Secure Remote Access (SRA) Service Description

Transcription

1 Secure Remte Access (SRA) Service Descriptin Synetrix Hldings Limited Dcument Versin 1.1 Date August 6th 2007 Services prvided by Cpyright Statement The cpyright in this wrk is vested in Synetrix (Hldings) Ltd. (Synetrix) and this dcument is issued in cnfidence fr the purpse nly fr which it is supplied. It must nt be reprduced in whle r in part except under an agreement r with the cnsent in writing f Synetrix, and then nly n the cnditin that this ntice is included in any such reprductin. N infrmatin as t the cntents r subject matter f this dcument r any part theref arising directly r indirectly there frm shall be given rally r in writing r cmmunicated in any manner whatsever t any third party being an individual firm r cmpany r and emplyee theref, withut the prir written cnsent f Synetrix.

2 Table f Cntents Table f Cntents Dcument usage Intrductin Service summary Endpint Defense (pre authenticatin) Authenticatin and directry servers Remte access methds Resurce plicy cmpnents Custmisable end-user interface elements verview Optinal extras Service deplyment Terms and cnditins f the service Limitatins Pre-requisites Yur respnsibilities Service change requests Synetrix Hldings Limited Page 2 f 12

3 1. Dcument usage This dcument describes the Lndn Grid fr Learning (LGfL) Secure Remte Access (SRA) service prvided by Synetrix (Hldings) Limited, in rder t clearly define the service delivered. This dcument is maintained electrnically and the mst current versin can be fund n the Synetrix Custmer Service Centre website ( Other dcuments that prvide further infrmatin abut this service include: SRA Service Summary SRA Service Change Request Frm In additin, the SRA User Guide is maintained within SRA service web based administratin frnt end, accessible via the service administratin interface. 2. Intrductin The Secure Remte Access service prvides a safe, flexible, cst effective, and cmprehensive access methd t applicatin and netwrk layer resurces residing within either LEA r schls sites via standard web brwser client. It is fully integrated with the LGfL netwrk and with existing LEA WAN Management and Security Services; therefre, n changes are required t existing plicies. The service is based n Secure Scket Layer (SSL), a cryptgraphic industry standard prtcl supprted by all web brwsers fr the encryptin f data transmitted ver the Internet r any untrusted netwrk. This negates the need fr deplyment and management f supplementary client sftware and requires n changes t internal servers r devices t supprt the service. The underlying Secure Access Cluster IVE (Instant Virtual Extranet) deplyed and integrated within the cre LGfL netwrk prvides a virtual SSL VPN entity per LEA. Thrugh applied security and access cntrls, secure access t bth netwrk and applicatin resurces is enabled Synetrix Hldings Limited Page 3 f 12

4 3. Service summary This sectin prvides an verview f the functinality that is prvided by the SRA service. It cvers the three main areas f authenticatin, remte access methds, and resurces. Belw is a high-level verview f the three main elements f the IVE (Instant Virtual Extranet) with mre details prvided within the latter sub-sectins. Pre-Authenticatin and Authenticatin Include: Pre-authenticatin assessment Permit/Deny authenticatin plicy Establish authenticatin level Enfrce authenticatin & passwrd plicy Dynamic rle mapping 2007 Synetrix Hldings Limited Page 4 f 12

5 The pre-authenticatin assessment is used t check certain key attributes f the remte device, and netwrk befre the user is even allwed t submit credentials t sign in. This prevents ptential security risks such as malware and keystrke lggers that can hijack user credentials. If pre-assessment is cnfigured and the user is apprved, they mve nt the authenticatin stage. This checking cntinues peridically during the sessin t ensure endpint security is maintained. When the user has authenticated, a variety f attributes are lked at again t dynamically map them t a rle. The service permits administratrs t change sessin plicies and user rles depending n infrmatin that can change with every lg in. Fr example, the same persn culd access different infrmatin and resurces, r culd access them in a different way, depending n a cmbinatin f factrs, such as grup membership. The authenticatin realm is simply a gruping f authenticatin resurces that includes the authenticatin plicy itself. The authenticatin server verifies that the user is wh they say they are. The directry server (such as LDAP r Active Directry) has user/grup infrmatin that is used t map t rles. Rle mapping rules themselves (which are cnditins, based n a variety f attributes r infrmatin frm the directry server that the user has t meet t be mapped t a rle). Rles include: Determine sessin rle Establish sessin access settings Establish sessin UI The rle is where IVE sessin prperties are assigned, including what type f access is allwed (Cre, SAM, and/r NC) as well as sessin timeuts and bkmarks. Sme requirements can be set befre a user is even mapped t a rle back in the authenticatin realm at the rle mapping rule. Fr example if yu decide that Hst Checker/Cache Cleaner is vital t anyne accessing any material n the Payrll server, yu culd enfrce that plicy in the authenticatin step in the rle mapping rules, r yu culd enfrce it in the rle itself. As yu will see belw, just because a persn s rle entitles them t a certain kind f access (say SAM fr client/server apps), des nt mean that they will have access t all client/server resurces. Resurces include: Resurce-based authrisatin Dynamic permit/deny plicy Granular resurce cntrls t the URL, file, r server level Resurce plicy includes the resurce names (like URLs., hstnames, and IP addresses/netmasks), as well as resurce-specific actin like rewriting and caching Synetrix Hldings Limited Page 5 f 12

6 At this level administratrs can limit access t the URL, file, r server level, even if the access methd is apprved in the rle. Say, fr example, a remte user is authenticated and mapped t a rle that allws Web access. They brwse t the finance server which has a resurce plicy that requires that Hst Checker and Cache Cleaner be running. Because the remte netwrk client will nt allw any dwnlads the Hst Checker (HC)/Cache Cleaner (CC) prgram will nt dwnlad and execute s access t the finance server is denied. Therefre, even thugh their rle gives them Web access, the Web resurce (the finance server) denies access t that resurce. If the same user can get internet cnnectivity n a client that meets all the requirements and des have HC/CC installed (dnladed and executed), they are mapped t the same rle but als match the resurce authrisatin plicy (preauthenticatin checks) s they can get the infrmatin they require Endpint Defense (pre authenticatin) The SRA service prvides a cmprehensive slutin t assess the trust wrthiness f endpints. It uses a layered apprach t address the full range f risks that endpints can pse t yur netwrk and resurces. Using the fllwing cmpnents, yu can secure the systems f users bth inside and utside yur netwrk befre allwing them t cnnect t yur virtual SSL VPN entity. Hst Checker Hst Checker (als called native Hst Check and plicybased enfrcement) is a native IVE cmpnent that yu can use t perfrm endpint checks n hsts that cnnect t the IVE. Hst Checker checks fr third party applicatins, files, prcess, prts, registry keys, and custm DLLs and denies r enables access based n the results f the checks. Hst Checker can als be used t dwnlad advanced malware detectin sftware directly t the user s cmputer. When a user s cmputer des nt meet the requirements yu specify, yu can display remediatin instructins t users s they can bring their cmputers int cmpliance. Hst Check Client Interface (Windws nly) The Hst Check Client Interface is an API that allws yu t run yur wn DLLs using Hst Checker. Thrugh the interface, yu can prmpt Hst Checker t run a DLL that yu already installed n the user s system r distributed as part f a crprate OS image, including prgrams that check cmpliance with crprate images, antivirus sftware, and persnal firewall clients. Hst Checker runs the specified DLL when a user signs int the IVE, and then bases its subsequent actins n the success r failure result that the DLL returns. Fr example, yu may deny a user access t the IVE if the client check sftware fails. Hst Check Server Integratin Interface (Windws nly) The Hst Check Server Integratin Interface is an API that allws yu t tightly integrate a J.E.D.I. cmpliant system with the IVE. Like the Hst Check Client Interface, yu can use the Hst Check Server Integratin Interface t prmpt Hst Checker t run third-party sftware n the client, including hst integrity scans, malware detectrs, and virtual envirnments. With this interface, yu may als specify with granularity what Hst Checker shuld d based n the result f the diverse plicy checks that the third-party applicatins cnduct. Yu can invke these plicies t dynamically map users 2007 Synetrix Hldings Limited Page 6 f 12

7 t realms, rles, and resurces based n the results f individual plicies cntained in yur sftware package. Cache Cleaner (Windws nly) Cache Cleaner is a native IVE cmpnent that yu can use t remve residual data, such as ckies, temprary files, r applicatin caches, frm a user s machine after an IVE sessin. Cache Cleaner helps secure the user s system by preventing subsequent users frm finding temprary cpies f the files that the previus user was viewing and by preventing Web brwsers frm permanently string the usernames, passwrds, and Web addresses that users enter in Web frms. Using these endpint defense cmpnents, yu can develp a layered prtectin apprach, managing and prvisining a variety f endpint checks. Fr example, yu may chse t check fr virus detectin befre allwing a user access t any f the authenticatin realms, launch the sftware n the user s system if necessary, map the user t rles based n individual plicies defined in yur wn DLL, and then further restrict access t individual resurces based n the existence f spyware detectin sftware. Then, yu may use Cache Cleaner t remve residual files and clear the user s applicatin cache nce the user has terminated their sessin Authenticatin and directry servers An authenticatin server is a database that stres user credentials username and passwrd and typically grup infrmatin. When a user signs in t the IVE, the user specifies an authenticatin realm, which is assciated with an authenticatin server. If the user meets the realm s authenticatin plicy, the IVE frwards the user s credentials t the assciated authenticatin server. The authenticatin server s jb is t verify that the user exists and is wh they claim t be. The Secure Remte Access Service platfrm supprts the mst cmmn authenticatin servers, including Windws NT Dmain, Active Directry, RADIUS, LDAP, NIS, RSA ACE/Server, and Netegrity SiteMinder, and enables yu t create ne r mre lcal databases f users wh are authenticated by the IVE. A directry server is a database that stres user and typically grup infrmatin. Yu can cnfigure an authenticatin realm t use a directry server t retrieve user r grup infrmatin fr use in rle mapping rules and resurce plicies. Currently, the IVE supprts LDAP servers fr this purpse, which means yu can use an LDAP server fr bth authenticatin and authrisatin. In additin t LDAP, yu can use a RADIUS r SiteMinder server fr retrieving user attributes that can be used in rle mapping rules Synetrix Hldings Limited Page 7 f 12

8 3.3. Remte access methds The service prvides three access methds which can be used individually r in parallel t prvide secure flexible access t a range f applicatins and resurces. CORE ACCESS Cre Clientless Access prvides access t a hst f applicatins and resurces frm any PC. Requests cme int the Secure Access appliance, and terminate there; the Secure Access appliance dynamically rewrites the request, and frwards it t the resurce. This means that end users and internal resurces are never in direct cntact, making this the mst secure methd f access. Cre Access is based n a Web request fr cntent, and because Web requests are by their nature very detailed it enables very granular access cntrls all the way t the URL r file level. This access methd prvides access t the fllwing Secure Web Applicatin Access (Web URL re-writing) Secures Access t Web-based cntent and applicatins Supprt fr HTML, JavaScript, DHTML, VBScript, scket-based Java applets, XML, Flash etc. Standards-Based Client Access Supprt fr standards-based prtcls (IMAP, POP, and SMTP), fund in applicatins like Outlk Web Access (OWA), r Ltus intes. Because the Secure Access appliance is hardened, and all Cre sessins are terminated n it, the end user is never in direct cntact with the resurce. This prvides an extra layer f prtectin servers. Anywhere access with n additinal client sftware r hardware Secure File Share Access (File re-writing) Dynamically Webifies Windws and UNIX Files (CIFS/NFS) Secure Terminal Access Access t Telnet/SSH server hsts (VT100, VT320 ) Anywhere access with n terminal applicatin r VPN clients SECURE APPLICATION MANAGER SAM prvides access t client/server applicatins, including native messaging clients, like Micrsft Outlk and IBM/Ltus Ntes, via a crss-platfrm, dynamically dwnladed agent. This cmplete supprt significantly reduces desktp supprt calls and administratin while prviding access t all client/server applicatins, including dynamic TCP apps. Administratrs can easily enable native Citrix integratin by dynamically prvisining Win32 Citrix clients frm the Secure Access gateway, as 2007 Synetrix Hldings Limited Page 8 f 12

9 well as prvide native supprt fr Micrsft Terminal Services withut the need fr a pre-installed Terminal Services client. All that the user requires is the applicatin client (i.e., the Outlk Exchange client) and a standard Web brwser. Native delivery f MSTS and Citrix ICA clients Eliminates csts, cmplexity, and security risks assciated with VPNs N incremental sftware/hardware r custmizatin t existing apps Java (JSAM) and Windws (WSAM) versins WSAM enables client/server applicatins n mbile devices, such as handheld/pda devices. WSAM can be prvisined in a variety f ways, even if the end user des nt have administrative rights NETWORK CONNECT Netwrk Cnnect adaptive dual transprt mde prvides all f the functinality f an IPSec VPN and an SSL VPN frm ne platfrm, reducing verall cst and simplifying day-t-day management. When the user is authenticated and after the initial key exchange, Netwrk Cnnect will create a high perfrmance IPSec-like netwrk tunnel. If the underlying netwrk cnfiguratin des nt supprt that type f cnnectin, Netwrk Cnnect will autmatically fall back t SSL. This functin is transparent t the end user and ensures the highest perfrmance frm any cnnectin, enabling pwer users t take full advantage f pwerful, resurceintensive applicatins like VIP r streaming media frm a standard Web brwser. Adaptive dual transprt mde f High Perfrmance/High Availability Initially attempts t set up high perfrmance, IPSec-like transprt If unsupprted by netwrk, seamlessly fails ver t SSL Greater flexibility cnfiguring users t access multiple hsts/subnets Crss Platfrm dynamic dwnlad Client and server-side lgging, auditing and diagnstics Endpint assessment and cntainment integratin 3.4. Resurce plicy cmpnents A resurce plicy serves as the third level f resurce access cntrl. A resurce plicy is a set f resurce names (such as URLs, hst names, and IP address/netmask cmbinatins) t which yu grant r deny access r ther resurce-specific actins, such as rewriting and caching. While a rle may grant access t certain types f access features and resurces (such as bkmarks and applicatins), whether r nt a user can access a specific resurce is cntrlled by resurce plicies. Autmatic resurce plicies (aut plicies) can be used fr simplificatin during resurce prfile cnfiguratin. A resurce plicy cntains the fllwing infrmatin: 2007 Synetrix Hldings Limited Page 9 f 12

10 Resurces: A cllectin f resurce names (URLs, hst names, r IP address/netmask cmbinatins) that specify the resurces t which the plicy applies. Rles: An ptinal list f user rles t which this plicy applies. The default setting is t apply the plicy t all rles. Actin: The actin fr an IVE t take when a user requests the resurce crrespnding t the Resurce list. An actin may specify t allw r deny a resurce r t perfrm r nt perfrm an actin, such as t rewrite Web cntent r allw Java scket cnnectins. Detailed rules: An ptinal list f elements that specifies resurce details (such as a specific URL, directry path, file, r file type) t which yu want t apply a different actin r fr which yu want t evaluate cnditins befre applying the actin. Yu can define ne r mre rules and specify the rder in which the IVE evaluates them Custmisable end-user interface elements verview The service enables the custmisatin f the the lk and feel f the fllwing elements in the end-user interface: Sign-in pages (default and custm) Authenticatin > Signing In > Signin Pages pages can be custmised. Using settings in this page, yu can create welcme messages, sign ut messages and ther instructins; cntrl page headers; custmise select errr messages; and create a link t a custm help page within the default IVE sign-in page. 4. Optinal extras Secure Meeting - Secure Meeting allws IVE users t securely schedule and hld nline meetings between bth IVE users and nn-ive users. In meetings, users can share their desktps and applicatins with ne anther ver a secure cnnectin, allwing everyne in the meeting t instantaneusly share electrnic data n-screen. Meeting attendees can als securely cllabrate nline by remte-cntrlling ne anther's desktps and thrugh text chatting using a separate applicatin windw that des nt interfere with the presentatin. Anther benefit f secure meeting is the ability f Help Desk staff r third party supprt cmpanies t prvide remte assistance t any user r custmer by remtely cntrlling their PC withut requiring the user t install any client sftware. This is achieved by using the Secure Supprt Meeting ptin, which is perated n a ne t ne basis. 5. Service deplyment The SRA service is a cmprehensive flexible service that has a high degree f peratinal cmplexity. Therefre, the initial service ffering will be fully managed 2007 Synetrix Hldings Limited Page 10 f 12

11 and as such, there will be n custmer cnfigurable settings ther than the management f the lcal (deplyed centrally n the IVE) authenticatin database if this ptin is chsen. There are fur main cmpnents f the SRA service that are; Cre Access, Netwrk Cnnect (NC), Secure Applicatin Manager (SAM) and Endpint Defence. An initial requirement gathering (cnsultative) exercise will be undertaken by Synetrix wh will engage with the end user t identify their remte access requirements and identify which element f the service will be used t facilitate. Fr example, a large secndary schl requires secure terminal access fr use by ffsite supprt persnnel. This will be cnfigured and deplyed using the Cre Access element f the service. Once the fundamental Cre Access cmpnent has been cnfigured and deplyed then changes t existing service elements r additins within this cmpnent, such as new bkmarks fr access t drive mappings, will be cvered by the change request prcess that may be free dependant n the number f changes already used. Shuld the end users at a later date require remte client access t say their SIMS database then a different cmpnent f the service will be required. In this instance, Secure Applicatin Manger (SAM) will be required and therefre a cnsultative prcess and detailed requirement gathering will be required. This prcess will be chargeable and prices can be fund n the SRA pricing sheet. 6. Terms and cnditins f the service 6.1. Limitatins Phase 1 will nt supprt ptin 2, 3, 4 sites Pre-requisites T use the service yu must meet the fllwing prerequisites. LGfL bradband service Optin 1 IP addressing 6.3. Yur respnsibilities T use this service effectively yu are respnsible fr: Ownership and administratin f authenticatin server database such as Active Directry. The service supprts lcal databases that reside n the IVE. Management access fr administratin f these databases can cnfigured althugh it is recmmended that where pssible site authenticatin databases such as Active Directry is used Service change requests Sme ptins can nly be mdified by Synetrix, at yur request Synetrix Hldings Limited Page 11 f 12

12 The initial cnfiguratin requirements will be determined during the service implementatin prcess and will include a single cmpnent f the SRA service. Thereafter, all changes t this must be presented n a Service Change Request frm available frm Additinal cmpnent requirement gathering and cnfiguratin is chargeable and is detailed as Cnsultancy within the SRA pricing schedule; hwever, this service includes eight free Service Change Requests per year. The initial cmpnent cnfiguratin requirements gathering and cnfiguratin will nt use up any f yur free Service Change Requests Synetrix Hldings Limited Page 12 f 12