Delivering Control with Context Across the Extended Network

Transcription

1 Delivering Control with Context Across the Extended Network

2 Agenda Current Challenges Cisco ISE Overview Introducing Cisco pxgrid Customer Success Stories Only Cisco ISE Delivers Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

3 What Keeps CIOs/CISOs Up at Night? 33% of Global Companies have already experienced a breach $300K = Average Cost of a Single, Successful Cyberattack The pain of managing, on average, over 45 different security vendors in a network 66% of Organizations fail to identify breaches for months or YEARS Over 660 Million personal records stolen from over 4,100 data breaches since % of IT Leaders plan to implement a mobile strategy Over 15 Billion Connected Devices by 2015 (4.4 per person!) Security is the Top of Mind Concern for CIOs/ CISOs

4 Network Threats Are Getting Smarter Phishing, Low Sophistication Hacking Becomes an Industry Sophisticated Attacks, Complex Landscape Viruses Worms Spyware and Rootkits 2005 Today APTs Cyberware Today Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4

5 More Connected Devices Expand Threat Surface IT Procured Managed Endpoints Enterprises Say Malware Targeted Mobile Devices in the Last 12 Months 1 Guest Access Simple Guest Access Enterprise Mobility Procured & BYOD Mobile Device Use Growing Evolving Need for Secure Access and Threat Defense Internet of Everything Explosion of Network Enabled Devices Cisco and/or its affiliates. All rights reserved. 1 Ponemon Research Cisco Confidential 5

6 The Resulting Challenges for Enterprise IT Breakdown of Traditional Network Perimeters Difficult Balance Between Security & Productivity Increased Complexity When Securing Enterprise Networks Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6

7 Bottom Line: What s Missing Today? Greater Visibility to accurately identify, rapidly onboard, and secure connected devices across wired, wireless or VPN Rich, contextual information to grant the right people & devices, the right levels of access to the network Capability to connect disparate network and security solutions to more rapidly take action against threats Enterprises require even greater visibility, context, and control to secure and control an increasing number of devices on their networks.

8 Agenda Current Challenges Cisco ISE Overview Introducing Cisco pxgrid Customer Success Stories Only Cisco ISE Delivers Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8

9 Cisco Identity Services Engine (ISE) Delivering Visibility, Context, and Control to Secure Network Access NETWORK / USER CONTEXT Who DEVICE PROFILING FEED SERVICE What When Where How REDUCE NETWORK UNKNOWNS AND APPLY THE RIGHT LEVEL OF SECURE ACCESS CONSISTENTLY ACROSS WIRED, WIRELESS and VPN Guest Access Cisco and/or its affiliates. All rights reserved. BYOD and Enterprise Mobility Secure Access Cisco Confidential 9

10 Why Cisco ISE? Cisco ISE is the Market-Leading Security Policy Management Platform that Unifies and Automates Secure Access Control Across Wired, Wireless, and VPN. Visibility Driven Accurately Identify and Assess Network Users & Devices Access Control Grant/Limit access to align with appropriate business policy Context Focused Use dynamic contextual data to accelerate the identification, mitigation, and remediation across extended networks

11 The Different Ways Customers Use ISE Guest Access Management Easily provide visitors secure guest Internet access BYOD and Enterprise Mobility Seamlessly identify & securely onboard devices with the right levels of access Secure Access across the Entire Network Streamline enterprise network access policy over wired, wireless, & VPN Software-Defined Segmentation with Cisco TrustSec Simplify Network Segmentation and Access Policy Enforcement

12 Historically, Securing Access Was Complicated The Past Cisco and/or its affiliates. All rights reserved. ISE 1.3 Cisco Confidential 12

13 Easy-to-Deploy Guest and BYOD Access Admin Friendly Set up a Guest or BYOD workflow in just a few clicks. End User Visibility ISE updates the portal workflow in real-time with each change.

14 Simplifying Guest Access for the Enterprise Corporate Branding and Themes Desktop & Mobile Ready! Streamlined Guest Creation Create Accounts Print SMS Mobile Guest Sponsorship Your credentials username: trex42 password: littlearms Guest Access Notification via SMS Cisco and/or its affiliates. All rights reserved. Design Easily in Minutes, Deploy Securely in Just Hours Cisco Confidential 14

15 Streamlining BYOD and Enterprise Mobility Reducing the Complexity of Managing BYOD and Device Onboarding Improved Device Recognition Integrated Native Certificate Authority for Devices Desktop & Mobile Ready! Customizable Branded Experiences Easy User Onboarding with Self-Service Device Portals Comprehensive Device Security with Posture and EMM Supports 1M Registered Endpoints and 250K ACTIVE, Concurrent Endpoints Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15

16 Dynamic Control with Rich Contextual Profiling Simple Identity Simply Isn t Helpful Enough Anymore POOR context awareness à Simple Identity - Who are you? à IP Address RESULT: Any user, Any device, Anywhere gets on the network EXTENSIVE context awareness à RICHER Identity Who? à Bob What? à Tablet Where? à Building 200, 1 st Floor When? à 11:00 AM EST on April 10 th RESULT: The Right user, on Right device, from the Right place is granted the RIGHT ACCESS

17 Increase Device Visibility with Profile Feed Service Reduce Unknown Devices on Networks by 74%, on Average * DEVICE PROFILING FEED SERVICE Get New, Vetted Device Profiles from Cisco & the Community More Accurately Profiled Devices; Faster, More Secure Onboarding Corporate Managed Tablet Cisco and/or its affiliates. All rights reserved. VoIP Office Phone IoT Security Camera Cisco Confidential 17

18 Enterprise Mobility Management Integrations Enforce True Device Compliance for All Mobile Devices Sees unregistered devices on the network? Forces EMM Policy Compliance? Keeps noncompliant devices off network? Sees ALL devices on the network Requires devices to comply with EMM policy Provides guest access to non-emm devices EMM Secures Actual Device SOLUTION ISE + EMM Together Cisco ISE Secures Network Access Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18

19 Secure Access with Cisco ISE and TrustSec Who: Doctor What: Laptop Where: Office Confidential Patient Records Internal Employee Intranet Who: Doctor What: ipad Where: Office Internet Who: Guest What: ipad Where: Office ü Acquires Important Context & Identity from the Network ü Monitors & Provides Visibility into Unauthorized Access ü ISE provides Differentiated Access to the network; TrustSec provides Segmentation throughout the network

20 access-list 102 permit udp lt gt 356 access-list 102 deny tcp eq gt 327 access-list 102 permit icmp lt lt 2286 access-list 102 deny tcp eq eq 4191 access-list 102 deny udp lt eq 3721 access-list 102 permit tcp eq eq 3716 access-list 102 permit icmp gt eq 4533 access-list 102 deny tcp lt gt 539 access-list 102 deny ip eq lt 4570 access-list 102 deny ip gt gt 2754 access-list 102 deny icmp lt lt 486 access-list 102 deny udp gt eq 2165 access-list 102 deny udp lt gt 428 access-list 102 permit ip eq gt 1511 access-list 102 deny tcp gt gt 1945 access-list 102 permit icmp lt eq 116 access-list 102 deny udp eq eq 959 access-list 102 deny tcp eq lt 4993 access-list 102 deny tcp eq lt 848 access-list 102 deny ip eq gt 4878 access-list 102 permit icmp lt eq 1216 access-list 102 deny icmp gt gt 1111 access-list 102 deny ip eq eq 4175 access-list 102 permit tcp lt gt 1462 access-list 102 permit tcp gt lt 4384 access-list 102 permit icmp eq eq 878 access-list 102 permit ip gt eq 467 Cisco TrustSec Software-Defined Segmentation Control Access to Resources Based on Business Policies Simplifies Firewall Rule, ACL, VLAN Management Prevents Lateral Movement of Potential Threats Traditional Security Policy Eliminates Costly Network Re-architecture Switch Router VPN & Firewall DC Switch Wireless Controller Cisco and/or its affiliates. All rights reserved. TrustSec Security Policy Segmentation Policy Enforced Across the Extended Network Cisco Confidential 20

21 Agenda Current Challenges Cisco ISE Overview Introducing Cisco pxgrid Customer Success Stories Only Cisco ISE Delivers Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21

22 Cisco Platform Exchange Grid (pxgrid) Accelerating Partner Technology Efficiencies via Context Sharing NE W For security, which is more useful information? The compromised device is OR - The compromised device is Paul Russell s ipad in Bldg. 200 Cisco ISE collects contextual big data from multiple sources across the network. Via Cisco pxgrid technology, this contextual data is shared with partners. With ISE contextual data, Partner Solutions can more accurately and more quickly identify, mitigate, and remediate security threats across the network Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22

23 Streamline Security Operations with ISE Ecosystem Connect Disparate Solutions and Reduce Threat Response Time NE W Faster Remediation of Threats with SIEM / TD Extension of Access Policy & Compliance with MDM Context-driven OT Policy and Segmentation for IoT Endpoint Vulnerability Remediation Simplified Network Troubleshooting and Forensics SSO Secure Access to Sensitive Data on Mobile Devices Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23

24 Agenda Current Challenges Cisco ISE Overview Introducing Cisco pxgrid Customer Success Stories Only Cisco ISE Delivers Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24

25 Cisco ISE Success Story Guest Lifecycle Industry: Finance Employees: 1,300 in 75 Branches Their Challenges: Too Many Guests Needing Access Security Risks from Open Guest Accounts Compliance in a BYOD environment Their Results: ü Speedier Guest Network, with Better Profiling ü Improved Compliance and Security ü IT Staff Operational Efficiencies The lack of expiry dates on guest access accounts was always a security threat. Using the Cisco ISE guest portal, we can flexibly and securely create temporary access.

26 Cisco ISE Success Story Campus BYOD Industry: Education Students & Faculty: 13,500+ Their Challenges: Better Control over Devices on Network Providing Consistent Secure Access Scaling to Meet Exploding BYOD Campus Needs Their Results: ü 10% Reduction in IT Troubleshooting ü 100% Network Uptime ü Vastly Improved End-User Experiences Our goal is to get as many people on our network as quickly, securely, and reliably as possible without our involvement. ISE enables us to do that.

27 Cisco ISE Success Story Secure Access Industry: Healthcare Endpoints: 35,000+ Their Challenges: Separating Clinical vs. Consumer Data Segregating Medical Devices, Based on Usage Controlling Compliant Access without Disruption Their Results: ü Granular Access Controls based on Context ü Implemented Port-Level Room Controls ü Comprehensive, Accurate Medical Endpoint Profiling Cisco ISE met our high water mark for use cases with flying colors. We are excited to be working with Cisco as we extend the model to other Sentara Healthcare facilities

28 Agenda Current Challenges Cisco ISE Overview Introducing Cisco pxgrid Customer Success Stories Only Cisco ISE Delivers Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28

29 Analysts Recognize Cisco ISE Industry Leadership Analysts Continue to Position Cisco ISE as Market and Technology Leader A LEADER in Gartner Magic Quadrant for NAC - Gartner December 2013, 2012, 2011 A CHAMPION in Info-Tech Vendor Landscape for NAC - Info-Tech Research Group, 2014 Cisco TrustSec and Cisco ISE are consistent with our view of identitycentric end-to-end security that is both needed and lacking in the enterprise today. - Forrester 2011 The Cisco ISE 1.3 is Cisco s most important NAC version since Cisco first offered the ISE 1.0. Perhaps the most exciting part of Cisco ISE 1.3 NAC is the integration with pxgrid... In this generation NAC platform, Cisco wanted to make an easier, more intuitive platform while adding features and functionality. Cisco has gone a long way toward achieving these objectives. Image: Gartner Magic Quadrant for Network Access Control 2013, Lawrence Orans, John Pescatore 12 December Frost & Sullivan, 2014

30 Customers Around the World Trust Cisco ISE Continuing to Drive the Market as the #1 Solution Purchased by 50% of Fortune Global % of Fortune Global 25 Leading Technology Innovation that Drives Industry Standards in the NAC Market and Beyond 600+ ATP Partners 7,000 Customers 36 Million+ Endpoints Licensed

31 Cisco ISE is Core to Cisco Security Attack Continuum BEFORE Control Enforce Harden DURING Detect Block Defend AFTER Scope Contain Remediate Firewall VPN NGIPS Advanced Malware Protection NGFW UTM Web + Security Network Behavior Analysis NAC + Identity Services pxgrid + ISE Ecosystem ISE Provides Visibility, Context, and Control Across the Entire Continuum

32 Cisco ISE Provides One Policy for Cisco Unified Access ONE NETWORK Integrated Wired and Wireless in ONE Physical Infrastructure, with ONE Operating System & Open APIs CISCO UNIFIED ACCESS ONE MANAGEMENT Single Plane of Glass Management with Cisco Prime ONE POLICY Simplified, Unified Policy Management with Cisco ISE

33 Only Cisco ISE Can Offer Unparalleled Network Visibility Reduce the Complexity of Securing Access Contain Advanced Network Threats Optimize Downstream Security Services Eliminate Unknowns to Get a Clearer Picture of Who & What Is On Your Network Manage Simplified, Unified Access Policy across Wired, Wireless, & VPN Identify Threats and Prevent Lateral Movement Across the Network Share Dynamic Context with Partners to Accelerate their Security Capabilities Cisco ISE is the Key Component to Support Secure Unified Access and Achieve Enterprise Security Objectives.

34