F5 Networks Defence Methodiken auf Transportund Applikationsebene. Specialist SE - Security

Transcription

1 F5 Networks Defence Methodiken auf Transportund Applikationsebene Stephan Schulz Specialist SE - Security s.schulz@f5.com

2 F5 Company Snapshot Founded: 1996 ADC Market Share Headquarters: Seattle, Wa Operations worldwide: 32 countries Employees: over 4,500 Revenue FY15: $1,9 B 48,6% Gartner Magic Quadrant: #1 DevCentral: over User Application Delivery Controller (ADC) Segment Includes: Server Load Balancing/Layers 4-7 Switching and Advanced (Integrated) Platforms. Graphic created by F5 based on Gartner data. Gartner, Inc. Market Share: Enterprise Network Equipment by Market Segment, Worldwide, 3Q13,

3 IT(Application) Security Trends & Challenges Application Attacks

4 ... its not the intention to scare you...

5 ... but to be able to protect, you need to know about...

6 Vulnerabilities 75% of internet threats target web servers (2015 Cisco Annual Security Report) 86% of websites has at least 1 vulnerability and an average of 56 per website (WhiteHat Security Statistics Report 2015)

7 Likelihood of Vulnerabilities Insufcient Transport Layer Protection: 70% Information Leakage: 56% Cross-site Scripting: 47% Source: WhiteHat Website Security Statistics Report 2015

8 Patching vulnerabilities remain an issue 99% of vulnerabilities were compromised a year after the vulnerability was made public (Verizon Data Breach Investigations Report 2015) Less than 49% of companies have an organized effort for patching (2015 Cisco Annual Security Report)

9 Source: BSI Vulnerabilities Typical Content Management Systems

10 IT(Application) Security Trends & Challenges Network (DDoS) Attacks

11 DoS / DDoS / (D)DDoS Attacks are Multi Layered 3DoS = Diverse Distributed Denial of Service

12 ... It s really easy to use...

13 ... It s really easy to use... IP-Address or FQDN (tools to convert available...) 80 or minutes...

14 Ist very easy to earn money...

15 Some facts about (D)DDoS Attacks 133 Attacken pro Tag in Deutschland. Davon geht das BSI aus 90 Prozent Steigerungsrate bei DDoS-Angriffen - weltweit 38 Prozent Wachstum bei Multi-Vektor-Attacken 400 Gbp/s ist der derzeitige Rekord für einen DDoS-Angriff in Europa 29 Stunden beträgt inzwischen die durchschnittliche Angriffsdauer Schon für 3 Dollar lassen sich einfache DDoS-Attaken in Auftrag geben* * Aktuelle Informationen unter All About Security, BSI-Lagebericht, Heise Security, it daily, Security Insider

16 Amount and Volume of Attacks are increasing...

17 Bots - everywhere IoT No Focus in Security Low Cost

18 IT(Application) Security Trends & Challenges Perimeter 2.0

19 The Traditional Approach to Security is Inadequate

20 IT(Application) Security Trends & Challenges SSL Everywhere

21 SSL Encryption Continues to Accelerate Driving Change Insider Threat Regulatory and Compliance Evolving Cryptography Everything is Connected AMOUNT OF ENCRYPTED ENTERPRISE TRAFFIC % 30 Annual Growth Next Generation Protocols Require SSL HTTP 2.0 SPDY TLS 1.3 TODAY 25% % F5 Networks, Inc. 21

22 Zero Trust F5 Networks, Inc 22

23 Cybersecurity professionals must stop trusting packets as if they were people. Instead, they must eliminate the idea of a trusted network and an untrusted network. In Zero Trust, all network traffic is untrusted. The Zero Trust Model has three key concepts: Ensure all resources are accessed securely ü Encrypt everything regardless of location. Or: The trusted zone is no more! Adopt a least privilege strategy and strictly enforce access control ü All users are (initially) untrusted! Inspect and log all traffic ü Regardless of origin: Both traffic coming from WAN and LAN is suspicious! John Kindervag Forrester Research F5 Networks, Inc 23

24 Typical Architecture built for little/no Encryption 0% SSL 100% TLS R R FW IPS 443 Pass NGFW IPS ßZero Visibility Thru LB LB SSL Servers Apps Servers Apps ßKey Mgmt Nightmare F5 Networks, Inc. 24

25 New Architecture now for SSL/TLS Visibility IPS R FW BIG-IP DLP APT SVR WAF F5 Networks, Inc. 25

26 F5 Networks - Security Solutions... for an Application World

27 The New Perimeter is an App Perimeter Apps are the Gateway to Data! TRADITIONAL APPLICATION CENTRIC App APP SSL SSL SSL SSL-visible Location-independent Session-based Continuous trust verification Strategic control points App availability TRADITIONAL NETWORK PERIMETER PER-APP / PER-USER PERIMETER IT S TIME TO RETHINK SECURITY ARCHITECTURES F5 Networks, Inc 27

28 F5 s Approach to Application Security Protecting Applications and Data Wherever they Live

29 F5 Networks - Security Solutions Whiteboard - Overview

30 END USER EXPERIENCE Global Application Availability DNS Security Business Continuity Enterprise Users $ Customers Anti-Fraud (WebSafe / MobileSafe) Attacker Malware Detection Anti-Phishing Transaction Monitoring/Analysis Application Level Encryption CLOUD BASED MITIGATION DDoS (L4 / L7) managed WAFaaS DATA CENTER FIREWALL High Performance Firewall DDoS Mitigation (HW-based) Perimeter Security CONTEXT AWARE WEB SECURITY Corporate Compliance Regulatory Compliance Policy Enforcement Malware Protection END USER EXPERIENCE Application Awareness Network Transformation IPv6, SPDY, HTTP 2.0 Software Define Networks SSL / PFS DNS Services (GTM) Secure Web Gateway (SWG) Application Delivery Controller (LTM ) Identity Access Management (APM) HIGH PERFORMANCE SERVICES FABRIC FLEXIBILITY MULTI-TENANCY SilverLine Firewall (AFM) SCALABILITY Web Application Firewall (ASM) PROGRAMMABILITY MOBILE WORKFORCE BYOD Virtual Desktop Infrastructure Single Sign-On Cloud Federation APPLICATION SECURITY E-Commerce Data Protection PCI Compliance OWASP Top Ten Attacks VDI VDI VDI WEB V WEB WEB

31 Full-Proxy Architecture Complete Control WAF WAF Slowloris attack XSS HTTP irule irule HTTP Data leakage SSL renegotiation SSL irule irule SSL SYN flood ICMP flood TCP irule irule TCP Network Firewall

32 Full-Proxy Architecure HTTP/2 IPv4 HTTP/1.1 VXLAN Data Center Devices TLSv1.2 SSLv Employees Contractors SSLv3 IPv4 IPv6 BIG-IP Platform IPv4 Physical Customers Hyperviso r Virtual Private/Public Cloud F5 Networks, Inc

33 F5 Networks - Security Solutions Short Demo

34 F5 Networks - Security Solutions Wrap Up

35 Multi-Layered Application Delivery Security Solution Bringing deep application fluency to security One Platform Network Firewall Traffic Management Web App Security Access Control DDoS Protection SSL DNS Security Web Fraud Protection EAL2+ EAL4+ (in process)

36 F5 Security Reference Architecture Single Vendor - Complete Protection

37 Solutions for an application world.