Cryptographically Isolated Virtual Networks

Transcription

1 Cryptographically Isolated Virtual Networks A Community of Interest Approach SecTor 2013 Rob Johnson, Distinguished Engineer Unisys

2 Agenda Who am I? What is the issue? What are Secure COIs? How do Secure COIs work? How do Secure COIs help? What did I say? 2013 Unisys Corporation All rights reserved Page 2

3 Crypto COIs Who Am I? Rob Johnson, Distinguished Engineer, Unisys 32 years with Unisys about average for Unisys engineers Same company, different jobs Current Jobs Chief Architect Unisys Stealth program Security Architect, Unisys Secure Private Cloud program Security Architect, Unisys Forward! program What I do Architecture Products, services, solutions, protocols, design analysis, Evangelism Conferences, customers, whitepapers, 2013 Unisys Corporation All rights reserved Page 3

4 Crypto COIs What Is The Issue? Competing Trends Networks are getting fewer and flatter 2013 Unisys Corporation All rights reserved Page 4

5 Crypto COIs What Is The Issue? Competing Trends Networks are getting fewer and flatter Regulations are getting more numerous and tighter 2013 Unisys Corporation All rights reserved Page 5

6 Crypto COIs What Is The Issue? Competing Trends Networks are getting fewer and flatter Regulations are getting more numerous and tighter Technology Outruns Bureaucracy 2013 Unisys Corporation All rights reserved Page 6

7 Crypto COIs What Is The Issue? Maybe the World Really Is Flat! LANs => VLANs Hardware Switches => vswitches VLANs => SDNs (Software Defined Networks) vswitches => Clouds IPv4 => IPv6 PSTN => VoIP BYOD Remote access from unmanaged PCs Employee laptops inside the firewall Phones and Tablets Mobile malware grew by 614% % of BYOD enterprises have had a BYOD-related data breach 2 1: Juniper Networks 2: Decisive Analytics 2013 Unisys Corporation All rights reserved Page 7

8 Crypto COIs What Is The Issue? Private Information Must Be Protected Personally Identifiable Information (PII) Personal financial information (PCI DSS) Corporate financial information (US: SOX) Healthcare information (US: HIPPA) Governmental information (US: FISMA/FedRAMP) Data jurisdictions Regulations Are Similar, But Different Isolation of in-scope systems Segmentation of networks connecting in-scope systems Traditional: Physical Emerging: Cryptographic 2013 Unisys Corporation All rights reserved Page 8

9 Secure COIs What Are They? Community of Interest (COI) Members of a COI can communicate with each other 2013 Unisys Corporation All rights reserved Page 9

10 Secure COIs What Are They? Community of Interest (COI) Members of a COI can communicate with each other Non-members can not communicate with members (unless explicitly allowed) 2013 Unisys Corporation All rights reserved Page 10

11 Secure COIs What Are They? Community of Interest (COI) Members of a COI can communicate with each other Non-members can not communicate with members (unless explicitly allowed) Network Virtualization Cryptographically enforced 2013 Unisys Corporation All rights reserved Page 11

12 Secure COIs What Are They? Community of Interest (COI) Members of a COI can communicate with each other Non-members can not communicate with members (unless explicitly allowed) Network Virtualization Cryptographically enforced Topology agnostic 2013 Unisys Corporation All rights reserved Page 12

13 Secure COIs What Are They? Community of Interest (COI) Members of a COI can communicate with each other Non-members can not communicate with members (unless explicitly allowed) Network Virtualization Cryptographically enforced Topology agnostic Identity-Based Users authorized as COI members My set of COIs defines my virtual network 2013 Unisys Corporation All rights reserved Page 13

14 Secure COIs What Are They? Dynamic Mesh of Secure Endpoints Point-to-point tunnels Pre-tunnel COI membership agreement FIPS (or local equivalent) cryptography Protocols Multi-factor user authentication Secure user COI authorization Network tunneling protocol Standard IPsec Pre-IKE COI agreement protocol Proprietary 2013 Unisys Corporation All rights reserved Page 14

15 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Id Mgmt Svr 2013 Unisys Corporation All rights reserved Page 15

16 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Alice Browses to Server-A, which is also a member of COI-A COI-A holds traffic until a point-to-point tunnel is established Server-A Id Mgmt Svr 2013 Unisys Corporation All rights reserved Page 16

17 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Alice Browses to Server-A, which is also a member of COI-A Id Mgmt Svr Server-A COI-A holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-A membership 2013 Unisys Corporation All rights reserved Page 17

18 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Alice Browses to Server-A, which is also a member of COI-A Id Mgmt Svr Server-A COI-A holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-A membership Server-A accepts COI-A and returns ECDH key 2013 Unisys Corporation All rights reserved Page 18

19 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Alice Browses to Server-A, which is also a member of COI-A Server-A COI-A holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-A membership Server-A accepts COI-A and returns ECDH key Id Mgmt Svr Client-1 validates Server-A s key and sends back its ECDH key 2013 Unisys Corporation All rights reserved Page 19

20 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Alice Browses to Server-A, which is also a member of COI-A Server-A COI-A holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-A membership Server-A accepts COI-A and returns ECDH key Id Mgmt Svr Client-1 validates Server-A s key and sends back its ECDH key Server-A and Client-1 have agreed on a shared secret which they use to establish an IPsec tunnel 2013 Unisys Corporation All rights reserved Page 20

21 Secure COIs How Do They Work? Alice Logs Onto Client-1 Alice s credentials are authenticated Alice s Role is determined Alice s membership in COI-A is authorized Alice Browses to Server-A, which is also a member of COI-A Server-A COI-A holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-A membership Server-A accepts COI-A and returns ECDH key Id Mgmt Svr Client-1 validates Server-A s key and sends back its ECDH key Server-A and Client-1 have agreed on a shared secret which they use to establish an IPsec tunnel Traffic between Client-1 and Server-A flows through the IPsec tunnel 2013 Unisys Corporation All rights reserved Page 21

22 Secure COIs How Do They Work? Alice Logs Off Client-1 Tunnel to Server-A is terminated Alice s COI membership is forgotten Id Mgmt Svr Server-A 2013 Unisys Corporation All rights reserved Page 22

23 Secure COIs How Do They Work? Alice Logs Off Client-1 Tunnel to Server-A is terminated Alice s COI membership is forgotten Bob Logs Onto Client-1 Bob s credentials are authenticated Bob s Role is determined Bob s membership in COI-B is authorized Id Mgmt Svr 2013 Unisys Corporation All rights reserved Page 23

24 Secure COIs How Do They Work? Alice Logs Off Client-1 Tunnel to Server-A is terminated Alice s COI membership is forgotten Bob Logs Onto Client-1 Bob s credentials are authenticated Bob s Role is determined Bob s membership in COI-B is authorized Server-A Id Mgmt Svr Bob Browses to Server-A, which is not a member of COI-B COI-B holds traffic until a point-to-point tunnel is established 2013 Unisys Corporation All rights reserved Page 24

25 Secure COIs How Do They Work? Alice Logs Off Client-1 Tunnel to Server-A is terminated Alice s COI membership is forgotten Bob Logs Onto Client-1 Bob s credentials are authenticated Bob s Role is determined Bob s membership in COI-B is authorized Server-A Id Mgmt Svr Bob Browses to Server-A, which is not a member of COI-B COI-B holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-B membership 2013 Unisys Corporation All rights reserved Page 25

26 Secure COIs How Do They Work? Alice Logs Off Client-1 Tunnel to Server-A is terminated Alice s COI membership is forgotten Bob Logs Onto Client-1 Bob s credentials are authenticated Bob s Role is determined Bob s membership in COI-B is authorized Server-A Id Mgmt Svr Bob Browses to Server-A, which is not a member of COI-B COI-B holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-B membership Server-A rejects COI-B and siliently drops Client-1 s request 2013 Unisys Corporation All rights reserved Page 26

27 Secure COIs How Do They Work? Alice Logs Off Client-1 Tunnel to Server-A is terminated Alice s COI membership is forgotten Bob Logs Onto Client-1 Bob s credentials are authenticated Bob s Role is determined Bob s membership in COI-B is authorized Server-A Id Mgmt Svr Bob Browses to Server-A, which is not a member of COI-B COI-B holds traffic until a point-to-point tunnel is established Client-1 securely advertises COI-B membership Server-A rejects COI-B and siliently drops Client-1 s request Client-1 times out the request and discards traffic to Server-A 2013 Unisys Corporation All rights reserved Page 27

28 Secure COIs How Do They Help? Identity-Based Network Virtualization COIs grouped into Roles for access control Managed through IdMS No network infrastructure changes Regulatory Compliance Identity-based authentication Separation of duties Role-based authorization Network traffic is encrypted In-scope resources are segregated, maybe Dark Endpoints No access allowed from outside COI Mitigates malware exposure, including from BYOD devices 2013 Unisys Corporation All rights reserved Page 28

29 Secure COIs Summary Two Colliding Trends Flattening/virtualization of networks Increasingly tight security controls 2013 Unisys Corporation All rights reserved Page 29

30 Secure COIs Summary Two Colliding Trends Flattening/virtualization of networks Increasingly tight security controls Secure COIs Identity/Role-based COI membership, ie access control Isolation/segregation of critical resources Cryptographically enforced dynamic mesh 2013 Unisys Corporation All rights reserved Page 30

31 Cryptographically Isolated Virtual Networks A Community of Interest Approach Questions? Contact: Rob Johnson RobertJohnson@unisyscom 2013 Unisys Corporation All rights reserved Page 31