollector

19 NetFlow Supported Platforms NetFlow Capable WAN User Switch Router Router Firewall DC Switch Server ISE NetFlow Exporters Catalyst 2960-X (NetFlow Lite) - Sampled Only Catalyst 3560-X (SM-10G module only) Catalyst 3750-X (SM-10G module only) Catalyst 3850/3650 (FNF v9 SGT support) Catalyst 4500E (Sup7E/7LE) Catalyst 4500E (Sup8) (FNF v9 SGT support) Catalyst 6500E (Sup2T) (FNF v9 SGT support) Catalyst 6800 (FNF v9 SGT support) Cisco ISR G2 (FNF v9 SGT support) Cisco ISR 4000 (FNF v9 SGT support) Cisco ASR1000 (FNF v9 SGT support) Cisco CSR 1000v (FNF v9 SGT support) Cisco WLC 5760 (FNF v9) Cisco WLC 5520, 8510, 8540 (v9) * ASA5500, 5500-X (NSEL) Nexus 7000 (M Series I/O modules FNF v9) Nexus 1000v (FNF v9) Cisco NetFlow Generation Appliance (FNF v9) Cisco UCS VIC (VIC 1224/1240/1280/1340/1380) Cisco AnyConnect Client (IPFIX) *

20 Network as an Enforcer

21 access-list 102 permit tcp lt gt 1462 access-list 102 permit tcp gt lt 4384 access-list 102 permit icmp eq eq 878 access-list 102 permit ip gt eq 467 Network as an Enforcer Software-Defined Segmentation with TrustSec Traditional Security Policy Security Control Automation Simplified Access Management Improved Security Efficacy TrustSec Security Policy Network Fabric Switch Router Wireless DC FW DC Switch Flexible and Scalable Policy Enforcement

22 Network Segmentation with TrustSec Segmentation based on RBAC Independent from address based topology Role based on context AD, LDAP attributes, device type, location, time, access methods, etc Use Tagging technology To represent logical group (Classification) To enforce policy on switch, router, and firewall Software Defined Policy managed centrally Policy provisioned automatically on demand Policy invoked anywhere on the network dynamically Security Group: Manager Username: johnd Group: Store Managers Location: Store Office Time: Business Hour AUTHORIZED PERSONNEL ONLY Resource Enforcement Switches Routers Firewall DC Switch Hypervisor SW

23 How TrustSec Simplifies Network Segmentation Traditional Segmentation Static ACL Routing Redundancy DHCP Scope Address VLAN Enterprise Backbone VACL Aggregation Layer Access Layer TrustSec Micro/Macro Segmentation Central Policy Provisioning No Topology Change No VLAN Change DC Servers Enterprise Backbone DC Firewall / Switch Policy Access Layer ISE Non-Compliant Voice Employee Supplier BYOD Voice Non-Compliant Employee Supplier BYOD Quarantine VLAN Voice VLAN Data VLAN Guest VLAN BYOD VLAN Employee Tag Voice VLAN Data VLAN Security Policy based on Topology High cost and complex maintenance Supplier Tag Non-Compliant Tag Use existing topology and automate security policy to reduce OpEx

24 TrustSec in Action Remote Access ISE Directory Application Servers 8 SGT 5 SGT Wireless Network Users Switch Routers DC Firewall DC Switch Application Servers 7 SGT Classification Propagation Enforcement

25 TrustSec Functions Classification Propagation Enforcement 5 Employee 6 Supplier 8 Suspicious A B 8 5 Static Dynamic Inline SXP WAN SGACL SGFW SGZBFW

26 TrustSec Supported Platforms SGT User WAN (GETVPN DMVPN IPSEC) Switch Router Router Firewall DC Switch vswitch Server ISE Classification Propagation Classification Catalyst 2960-S/-C/-Plus/-X/-XR Catalyst 3560-E/-C/-X/-CX Catalyst 3750-E/-X Catalyst 3850/3650 Catalyst 4500E (Sup6E/7E) Catalyst 4500E (Sup8) Catalyst 6500E (Sup720/2T) Catalyst 6800 WLC 2500/5500/5400/WiSM2/8510/8540 WLC 5760 Nexus 7000 Nexus 6000 Nexus 5500/2200 Nexus 1000v ISRG2, CGR2000, ISR4000 IE2000/3000/CGR2000 ASA5500 (RAS VPN) Propagation Propagation Catalyst 2960-S/-C/-Plus/-X/-XR Catalyst 3560-E/-C/, 3750-E Catalyst 3560-X/3750-X Catalyst 3850/3650 Catalyst 4500E (Sup6E) Catalyst 4500E (Sup, 7E, 7LE, 8E) Catalyst 4500X Catalyst 6500E (Sup720) Catalyst 6500/Sup2T, 6800 WLC 2500/5500/5400/WiSM2/8510/8540 WLC 5760 Nexus 7000 Nexus 6000 Nexus 5500/2200 Nexus 1000v ISRG2,ISR4000 IE2000/3000/CGR2000 ASR1000 ASA5500 Enforcement Enforcement Catalyst 3560-X Catalyst 3750-X Catalyst 3850/3650 WLC 5760 Catalyst 4500E (7E) Catalyst 4500E (8E) Catalyst 6500E (2T) Catalyst 6800 Nexus 7000 Nexus 6000 Nexus 5500/5600 Nexus 1000v ISR G2, ISR4000, CGR2000 ASR 1000 Router CSR-1000v Router ASA 5500 Firewall ASAv Firewall Web Security Appliance

27 Summary & Resources

28 Network as a Sensor and Enforcer Summary The network is a key asset for threat detection and control NetFlow, Cisco ISE and visualisatioin and mitigation tools provide visibility and intelligence TrustSec provides software defined (micro) segmentation

29 To learn more visit

30