Intelligent Application Gateway

Transcription

1 November 2006 Intelligent Application Gateway Chema Alonso Microsoft MVP Windows Security Informática64 Manufacturing & General Financial & Insurance Healthcare & Education Energy Government 2006 Microsoft Corporation. All rights reserved.

2 November 2006 Microsoft Forefront ofrece un alto nivel de protección y control sobre la seguridad de la infraestructura de red de su empresa con gestión integrada y sencilla 3 Cualquier lugar Cualquier dispositivo Seguridad basado en políticas /Extranet Optimización de Productividad 2006 Microsoft Corporation. All rights reserved. Cualquier aplicación Facilidad de uso Integración ininterumpida

3 IAG provee acceso y protección SSL a aplicaciones y gestión segura del puesto final, activando control de acceso granular e inspección de contenidos para un grupo de dispositivos o grupos de negocio, intranet y recursos cliente/servidor. Control de Acceso Protección de activos Defensa de la Información Seguro, basado en navegación a las aplicaciones corporativas y datos desde otros lugares y dispositivos Garantizar la integridad y securización de infraestructura de redes y aplicaciones bloqueando ataques y tráfico malicioso Politicas adecuadas a las bases legales y guias de negocio para la utilizacion de datos sensibles Intelligent Application Gateway Tunneling Security Client Knowledge Centre OWA... Sharepoint.... WHO? WHAT? Citrix.. Devices Knowledge Centre PDA... WHERE? Linux.. Windows.... Authorization User Experience SSL VPN Gateway High-Availability, Management, Logging, Reporting, Multiple Portals MAC... Policy & Regulation Awareness Centre ISO7799 Application Aware Modules Corporate Governance SarbOx Basel2 COMPLIANT? Citri x Generic Web Specific Java/Browser Embedded Client/ Exchange/ Outlook OWA SharePoint /Portals

4 Integrated Solution Benefits User types URL into browser

5 Transaction is sent over internet to external server, receives packet

6 All protocol layers and TCP/IP headers are stripped off Still-encrypted data is transferred to memory bank via SCSI connection

7 Switch disconnects from external server, connects to internal server SBC Data is fetched from appliance memory

8 Data Data is decrypted, SSL session is established and platform dependent Endpoint Compliance Module is sent back to browser to interrogate machine SBC If Endpoint Compliance Module doesn t find the machine up to scratch stricter security policies are enforced

9 Data encrypted login page is generated and sent back Customized login page appears in browser s window

10 Data Flow Username: John Smith Password: *********** SecurID: ********** User completes authorization credentials & submits response SBC shuttles the data across the air gap

11 SBC Data O K checks user credentials with appropriate authentication server; user is authenticated. credentials are combined with Endpoint Compliance results to determine Access Policy SBC User receives dynamically generated Home Page (based on identity and location) and selects desired application

12 shuttles the data across the air gap SBC Data Real Web (SMB) Application data is inspected and compared to Mandatory Access Control List

13 SBC Security Data Manager determines which back-end server to relay the request to Transaction Data is dispatched to the appropriate server

14 Application generates response Data Response is converted by HAT engine for external use. Response may also be rewritten and/or blocked depending on Policy

15 SBC SBC response User works with application as if inside corporate network environment

16 SBC After user completes session Attachment Wiper cleans up to ensure nothing sensitive remains on access machine Demo Escenario de funcionalidad Intelligent Application Gateway 2007 November

17 Preguntas? Technews I64 November

18 Hands On Lab

19 Contacto Chema Alonso Technews and also user/pass for both is: user=msmith pass=!exchange

20 2006 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. 39