Security Everywhere Within Juniper Networks Mobile Cloud Architecture. Mobile World Congress 2017

Transcription

1 Security Everywhere Within Juniper Networks Mobile Cloud Architecture Mobile World Congress 2017

2 Agenda Challenges and Trends Use Cases and Solutions Products and Services Proof Points Juniper s Mobile Cloud Architecture

3 Challenges and Trends Customer challenge: rapid growth in security threat and exposure THREAT SOPHISTICATION Zero day attacks Advanced, persistent, targeted attacks Adaptive malware CLOUD Virtualization and SDN Applications, data, management in the cloud Application proliferation INFRASTRUCTURE Hybrid cloud deployments growing Device proliferation and BYOD IoT and big data everywhere

4 Software-Defined Secure Network Policy, Detection & Enforcement Cloud-based Threat Defense Detection Enforcement Threat Intelligence Dynamic and Adaptive Policy Engine Policy Bottoms Up and Top Down Approach Leverage entire network and ecosystem for threat intelligence and detection Utilize any point of the network as a point of enforcement Campus & Branch Network Detection DC Enforcement Private Cloud Public Cloud Dynamically execute policy across all network elements including third party devices

5 SDSN Enforcement - Granularity of Control Perimeter Security Secure Network Outside (Untrusted) Outside (Untrusted) Hyper-connected Network w/security at Perimeter Complex Security Policies Lateral Threat Propagation Limited Visibility Secure Network User Intent Based Policies Block Lateral Threat Propagation Comprehensive Visibility

6 SDSN - User Intent Policy Model Network Configuration User Intent Policy Firewall Rule Tables Access Control Lists Routing Tables & SDN Service Chains Access Control Threat Prevention Compliance Extensibility Automation IP MAC Proto Port Users Devices Sites Applications Meta Data Private Public AD CMDB vcenter Custom Islands of Management Device/Platform specific configurations Tough to automate, challenging compliance Comprehensive Security User Intent Based Policies Native automation and compliance support

7 SDSN - Threat Management Manual Threat Workflows Threat Management Automation Feed Incident Response Net-Sec Operations Endpoint Security CnC & GeoIP Custom/3 rd party feeds feeds Cloud based threat prevention Feed SIEM Malware Found TKT TKT SDSN Policy Controller Multiple Teams Cohesive Threat Management System Threat Detection Enforcement Delays Vendor specific threat feeds Automation across Network & Security Open API & 3 rd Party threat feeds

8 Solution: Secure IoT Service Fabric Virtualization, Orchestration, Analytics, Security Orchestration Contrail, CSO, Policy Analytics JTI, JSA Security VPN, SDSN, Sky ATP M2M/IoT Devices RAN MEC Mobile SP Network Control Plane Cloud CPE IoT Applications and Services IoT Gateway 2/3/4/5G NB-IoT User Plane (Distributed or Centralised) Wireline

9 Use Cases: Secure Mobile Network LTE Security Gateway Encrypts and protects integrity of traffic from enodeb to EPC across any mobile backhaul infrastructure Controls traffic between infrastructure components and protects against inter-device signaling overload (SCTP-FW) Gi/SGi Firewall and Service Delivery Gateway Protects service provider infrastructure and user devices from outside-in attacks Deliver value-added services such as UTM and App ID/QoS/FW Perform CGNAT for IPv6 transition and IPv4 address exhaustion 3G/GSM LTE LTE SecGW Backhaul Roaming Partners EPC Internet Gi Firewall Gp/S8 Firewall Create a security border with roaming control at the service provider to service provider roaming interface Manages 3GPP release interoperability and protocol differences between service providers Gp Firewall Comprehensive security solutions protecting customer data and privacy, as well as the infrastructure to enable a self defining network.

10 IPsec Capacity (IMIX) Gi FW Capacity (IMIX) Products: Security Gateways and Gi Firewalls Security Everywhere 400G SRX5800 MX TB 200G SRX5600 MX G 60G Scale out with Contrail SRX5400 MX G 10G 1G vsrx MX104 (SecGW only) SRX4100/ G Integrated Routing, Switching and Security Common Junos Operating System Unprecedented Scale

11 Service Provider: Mobile Edge Computing MOBILE HUB SITE NFX250 Network Perf App S1-U IP MEC server S1-U GTP IPsec MX104 vsrx IoT IoT App SRX SecGW 3 rd Party Feeds JSA SKY ATP SDSN Policy Enforcer Policy update for Service Chain Dynamic service Contrail Service chains Orchestrator IoT App Network Perf App SGi from EPC vsrx IoT TELCO CLOUD POLICY ENFORCER Describe traffic pathways for IoT and Network performance apps at Mobile Hub and Telco Cloud DETECTION Sky ATP: IoT malware detection Sky ATP: cloud server malware detection JSA: multi-dimensional detection ENFORCEMENT vsrx provisioned in service chains Infected IoT devices & servers quarantined Enforce legitimate traffic pathways

12 Use Case: Distributed Security Gateway LTE-A Features available as software upgrades 2016 onwards Coordinated Multi-Point (CoMP) Enhanced Inter-cell Interference Coordination, (eicic) Drive inter-cell site coordination & backhaul network requirements Timing: Frequency & Phase: Frequency16ppB, Phase +/- 0.5µSecs Distributed Security: X2 Handover Interface requires a latency of <3-5ms Accurate timing current & installed backhaul is a major change: accuracy relies on hardware Security gateways: Core SecGW terminates S1 IPsec tunnels & protects EPC Distributed LTE-A SecGW for X2 at the Hub-Site deployed at Fiber Edge IP Access Network CSR LTE-A X2 Traffic MX104 Hub site router Distributed SecGW w/ms-mic IPsec Termination for LTE-A X2 LTE-A S1 Traffic IPsec Termination For LTE S1 & X2 Protects EPC IPsec Termination for LTE-A S1 Other security features available CORE Switch Site Macro Cell Site Hub Site POC3 Hub Site LTE S1 Traffic LTE X2 Traffic Core LTE SecGW SRX5800 LTE SecGW EDGE Router EDGE Router Source: Qualcomm

13 Services Security Everywhere Customer Lifecycle Plan Build Operate Assessment Design Deployment Migration Maintenance Optimization Juniper Service Offerings Juniper Professional Services Security & SDSN Assessment and Deployment Security VNF Testing & Deployment Service Custom Engagements Customer On-Boarding Juniper Care Juniper Care Plus Juniper Optimum Care Juniper Education and Training

14 Proof Points Security Everywhere Juniper s SDSN framework We believe that security is the 'killer app' that will accelerate SDN adoption. The complement of SDN and security can solve one of the greatest problems enterprises have dealt with over the last 25 years of enterprise network expansion, an operationally efficient way to implement policy, detection and enforcement across the entire network. With its Software- Defined Secure Networking vision, Juniper is making a move in that direction. Mike Spanbauer, VP of Security Test & Advisory, NSS Labs The low footprint and high density advantages of the csrx, will allow us greater leverage to secure east west traffic. The multi-core vsrx delivers high performance and the ability to handle large amounts of traffic We expect both products to significantly increase the benefits we deliver to our customers. John White, VP of Product Strategy, Expedient As the security landscape continues to evolve, it is more important than ever to work together to combat cyber threats. These key additions to our security portfolio will further our Software-Defined Secure Networking vision and greatly benefit our customers Kevin Walker, Juniper Security CTO Comprehensive Global policy orchestration, unified threat detection, and automated + localized enforcement Interoperable Security solution interoperability and integration with major RAN vendors Integrated Integrated security policy enforcement into products like LTE Security Gateway function on Pre/IP-Agg routers High Performance Industry s highest performance physical and virtual firewalls for networks and Data Centers Open Framework Combined with proprietary countermeasures for advanced threat protection from the cloud

15 Mobile Cloud Architecture 1 of 5 Solutions within Juniper s Mobile Cloud Architecture Security Everywhere Use Cases Partners Services Automated Control & Orchestration Security Everywhere IPsec SecGw. FW, NAT, VPN SecGw FW, NAT, VPN Disaggregation & Virtualization Distributed Data Centers Integrated Packet, Optical & Timing Solutions Products Enterprise Site Software Defined Secure Networking Security detection, policy, and enforcement everywhere SRX Series Services Gateways Firewall, NAT, VPN vsrx Virtual Firewall, NAT, VPN, IPsec Sky ATP Advanced Threat Protection Het-Net Sites (Macro & Small Cells) Distributed Compute Node Distributed Data Center Access & Aggregation Network NGCO Regional Data Center Core Network Application Application Enablement Layer Compute Application Centralized Data Center Internet/ Roaming Junos Space Security Director Services Residential Business Security and SDSN Assessment and Deployment Services, Security VNF Testing & Deployment Service

16 Mobile Cloud Architecture Use Cases Partners Services Juniper s Mobile Cloud Architecture E2E Offering for your Next-gen Secure Distributed Telco Cloud from the Industry s Most Trusted Vendor Automated Control & Orchestration Industry s most deployed SDN solution for multi-vendor and multi-layer network automation. Security Everywhere Industry s most innovative and comprehensive platform to secure the distributed telco cloud. Disaggregation & Virtualization Pioneer in utilizing an open framework to ensure a seamless migration to carrier-grade NFV. Distributed Data Centers Complete, automated and secure solutions for mini DCs at the edge and large DCs in the core. Integrated Packet, Optical & Timing Solutions Integrated solutions from a global leader and innovator in packet networking and optical DCI. Enterprise Site Key mobile use cases supported Application Application Distributed Data Center Regional Data Center Application Enablement Layer Best-of-breed partner ecosystem Compute Best-in-class life-cycle service & support Het-Net Sites (Macro & Small Cells) Distributed Compute Node Access & Aggregation Network NGCO Core Network n Centralized Data Center Internet/ Roaming Residential Business

17 Thank you