A problem well stated is a problem half-solved. -Charles Kettering The other half of the problem is the VPN Connection...

Transcription

1 Shaun Ellis 1

2 A problem well stated is a problem half-solved. -Charles Kettering The other half of the problem is the VPN Connection... -Shaun Ellis Shaun Ellis 2

3 What is it? What makes it different than my current VPN Access? Gatekeeper Installation NERC/CIP Compliance 3

4 What is it? 4

5 What is it? SecureLink s remote support network is the first system designed specifically to address the issues involved in managing remote support connections for customers. Over 15,000 organizations including hospitals, financial institutions, public sector entities and the vendors that supply them software use. SecureLink provides a secure and effective remote support solution to comply with NERC, and many other regulations.

6 6 Before SecureLink Firewall Modem VPN Desktop Sharing Site to Site Network

7 With SecureLink 7

8 8

9 Customer Network ESC Network Technical Support Engineer Two Factor Authentication SecureLink Website Gatekeeper Outbound Port 22 Encrypted SSH Tunnel Connection This can be a stand alone server or an existing StackVision Server 9

10 What makes it different than VPN? 10

11 11 What makes it different than VPN? SecureLink is different than VPN s because it puts the customer in total control of the ESC connectivity, while allowing ESC to resolve issues more efficiently.

12 What makes it different than VPN? VPNs Technician authenticated on customer side, customer must maintain access list. Accounts may be shared by vendor SecureLink Remote Support Module Technician authenticated on vendor side using Active Directory, LDAP or other secure, 2 factor methods. All technicians have individual account. AUTHENTICATION 12

13 What makes it different than VPN? VPNs User becomes a node on the network, enabling snooping and causing IP address and spilt tunneling conflicts. Client software possibly required SecureLink Remote Support Module User may only access privileges defined by customer at the machine and port level. Browser-based, no software is required. ACCESS 13

14 What makes it different than VPN? Basic Auditing VPNs SecureLink Remote Support Module High definition audit that ties activities to individuals: services accessed, files transferred, commands entered and video recording of RDP and desktop sharing sessions for future playback. AUDITING 14

15 What makes it different than VPN? VPNs SecureLink Remote Support Module connection notifications, access anytime, on-demand or via an access schedule, secure credential storage, built in tools for desktop sharing and file transfer. REMOTE SUPPORT NETWORK FEATURES 15

16 What makes it different than VPN? 16 Allow access anytime, set up manual access windows, or even enable and disable access according to an access schedule.

17 17 What makes it different than VPN? Receive a notification of whenever ESC connects, as well as a full summary of access activity when a connection ends to the Customer to the Customer on Session End Not on Connection on Disconnect.

18 Support Rules! Support don t end my session! SecureLink Website End Session 18

19 What makes it different than VPN? Record all RDP activity on your network for future playback and forensics. 19

20 20

21 What makes it different than VPN? Audit all ESC activity on your network 21

22 Gatekeeper Installation 22

23 Gatekeeper Installation The SecureLink Gatekeeper is a software component designed to be installed on a single Windows Server Its purpose is to serve as a secure access point into one or more servers on your network by trusted 3rd parties. The Gatekeeper requires internet access to communicate with your vendors SecureLink server, but there are no firewall changes necessary to enable your vendor to connect using SecureLink.. 23

24 24 Gatekeeper Installation Unless. The Gatekeeper is installed on a Server that does not have internet access, rules should be set on the firewall to allow SSH and HTTP access outbound port 22 directly to your vendor's SecureLink server.

25 25 Gatekeeper Installation The Gatekeeper s Windows installer can be launched and installed with 2-clicks. Once the Gatekeeper passes the connectivity test, it will prompt for a registration code.

26 Gatekeeper Installation The registration code is generated by the SecureLink server and uniquely identifies the customer profile and the machine it is installed on. The new Gatekeeper will only communicate and establish connections with the SecureLink server where it is registered. 26

27 NERC/CIP Compliance 27

28 NERC/CIP Compliance 28

29 Update from the Field Justin Soderberg Western Farmers 29

30 Questions? 30