SECURING YOUR MODERN DATA CENTER WITH CHECK POINT Javier Hijas Security Architect Check Point Europe 1
Agenda 1 2 3 4 What Questions is a modern / Answers datacenter Datacenter protection evolution Security Challenges Questions/Answers [Restricted] ONLY for designated groups and 2015 Check Point Software Technologies Ltd. 2 individuals
Datacenter is The Backbone of any Enterprise Business CRM ERP Web Server File System Billing Mail Server 3
But when it breaks down? $0.5M Cost of outage per hour Study on Data Center Outages Ponemon Institute 33% Caused by cyber attacks 4
Physical Datacenter Virtual Datacenter Private Cloud Hybrid Cloud Public Private The Evolution of the Data Center 5
The new era of Private Cloud Delivery of applications at the fraction of cost and time! 6
2015 Check Point Software Technologies Ltd. 7
8
SDN (Software Defined Network) Central management of traffic in the Data Center SDN controller 9
10
11
12
13
14
15
16
17
The modern Data Center A MAJOR SECURITY PARADIGM SHIFT 18
Current Data Centers Perimeter Security INTERNET LAN 19
Establishes attackers want to move inside the datacenter 20
Hard to secure dynamic environment With many applications that move around 21
? Applications Catalog How to define security policy for application Before it gets provisioned 22
So What Is Needed? Best Security Perimeter & lateral traffic Adaptive Security Management Integrated with cloud management, SDN and orchestration 23
Cloud Based Data Centers Perimeter Security NORTH North - South 20% of traffic SOUTH 24
Cloud Based Data Centers Lateral Traffic Security WEST EAST East West 80% of traffic 25
Cloud Based Data Centers Perimeter & Lateral Security NORTH WEST EAST SOUTH 2015 Check Point Software Technologies Ltd. 26 [Restricted] ONLY for designated groups and individuals
Adaptive Security Management Security Management i Cloud Management & SDN Controller Data-Center aware and adaptive security policy 27
Check Point Security Leader for the Modern Data Center 28
Datacenter Security Key Objectives Secure datacenter application with context-aware protection Automatically program the network to Secure 100% of datacenter traffic Datacenter security compliance & threat visibility 29
Check Point s Solution: The Complete Data Center Protection SDN Controller Security Management Cloud Management Perimeter VE 30
Integration With Partners SDN Controller Security Management Cloud Management Perimeter Virtualized Server 31
Vmware/NSX integration Check Point Software Technologies Magnus Sköld Security Engineer 32
+ = 1 2 3 Best in Class Security for -to- traffic With Check Point VE Use NSX objects for already deployed Check Point gateways Gold standard single management for physical and virtual gateways 2015 Check Point Software Technologies Ltd. 33
Multi-Layer Best-in-Class Security Firewall Blocks L4-L7 attacks IPS Stops exploits of known vulnerabilities Anti Virus Blocks download of known malware files vm vm VE Anti Bot Prevents bot damage from infected devices Hypervisor Hardware Threat Emulation Stops unknown zero-day malware in files APP Control Blocks usage of web2.0 applications 2015 Check Point Software Technologies Ltd. 34
Most complete NSX ecosystem integration Tags Security Groups NSX 1 Consume 2 Enforce 3 Contribute Use NSX security groups in Check Point policy rules Enforce policy rules by Check Point physical & virtual GWs Tag bot infected s triggered by Check Point bot detection 2015 Check Point Software Technologies Ltd. 35 [Confidential] For designated groups and individuals 35
Automatic VE Provisioning Check Point VE for -to- protection Check Point Appliances for external threats NSX Check Point management installs policy and updates malware signatures NSX manager automatically deploys Check Point virtual GWs (VE) on all ESX servers DATA CENTER 2015 Check Point Software Technologies Ltd. 36 [Confidential] For designated groups and individuals 36
Transparent Security Insertion NSX Service Composer From To Action Web Servers SG Any Security Group NSX NSX transparently Web forwards traffic to Check Point App virtual GW (VE) DB Check Point VE DATA CENTER 2015 Check Point Software Technologies Ltd. 37 [Confidential] For designated groups and individuals 37
Use Security Groups in Check Point Policy Check Point Smart Dashboard From To Service Action Installed on Finance Users Web Servers SG HTTPS IPS & AntiBot DC Perimeter Web Servers SG App Servers SG RabbitMQ FW & IPS VE Virtual GW Web Servers SG Any Any Block VE Virtual GW Security Group NSX security group Web App DB Enforcement by Check Point physical GWs & virtual GWs (VE) DATA CENTER 2015 Check Point Software Technologies Ltd. 38 38 [Confidential] For designated groups and individuals
Automatic Tagging of Infected s Tag NSX Web Instant tagging of the infected virtual machine App DB A bot is detected by Check Point gateway DATA CENTER 2015 Check Point Software Technologies Ltd. 39 [Confidential] For designated groups and individuals 39
Automatically Protect vcac Blueprints New vcac blueprint instances are automatically secured by Check Point policy Web Web NSX & vcac App App DB DB DATA CENTER 2015 Check Point Software Technologies Ltd. 40 [Confidential] For designated groups and individuals 40
DEMO Check Point Software Technologies Magnus Sköld Security Engineer 41
vsphere + NSX + Check Point Setup CP MGMT vcenter Eth0 VE Management Eth0 VE Management Eth2 (disconnected) VE Inspection port Eth2 (disconnected) VE Inspection port dvfilter dvfilter dvfilter dvfilter Distributed vswitch 42
vsphere Setup vcenter Distributed vswitch 43
vsphere + NSX Setup vcenter dvfilter dvfilter dvfilter dvfilter Distributed vswitch 44
vsphere + NSX + Check Point Setup CP MGMT vcenter Eth0 VE Management Eth0 VE Management Eth2 (disconnected) VE Inspection port Eth2 (disconnected) VE Inspection port dvfilter dvfilter dvfilter dvfilter Distributed vswitch 45
Questions? 46
Check Point THE BEST FIT 1 2 Our Value Proposition: Physical and Virtual Security gateway for all datacenter traffic R80 - Cloud Aware Security management 3 Security service insertion with key SDN players 47
THANKS! 2015 2014 Check Point Software Technologies Ltd. 48 [Restricted] ONLY for designated groups and individuals