Seminar: IT Security Design der neuen Art 2016 IXIA AND/OR ITS AFFILIATES. ALL RIGHTS RESERVED.

Transcription

1 Seminar: IT Security Design der neuen Art 1

2 OUR HISTORY AND COMPETENCE Anue Systems: > Network Visibility: > Packet Brokers (NTO) > Network Testing: > Impairment Generator 2002 June Oct NetOptics: > Network Visibility: > Packet Brokers (xstream) > Inline Security (BypassTap) > Network Taps Ixia: > Founded in 1997 > Active testing of > IP networks, > Wifi > 3G/LTE 2005 July 2012 BreakingPoint: > Security testing > Attack analytics Keysight Technolgies: > April 2017 Ixia part of Keysight Technologies (ixia solutions group) 2

3 Visibility Portfolio (offline) 3

4 QUESTION How do they make sure that the millions of Dollars that has been spent are paying off in terms of: Availability: - meet SLAs Security: - Potential threats, data loss prevention, vulnerabilities Compliance: - Sarbanes-Oxley, HIPPA, PCI-DDS Performance: - End user experience, troubleshooting, root cause analysis Trends: - Capacity planning and scalability 4

5 HERE IS THE SOLUTION Step 1: Deploy Ixia TAPs Internet Deploy Ixia TAPs within your network architecture providing you full visibility S S S 5

6 TAP VERSUS SPAN TAP Full Duplex Taps (no packet loss due to aggregation) Simplest optical TAPs are safe as houses and grow with the Network from GE to 100GE Copper TAPs are fail safe even when the power is lost Available for all media types: Copper: 10M, 100M & 1G Optical: Single Mode 1G till 100G Multi Mode 1G till 100G Cisco Bidi SPAN Limited number of SPANs leads to compromise (Multiple tools cannot be used at the same time) Have to be configured and maintained (Danger working on Production Network) Load depended behavior (tend to lose packets already at lower processor load) 6

7 VIRTUAL NETWORKS Problem: East-West traffic never leaves the physical server and so it does lead again into: Hypervisor VM 1 WEB VM 2 APP VM 3 DB Security, Monitoring and Compliance Risks East-West (green arrows) Traffic NOT Seen by Network Monitoring Tools No Visibility Virtual Switch No Audit Trail No Utilization Insight 7

8 VIRTUAL TAP KVM HYPER-V Cloudlens vtap is capable of capturing and then sending inter-vm traffic of interest to the tools that are already monitoring your physical network. Plus it can perform basic filtering. ESXi vtap Service vswitch Monitoring vswitch GRE-VLAN-ERSPAN Custom Tunnel 8

9 HERE IS THE SOLUTION Step 2: Deploy Ixia Cloudlens vtap Internet S S S Ixia Cloudlens vtaps providing access to east-west traffic within the same hypervisor 9

10 PROBLEM WITH THE GRANULARITY Granularity can become very costly due to: > Every TAP requires two tool ports (A>B & B>A) > Link speed dictates tool speed and performance (very costly for 40G/100G) > Different tools are competing against the same TAP or SPAN port > If not as much tool ports as TAP or SPAN are available engineers need to change ports. (Problems with access control/rights & distance) Finally a project is dead already before it started > Tools are flooded with unnecessary data 10

11 HERE IS THE SOLUTION Step 3: Deploy Ixia Packet Broker Internet S S S Ixia Vision Packet Broker: > aggregate SPAN,& TAP & tools > filter & forward only relevant data > Providing Advanced and ATIP features > optimizing tool performance 11

12 CENTRALIZED SOLUTION 12

13 DISTRIBUTED SOLUTION WITH CLUSTERING 13

14 USE CASE VISIBILITY PER TOP OF RACK Internet Tools Farm VisionEdge Series S S Ixia VisionEdge Series Ports from 1G till 100G Filtering till L4 Single or multiple tools to be connected Tap top of rack switches with a few taps 14

15 USE CASE HIGH DENSITY LEAF-SPINE Internet Fabric Controller VisionEdge Tools Farm S S S Ixia VisionEdge Series Ports from 1G till 100G Filtering till L4 Clustering support to move network traffic to central tools Medium scale data center Multiple racks and leaf-spine topology Redundant paths to tap 15

16 VISIBILITY INTELLIGENCE STACKS NetStack(~NPB Basics) 3 Stages of Filtering Dynamic Filter Compiler Double your Ports VLAN Tagging Aggregation & Replication Load Balancing PacketStack (~AFM) Deduplication Header Stripping & Protocol Trimming Timestamping Data Masking GRE Tunneling Burst Protection AppStack (~ATIP) Application & RegEx filtering Geolocation & Tagging Real-time Dashboard NetFlow & IxFlowReg Data Masking + PCAP SecureStack Passive SSL Decryption Active SSL (Q2 2017) 16

17 PACKETSTACK (AFM) Advanced Packet Processing (AFM) Features Deduplication Header stripping Packet Trimming Data Masking Tunnel Termination Timestamping Burst Protection NPB Adv. Packet Processing Hardware AFM All unique frames going to /8 Only the first 128 bytes of TCP Port 25 frames 17

18 PACKETSTACK (AFM) 1. Assign AFM bandwidth > Network- ToolPort > Dynamic Filter 2. Configure & combine > Multiple functions at the same 18

19 APPSTACK (ATIP) Meta Data All traffic from Georgia NPB App Brokering App Filtering All voice traffic from HTC Ones Someone from S. Africa watching House of Cards on Netflix on an iphone on Vodacom s network ATI Processor (ATIP) - Context-rich Application Visibility Application forwarding based on application, geography, and RegEx matching Real-time dashboard Rich NetFlow / IPFIX generation > Device OS > Browser > Geolocation Data Masking > Dynamic (RegEx) 19

20 SECURE STACK - SPYGLASS Encrypted traffic is expected to be 75% of all traffic by the end of 2017 Challenge: It is extremely expensive to inspect encrypted traffic at volume and speed! 20

21 HIGH PERFORMANCE ACTIVE SSL INSPECTION New high-performance Application Module for Vision ONE and Vision 7300 Dedicated cryptographic processor Integrated with Inline support on NTO Both inline and passive tool support Policy-based SSL inspection URL categorization 21

22 USE CASE HIGH DENSITY WITH ADVANCED PACKET PROCESSING FOR TOOL OPTIMIZATION Internet VisionEdge Series Vision ONE/7300 Tools Farm S S S Ixia VisionEdge Series Ports from 1G till 100G Filtering till L4 Aggregating lot of ports VisionOne-ControlTower Benefits Advanced Packet Processing > De-duplication, Trimming, Stripping > L7 filtering, SSL decryption, Netflow gen. Single pane of glass UI with Ixia Fabric Controller (IFC) Medium scale data center Multiple racks and leaf-spine topology 22

23 USE CASE ULTRA SCALE WITH ADVANCED PACKET PROCESSING FOR TOOL OPTIMIZATION Internet VisionEdge Series Vision 7300 Tools Farm S S S Ixia VisionEdge Series Ports from 1G till 100G Filtering till L4 Aggregating lot of ports VisionOne-ControlTower Benefits Advanced Packet Processing (Terabits/s) > De-duplication, Trimming, Stripping > L7 filtering, SSL decryption, Netflow gen. Single pane of glass UI with Ixia Fabric Controller (IFC) Massive scale data center 100s of 10/40/100G taps required 23

24 Security Portfolio (inline) 24

25 INLINE VERSUS OUT OF BAND Out of Band Inline - Tool goes into the link - Defective tool does take the link down - Tools are: NGFW, IPS - Tool does receive only copies from the link - Defective tool does not take the link down - Tools are: APM, NPM, VoIP Analyzer, DLP, SIEM, IDS, Sandboxing - TAP: electrical or optical 10M-100G 25

26 BYPASS REGULAR OPERATION (BYPASS=OFF) Bypass Tap (1) Heartbeat packet preserves the link state towards IPS Protects against power, link, and application failure Provides flexibility for upgrades, moves, etc. 26

27 ANY ADVANTAGE BY ADDING A PACKET BROKER? Spare Unit Jumps in if any of the production units has an issue Keeps security index up (no more 100% or nothing) Load Balancing Load balance link bandwidth between one tool load balance group Cost effective solution (multiple 1G IPS are cheaper than a single 10G IPS) 27

28 AND EVEN MORE ADVANTAGES BY ADDING A PACKET BROKER Redirect packets Traffic that does not need to be inspected by the inline tools can be redirected back into the link Offload security tools from unwanted traffic Better resource management Inline SSL decryption Powerful 10Gbit/s bidirectional inline SSL decryption Offload decryption from tools (better performance and less delay at less cost) 28

29 SEAMLESS INTEGRATION OF NEW SECURITY TOOLS Phase 1 New security tools are receiving only copies of the link packets Security teams can get familiar with the behavior Phase 2 Seamless inline integration once Security teams are confided with the new tool 29

30 WHAT IF I HAVE MULTIPLE LINKS TO THE WORLD? Packet Broker does: Maintain link affinity. Packets from each link are assured to be delivered back to that link. Load balance all packets with session affinity through the individual tools in the LBG Switch to standby units in case of an issue with the production units 30

31 OK, BUT WHAT IF I HAVE INLINE AND OFFLINE SECURITY TOOLS? We are happy to help Internally tap whatever out of band tool (Sandboxing, Data Recorder, IDS) you want to the Packet Broker In this case the Packet Broker will send packet copies from the internally tapped links to the OOB tools Use Advanced Features (Deduplication, Packet Trimming, Header Stripping ) or ATIP features (Application layer filtering, SSL decryption or Netflow generation) to your advantage 31

32 BUT AN IPS DECIDES WHAT A SANDBOXING UNIT NEED TO CHECK Still not an issue Let the IPS manage filter settings of the Packet Broker programmatically through RESTful API 32

33 SINGLE POINT OF FAILURE? NOT WITH HA? Here is the solution: Use BypassVHD switches supporting High Availability (HA) and double up the Packet Broker and Tool infrastructure for 100% redundancy The advantage of a HA Bypass is that it has two links down to the Packet Broker. If one of the links fails the Bypass will switch traffic to the other Bypass. Only if both links down do not work anymore the Bypass will fail the links open 33

34 AND HERE IS THE FULL PICTURE A single ixia Packet Broker can handle inline as well as offline applications. 34

35 CloudLens 35

36 INTRODUCING CLOUDLENS Visibility across all your cloud environments - public, private, and hybrid clouds CloudLens CloudLens Private CloudLens Public Branch Office Virtual DC Private Cloud Public Cloud CloudLens vtap CloudLens vpb CloudLens vatip 36

37 VIRTUAL DATACENTER VISIBILITY Inter-VM East-West Traffic Monitoring No Blind Spots Physical End Point Tools KVM HYPER-V IPS/IDS Traffic Analysis DLP Virtual Traffic Visibility Provides Visibility into Data Center Network (Inline/ Out of Band) ESXi vswitch vtap Service Monitoring vswitch CloudLens Mgr. Netflow / Full Packets Netflow Geo-location Time Stamping Deduplication Header Stripping FireEye SPLUNK ** Scrutinizer ** NTOP Monit Probe ** (Radcom) vgsc Monitoring Host Inter-VM Traffic Monitoring Multiple Hypervisor Support (ESXi, KVM, Hyper-V, OpenStack) vswitch/router Agnostic (VSS, vds, Cisco Nexus) GRE VLAN ERSPAN Protocols Monitoring Tool Agnostic Centralized Management GRE-VLAN-ERSPAN Custom Tunnel 37

38 HOW CLOUDLENS WORKS IXIA CloudLens Public Management Layer Monitoring Tools Security Tools Performance Tools Secure Visibility Path Filtering at source Filtered Traffic securely sent from Instance to Tool 38

39 ARCHITECTURE DESIGN HYBRID CLOUD 39

40 IXIA SOLUTIONS FOR THE ARCHITECTURE DESIGN Ixia FlexTap Ixia Taps are available for all media types: Copper: 10M, 100M & 1G Optical: Single Mode & Multi Mode 1G till 100G Cisco Bidi 40

41 IXIA SOLUTIONS FOR THE ARCHITECTURE DESIGN Ixia CloudLens Inter-VM Traffic Monitoring Multiple Hypervisor Support (ESXi, KVM, VM, OpenStack) vswitch/router Agnostic (VSS, vds, Cisco Nexus) GRE-VLAN-ERSPAN Protocols 41

42 IXIA SOLUTIONS FOR THE ARCHITECTURE DESIGN Ixia CloudLens AWS Support SaaS Web-Interface where Cloud Visibility is managed Docker based component that sits within Source and Tool Instances in a customers environment Filtered traffic securely sent from Instance to Tool 42

43 IXIA SOLUTIONS FOR THE ARCHITECTURE DESIGN Ixia Packet Broker Aggregation & Filtering till Application Level Packet Processing (Trimming, Stripping, De-Duplication SSL-Decryption, Netflow Generation Web Based User Interface 43

44 SO WHAT DO I NEED FROM IXIA? Only four things: Packet Broker Bypass Tap CloudLens 44

45 IXIA FLEX TAP - 1G/10G/40G/100G (LR & ER) > Single Mode with LC Connector > Split Ratio 50/50, 60/40, 70/30, 80/20 & 90/10-1G (SX) > Multi Mode with LC Connector > 62,5 µm > Split Ratio 50/50, 60/40, 70/30, 80/20 & 90/10-1G (SX) & 10G (SR) > Multi Mode with LC Connector > 50 µm > Split Ratio 50/50, 60/40, 70/30 & 80/20-40G (SR4) > Multi Mode with MTP Connector > 50µm > Split Ratio 50/50 & 70/30-40G (Cisco Bidi) > Multi Mode > 50µm > Split Ratio 50/50-100G (SR10) > Multi Mode with MTP Connector > 50µm > Split Ratio 50:50 & 70:30-40G (MR4) > Multi Mode with LC Connector > 50 µm > Split Ratio 70/30 45

46 IXIA BYPASS SWITCH ibypass 3 ibypass 10G ibypass (4x10G) ibypass HD ibypass VHD 46

47 WHO IS WHO OF IXIA PACKET BROKER 47

48 Break 48

49 Front Line Defence Threat ARMOR 49

50 BEHIND EVERY SECURITY BREACH IS A SECURITY TEAM WITH HIGH-QUALITY TOOLS 50

51 BUT ON AVERAGE, ONLY 29% OF ALERTS RECEIVED ARE INVESTIGATED* WHY? 51 *Ponemon 2016 State of Malware Detection & Prevention

52 THE INTERNET IS FULL OF GOOD AND BAD TRAFFIC 52

53 HAMMERING YOUR COMPANY S SECURITY INFRASTRUCTURE 53

54 THE CONSTANT BARRAGE OF NETWORK PROBES AND SCANS CREATES A LOT OF NOISE AND HIDES CRITICAL EVENTS 54

55 BUT THERE IS A SOLUTION 55

56 NOW YOU CAN FILTER OUT KNOWN BAD IPs 56

57 AND COMPLETELY REMOVE UNTRUSTED COUNTRIES 57

58 MAKING YOUR SECURITY TOOLS MORE EFFICIENT 58

59 INTRODUCING 59

60 ThreatARMOR FROM IXIA ThreatARMOR is a threat intelligence gateway. Blocks known-bad IPs and eliminates untrusted countries. Reduces alert fatigue and false positives

61 HOW ThreatARMOR COMPLEMENTS YOUR SECURITY DEPLOYMENT 61

62 HOW MANY BAD IP S CAN MY SECURITY DEVICE BLOCK? Next-gen Firewalls are optimized for DPI, threat detection, web security, and user based policies. They can typically block 10,000 to 40,000 IP ranges. This enough to handle a handful of countries and some manual block rules, but not enough to handle the tens of millions of malicious, hijacked, and unregistered IP addresses without substantial performance degradation. ThreatARMOR can block over 4 billion IP s at line rate. Offloading this large-scale IP blocking to ThreatARMOR increases firewall performance by up to 75%, freeing up resources while enabling more advanced firewall features. Web Transaction Rate 4,294,967,296 EVERY IP ON THE INTERNET INDIVIDUALLY EVALUATED WITH NO PERFORMANCE HIT ATI RAP SHEETS TOP 10 BOTNET COUNTRIES NGFW+TA NGFW ,000 IP RANGES 40,000 IP RANGES TOP 5 BOTNET COUNTRIES BOGONS HIJACKED IP s ENTRY-LEVEL NGFW HIGH-END NGFW ThreatARMOR 62

63 ThreatARMOR BRINGS THREAT INTELLIGENCE TO YOUR NETWORK IXIA ATI Research Center ThreatARMOR Rap Sheets ThreatARMOR Appliance Professional-grade Threat Intelligence Clear proof for every blocked site. Set, Select and Forget. Auto-updates every 5 min. Maximum reliability

64 HOW IS ThreatARMOR DIFFERENT? HIGH PERFORMANCE HIGH RESILIENCY Purpose-built to hold every IP address on the Internet Guaranteed line-rate performance blocking full ATI Rap Sheet database Scale with no performance impact from blocking one, one thousand, or one billion IP addresses Built for maximum reliability Dual-redundant power supplies Integrated bypass NIC Field-replaceable SSD Serial console capability 64 64

65 DEPLOY ThreatARMOR IN 30 MINUTES EASY TO CONFIGURE 1. Connect power and Ethernet cables 2. Pick Report Only or Blocking Mode 3. Walk away, it updates automatically Criminal site blocking is automatic Geo-blocking is optional 65 65

66 Dashboard shows top blocked countries, recent blocked IP and reason, and top traffic Log of countries recent IP Real-time overview blocks with reason. shows countries Click on any block attempting malicious for full Rap Sheet connections, total data including local throughput and IP addresses, DNS blocked connection info, screen shots stats and checksums. Bottom allowed countries are good candidates for blocking 66

67 CASE STUDY: SECURITY INTRUSION ALERTS REDUCED BY 80% ThreatARMOR cuts intrusions and capex CASE STUDY: HyperBox CHALLENGE: With 3 million attacks on web servers daily, customer needed a cost-effective, automated defense strategy SOLUTION: ThreatARMOR RESULTS: Reduced IDS intrusion detections from 1M to 200K, saving IT significant time due to fewer alerts Deferred new capex purchases by maximizing existing IDS and firewall tools Service Provider Sector Better Visibility Better Security 67

68 ThreatARMOR - YOUR THREAT INTELLIGENCE GATEWAY BLOCK the unwanted from touching your network GET MORE out of your security team and tools ENFORCE Ixia s professional-grade Application and Threat Intelligence feed IMPROVES YOUR SECURITY PERFORMANCE FAST! 68 68

69 THANK YOU 69

70 SUMMARY Ixia Packet Broker > can be used for inline (security) or offline (visibility) applications at the same time > allows cost effective usage of any tool Ixia Bypass Switch > prevents companies from being offline due to a security tool issue Ixia Tap > Provides reliable measurement points anywhere in the data center Ixia Cloudlens > Provides packet level access in virtual environment Might be installed with a dedicated monitoring or security project but once installed it is the base for any additional tools (inline or offline) that need to be attached 73