W&M 2009 – NAC – creating the inherently secure cross platform network
-
Upload
ipexpo-online -
Category
Technology
-
view
264 -
download
3
Transcript of W&M 2009 – NAC – creating the inherently secure cross platform network
NAC – creating the inherently secure cross platform network
Identity Management / Network Access Control
Wired and Wireless (Incl. RFID / RTLS)
Security and Compliance Solutions Designing, Implementing and supporting LAN/WAN
Security / Health / Vulnerability Audits
Data and Voice (VoIP) Solutions
Fully Managed Services (24x7x365) BS7799 / ISO 27001 Compliance
Network Management and Monitoring
Bespoke and Tailored Services
Who are we?
Training (Manufacturer & Bespoke)
NAC – creating the inherently secure cross platform network
What does that mean?
Anyone know what this is?
NAC Version 1
Lockdown Network – Power off at 18:00
Open Network – Power on at 09:00
5
Goal of NAC– Limit access to network
resources based on a user’s business needs and the real-time security risk of the user or networked device
Components of NAC– Assess Identity: sets access privileges based on
dynamic user-centric criteria so that policies move with the user and are not bound to specific ports or hardware
– Ensure Compliance: ensures that all communications are authenticated, authorized, and free from viruses, worms, and malware
– Enforce Policy: allows entry by only valid users, and quarantines/remediates unauthorized and/or harmful devices on the basis of stateful-firewall roles
“They say NAC is”
In Reality NAC Solutions are
Very Difficult to prevent Staff from plugging in their own devices especially in multi-site environments
About Audits / Compliance; Present Network Information i.e. devices or users, where they are, when they were on, are they authorised?
Do they connect Wired and Wireless?
Difficult to allow temporary access for guests, visitors and contractors
Difficult To solve, traditionally you need; Independent Solutions on wired & wireless networks =
Multiple Platforms to Manage/Support = Increased Support / Maintenance Costs =
Inefficiency in resolving problems!
In Reality it’s
Business needs to be easier not harder
Devices HAVE to connect easily
Networks must be SECURE by design
Users have to be able to use their systems
Access has to be FLEXIBLE
NAC should be about improving resource access
Anywhere, Anyhow, Anyone
Imagine a world ;
• Any device can connect to any wired port on your network• Any device can connect to your wireless network• Irrespective of whether it belongs to staff / visitor • The device and user is identified and authorised• The device can be checked it is safe to connect• The user and device are given the relevant access• Details of the device and user Access is logged• You can find and control every device & user across your
network
Corporate Network
Easy for wired / wireless users to connect
Auto provision of printers, CCTV, Servers, Scanners, VoIP
Reception / Department Mgrs
Can create temp users and allocate roles (i.e. Contractor / Visitor etc)
IT Dept
Full visibility of network devices & users. The ability to delegate some tasks
Security Team
Confidence the Network is Secure
Audit and Compliance
Full audit trail
Unwanted Users / Devices
More than NAC
VISIBILITY; Automatically Identify and Track ‘every’ device on wired / wireless networks Automatic Inventory of what has been and is on your network Automatically Scan devices for compliance
CONTROL
Automatically Block, Alert and Record Unauthorised Access Attempts Automatically Register devices by department (if allowed) Automatically Register devices if they meet a “confidence” level Automatically Enforce ‘global’ or department policies Enable ‘guest’ access without compromising security
AUDIT Real-Time & Historical Audit of ‘ALL’ activity Audit & Regulatory Compliance (PCI, CoCo, etc)
It’s about
12
100% Out of Band Architecture
13
The Bradford Networks Product Range
Licensing
There are various elements available for licensing:-You can buy limited functionality and build up to a full NAC Product
A brief summary is shown below – Functionality Full NAC NAC Lite User Tracking GCS
Register Devices Limited
Custom Device Option
Authenticate Users Limited
Policy Scan Limited
Dissolvable Agent
Persistent Agent
Track Devices
Track Users
Enable/Disable Devices
Connection Audit Trail
Guest / Conference Service
3rd Party Security Integration
15
Interoperability with over 300 models of networking equipment from 20 leading vendors
Unmatched Interoperability
Quick Status
Client View
Seven points of identity
Filter returns 44 clients out of a total of 475 Data can be exported to .csv
IT Manager
Department Manager
Contractor User
Receptionist
Guest User
Multi-User Conference
IT Staff Employee “Sponsors” Visiting Users
IT Manager can empower non-technical employees to set up network access for specific visiting users.
Sponsor for: • Contractors
Sponsor for: • Guests
• Conferences
Guests and Conferences
19
• Simple discovery mechanism
• Multiple profiling parameters to establish type of device
• Automated control actions per device type
Automate Network Provision
20
• Network service by device type
• Multiple edge control options (Role/VLAN, Port Location, Port CLI/ACLs, etc.)
• Device without a matching profile kept off the network
Confidence = Network Access
21
• Visibility, tracking and access control rights passed down to functional groups
• Automated access rules defined in device templates help maintain IT control
Workflow
22
Example: Adding a Printer
23
Setting Confidence
Rogue Device Plugged into Switch Port
SWITCH VIEW
Rogue Device could be - persons own laptop, a NAT device - wireless / wired router , printer - ANYTHING
Visibility
Email Alert with full details
Email with full details of alarm; Rogue Device Detected; Mac Address, IP Address, Time, Date, Location
EMAIL ALARM
Email Alarms Fully Customisable “Rogue Connected”
Email sent to Groups, Individuals etc
Control
Rogue Device Immediately
Disabled / Removed from Network
SWITCH VIEW
LOCKING DOWN & SECURING YOUR NETWORKS
Auto-Enforcement
“Rogue Connection” Event Recorded
Search in real-time and historically
EVENT VIEW
Audit
Future NAC
Trusted Network Connect
Microsoft NAP
Bradford Networks
DHCP
RADIUS
RADIUS
Microsoft Vista NAP
Trusted Network Connect(TNC) Architecture
Full Visibility of entire network (all sites) and connected devices
Real-Time and Historical audit trail
Security and Control; Block unknown / unauthorised ‘rogues’
Distributed and Automated Device Management
Foundation to build a full Network Access Control Architecture; End Point Policy Enforcement (Client-less / Client Scanning) Allow Secure Guest / Visitor Access Remote Scan – check device before arrival
KEY FEATURES“More than NAC”
• KEY BENEFITS
Fits ‘ANY’ Network Design Network Independent (wired or wireless) “Out of Band” (not “In-Line”) solution;
NO Network Re-Design NO Single Point of Failure NO Network Downtime during implementation Phased Roll Out: Granular – Port By Port
Client-less Policy Enforcement Scalable;
One system secures up to 12,000 devices, across multiple sites Cost effective and ‘proven’ solution
Over 600 customers worldwide, 100 UK & Ireland
“Minimal Impact”
• GOVERNMENT ORGANISATION (CANNOT BE NAMED BUT REFERENCE AVAILABLE)
• PROBLEM / REQUIREMENTS
Required visibility of all remote sites (7 across the UK) Unauthorised Network Access forbidden but not easily enforced Complex to secure different Vendor devices (including hubs) Roaming staff / devices needed to be controlled / VLAN’d off Solution MUST not disrupt network / users
• KHIPU’S SOLUTION
Single Central system, securing all remote devices Phased and Controlled Roll Out with NO downtime Prevents ‘Rogue’ device access Manages devices by switching them into appropriate VLAN’s Completely ‘locked down’ network
“Why customers buy”
Questions and Answers
Come and see us at stand 1816
T: +44 (0) 845 2720900 Khipu Networks LimitedInfineon HouseMinley RoadFleet
http://www.khipu-networks.com Hampshire GU51 2RDUnited Kingdom
We should probably talk!