Next-Generation Centralized Security Management for MSSPs & Distributed Enterprises

Size: px

Start display at page:

Download "Next-Generation Centralized Security Management for MSSPs & Distributed Enterprises"

Sara Jenkins
6 years ago
Views:

1 Next-Generation Centralized Security Management for MSSPs & Distributed Enterprises

As Enterprise and MSSP networks expand with more offices, users and experience trends like device proliferation, application explosion, virtualization and more, they deal with greater security risks

2 As Enterprise and MSSP networks expand with more offices, users and experience trends like device proliferation, application explosion, virtualization and more, they deal with greater security risks across branch offices and customer offices. Blended attacks from malware, trojans, phishing and pharming threats target enterprise networks at the weakest entry pointsthe branch offices. From managing distributed security appliance deployments to ensuring consistent security policy implementation across branch office and clients, overtaxed IT Managers as well as MSSPs seek a centralized management system that gives them the confidence to centrally manage security for multiple sites with desired flexibility and manageability. Cyberoam Central Console Cyberoam Central Console (CCC) is a centralized management solution that allows Enterprises and MSSPs to manage multiple Cyberoam network security appliance (UTM and Next Generation Firewall) deployments across remote or branch offices and clients respectively. With a range of features, CCC simplifies security management for actions like rapid deployment of organization-wide security policies and updates, to better protect dispersed networks, resulting in benefits of reduced cost, complexity and time. CCC Next-Generation Management Hardware Appliances Next-Generation Management series of CCC appliances ( CCC NM) deliver high performance from underlying powerful new hardware and fulfill demanding processing needs to support security policy enforcement in large, complex and dispersed networks. Virtual CCC Appliances The virtual CCC appliances support VMware and Hyper-V virtualization platforms and offer full set of features as CCC hardware appliances. By allowing organizations to leverage the virtual environment, CCC Virtual appliances eliminate the need for dedicated hardware, reduce cost of ownership and simplify future upgrades. The CCC virtual appliances allow customers to manage up to 5 Cyberoam network security appliances without any license fee. MSSP Customers Enterprise Branch Offices Boston Mumbai Dubai New York Boston Dubai Boston Mumbai Dubai GGY Inc. ACME Inc. Internet Internet Cyberoam Central Console Cyberoam Central Console MSSP Security Operations Center Corporate Headquarters

Cyberoam Central Console (CCC) Features: 1 CENTRALIZED POLICY MANAGEMENT & SECURITY UPDATES CCC allows centrally managing security policies for dispersed Cyberoam security appliance deployments and

This not only simplifies security management but also enables uniform policy implementation, giving real-time protection against threats, drastically improving response time to mitigate security

3 Cyberoam Central Console (CCC) Features: 1 CENTRALIZED POLICY MANAGEMENT & SECURITY UPDATES CCC allows centrally managing security policies for dispersed Cyberoam security appliance deployments and enables integrated provisioning of Firewall, IPS, Anti-virus and VPN security services across branch offices and client offices from a single, web-based GUI. This not only simplifies security management but also enables uniform policy implementation, giving real-time protection against threats, drastically improving response time to mitigate security risks against newly identified threats for enterprises and MSSPs alike. Centralized View of distributed appliance deployments Centralized Policy Enforcement 2 INTELLIGENT GROUPING OF APPLIANCES CCC allows meaningful grouping of distributed Cyberoam network security appliances based on geography, Cyberoam security appliance models, firmware version, organizations (especially for MSSPs) and service subscriptions. Enhanced with Web 2.0 benefits, the Dynamic Views in CCC provide at-a-glance information on the dashboard that helps in managing, searching and sorting appliances for quick monitoring and action. CCC offers flexibility in sorting appliance views on the dashboard by allowing customizable selection criteria for sorting. Grouping of security appliances Based on Geography Based on Appliance Models Based on Client Appliance Group Template Policy Appliance Group Template Policy Appliance Group Template Policy Geography_wise Geography_wise ( #2 ) Country : APAC ( #2 ) State : Singapore ( #2 ) ACME_SG_01 ACME_SG_02 All Appliance Models All Appliance Models ( #5 ) Model : CR15wiNG ( #1 ) ACME_Corp_01 Model : CR25iNG ( #4 ) ACME_USA ACME_SG ACME_ANZ Client_wise Client_wise ( #4 ) Company : Life Pharma Inc ( #2 ) LIFE_PHARMA_CAN LIFE_PHARMA_SG Company : Profit Bank Ltd ( #2 ) PROFIT_BANK_JP PROFIT_BANK_ANZ

3 TEMPLATE-BASED CONFIGURATION Enterprises and MSSPs can create policy templates based on best practices for re-use while setting up security policies for new branch offices and customers, saving

For example, applying a security policy template with VPN, Web and Application filter, IPS configuration to new branch offices; applying Education vertical policy template for new customers in

4 3 TEMPLATE-BASED CONFIGURATION Enterprises and MSSPs can create policy templates based on best practices for re-use while setting up security policies for new branch offices and customers, saving them considerable time and effort. For example, applying a security policy template with VPN, Web and Application filter, IPS configuration to new branch offices; applying Education vertical policy template for new customers in Education by MSSPs. 4 ROLE-BASED ADMINISTRATION CCC enables Enterprises and MSSPs to set role-based administration for CCC appliances as well as individual /group of Cyberoam security appliances. Both enterprise businesses and MSSPs have dedicated teams for managing and overseeing different security functions relating to various areas such as VPN, Application security, IPS management and the like. Having role-based access enables distributing such tasks to separate users based on region, role or responsibilities while maintaining centralized administrative control over what each administrator can see and do through CCC console. CCC access Access to group of Security appliances Configuration None Read-Only Read-Write Dashboard Objects Network Firewall Console access from GUI Web Filter Application Filter Edit CCC User User Name * Password* Access Profile * Accessible Appliance * admin ********** Change Password Administrator IM QoS System Identity VPN IPS Anti Virus Anti Spam Logs & Reports CCC Management Appliance Management Appliance Monitoring CCC Logs Select All ACME_USA ACME_SG Add Appliance

5 CHANGE CONTROL AND LOGGING Gives Enterprise and MSSP administrators the power to roll-back configuration

security policy 6 CCI API Enables MSSPs and Enterprises to leverage existing Professional Services

and operational efficiency Integration with PSA tools like ConnectWise enables automatic ticket generation

5 5 CHANGE CONTROL AND LOGGING Gives Enterprise and MSSP administrators the power to roll-back configuration changes and helps them with an audit trail for compliance review and to track deviations from a standard security policy 6 CCI API Enables MSSPs and Enterprises to leverage existing Professional Services Automation (PSA) Tools, IT infrastructure monitoring and ticketing systems, providing benefits of usability and operational efficiency Integration with PSA tools like ConnectWise enables automatic ticket generation and resolution for key CCC alerts on PSA interface, enabling accelerated process automation for managed security services

6 7 AUDIT LOGS & ALERTS Timely notifications can be set for individual or group of Cyberoam security appliances through alerts across branch offices and client offices based on expiry of subscription modules, excess disk usage, IPS and virus threat counts, unhealthy surfing hits and other parameters. CCC's alert configuration facility helps enterprises and MSSPs reduce false alarms. For example, administrators can set an alert when the CPU usage reaches above 90% for a specific time period (say 20 minutes) instead of setting an alert when it momentarily peaks to 90% - which can trigger a false alarm. CCC's Log Viewer offers logs and views of administrator actions on CCC as well as dispersed network security appliances, which helps with investigative analysis, supports regulatory compliance as well as keeps track of historical activities across distributed networks. Alert configuration Update Alert Profile Profile Name * Alert From 10_103_7_1 Send (s) alert to ben@acme.com Appliance(s) All Appliance Alerts criteria Any subscription module expires within 7 day(s) CPU usage exceeds % 20 Memory usage exceeds % 20 Disk usage exceeds 90 % IPS Threats count exceeds 1000 Web virus count exceeds Mail Virus count exceeds Total virus count exceeds Spam Mail count exceeds Unhealthy Surfing hits 1000 Appliance Connection Status CCC Logs View Log For : Start Date : End Date : Policy Configuration Policy Configuration Management Console System Events C C Search Records per page 20 (1 of 10) Time Event User Name IP Address Entity Sub Entity Action Status Appliances Message :39: :39: :38: admin admin admin User Alerts Users Clientless User Alert profile Clientless User Insert Insert Insert Error Error Error ACME_USA ACME_SG Entity blocked. CCC is not able to connect to the appliance as Remote management through CCC is not enabled from appliance. Push operation blocked as appliance is not synchronized. Entity blocked. CCC is not able to connect to the appliance as Remote management through CCC is not enabled from appliance. Cyberoam Security appliance logs Event Viewer Log Viewer Start Date * End Date * Appliance :00: :59:59 C C File Type Audit Logs Archived Files System Logs Anti Virus IPS Authentication Audit Logs From: :00:00 To: :59:59 Show 5 days per page Page 1 of 3 Go to page : Go Date File Details Total Size Action 2014/07/25 00_23hrs.log (92.71 KB) KB View Data Unload 2014/07/20 00_23hrs.log (1.54 KB) 1.54 KB View Data

8 INTEGRATION WITH CYBEROAM IVIEW Allows auto-provisioning of managed appliances in Cyberoam iview and automatically syncs CCC administrators in Cyberoam iview, resulting in reduced complexity and

FEATURES & BENEFITS Features Centralized policy management and security updates Benefits Real-time protection against newly identified threats Reduced operational cost, complexity and time to manage

7 8 INTEGRATION WITH CYBEROAM IVIEW Allows auto-provisioning of managed appliances in Cyberoam iview and automatically syncs CCC administrators in Cyberoam iview, resulting in reduced complexity and effort for network administrators and security service providers alike. FEATURES & BENEFITS Features Centralized policy management and security updates Benefits Real-time protection against newly identified threats Reduced operational cost, complexity and time to manage dispersed networks Organization-wide uniform policy implementation Control over distributed networks from a central console Web 2.0 enabled GUI Dynamic views for managing, searching and sorting Cyberoam security appliances Quicker policy setting and security management Intelligent grouping of Cyberoam security appliances Template-based configuration Allows meaningful grouping of security appliances based on clients (for MSSPs), geography, security appliance model and more Create policy templates based on best practices for re-use Enables enterprises to extend security policies for new branch offices in minimal time Enables MSSPs to apply vertical-focused policies for new clients in minimal time API Enables MSSPs and Enterprises to leverage existing Professional Services Automation (PSA) Tools, IT infrastructure monitoring and ticketing systems, providing benefits of usability and operational efficiency Integration with PSA tools like ConnectWise enables automatic ticket generation and resolution for key CCC alerts on PSA interface, enabling accelerated process automation for managed security services Role-based administration Change control & logging Alerts and audit logs Delegation of administrative rights based on user roles Security against misuse of administrator privileges Track and roll-back configuration changes for managed Cyberoam appliances Audit trail for policy and device changes - Enables compliance review - Helps track deviations from a standard security practice Timely notifications for alerts like reminders for security subscription expiry, threats count crossing a threshold, appliance connection status, VPN connection status change and more Helps with investigative analysis; supports regulatory compliance Integration with Cyberoam iview (Logging & Reporting solution) Auto-provisioning of managed appliances in Cyberoam iview Automatically syncs CCC administrators in Cyberoam iview Reduces complexity, saves time and effort

8 CCC Appliance Range CCC Hardware Appliance Range CCC15NM CCCNM CCC100NM CCC200NM CCC0NM CCC Virtual Appliance Range CCCV15 CCCV CCCV100 CCCV200 CCCV0 Cyberoam Product Portfolio Network Security Appliances (Hardware & Virtual) Centralized Management - CCC (Hardware, Virtual & Cloud) Centralized Reporting - iview Toll Free Numbers USA : India : APAC/MEA : Europe : sales@cyberoam.com C o p y r i g h t Cyberoam Te c h n o l o g i e s Pvt.Lt d. Al l R i g h t s R e s e r v e d. Cyberoam and Cyberoam logo are registered trademark of Cyberoam Technologies Pvt. Ltd. Although Cyberoam has attempted to provide accurate information, Cyberoam assumes no responsibility for accuracy or completeness of information neither is this a legally binding representation. Cyberoam has the right to change, modify, transfer or otherwise revise the publication without notice.

Unified Threat Management

G H I J ECS Enter Unified Threat Management CR500ia-1F QUICK START GUIDE CR500ia-1F Appliance Document Version: PL QSG500ia-1F/96000/10.02.0.0.473/08082012 G H I J CR500ia-1F ECS Enter DEFAULTS Default