INTELLIGENT SECURITY: THE STRATEGIC APPROACH TO HIGH-PERFORMANCE NETWORKS FOR HIGHER EDUCATION

Transcription

1 WHITE PAPER INTELLIGENT SECURITY: THE STRATEGIC APPROACH TO HIGH-PERFORMANCE NETWORKS FOR HIGHER EDUCATION Copyright 2010, Juniper Networks, Inc. 1

2 Table of Contents New Challenges Evolving Security Threats Revisited The Balancing Act for Higher Education s IT Professionals Intelligent Security: The Juniper Networks Approach A Closer Look at Solution Components for Higher Education Granular Access Control Intrusion Prevention Encrypted Communications Addressing the New Need for Mobile Security Unified Threat Management Identifying Hidden Threats: Implementing Compliance and Policy Controls About Juniper Networks Copyright 2010, Juniper Networks, Inc.

3 It s difficult to imagine a college or university of any size operating effectively today without network infrastructure that enables communications and resource access for all stakeholders. Network infrastructure is a critical component in every university s daily operation. From connectivity in student dorms to secure remote access for traveling faculty and distance learners, every member of the learning community is connected and dependent on the network to work 24/7, anywhere, all the time. Higher education s expectations for high-performance networks continue to rise with students, faculty, administrators, donors, and support staff all depending on the network for daily academic progress and productivity. Reliability, flexibility, speed and scalability are mandatory and yet, there s far more to higher education s growing needs and opportunities. For example, many universities have discovered significant value in Web conferencing to help multi-campus institutions share resources. Traditional applications such as course registration, enrollment, and the delivery of digital course resources are rapidly evolving into web-based applications, facilitating easier access and use for students, faculty and staff. Improved communications, ready access to resources, and expanded connections throughout the university community support each college and university s vision and mission but with this always-on, always-accessible posture, the challenge to keep information resources and network communications secure has grown dramatically. Information and network security continues to be a priority concern for every educational IT department. This solutions brief outlines current trends and challenges and explores how a structured approach to implementing intelligent security can help higher education s IT managers meet the diverse and growing needs of their constituencies. New Challenges Evolving The traditional college campus has changed radically in the recent past. Traditional brick-and-mortar classrooms and labs now have virtual counterparts as students and faculty tap resources and experts across the globe through their home institutions networks. Institutions are grappling with ever-growing pressures to compete for students, faculty and funding, and as a result, they ve accelerated their involvement in distance learning, online courses and outreach centers that can dramatically expand their presence and position. With each step forward, new challenges inevitably surface, spurring higher education to analyze the need for more and more powerful technology and commensurate security to protect information and users. Security Threats Revisited As institutions grant students, faculty and staff broader and in many cases deeper access to applications, databases and information resources via local and remote networks, those resources and the networks become increasingly vulnerable. There simply are no one-size-fits- all formulas. For example, remote students and remote faculty have differing access needs. Remote students might only need access to registration applications and course materials. Remote faculty, on the other hand, might require full access to all academic resources for class and research activities, student data and specific administrative applications as well. As connected and mobile devices find their ways on campus and into students hands, not only does every classroom, dorm room and administrative office become a potential entry point for a security breach or attack but hackers potentially thousands of miles away become a security risk via unsecured remote access solutions. Sophisticated attacks can be launched by deliberate attackers or users who unknowingly cause a problem. Unfortunately, security attacks are increasing both in numbers and complexity and all too often include viruses and worms that are typically known as malicious programs or malware. Many malware forms use common applications such as to send messages to other users, while other malware attacks exploit application vulnerabilities to replicate themselves via the network. External attacks are a constant challenge, but attacks perpetrated from inside the campus network are equally troubling and difficult to defend. From unintentional attacks from a laptop carrying an unknown virus to attacks by disgruntled students or staff who seek to destroy or steal proprietary data, security threats from the inside out are ever present. Copyright 2010, Juniper Networks, Inc. 3

4 The Balancing Act for Higher Education s IT Professionals Colleges and universities need their networks to operate in keeping with their mission to provide and promote open expression of ideas and unfettered access to the resources that fuel learning and knowledge transfer, all while protecting their networks against very real security threats. It s a daily balancing act for IT professionals with challenges that fall into three critical categories: Optimum Security/Flexible Access: Network security must protect sensitive information while still providing students, faculty, staff and administration full access to the resources, data and applications they need when they re needed. Collaborative Security Defense: The need is for a strong security stance through multiple layers of security that share threat posture and policy enforcement in a collaborative manner to proactively protect the network and IT resources. End-to-End Security: Campus IT professionals need a complete set of high-performance tools to embed security all the way from remote locations of the main campus data center with automated provisioning and centralized reporting to streamline IT security operations. Intelligent Security: The Juniper Networks Approach Juniper Networks developed a new approach to help colleges and universities balance strong network security and open network access successfully over the long term. A combination of security solutions delivers a market-leading intelligent security solution that has been field proven in the networks of major service providers, enterprises and higher education institutions around the globe. This solution provides the balancing act for higher education s IT professionals with an optimum and flexible access security solution that leverages a collaborative security defense approach with end-to-end security being provided from the core of the campus network through the network access and extended out to remote devices that connect to the network. The Juniper Networks solution provides higher education s IT professionals with a complete set of security tools they can deploy in layers with shared intelligence to achieve optimized security across their networks. FETURE Granular access control with a standards-based implementation High-performance intrusion prevention resources Highly secure encryption technology Deep application file-level security BENEFIT Easily control user and device access to specific resources in a structured environment without costly network upgrades Proactively protect campus resources and users from hidden security threats such as worms within authorized traffic when the threat occurs Protect sensitive information such as student or financial data during transit across the network and over external networks for remote faculty and students Detect and eliminate harmful malware early, including viruses and trojans in various and Web servers, before it can propagate A Closer Look at Solution Components for Higher Education Granular Access Control Firewalls: A firewall helps to protect the institution s network from malicious content by performing a stateful inspection of incoming network packets. The firewall examines the packet header (source and destination IP address/port numbers, packet sequence numbers) to allow or deny packet transit. Session-aware firewalls also examine the session level to keep track of dynamic session protocols used in common client/server communications. Firewalls can also help provide denial-of-service (DoS) attack protection, in which malicious attacks can flood a network with packets in an attempt to bring down the network. Firewalls quickly detect this threat and automatically screen these packets. Firewall Security Domains: Using a single Juniper Networks firewall appliance, campuses can create distinct network segments and manage users access to those segments. Access rules for each security domain can be defined with respect to source and destination IP address, physical interface, VLAN tag or user, and device or environment. For example, domains can be defined for the libraries, dorms, administrative offices, classrooms, and other university or campus locations. By defining security domains within the Juniper Networks intelligent security solution, domain- specific security 4 Copyright 2010, Juniper Networks, Inc.

5 can be easily configured and logically deployed across a wide variety of university locations and environments, each with its own specific rules and policy enforcement. In addition, a campus might create domains according to campus service types like faculty, administration, alumni, distance learning student, or guest and overlay this service type domain with location-specific domain security to easily and effectively provide network security enforcement at scale. This makes it easy to create, manage and enforce rules for access to applications and data across the entire campus and to extend the proper enforcement out to remote users as well. ORGANIZATION Situation/Need: Solution: Results: Voice of the Customer: UNIVERSITY OF NEVADA, RENO Deploy a secure, scalable and easy-to-use network security solution to authenticate users before they access the university network, while also stopping worms, trojans, spyware, malware and other emerging attacks from penetrating and proliferating across the network. Juniper Networks SRX Series Services Gateways are appropriately configured for throughput requirements with integrated intrusion detection and prevention and additional unified threat management, coupled with Unified Access Control and the SA Series SSL VPN Appliances and Junos Pulse for secure remote access. Comprehensive, collaborative and intelligent network security and protection, ease of management and network reliability. The Juniper appliances are blocking what they are supposed to block and we aren t having any problems with the peer-to-peer applications or spyware. We ve had great success with Juniper s security solutions. - Jeff Springer, Network Security Manager, University of Nevada, Reno Unified Access Control: Colleges and universities benefit from having a centralized access policy manager to restrict access to authorized users and to assure that networked endpoints are compliant with the campus network security policy. A network access control solution enables security policy enforcement and protects critical campus applications while forcing those who want to access the network to be fully compliant with IT security policies before access is granted X is the IEEE standard for port-based network access at the data link or access layer (Layer 2) by identifying and authenticating each LAN user before the network provides the user with an IP address. Juniper Networks Unified Access Control combines standards-based 802.1X control technologies while leveraging existing campus investments and deployments. All policy is created and pushed by Juniper Networks IC Series Unified Access Control Appliances, hardened, centralized policy servers. UAC is compatible with multiple authentication and authorization databases, thereby allowing the combination of Microsoft Windows Active Directory user repositories, LDAP databases, Security Information Management Systems (SIMS) and other popular security management tools. Endpoint control of user identity, device state and network location can be determined by Juniper Networks Junos Pulse, a dynamically deployable converged agent and application integration platform, as well as via agentless mode when installing the Junos Pulse client is not feasible. Finally, UAC can enforce policy at Layer 2 using any vendor s 802.1X-enabled switches or wireless access points, at Layers 3-7 using Juniper firewalls or both for additional granularity. The result is a uniquely flexible solution that combines user identity, device security state information and network location to create a sessionspecific access control policy for each network user, device and location combination. Intrusion Prevention The next layer of an intelligent security stance involves application-level protection technologies that monitor network traffic and dynamically analyze it for signs of attacks and intrusions. These devices are now searching for hidden security threats inside common applications like and instant messaging (IM). These intrusion detection and prevention (IDP/IPS) devices examine control and data fields within the application flow to verify that the actions are allowed by the security policy and do not represent a threat to end systems. By determining application-level commands and primitives, they can identify content out of the norm and content that represents a known attack or exploit from worms, trojans, spyware and others. IDP devices can detect certain viruses or trojans by examining application service fields. For instance, IDP devices can examine the subject field, attachment name or attachment type within traffic to detect characteristics of known viruses. Copyright 2010, Juniper Networks, Inc. 5

6 Juniper Networks IDP Series Intrusion Detection and Prevention Appliances detect both known and unknown applicationlayer threats within network traffic and eliminate those threats in real time. IDP Series products also detect the use of unauthorized applications like instant messengers or file sharing. The IDP Series with its multi-method detection (MMD) offers comprehensive coverage by leveraging multiple detection mechanisms. For example, by utilizing signatures as well as other detection methods that include protocol anomaly traffic detection, the IDP Series can thwart known attacks at all levels of the protocol stream as well as possible future variations of an attack. Encrypted Communications The third layer of intelligent security involves setting up secure connections between locations that encrypt transmissions using VPNs when running across untrusted mediums such as the Internet. While no one VPN solution is the right solution for every mobile student/faculty or for a distributed site situation, there are multiple VPN options from which to choose. For fixed remote campus location, IPsec is the preferred method of deploying VPNs. IPsec can operate with low latency for applications that require high performance. Once configured and in place for fixed locations, the VPNs typically do not need to be reconfigured and usually operate without manual intervention. Juniper offers several purpose-built network security appliances that combine stateful inspection firewall capabilities with IPsec VPN functionality in one platform. For remote faculty, students enrolled in virtual programs, or staff members who telecommute, the ideal alternative is to use SSL VPNs. Since the SSL VPN uses technology embedded in all standard Web browsers, it uses a clientless platform and requires little or no manual configuration on behalf of the user or changes to internal servers. This makes VPN access seamless to the remote user. It is robust, and it combines communications security with ease of use. Juniper Networks SA Series SSL VPN Appliances provide these users with a complete end-to-end security solution that includes the Junos Pulse endpoint agent to ensure policy compliance and the integrity of the end system before allowing a secure connection to the network, data and server-based applications. Addressing the New Need for Mobile Security With practically every student, faculty and staff member using smartphones as a regular component of their communication, colleges and universities have been forced to expand their security processes and infrastructure. IT staff is now required to enforce device security and compliance to properly protect networked resources from a new set of threats. Typically, smartphones go completely unprotected while users browse the Web, download applications, check , conduct financial transactions, or access social networking sites. These devices contain sensitive data that can be vulnerable to malware, spam, breach, theft, and other threats. When universities issue smartphones to faculty and staff, loss or theft is a new threat vector that can compromise confidential data. The new Juniper Networks Junos Pulse Mobile Security Suite offers antivirus, antispam, personal firewall protection, loss and theft protection, backup and restore functionality, and application monitoring and control. This new solution includes both a client component, Juniper Networks Junos Pulse, and the Junos Pulse Mobile Security Suite, which is available as a Software as a Service (SaaS) hosted solution from Juniper. The Suite supports most major smartphone platforms and provides protection from malware, physical compromise, as well as other threats for Windows Mobile, Symbian Series 60, BlackBerry, and Google Android smartphones. The Junos Pulse Mobile Security Suite provides the industry s most comprehensive mobile security solution, offering the widest range of security functionality across the broadest set of devices. Unified Threat Management File-level protection provides the ability to extract files within traffic and inspect them to detect malware, including viruses, worms or trojans. A common technology for file-level protection in a network is an antivirus gateway. Antivirus systems typically scan files in and Web traffic, mainly inspecting communication from servers to clients. Viruses are aimed at damaging end user systems, but use various and Web servers and shared storage devices to propagate. Consequently, it is important to detect viruses while they are being uploaded to or downloaded from servers. An antivirus system searches for virus signatures a unique string of bytes that identifies a virus and zaps the virus from the file. Most antivirus scanning systems catch not only the initial virus but also many of its variants, since the signature code usually remains intact. Gateway antivirus systems scan files that are embedded in network traffic, including files 6 Copyright 2010, Juniper Networks, Inc.

7 in HTTP traffic (Web downloads) and files in traffic (attachments). If an infected file is detected, a gateway antivirus system removes it from the traffic, so that it does not affect other users. To scan files within network traffic, the gateway antivirus must detect a broad range of file-encoding protocols (for example, MIME, uucode and Base64) and file compression algorithms. Juniper Networks SRX Series Services Gateways include a complete set of unified threat management security features such as stateful firewall, intrusion prevention, antivirus, instant message scanning, antispyware, anti-adware, antiphishing, antispam and Web filtering to stop worms, spyware, trojans, malware and other emerging attacks. Identifying Hidden Threats: Implementing Compliance and Policy Controls For many colleges and universities, deploying the necessary detection and enforcement points in their networks is only one component of the total security picture. Their roles also entail solving enterprise-wide policy and security issues. IT leaders need the ability to view, analyze and respond to information across the entire infrastructure and as a result, they need visibility into all points of the network, regardless of whether or not security devices exist at all these points. Additionally, IT administrators are increasingly open to scrutiny from both internal and external audit groups. To protect against both internal and external threats and to support the existence and effectiveness of control standards clear, comprehensive and always-accessible reports must be available. Juniper Networks STRM Series Security Threat Response Managers collect, correlate and analyze discrete security and network infrastructure information in a centralized location, to deliver an enterprise-wide threat management view that encompasses both the network and the security operation s span of control. STRM Series solutions deliver four essential benefits: Threat Detection: Network administrators can now detect events that might otherwise be missed by product or operational silos. Log Management: IT leaders can respond to the right threats at the right time through the effective management of millions of log files. Compliance: IT leaders can develop and implement a compliance and policy safety net with comprehensive event storage and reporting. IT Efficiency: The STRM Series enables IT leaders to view and use aggregated data from existing network and security investments, drawing more value and functionality from their existing network components. ORGANIZATION Situation/Need: Solution: Results: Voice of the Customer: ISLE OF WIGHT (IOW) COLLEGE OFF THE SOUTH COAST OF ENGLAND IOW needed a secure, flexible remote access solution at the right price to accommodate teaching staff when abroad, working from home, or at the college s outreach centers. Juniper Networks SA Series SSL VPN Appliances For more than 50 key staff members, key work resources are now readily, yet securely available any time, from anywhere. The entire network is protected while providing remote access and cost savings for both the IT budget and management resources. Juniper Networks solution is exactly what IOW needs, at the right price. It is flexible and easily scales, allowing us to provide remote access to more staff members without incurring significant capital or management overhead costs. - Rosie Quelch, Network Manager, Isle of Wight College Copyright 2010, Juniper Networks, Inc. 7

8 Intelligent Security: The Solution for Optimum Protection for Twenty-First Century Colleges and Universities With the growing need for open access to campus information and resources by onsite and remote students, faculty and staff, higher education networks remain the target of increasingly sophisticated security attacks. The challenge is protecting vital campus assets, while continuing to foster open communication and idea exchange throughout the learning community. Juniper Networks can help higher education s IT professionals build an intelligent security solution that is designed to do the following: 1. Control who has access to resources through the use of firewalls with domain-level policy enforcement and granular access controls 2. Protect against application-level attacks from worms with integrated intrusion detection and prevention 3. Facilitate encrypted communications with IPsec or SSL VPN solutions 4. Detect and deny deep file-level viruses or spyware using a comprehensive and integrated unified threat management solution For more information on Juniper Networks solutions for higher education, including new options for security for smartphone and mobile device access, please visit or contact your Juniper Networks representative today. About Juniper Networks Juniper Networks is in the business of network innovation. From devices to data centers, from consumers to cloud providers, Juniper Networks delivers the software, silicon and systems that transform the experience and economics of networking. The company serves customers and partners worldwide. Additional information can be found at Corporate and Sales Headquarters APAC Headquarters EMEA Headquarters To purchase Juniper Networks solutions, Juniper Networks, Inc North Mathilda Avenue Sunnyvale, CA USA Phone: 888.JUNIPER ( ) or Fax: Juniper Networks (Hong Kong) 26/F, Cityplaza One 1111 King s Road Taikoo Shing, Hong Kong Phone: Fax: Juniper Networks Ireland Airside Business Park Swords, County Dublin, Ireland Phone: EMEA Sales: Fax: please contact your Juniper Networks representative at or authorized reseller. Copyright 2010 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, Junos, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice EN Dec 2010 Printed on recycled paper 8 Copyright 2010, Juniper Networks, Inc.