Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki...
Transcript of Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki...
![Page 1: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/1.jpg)
Cisco Connect DubrovnikCroatia • 28.03.2019.
Global vision.
Local knowledge.
![Page 2: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/2.jpg)
Milan Mesić i Josip Strmečki
automatizirajte sigurnost i zaustavite prijetnje
pxGrid
![Page 3: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/3.jpg)
Problem s API-ima
I have NBAR info!I need identity…
I have firewall logs!I need identity…
I have sec events!I need reputation…
I have NetFlow!I need entitlement…
I have reputation info!I need threat data…
I have MDM info!I need location…
I have app inventory info!I need posture…
I have identity and device-type!I need app inventory and vulnerability…
I have application info!I need location and auth-group…
I have threat data!I need reputation…
I have location!I need identity…
SIO
We need to share data
![Page 4: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/4.jpg)
Rješenje
![Page 5: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/5.jpg)
50+ integracija
• Application Protection: Arxan, DB Networks
• SIEM and Analytics: HanSight, Hawk*, Huntsman*, LogRhythm*, Micro Focus NetIQ*, Splunk*, TripWire*, IBM-Qradar, Secureonix
• CASB: Elastica*, NetSkope, Skyhigh• Deception: Attivo, illusive*, TrapX*
• Endpoint and Custom Detection: Invincea*, Redshift*, ThreatTrack, CloudPost Networks***, McAfee DXL, TriagingX
• Firewall and Policy Management: Bayshore*, Check Point, InfoBlox*, Intelliment, Cisco FMC*
• Forensics and IR: Cisco Cognitive Threat Analytics*, Lumeta, Endace, Cisco Stealthwatch*, Lemonfish*, TripWire*, WireX Systems
• IAM/SSO: Ping Identity, Secureauth*, Situational• Other: Cisco WSA, Ark NSS****, Cisco ISE PIC• Threat Intelligence: Infocyte*• UEBA: E8*, Exabeam*, Fortscale*, Niara, Greenlight****• Vulnerability Management: Rapid 7*, SAINT*, Tenable*,
Tripwire*
s&t Firewall Management
Tools
VulnerabilityManagement
Forensics and IR
SIEM &Analytics
IAM & SSO
Net/App Performance
UEBA
Cisco ISE
Application
Protection
CASB
Endpoint & Custom
Detection
Rapid Threat Containment (RTC)
EMM/MDM
?
pxGrid
Solutions* Rapid Threat Containment, ** Regulatory and Compliance Solution***IoT, ****Regulatory and Compliance
s&t Firewall Management Tools
Deception
![Page 6: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/6.jpg)
firewall ACL policy analiza i optimizacija
fleksibilno i skalabilnost za sve tipove konfiguracijskih logika pojedinih vendora
rezultat usklađen točno onome što korisnik želi
fw opti KONVERZIJA OPTIMIZACIJA TESTIRANJE
![Page 7: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/7.jpg)
firewall ACL policy analiza i optimizacija
fleksibilno i skalabilnost za sve tipove konfiguracijskih logika pojedinih vendora
rezultat usklađen točno onome što korisnik želi
fw opti KONVERZIJA OPTIMIZACIJA TESTIRANJE
Rule Source Destination Service Action
12 NET_A HOST_1 SNMP ACCEPT
13 HOST_12 HOST_2 SNMP ACCEPT
…
4345 NET_A HOST_2 SNMP ACCEPT
4346 HOST_11 HOST_1 SNMP ACCEPT
4347 NET_A HOST_3 SNMP ACCEPT
…
7642 HOST_11 HOST_2 SNMP ACCEPT
7643 HOST_12 HOST_1 SNMP ACCEPT
…
11523 HOST_12 HOST_3 SNMP ACCEPT
Source Destination Service Action
NET_A, HOST_12
HOST_1, HOST_2, HOST_3
SNMP ACCEPT
HOST_11 HOST_1, HOST_2
SNMP ACCEPT
![Page 8: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/8.jpg)
• produkcijski bazirani promet
• detaljno testiranje mission-critical firewallkonfiguracija
• koristi se i unaprjeđuje u kontinuitetu od 2012 u ISP, Banking, Retail, …
fw tester
![Page 9: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/9.jpg)
tools + pxGrid
Device connects to
the network
Authentication Request
Limited Access + ‘VA Scan’ flag
Syslog: Event LogScan request for endpoint IP address
Vulnerability scanning
Endpoint’s CVSS
(Vulnerability Score)
COA
Change of Authorization
(Full or Quarantine access)
Vulnerability attributes
ENDPOINT NETWORK DEVICE MNT PSN VULN SCANNER
TC-NAC
Queue requests
![Page 10: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/10.jpg)
pxGridispod haube
![Page 11: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/11.jpg)
Publish – Subscribemodel
Provider + Consumer
![Page 12: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/12.jpg)
Control plane: HTTP REST (RepresentationalState Transfer)
Data plane:STOMP overWebsocket+ REST
![Page 13: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/13.jpg)
CheckpointpxGridintegracija
![Page 14: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/14.jpg)
Komponentesustava
• Checkpoint gateway R80.20
• Checkpoint identity collector
• CISCO ISE 2.4
• Microsoft windows server 2012R2 (domain-controller)
CP + pxGrid
![Page 15: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/15.jpg)
• Integracija:ISE <-> ADmapiranje IP <-> korisnik
CP + pxGrid
![Page 16: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/16.jpg)
• Integracija:ISE <-> CP ICdijeljenje mapiranja
CP + pxGrid
![Page 17: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/17.jpg)
• Integracija:ISE <-> CP ICdijeljenje mapiranja
CP + pxGrid
![Page 18: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/18.jpg)
Cisco INDuse case
![Page 19: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/19.jpg)
Cisco IndustrialNetwork Director
![Page 20: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/20.jpg)
Integracija pxGrid
![Page 21: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/21.jpg)
Kako napravitipxGrid publisherai subscribera
![Page 22: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/22.jpg)
Kreiranje klijenta
![Page 23: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/23.jpg)
Aktivacija klijenta
![Page 24: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/24.jpg)
Odobravanje klijenta na Cisco ISE
![Page 25: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/25.jpg)
Registracija custom servisa
![Page 26: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/26.jpg)
Pregled aktivnosti u Cisco ISE - Publisher
![Page 27: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/27.jpg)
Pregled aktivnosti u Cisco ISE – Publisher + Subscriber
![Page 28: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/28.jpg)
Subscribe to service - Consumer
![Page 29: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/29.jpg)
Dobivanje poruke - Consumer
![Page 30: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/30.jpg)
GetHealths REST primjer
![Page 31: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/31.jpg)
GetUserGroups REST primjer
![Page 32: Global vision. Local knowledge. - Cisco - Global Home Page€¦ · Milan Mesići Josip Strmečki automatizirajte sigurnost i zaustavite prijetnje pxGrid. Problem s API-ima I have](https://reader034.fdocuments.us/reader034/viewer/2022042311/5ed97470629f1556ba618012/html5/thumbnails/32.jpg)
pxGrid – automatizirajte sigurnost i zaustavite prijetnje