Sikkerhet Network Protector SDN app Geir Åge Leirvik HP Networking

Transcription

1 Sikkerhet Network Protector SDN app Geir Åge Leirvik HP Networking

2 Agenda BYOD challenges A solution for BYOD Network Protector SDN matched with industry leading service How it works In summary

3 BYOD challenges Centralized Functionality Logging Monitoring and Reporting Capabilities Needed Solution Traits Centralized Ease of Deployment Malware Protection Configuration Controls Strong Visibility & Control Flexible Configuration to Support Different Requirements Role Based Access Rules Endpoint Integrity Checking Easy Integration with other Endpoint Management Systems Other SANS Mobility/BYOD Security Survey March % 20% 40% 60% 80% 100%

4 Complete Unified BYOD Solution Simple, Scalable and Secure Software Defined Networking (SDN) Unified BYOD Essentials On boarding Unified Wired & Wireless Network & Management Provisioning Monitoring SDN Architecture Management Application Layer Control Layer Infrastructure Layer Management

5 Products for a unified solution for BYOD Comprehensive unified wired wireless access products and management solution Software Defined Network (SDN) Security Unified Wired & Wireless Network & Management Unified BYOD Essentials 870, 850, & 830 Unified Wired WLAN Switch Unified Wired WLAN 10500/7500 Module Network Protector SDN Application IMC User Access Manager (UAM) HP IMC Smart Connect 2920 Series Switches Wi Fi Clear Connect Virtual Application Networks SDN Controller Services WLAN Lifecycle Design & Validation

6 HP Network Protector SDN App Enabling real-time threat detection across enterprise campus networks SDN Architecture Application Control Infrastructure Network Protector App VAN SDN Controller RepDV Database Secure BYOD Unprecedented Visibility Better than antivirus alone Malicious-site.com

7 SDN to achieve agility Ability to apply business logic to network behavior in dynamic fashion Application Layer Service abstraction enables disruption of the market via SDN applications SDN Architecture Control Layer Separate control and data plane; abstract control of many devices; expose network functionality via open API s Infrastructure Layer Open standard-based programmatic access to infrastructure

8 Software-defined network products Aligning to the SDN architecture definition Application Cloud Orchestration SDN Applications SDN Architecture Control Infrastructure Northbound Open Programmable APIs Controller Open Programmable Interface ( e.g. OpenFlow) Network Device Network Device Virtual Device

9 HP TippingPoint Complete network security solutions for today s advance threats Next gen IPS DVLabs research Network Defense System Reputation feeds Next gen mgmt Scalable infrastructure to address current and future security deployment models (NGIPS) Dynamic analytics and policy deployment with real time management (NG Mgmt) Predictive intelligence to proactively address current and future threat activity (DVLabs)

10 HP TippingPoint DVLabs Global security research as fuel for Network Protector Ecosystem Partner SANS, CERT, NIST, OSVDB, software & reputation vendors Researchers Customers Leading security research Continuously finds more vulnerabilities than the rest of the market combined Collaborative effort of market leading teams: DV Labs, ArcSight, Fortify, HP Labs, Application Security Center Collect network and security data from around the globe

11 HP Network Protector SDN App Environment Core HP TippingPoint Threat Management Center (1M+ bad sites) HP Virtual Application Networks Controller with Network Protector Application Distribution Edge DNS ( forward redirect response) normal) block)

12 Network Protector some scenarios

13 Topology DNS RepD VDB Network Protector App HP SDN controller IRF DC Core Switch (non OF capable) Stacked Access OF Switch (4x 3800) Access OF Switch VWIN VWIN

14 DNS Flow in partially SDN enabled network Service Insertion: HW redirection to controller DNS RepD VDB Malicious Domain is detected: DNS Network answer is forged by Network Protector Protector and resolved App with IP= Notification server HP SDN controller Safe DNS request is forwarded to DNS server once coming back from Network Protector inspection. VPC DC Core Switch (non OF capable) SI Tunnel (GRE) Stacked Access OF Switch (4x 3800) Access OF Switch safe domain VWIN VWIN bad domain

15 Malicious DNS requests reporting Per VLAN visibility DNS RepD VDB Network Protector App HP SDN controller IRF DC Core Switch (non OF capable)

16 Findings and Outcomes Resulting in a more secure network Proven efficiency Block Botnet propagation. Provide Blacklisting capability. Easiness of deployment OF at access layer or even few aggregation points. Legacy core is kept unchanged. Security reporting Instantaneous reporting of malicious DNS queries showing threat level

17 HP Network Protector SDN Application for BYOD Scales to Thousands of Endpoints Eliminates Need for Dedicated Appliances Automates Threat Protection for BYOD Based on Open Standards

18 Q & A

19 Thanks for your attention