USP Network Authentication System & MobileIron. Good for mobile security solutions

Transcription

1 USP Network Authentication System & MobileIron Good for mobile security solutions

2 Content About United Security Providers Today s network security challenges USP Network Authentication System Access control architecture MobileIron integration Datum Seite 2

3 USP Network Authentication System & MobileIron About United Security Providers Today s network security challenges USP Network Authentication System Access control architecture MobileIron integration

4 USP is the Swiss leader for IT-Security-Solutions Key Figures USP Offices Bern (Headquarter), London, Zurich Foundation 1994 Products USP Secure Entry Server The Web Access Management solution for easy and secure access to business applications. USP Network Authentication System The Network Access Control Solution for controlled access of useres and devices to the corporate network. Services Managed Security Services USP Managed Security Services for convenient and efficient 7x24 protection. Consulting Services United Security Providers advises and supports business in information security projects.

5 USP Network Authentication System & MobileIron About United Security Providers Today s network security challenges USP Network Authentication System Access control architecture MobileIron integration

6 So what s the status of network security today? 66% of network security breaches remain undiscovered for months or more 78% of initial intrusions are rated as low difficulty 50,000 network intrusions are detected every day. 9% of large organizations had a security or data breach in the last year involving smartphones or tablets. Once on-the-wire, an attacker has free access to system attack surfaces. 22% of enterprises are able to eliminate unwanted access today. 20% of large organizations detected that outsiders had successfully penetrated their network in the last year (up from 15% a year ago) Instituting a formal program for managing mobile devices to help ensure that any device is secure before it can access the network is one solution to improve security for the enterprise. Sources: IBM 2013 Information Security Breaches Survey Verizon 2013 Data Breach Investigations Report Cisco Annual Security Report 2014

7 Challenges in Network Security that USP solves with the USP Network Authentication System product include Access Policy creation and enforcement Monitor and contain threats to the network Secure Mobile Device Integration Dynamic VLAN Management Manage Guest Access Endpoint Profiling Secure BYOD Live reporting and device inventory «Gartner believes NAC will emerge as one of the key mechanisms for providing a flexible approach to protecting the network against the risks of personally owned mobile devices.» Gartner Group, John Pescatore & Lawrence Orans «Network Access Control - It won t be easy, but it will be worth it.» Lawrence Orans, Analyst at Gartner Group

8 The Challenge To get you back in control over access to your network and to reduce complexity Network Access Control

9 USP Network Authentication System & MobileIron About United Security Providers Today s network security challenges USP Network Authentication System Access control architecture MobileIron integration

10 The intelligent solution for the protection of networks The USP Network Authentication System family of products is the Swiss solution for network access control. The system protects wired and wireless networks against unauthorized access and automates the control of legitimate access. NAC Engine Captive Portal

11 USP Network Authentication System - NAC Engine The Best Protection for Corporate Networks The USP NAC Engine is a central NAC server which continuously and automatically ensures your policy for network access. A reliable protection for small, medium-sized and global networks that must work at all times. Network equipment vendor agnostic out-of-band NAC Policy definition, management, decision and enforcement Device detection, profiling, authentication, allocation Integrated Radius Proxy automated VLAN management Multinenancy and role-based administration Flexible logging, alarming and reporting Agentless Deployment Monitors up to Endpoints and Routers / Switches with one appliance

12 USP Network Authentication System - Captive Portal The access platform for guests and BYOD The USP Captive Portal provides secure access for guests and private devices. With selfregistration, strong authentication, and automatic user/device steering in the correct «limited access network». BYOD and Guests welcome! Flexible authentication scenarios (e.g. UID/PWD, mtan, Voucher, etc.) Sponsoring Portal to support internal authorization policies (e.g. employee can authorize his guests) Self-Registration of employee-private devices (BYOD) Multiple customizable landing-pages role based access control Information-correlation (identity, role, device, access) Out of Band Installation

13 Unique Features of the USP Network Authentication System Versatile and flexible NAC technology, without additional network infrastructure Vendor-Lockin Fast and seamless integration into heterogeneous customer environments Consulting, Integration and operation direct from the manufacturer Development and support in Switzerland

14 USP Network Authentication System & MobileIron About United Security Providers Today s network security challenges USP Network Authentication System Access control architecture MobileIron integration

15 An integrated, high-performance Access Control Architecture at a Glance USP Captive Portal (Self) Registration VPN Mobile PCs Tablets/ Smartphones LAN 4G WLAN User Auth. & Policy Enforcement Access to Web Appl. USP Secure Entry Server VPN VPN Access Integrity Compliance MobileIron Core App Deploym. Policy Check Provide Device Information Integrity Compliance USP Network Authentication System Access to Network Device Auth. & Policy Enforcement Business Intelligence Unified Communic. Data & Shares ID Check Identity Management ID Check

16 Modern Networks offer a variety of connection options A continuous control is missing More and more and increasingly different types of devices get connected A poorly protected network constitutes business critical risks Server Farm Monitoring Access Switch Access Switch Data Center Enforcement Points Firewall Core Switch Internet Gateway Do you know which devices are currently connected to your network? Access Switch WLC / Access Point Would you notice an incident at all? Do you have enough log information to analyze incidents? Office Zone Corporate Network

17 The USP NAC Solution seamlessly integrates with the existing IT environment Integration with inventory systems and RADIUS server Out-of-band Communication with all network components Server Farm Monitoring RADIUS Asset DBs Access Switch Access Switch Data Center Firewall Core Switch USP Network Authentication System Internet Gateway Live view of the network Access Switch WLC / Access Point Collection and analysis of log data Reach higher security-levels step by step Handle unknown devices Office Zone Corporate Network

18 Equipment and user are dynamically connected to the correct network segment Support VLAN zones Guest Networking Integration with the MDM (Mobile Device Management) System in the perimeter Server Farm Monitoring RADIUS Asset DBs Access Switch Access Switch Data Center Firewall Internet Gateway USP Captive Portal Core Switch USP Network Authentication System The network is under control and can be used policy compliant by all users Mobile Device Management System Access Switch WLC / Access Point Prod VLAN 1 Prod VLAN 2 Guest VLAN Office Zone Perimeter Corporate Network

19 USP Network Authentication System & MobileIron About United Security Providers Today s network security challenges USP Network Authentication System Access control architecture MobileIron integration

20 MobileIron integration in deep Services and Data M Access Access Access WAM Web Access Management System USP Secure Entry Server Internet Access Any Media Internet GSM, DSL, Cable Internet Access Apps Smartphone Tablet Mobile Devices I Corporate Access Corporate Access K Guest Access Guest_SSID Corp_SSID Access Point A Access Point B WLAN Wireless LAN Controller LAN Access Switch Access Point WLAN Captive Portal Policy H Enforcement RADIUS Packets / AP_MAC:SSID Policy Enforcement Policy L Enforcement NAC Network Access Control System USP Network Authentication System D App Deployment SDK Sync C Mobile Device Management Internet Access Internet Policy ruleset Apps A Authorization Corporate App Store MDM Mobile Device Management System E Inventory data Health Info CSV Files / SQL Device ID Device Type Device Model MAC Address OS Type OS Version... MobileIron Peripheral systems USP Products MobileIron Services / applications Access Media J Authentication B Authentication IDM Active Directory System, etc. G Authentication RADIUS Packets CSV Files / SQL F Inventory data Device ID MAC Address Device Name Device Owner Device Type Device Class...

21 Description of the components WAM Web Access Management System USP Secure Entry Server WAM - Web Access Management System: USP Secure Entry Server Web Application Firewall & Policy Enforcement 2-factor Authentication and Single Sign-On SSL-Offloading Loadbalancing Monitoring & Alarming MDM Mobile Device Management System MobileIron MDM - Mobile Device Management System: MobileIron Mobile Device Management Policy Deployment Corporate App Store (Interne Apps) NAC Network Access Control System USP Network Authentication System NAC - Network Access Control System: USP Network Authentication System Network Access Control with 802.1X and/or MAC Authentication Device Detection & Profiling Central Device Management (Endpoint) Policy Enforcement Reporting Monitoring & Alarming

22 Description of the interfaces (1/2) A Authorization: Interface between WAM and MDM Check the managed mobile device credentials to control the access to the services B C Authentication: Interface between WAM and IDM Check the user credentials Mobile Device Management: Interface between MDM and Mobile Devices Device management Policy deployment D App deployment: Interface between App Store and Mobile Devices App provisioning E Inventory- / health data: Interface between MDM and NAC Transfer device settings for policy enforcement Transfer health information for policy enforcement F Inventory data: Interface between IDM and NAC Transfer device settings for policy enforcement G Authentication: Interface between NAC and IDM Check mobile device and/or user credentials for network access control

23 Description of the interfaces (2/2) H Policy Enforcement: Interface between NAC and net devices Steer net devices und policy enforcement for Network Access Control I Corporate Access: Interface between mobile devices and net devices Entry point for corporate access J Authentication: Interface between MDM and IDM Check user credentials K Guest Access: Guest networking for unregistered devices Access control for external and unknown devices L Policy Enforcement: Interface between NAC and Captive Portal Steer the captive portal for persistent guest access M Access: Interface between WAM and services Access control to services for managed mobile devices Data- tunneling for corporate apps

24 Usable device settings for network access control decisions Supported queries (items) blockreason manufacturer principal compliance mdmmanaged quarantinedstatus countrycode mdmprofileurlid regcount countryid model regtype countryname name status address notifyuser statuscode employeeowned operator userdisplayname homeoperator operatorid userfirstname languagecountryid phonenumber userlastname languageid platform usersource lastconnectedat platformtype uuid

25 Get more information Product microsite: USP website:

26