A Pragmatic Approach to HealthCare Security. Hans Mathys CSE, Cybersecurity, Cisco Switzerland

Transcription

1 A Pragmatic Approach to HealthCare Security Hans Mathys CSE, Cybersecurity, Cisco Switzerland

2 Referatsabstract A Pragmatic Approach To HealthCare Security - Cyber-Security ist nicht nur eine Herausforderung der modernen Gesellschaft, sondern ein Fundament für regelkonforme Businessprozesse, Risikominimierung und Persönlichkeitsschutz. Dieser Vortrag zeigt Möglichkeiten, wie die Kombination von Netzwerk und Security-Anwendungen die Erkennung von Angriffen ermöglicht, den Diebstahl von kritischen Daten verhindert und den unterbruchfreien Betrieb von IT Infrastruktur auch während einer Attacke gewährleistet. Dabei wird speziell auf die Security- Intelligenz hingewiesen und die integrierte Architektur, um Massnahmen in Echtzeit automatisiert anzuwenden. Folie 2,

3 Network Security Integration Regulation Visibility Segmentation Enforcement 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public 3

4 Security in the News Both the scale and the capability of this operation are concerning. Working with our partners, we estimate the number of infected devices to be at least 500,000 in at least 54 countries. The known devices affected by VPNFilter are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well at QNAP network-attached storage (NAS) devices. No other vendors, including Cisco, have been observed as infected by VPNFilter, but our research continues.

5 VPNFilter Threat Update 2017 Cisco and/or its affiliates. All rights reserved. Cisco Public Advanced, modular malware (e.g. industrial protocol monitoring) Code reuse from APT-28/Fancy Bear ~500K SOHO devices compromised in 54 countries Destructive capability NO Cisco devices compromised Cisco and/or its affiliates. All rights reserved. Cisco Public 5

6 Increased Sophistication

7 Umbrella, WSA VPNFilter Detections & Protections NGFW and NGIPS AMP & Threat Grid Stealthwatch & Stealthwatch Cloud 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public Cisco and/or its affiliates. All rights reserved. Cisco Public 7

8 Cisco Umbrella and Web Security Appliance can block internet communications of affected devices to known malicious destinations. Umbrella, WSA Cisco Stealthwatch Enterprise and Stealthwatch Cloud can detect affected devices communicating on the network to known malicious destinations on the internet. Stealthwatch & Stealthwatch Cloud Cisco NGFW and NGIPS can block the communication of affected devices on the network to known malicious destinations on the internet. NGFW and NGIPS AMP and Threat Grid detect known IoCs and file hashes to block Stages 1-3 malware and plug-ins AMP & Threat Grid 2018 Cisco and/or its affiliates. All rights reserved. Cisco Public Cisco and/or its affiliates. All rights reserved. Cisco Public 8

9 Threat Defense Architecture Segmentation Visibility & Analysis Endpoint Protection Services Extensible, scalable segmentation to protect IoT devices Detect anomalies, block threats, identify compromised hosts Secure endpoints and users wherever they are and work from with control and visibility Reduce risk, design, deploy, and respond to incidents while protecting the business Identity Services Engine/TrustSec Next-Generation FW Umbrella Stealthwatch ISE/TrustSec Cognitive Threat Analytics Advanced Malware Protection Security Connector AnyConnect Umbrella AMP for Endpoints Cloudlock Design Assess risk Incident Response Cisco and/or its affiliates. All rights reserved. Cisco Public 9

10 Unlock Next-Generation Secure Network Access with contextual awareness and segmentation Preconfigure access by business profiles Identify profiles automatically and intelligently Enforce access across entire infrastructure Finance Employee Profile Lobby Finance HR PROFILE ACCESS Guest / Vendor Profile Lobby Finance HR PROFILE ACCESS Finance credential Low risk Finance Employee Profile Device complaint Guest Guest / Vendor Profile Low risk Device complaint Lobby Finance HR Lobby Finance HR Cisco and/or its affiliates. All rights reserved. Cisco Public 10

11 Maximize your security and contain breaches Safeguard your network Stop threats from spreading Harmonize your security solutions Access Denied Cisco and/or its affiliates. All rights reserved. Cisco Public 11

12 Building your next-generation network is a process The capabilities you need to handle the digital demands of today: Rapid Threat Containment SDA Access Outcome: Guest, Wireless Access Identity-based Services Automated Segmentation Device Management, IoT, BYOD Network and Asset Visibility; Policy Monitoring Cisco and/or its affiliates. All rights reserved. Cisco Public 12

13 Gain more insight. Supervisor Workstation Thermostat Threats ISE Users/ Devices Command and control servers File transfers Web applications Application protocols Routers and switches HMI device Camera DNS Umbrella Malware Network servers Stealthwatch / CTA / ETA Gas valve Cisco Firepower NGFW / AMP Cisco and/or its affiliates. All rights reserved. Cisco Public 13

14 Visibility and Policy with Cisco Identity Services Engine A centralized security solution that automates context-aware access to network resources and shares contextual data Physical or VM Identity Profiling and Posture Role-Based Policy Access Network Resources Who Traditional Cisco TrustSec Network Door What When Where How Guest Access BYOD Access Role-Based Access Compliant Secure Access ISE pxgrid Controller Context Cisco and/or its affiliates. All rights reserved. Cisco Public 14

15 Software-Defined Segmentation Software-Defined Segmentation Easily Classify Endpoints Devices and Use Group-Based Policies in NGFWs and the Network SGT_Guest SGT_Building Management SGT_Employee Guest 1 50 Temperature Device 1 Employee 1 Employee 2 Employee 3 Guest 2 Surveillance Device 1 Employee 4 50 Guest 3 Guest 4 Temperature Device 2 Surveillance Device 2 SGT_FinanceServer SGT_Printers Fin 1 Fin 2 Printer 1 Printer Cisco and/or its affiliates. All rights reserved. Cisco Public 15

16 Simplifying Segmentation with TrustSec Traditional Segmentation Static ACL Routing Redundancy DHCP Scope Address VLAN Enterprise Backbone VACL Aggregation Layer Access Layer TrustSec Micro/Macro Segmentation Central Policy Provisioning No Topology Change No VLAN Change Enterprise Backbone DC Servers DC Firewall/Switch Policy Access Layer ISE Non-Compliant Voice Employee Supplier BYOD Voice Non-Compliant Employee Supplier BYOD Quarantine VLAN Voice VLAN Data VLAN Guest VLAN BYOD VLAN Employee Tag Voice VLAN Data VLAN Security Policy based on Topology High cost and complex maintenance Supplier Tag Non-Compliant Tag Use existing topology and automate security policy to reduce OpEx Cisco and/or its affiliates. All rights reserved. Cisco Public 16

17 Segmentation Management Maintain Agility with Simple, Dynamic Policy Updates Sources Company Database Destinations Public Cloud External Partner Internet Simplify role creation Define access policies using plain language instead of complex ACLs and firewall rules Guest Employee BYOD Building Mgmt. Employee Define Define Define Define Deny Deny Deny Permit Access Access Access Access Permit Permit Permit Permit Define Define Define Define Permit Deny Deny Web Apps AccessDeny Access Deny Deny Access Deny Access Define Web AppsDefine Web Apps Web Define Apps Web Apps Define Permit Permit Deny Deny Deny Access Access Access Access Define Define Define Define Permit Permit Permit Access Access Access Access Apply rules automatically Define segmentation based on logical groupings that are applied automatically Maintain and scale dynamically Defining policies with logical tags means that rules don t depend on individual IP addresses and can be dynamically and transparently changed no matter the group size Cisco and/or its affiliates. All rights reserved. Cisco Public 17

18 Software-Defined Segmentation Campus/Branch/DC Segmentation Segment traffic based on classified group (SGT), not based on topology (VLAN, IP subnet) Shared Services Data Center Application Servers Micro-Segmentation/Host Isolation in LAN and DC with single policy (segment devices even in same VLAN or same security group) SGACL SGACL ISE Employee Tag Supplier Tag Non-Compliant Employee VLAN: Data-2 Voice Voice Employee Supplier Non-Compliant VLAN: Data-1 Non-Compliant Tag Application Servers Tag Shared Services Tag Cisco and/or its affiliates. All rights reserved. Cisco Public 18

19 Visibility Threat-Hunting Monitor Detect CISCO STEALTHWATCH Analyze Respond Extended Network Cloud Branch Data Center The Stealthwatch system enhances your security across the enterprise, providing comprehensive network visibility and intelligence Your network is a key asset for threat detection and control The Stealthwatch architecture ensures robust and flexible deployment Cisco and/or its affiliates. All rights reserved. Cisco Public 19

20 Companies are responsible to protect customer data and privacy as good as possible including the whole production or value chain. Data loss has to be detected, reported and analyzed. Will GDPR change the game? Cisco and/or its affiliates. All rights reserved. Cisco Public 20

21 Enterprise Network Security Should Provide Unified security that reduces risk and complexity Detailed network traffic visibility for threat detection Effective protection against known and unknown threats Cisco and/or its affiliates. All rights reserved. Cisco Public 21

22 Cisco Enterprise Network Security Trustworthy Systems Security embedded into hardware and software by design Network as a Sensor Visibility and analytics across the extended enterprise, industry-leading threat intelligence Network as an Enforcer Consistent threat protection and remediation across the network Secure your digital network in real-time, all the time, everywhere Cisco and/or its affiliates. All rights reserved. Cisco Public 22

23 Security Embedded in Hardware and Software Reduced Vulnerabilities and Risk Visibility into Platform Integrity Faster Identification and Remediation of Threats Cisco and/or its affiliates. All rights reserved. Cisco Public 23

24 Consistent Threat Protection and Remediation Across the Network Network as an Enforcer Contain threats quickly Software-Defined Access, TrustSec 140% Return on investment Total economic impact by Forrester Stop threats at the edge NGFW 100% Leading breach detection Source: NSS Labs Protect users wherever they work Umbrella By 2018, Gartner estimates 25% of corporate data traffic will bypass perimeter security Cisco and/or its affiliates. All rights reserved. Cisco Public 24

25 Consistently Apply Policy, Control Access to Resources and Block Attacks Network as an Enforcer TrustSec Control access to network segments and resources according to your security policy by working with ISE Consistently delivers security policy across branch, campus, data center, and cloud TrustSec Simplifies network segmentation with a softwaredefined approach Shrinks the attack surface by preventing lateral movement of potential threats Switch Router VPN and Firewall DC Switch Wireless Controller Segmentation Policy Enforced Across the Extended Network Cisco and/or its affiliates. All rights reserved. Cisco Public 25

26 Stop Threats at the Edge Network as an Enforcer Cisco Firepower NGFW and NGFWv Stop more threats Gain more insight Detect earlier, act faster Reduce complexity Get more from your network Threat Focused Fully Integrated Cisco and/or its affiliates. All rights reserved. Cisco Public 26

27 NGFW Only Covers 75% of Users Network as an Enforcer Users spend 25% of the time off network Cisco and/or its affiliates. All rights reserved. Cisco Public 27

28 Protect Users Wherever They Work Network as an Enforcer Cisco Umbrella Malware C2 Callbacks Phishing Intelligence to see attacks before launched Visibility and protection everywhere Stop threats before connections are made Enterprise-wide deployment in minutes Cisco and/or its affiliates. All rights reserved. Cisco Public 28

29 Backed by Talos Security Intelligence Talos Security Intelligence and Research Group Industry-leading threat researchers and sophisticated systems Threat intelligence that detects, analyzes and protects against both known and emerging threats Threat Intelligence Insight into nearly 17 billion web requests each day Detection Research Outreach Engine Development Vulnerability R&D Security from people who get networks Cisco and/or its affiliates. All rights reserved. Cisco Public 29

30 Thank you.