SECURING YOUR MODERN DATA CENTER WITH CHECK POINT

Transcription

1 SECURING YOUR MODERN DATA CENTER WITH CHECK POINT Javier Hijas Security Architect Check Point Europe 1

2 Agenda What Questions is a modern / Answers datacenter Datacenter protection evolution Security Challenges Questions/Answers [Restricted] ONLY for designated groups and 2015 Check Point Software Technologies Ltd. 2 individuals

3 Datacenter is The Backbone of any Enterprise Business CRM ERP Web Server File System Billing Mail Server 3

4 But when it breaks down? $0.5M Cost of outage per hour Study on Data Center Outages Ponemon Institute 33% Caused by cyber attacks 4

5 Physical Datacenter Virtual Datacenter Private Cloud Hybrid Cloud Public Private The Evolution of the Data Center 5

6 The new era of Private Cloud Delivery of applications at the fraction of cost and time! 6

7 2015 Check Point Software Technologies Ltd. 7

8 8

9 SDN (Software Defined Network) Central management of traffic in the Data Center SDN controller 9

10 10

11 11

12 12

13 13

14 14

15 15

16 16

17 17

18 The modern Data Center A MAJOR SECURITY PARADIGM SHIFT 18

19 Current Data Centers Perimeter Security INTERNET LAN 19

20 Establishes attackers want to move inside the datacenter 20

21 Hard to secure dynamic environment With many applications that move around 21

22 ? Applications Catalog How to define security policy for application Before it gets provisioned 22

23 So What Is Needed? Best Security Perimeter & lateral traffic Adaptive Security Management Integrated with cloud management, SDN and orchestration 23

24 Cloud Based Data Centers Perimeter Security NORTH North - South 20% of traffic SOUTH 24

25 Cloud Based Data Centers Lateral Traffic Security WEST EAST East West 80% of traffic 25

26 Cloud Based Data Centers Perimeter & Lateral Security NORTH WEST EAST SOUTH 2015 Check Point Software Technologies Ltd. 26 [Restricted] ONLY for designated groups and individuals

27 Adaptive Security Management Security Management i Cloud Management & SDN Controller Data-Center aware and adaptive security policy 27

28 Check Point Security Leader for the Modern Data Center 28

29 Datacenter Security Key Objectives Secure datacenter application with context-aware protection Automatically program the network to Secure 100% of datacenter traffic Datacenter security compliance & threat visibility 29

30 Check Point s Solution: The Complete Data Center Protection SDN Controller Security Management Cloud Management Perimeter VE 30

31 Integration With Partners SDN Controller Security Management Cloud Management Perimeter Virtualized Server 31

32 Vmware/NSX integration Check Point Software Technologies Magnus Sköld Security Engineer 32

33 + = Best in Class Security for -to- traffic With Check Point VE Use NSX objects for already deployed Check Point gateways Gold standard single management for physical and virtual gateways 2015 Check Point Software Technologies Ltd. 33

34 Multi-Layer Best-in-Class Security Firewall Blocks L4-L7 attacks IPS Stops exploits of known vulnerabilities Anti Virus Blocks download of known malware files vm vm VE Anti Bot Prevents bot damage from infected devices Hypervisor Hardware Threat Emulation Stops unknown zero-day malware in files APP Control Blocks usage of web2.0 applications 2015 Check Point Software Technologies Ltd. 34

35 Most complete NSX ecosystem integration Tags Security Groups NSX 1 Consume 2 Enforce 3 Contribute Use NSX security groups in Check Point policy rules Enforce policy rules by Check Point physical & virtual GWs Tag bot infected s triggered by Check Point bot detection 2015 Check Point Software Technologies Ltd. 35 [Confidential] For designated groups and individuals 35

36 Automatic VE Provisioning Check Point VE for -to- protection Check Point Appliances for external threats NSX Check Point management installs policy and updates malware signatures NSX manager automatically deploys Check Point virtual GWs (VE) on all ESX servers DATA CENTER 2015 Check Point Software Technologies Ltd. 36 [Confidential] For designated groups and individuals 36

37 Transparent Security Insertion NSX Service Composer From To Action Web Servers SG Any Security Group NSX NSX transparently Web forwards traffic to Check Point App virtual GW (VE) DB Check Point VE DATA CENTER 2015 Check Point Software Technologies Ltd. 37 [Confidential] For designated groups and individuals 37

38 Use Security Groups in Check Point Policy Check Point Smart Dashboard From To Service Action Installed on Finance Users Web Servers SG HTTPS IPS & AntiBot DC Perimeter Web Servers SG App Servers SG RabbitMQ FW & IPS VE Virtual GW Web Servers SG Any Any Block VE Virtual GW Security Group NSX security group Web App DB Enforcement by Check Point physical GWs & virtual GWs (VE) DATA CENTER 2015 Check Point Software Technologies Ltd [Confidential] For designated groups and individuals

39 Automatic Tagging of Infected s Tag NSX Web Instant tagging of the infected virtual machine App DB A bot is detected by Check Point gateway DATA CENTER 2015 Check Point Software Technologies Ltd. 39 [Confidential] For designated groups and individuals 39

40 Automatically Protect vcac Blueprints New vcac blueprint instances are automatically secured by Check Point policy Web Web NSX & vcac App App DB DB DATA CENTER 2015 Check Point Software Technologies Ltd. 40 [Confidential] For designated groups and individuals 40

41 DEMO Check Point Software Technologies Magnus Sköld Security Engineer 41

42 vsphere + NSX + Check Point Setup CP MGMT vcenter Eth0 VE Management Eth0 VE Management Eth2 (disconnected) VE Inspection port Eth2 (disconnected) VE Inspection port dvfilter dvfilter dvfilter dvfilter Distributed vswitch 42

43 vsphere Setup vcenter Distributed vswitch 43

44 vsphere + NSX Setup vcenter dvfilter dvfilter dvfilter dvfilter Distributed vswitch 44

45 vsphere + NSX + Check Point Setup CP MGMT vcenter Eth0 VE Management Eth0 VE Management Eth2 (disconnected) VE Inspection port Eth2 (disconnected) VE Inspection port dvfilter dvfilter dvfilter dvfilter Distributed vswitch 45

46 Questions? 46

47 Check Point THE BEST FIT 1 2 Our Value Proposition: Physical and Virtual Security gateway for all datacenter traffic R80 - Cloud Aware Security management 3 Security service insertion with key SDN players 47

48 THANKS! Check Point Software Technologies Ltd. 48 [Restricted] ONLY for designated groups and individuals