Case study: UniCredit Tiriac Bank deploys Cisco Network Admission Control

Transcription

1 Case study: UniCredit Tiriac Bank deploys Cisco Network Admission Control Bogdan Zamfir, CISM Head of IT Function, ICT Security, UniCredit Tiriac Bank Victor Alazaroae Presales Consultant, Datanet Systems

2 AGENDA UNICREDIT TIRIAC BANK PROFILE CISCO NETWORK ADMISSION CONTROL SOLUTION OVERVIEW Initial situation Business objectives Architecture deployment Phases RESULTS WHY DATANET SYSTEMS? NEXT STEPS 2

3 PROFILE 3

4 About UniCredit Tiriac Bank Being in the top 5 on the Romanian market, UniCredit Tiriac Bank offers to its customers, through over 235 branches and over employees, financial solutions for the needs of individuals, SMEs, corporations, freelancers. UniCredit Tiriac Bank at a glance (as at 31 December 2010) Total assets: RON 20.8 billion Total revenues: RON 1,363 million Net profit: RON 171 million Customers: over 500,000 UniCredit is a major international financial institution with strong roots in 22 European countries and an international network present in approximately 50 markets, with 9,585 branches and more than 161,000 employees. In the CEE region, UniCredit operates the largest international banking network with around 4,000 branches and outlets. 4

5 SOLUTION OVERVIEW 5

6 Initial Situation: Figures branches 3500 online users accessing the network with their laptops and desktops: internal employees (fix and mobile workstations) consultants partners passive devices connected on the network like: IP phones Printers FAXes ATMs Video surveillance equipments 6

7 Initial Situation: Access methods Closed network Access control into the network infrastructure is actually based on MAC address manual restriction User/PC authentication using dot1x 7

8 Initial Situation: Main Issues Administrative and operational tasks to permit user and device to access the network are slow and heavy due to: New users Mobility New devices (printers, IP phones, FAXes, etc.) There is no tool available to check the compliance level of the PC s accessing the network infrastructure like: Windows updates AV updated Mandatory desktop software 8

9 Business Objectives Reduce administrative and operational cost using a scalable/automated solution that: automatically enforce security policies on all devices controls access on the network minimize the effort of the network administrators Increase the operational efficiency using a scalable/ automated solution that: discovers and identifies dynamically all passive devices controls the access of passive devices on the network infrastructure minimize the effort of the infrastructure administrators 9

10 Business Objectives (2) Minimize the security risks associated with noncompliant and non-authorized devices accessing the network: minimize number of security incidents reducing loss and leakage of information minimize the administrative/operational effort 10

11 Architecture Deployment 11

12 Phases Phase 1 Local Testing Pilot Requirements Phase 2 extending the solution across all Bank s infrastructure 12

13 Phase 1: Local and Pilot testing Local Testing 16 testing scenarios Pilot Testing implementing the solution in a branch for one month 13

14 Phase 1: Local Testing and Pilot Results Requirements for access, changes and configuration in the network infrastructure Requirements for AV checks and enforcements Requirements for Windows Update checks and enforcements 14

15 Phase 1: Network infrastructure requirements User authentication before accessing network resources: Role base access for HQ users Fix access for Branch users Automatic discovery, identify and monitoring of the passive devices and assigning to the right VLAN: IP Phone Printers FAXes ATMs Video Surveillance Equipments 15

16 Phase 1: Network infrastructure requirements (2) Changes and configuration in the network infrastructure Branch and HQ access switches configuration (authentication VLAN, SNMP) Branch WAN routers configuration (routing, ACLs, SNMP, Netflow) 16

17 Phase 1: Requirements for AV checks and enforcements AV Symantec Endpoint Protection Version AV services: Symantec Endpoint Protection Symantec Event Manager Symantec Management Client Symantec Settings Manager AV definition 17

18 Phase 1: Requirements for Microsoft Windows checks and enforcements Windows AD integration and SSO user authentication Automatic Update service is started Latest Windows updates patches installed on client machine Update patches accordingly with the WSUS update policy 18

19 Phase 2 Deploying the NAC solution across all Bank infrastructure gradually: Preparing the network infrastructure (routers, switches) Distributing the agent software to client workstations User authentication to access the network resource without checks and enforcement User authentication to access the network resource with checks but without enforcement User authentication to access the network resource with checks and enforcement. 19

20 RESULTS 20

21 How user authentication, checks and enforcement happens? 21

22 How headless (passive) device are accessing the network? 22

23 NEXT STEPS Adding more checks and application enforcement on desktops beside AV and Windows Update Integrating with the existing SIEM platform 23

24 WHY DATANET SYSTEMS? Long term relationship with the Bank Competence of the technical team Expertise in network security solutions Knowledge of the needs of the banking sector Flexibility in order to accommodate to the bank needs 24

25 DATANET SYSTEMS Profile and experience Cisco Gold Partner since 2004, Cisco Learning Partner since 2008 Datanet is Cisco Advanced Security specialized partner = certified specialists in Cisco security technologies + lab + professional services portfolio Datanet personnel includes 9 CCIE R&S and Security, CISM, Cisco and Ironport security specialist certifications 13 years experience in network security projects for banks, service providers, enterprises.

26 CISCO NAC Key Ingredients

27 Cisco Network Admission Control

28 How do you record and track headless devices in your environment?

29 How do you centrally provision and manage guests who access your network?

30 How do you centrally provision and manage guests who access your network?

31 Guest User Account Detail Delivery

32 Installed Agent, Web Agents, or Agent-less

33 Datanet Systems professional and financial services Proof of concept Low level design Installation and commissioning Outsourced operations (monitoring, reporting, MAC) 24x7 rapid on-site service and technical support Financial services leasing or rental

34 Datanet Systems Application customization and remediation

35 Datanet Systems device profile identification customization

36 Thank you! Q & A 36