ABOUT ME ¢ Senior Network Engineer MSO at VeriFone Inc. ¢ Previously Network Solutions Architect at one of top polish IT
integrators ¢ CCIE #25543 (Routing & Switching) ¢ Blogger – http://ccieplayground.wordpress.com ¢ Administrator of CCIE.PL board
� The biggest Cisco community in Europe � About 7800 users � 3 admin, 3 moderators � Over 60 polish CCIEs as members, 20 of them actively posting � About 100 new topics per month � About 800 posts per month � English section available
AGENDA ¢ Facts about firewalls market and evolution ¢ Security challenges ¢ Next Generation Firewalls ¢ NGIPS ¢ Data Center Security Future
FACTS ABOUT FIREWALLS MARKET ¢ Virtualized versions of enterprise network
safeguards will not exceed 10% of unit sales by year-end 2016
¢ Through 2018, more than 75% of enterprises will continue to seek network security from a different vendor than their network infrastructure vendor
Source: Magic Quadrant for Enterprise Network Firewalls, Gartner, 14 April 2014
FACTS ABOUT FIREWALLS MARKET ¢ Less than 20% of enterprise Internet connections
today are secured using next-generation firewalls (NGFWs)
¢ By year-end 2014, this will rise to 35% of the installed base, with 70% of new enterprise edge purchases being NGFWs
¢ Fewer than 5% of enterprises will deploy all-virtual firewalls in data centers through 2016
Source: Magic Quadrant for Enterprise Network Firewalls, Gartner, 14 April 2014
FACTS ABOUT FIREWALLS MARKET ¢ Fewer than 5% of enterprises will deploy all-virtual
firewalls in data centers through 2016 ¢ Fewer than 2% of deployed enterprise firewalls will
have Web antivirus actively enabled on tchem through 2016
Source: Magic Quadrant for Enterprise Network Firewalls, Gartner, 14 April 2014
APPLICATIONS HAVE CHANGED – FIREWALLS HAVE NOT • The gateway at the trust border is the right place to enforce policy control
Ø Sees all traffic
Ø Defines trust boundary
Collaboration / Media SaaS Personal
• But applica;ons have changed Ø Ports ≠ Applica;ons
Ø IP addresses ≠ Users
Ø Headers ≠ Content
Source: PaloAlto, Palo Alto Networks Product Overview
INFRASTRUCTURE AS A SERVICE (IAAS) ¢ Set of modular building blocks of underlying resources ¢ Services may be introduced either through dedicated appliances or
through virtual appliance implementations ¢ Cost-effective use of capital IT resources through co-hosting ¢ Better service quality through virtualization features ¢ Increased operation efficiency and agility through automation
SECURITY CHALLENGES IN DC ¢ There is a challenge between achieving business value and protecting
these highly prized targets
Source: Infonetics Research Report Experts: Data Center Security Strategies and Vendor
REQUIREMENTS FOR DC FIREWALLS ¢ Threat Prevention
� Protect against external attacks – including those routed through internal “secure” clients
¢ Data Leakage Prevention � Protect confidential and unauthorized content from leaving the network
¢ Access Control � Control access – by user or groups of users – to specific applications and
content ¢ Performance
� Minimize latency and maximize throughput to ensure business performance is not compromised
Source: PaloAlto, Palo Alto Networks Product Overview
SECURING TRAFFIC FLOW North-South From Access Layer to Aggregation and to Core
East-West Usually between servers in same layer
URL FILTERING ¢ Block sites based on category or reputation ¢ Based on user or user group ¢ Allow administrators block websites with potentially harmful objects ¢ Allow blocking of non-business related sites ¢ Bandwidth control for designated categories ¢ Enforcing safe search ¢ Prevent file download/upload
APPLICATION VISIBILITY ¢ Identification of application using multiple factors not only port or IP
classification ¢ Allow administrators to deploy comprehensive application usage
control policies for both inbound and outbound network traffic
USER VISIBILITY ¢ Seamless integration with enterprise directory services
such as Active Directory, LDAP etc. ¢ Enables administrators to view and control application
usage based on individual users and groups of users, as opposed to just IP addresses
¢ User information is pervasive across all features including application and threat visibility, policy creation, forensic investigation, and reporting
CONTENT VISIBILITY ¢ Scanning engine that uses a uniform threat signature
format detects and blocks a wide range of threats and limits unauthorized transfer of files and sensitive data
¢ Comprehensive URL database controls non-work related web surfing
¢ IT departments can regain control over application and related threat traffic
FAILOVER – REPLICATED STATES ¢ Replicated features depends on vendor, used firmware and hardware –
check release notes for full list ¢ New features added with every release
MULTI-CONTEXT ¢ More often required by for
regulatory compliance ¢ Each context has separate
control-plane and data-plane, interfaces and config memory
¢ Some features are not supported in multi-context mode
CLUSTERING ¢ With new
approach it’s crucial to undestand the data flow within cluster in very scenario
¢ Lack of proper data and control plane can make more harm that lack of clustering
TRUSTSEC ¢ Provides the
ability to create policies to map end users, or consumers, to data center assets, or servers and applications
¢ AAA services for a variety of external actors
TRUSTSEC ¢ Policy in the
firewall has been expanded to include source and destination security groups that are downloaded from the ISE
NGIPS
Source: Gartner’s Magic Quadrant for Intrusion Prevention Systems Adam Hils, Greg Young, Jeremy D’Hoinne , 29 December 2014
NGIPS ¢ Some things remains unchanged:
� Tuning is the process of ‘defining’ protections that match the environment � Although most network provide standard services implementation creates
challenges � Failure to tune = failure to protect
NGIPS ¢ IPS are more and more context-aware ¢ Signatures are not the base for event correlation ¢ Events correlation happens on advanced monitoring systems – IPS
itself cannot perform this
NGIPS ¢ Many organizations have relied solely on access control lists and
enforcement as the only method of protecting the data center. ¢ A primary assumption is that the “authorized” user is really who they
say they are, or that the authorized user is in control of their device that is accessing the data center
NGIPS ¢ One of the easiest ways for a cyber attacker to get a foothold into an
enterprise organization’s network is by installing a rootkit onto a user’s end device.
¢ Security access control lists will allow the malware to traverse the network into the data center
NGIPS ¢ NGIPS requirements and imperatives:
� High Availability � Zero Downtime � Flow survivability � Hardware and link redundancy � Asymmetric packets flows expected and properly handled � Elastic scaling � Low latency � Manageability/visibility/orchestration � Security and regulatory compliance
DATA CENTER SECURITY FUTURE ¢ SDN will be a mainstream consideration for data center security
purchases by 2016
FOCUS OF FUTURE ¢ Specific cloud service requirement and technical specification ¢ Cloud service requirements in specific market area ¢ Cloud networking ¢ Security requirements ¢ Cloud SLA ¢ Operation and maintenance