redborder IPS redborder Just common sense IPS overview Common sense

Transcription

1 redborder Just common sense overview

2 redborder at a Glance redborder 2013 rb rb Flow Traffic collector and visualization. Netflow v5/9, sflow, IPFIX, Flexible Netflow, AVC, NBAR2, rb DDoS Extremely high performance Distributed Denial of Service detection and mitigation rb Stronghold Layer 7 firewall available as specific appliance as well as virtual image with centralized management rb Forensic High speed traffic archiving in appliance form rb Vault Unified log management for all redborder products as well as third parties rb CDN Appliances to build a Content Delivery Network with GEO located DNS resolving, reverse web proxying with caching, video streaming splitting, WAF, rb Policy Enforcer Interaction with third parties products in order to execute security counter measures (Openflow, ACL, CheckPoint OPSEC, Palo Alto, Netfilter, )

3 rb at a Glance

4 Management (I) Centralized management (2.x)

5 Management (2) Log and event management (2.x)

6 Management (3) Rule management

7 Management (4) Geo Location and Protection

8 Management (5) Probe configuration and SNMP

9 Performance We have raised Snort s performance to a new level

10 Expected 3.0 Performance based on preliminary Spirent tests redborder redborder Appliances A full appliance product line with hardware and software optimized to reach maximum performance Network Modules with 2 nd generation bypass and frontal insertion

11 Source Code Complete SW Images Training & Certification Stándard Support Elite Support (24X7) Community Enterprise Versions Appliance Pre-Installed Patches between versions rb BigData Framework HW Support & RMA HW Elite Support 24X7 Spare On Site in Situ Deployment & Consulting services Yes No Optional

12 Project Timeline & Short Term roadmap December 1.2 April October November 3.2 Rule management Basic SNMP monitoring Chef configuration Event management Bitacora User roles Full SNMP monitoring Rule threshods Rule rollback User auditing Snort Bugsolving Critic upgrade igb driver update Bypass activation on link failure pf_ring critic upgrade nosql Backend Kafka messaging OLAP Dashboard Long Term Storage Horizontal scalability Virtual domains Pre Correlation Passive inventory detection Snort upgrade Bugsolving October 1.0 February 2.0 December June 3.0 Single rule feed Architecture Functional prototype September Project starts pf_ring forwarding Multicore support LDAP authentication Manager High Availability Bypass Bugsolving GeoIP Protection NOC Dashboard Improved filtering Improved reports TokuDB storage engine Snort Bugsolving Non Produban Release DNA based forwarding ~30% performance increase Multi CPU enhancements Improved rb_sysconfg Snort upgrade Bugsolving

13 The rb 2013 Project and the best is rb 3.x ( ) about to come Performance Huge performance increase (Appliance only): Virtual Domains (Appliance Only). Versatility and the big change is BIGDATA! We will redesign the back end not only for rb, but for all our portfolio in order to: Passive Inventory Detection

14 The rb BigData FrameWork (1) a) Removal of the SQL back end and the different data warehouses for each product b) Standardized messaging format in Apache Kafka c) Real time computations and semantic routing through Twitter's Storm d) Single correlation engine for all products (and third parties) (TBD) e) Schemaless Long Term data storage in Couchbase Server for up to PetaBytes of information f) Internally development OLAP In Memory Database for aggregated data used for slice and dice dashboards and queries g) S3 type storage h) Cloud ready (in particular, for Amazon AWS) as all the elements scale horizontally without SPOF

15 The rb BigData FrameWork (2) Scalability without limits Common global storage but What do we achieve with all this? Correlation and information sharing Highly available multi datacenter

16 Thank you