Bring Your Own Device (BYOD) and 1:1 Initiatives: What Questions Do You Need to Answer Before Jumping In?

Transcription

1 Bring Your Own Device (BYOD) and 1:1 Initiatives: What Questions Do You Need to Answer Before Jumping In? Bruce Alexander Product Specialist- Wireless and Mobility Bret Straffon Product Specialist-Security Cisco Systems 2010 Cisco and/or its affiliates. All rights reserved. 1

2 Basic BYOD Mobility BYOD+Profiling Basic Advanced Beyond BYOD Guest Wi-Fi Corporate Wi-Fi Mobil only Guest Wi-Fi Corporate Wi-Fi Mobil Personal Mobile Device with Profiling Restricted Corporate resource access (HTTPS/ VLAN/ACL) Guest Wi-Fi Corporate Wi-Fi Mobil Personal Mobile Device with Profiling and Provisioning VPN Access Unrestricted Corporate resource access Wired BYOD Voice / Video everywhere VDI / VXI MDM C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 2

3 What s Mobile Device Management Does it solve all your problems???? MDM Solutions Advanced Systems Device inventory Device provisioning and deprovisioning Device data security Device application security User and device authentication Posture assessment Policy enforcement Context-aware access control Threat defense Web use policy Web application DLP Secure remote access Cost management Full or selective device remote wipe Cisco ISE Cisco ScanSafe Cisco WSA Cisco AnyConnect Cisco ASA C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 3

4 Device count per student Type of devices allowed Applications permitted Recommendation to users on devices Managing the devices: Profiling Provisioning Keeping your networks secure Troubleshooting C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 4

5 Mobile devices are replacing traditional PCs How many devices are being brought in? What do you allow per student? (quantity) Charging of devices- how to keep them alive for school work IP addressing schemes can be an issue C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5

6 What type of devices should you permit? Smartphones, Tablets, ipods, etc b?- Do you know what it does to your system performance?? Gaming systems? Mini Hotspots (3.4G to Wi-Fi Aps?) How are you going to control? Cameras? YOU need to set the rules upfront on what is and is not allowed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6

7 All Wi-Fi devices are not created equal!! PCs vary in type, radio characteristics, antennas, overall wireless performance Tablets and smart phones are not the same Not all Apple (insert any company name here) devices work the same. Chrome books??? Channels 165?? Roaming? C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 7

8 ActiveSync Integration Configure accounts & settings Microsoft Exchange, Gmail, Office 365 etc. Securely push account information (SCEP) User Accounts Owner attribute for clients Bulk CSV upload support for users Owners page for central view / management Profile Management Use profiles for granular controls C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 8

9 How do you determine who goes where? Do you have a guest Network? Are students allowed on Guest network? Do you police guest network? Authenticate the guest network? How do you separate teachers and students? Are all devices for a teacher allowed on the teacher network? Remember the 3 R s (and not Readin, Ritein, and Rithmetic!) 1. Right User 2. Right device 3. Right resource C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 9

10 Applications- what to and what not to allow Pandora Netflix Bit Torrent Instant Message C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 10

11 You need the ability to Identify standard ports, and L7 Deep Packet Inspection BEFORE Application View & Control based on Firewall sessions AFTER Network Based Application Recognition - NBAR2 Deep Packet Inspection and App ID Visibility to the port level interaction but not the applications running within the port First Generation Firewall HTTP = 75% SMTP = 15% FTP = 2% Telnet = 1% SNMP = 3% Traffic NBAR2 LIBRARY Deep Packet inspection Netflix = 50% YouTube = 15% WebEx = 10% Citrix = 9% exchange= 8% POLICY Packet Mark and Drop Netflow v9 export Ability to Classify applications with sub-classification within applications: e.g. Lync desktop share, video/voice, file transfer Apply Granular policies - Per SSID, Device, Campus, Building, Floor, Per user Real-time troubleshooting C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 11

12 How do you resolve connection issues? Slow response times? Who is responsible to keep the systems up to date? Virus scanner, OS Security breaches, etc. How do you find devices in a sea of devices? C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 12

13 C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 13

14 Wired + wireless Client fingerprints Location analytics Application QoS Realtime control C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 14

15 Troubleshooting items C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 15

16 Troubleshooting tools should include AP side analytics C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 16

17 C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 17

18 A Mobile Device Management ensures devices share a common configuration Devices should share the same network configuration, and have a valid authentication profile Geofencing tracks devices that leave the premises, helping to recover stolen devices, and allowing for remote lock and wipe Draw fences around school buildings, and make sure devices don t go home with students! Device profiles allow specific types of devices, or devices used for specific purposes, to have similar configurations All Science ipads should have the Periodic Table of Elements App, all English Windows Laptops should have a Grammar app, All Testing devices should have the same apps (if required) Use a Mobile Device Manager to monitor asset resources (memory, hard drive, etc.) Check remaining space, applications installed, battery life, etc. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 18

19 Device Lock Down Network Configuration GeoFencing Hardware Information C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 19

20 End-User Behaviors Over 15 billion devices by 2015, average person with 3 devices New workspace: anywhere, anytime 71% of Gen Y workforce do not obey policies 60% will download sensitive data on a personal device IT Trends Must control the multiple devices and guests Security: Top concern for BYOD Mobile malware has doubled (from 2010 to 2011) IT consumed with network fragmentation Reduce Security Risk Improve End-User Productivity Increase Operation Efficiency C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 20

21 Comprehensive Secure Access More Productive Faculty, Admin and Students Lower Operating Costs C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 21

22 BYOD Users get safely on the Internet fast and easy Guest Access It is easy to provide guests limited-time and limited- resource access Secure Access on Wired and Wireless Network and VPN Control with one policy across wired, wireless, and remote infrastructure Network Policy Rules written in business terms control access C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 22

23 Who What Where When How Security Policy Attributes Identity Context Identity Engine Wired Wireless VPN Organization-Relevant Policies Virtual machine client, IP device, guest, faculty, student, and remote user C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 23

24 Get users on the net in minutes, not hours Simple self-service portal for any user to get quickly on the net without help or hassle Reduce burden on IT and help desk staff Reliable automation reduces user problems to near zero so Immediate secure access Rigorous identity and access policy enforcement C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 24

25 Near-zero IT and help desk burden Faculty/Admin hosted Full guest lifecycle Accommodate and control Limited to Internet Time sensitive Streamlined system Integrated into the all-in-one enterprise policy control C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 25

26 Wired Wireless Remote Increase IT Productivity Automated onboarding and device security Enforcement embedded in the intelligent network Policy-governed unified access Dependable anywhere access C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 26

27 Increased Operation Efficiency Remote VPN User Wireless User Wired User Devices Virtual Desktop Policy-Based Access Control Identity and Context-Aware Network Scalable Enforcement Device Sensing VLANs Access Control Lists * Data Center Intranet Internet Security Zones C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 28

28 SGT Inter net Open Net Serv Net Data Center Restr ict DC Internet Superin tendent, IT Laptop Wired Net Permit Permit Permit Permit Permit All, ipad Internal Faculty, ipad VPN Student Any Permit Permit Permit Deny Deny Permit Permit Permit Permit Deny Permit Deny Deny Deny Deny Campus Cloud POLICY Policy Services 1 Services 2 IT John updates the Identity engine for BYOD and guest access policies, which are pushed to the network. Restricted Data Center Data Center Policy John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 29

29 Internet Brice Principal Campus Cloud Services 1 Wired Services 2 Wired Brice logs onto wired network on IT-issued laptop. Identity engine authenticates, identifies context, and applies wired execution policy. Restricted Data Center Data Center John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 30

30 Device Identity Internet Brice Principal Wireless AAA DID Campus Cloud Services 1 Wired Services 2 Onboarding Brice connects his new ipad to the WLAN and logs on. While Identity engine performs AAA check of his ID, Identity Engine Profiler identifies his device. Restricted Data Center Data Center John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 31

31 Internet Brice CFO REG Wireless Campus Cloud Services 1 Wired Services 2 Onboarding IE authenticates Brice, but does not recognize the ipad. IE redirects Brice to the onboarding portal to register his ipad. Restricted Data Center Data Center R DIR? John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 32

32 Internet Brice CFO Wireless Campus Cloud Services 1 Policy Wired Services 2 Onboarding IE forms a contextual identity: Brice + ipad + location. Restricted Data Center Policy Contextual Identity IE assigns a policy based on the context and grants it rolebased access. Data Center John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 33

33 Internet Brice Principal VPN Wireless Campus Cloud Services 1 Wired Services 2 VPN Brice uses the same ipad from a hotel room. Identity engine recognizes the context change and applies execution VPN policy.. Restricted Data Center Data Center John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 34

34 Brice Principal VPN Internet Sarah Sub Teacher Wireless Campus Cloud Services 1 Sponsor Wired Services 2 Brice enters guest hotspot portal and sponsors Sarah for 1-day access. Guest Sarah receives password through text message. She selects Guest WiFi, and Identity engine directs her to the guest portal to register and obtain Internet access. Restricted Data Center Data Center John IT Administrator Confidential. Product is planned, features are not committed. C Cisco and/or its affiliates. All rights reserved. Cisco Confidential 35

35 Thank you.