家中等职业教育改革发展示范学校.pptx
《家中等职业教育改革发展示范学校.pptx》由会员分享,可在线阅读,更多相关《家中等职业教育改革发展示范学校.pptx(45页珍藏版)》请在文库网上搜索。
1、Risk Management using Network Access Control and Endpoint Control for the EnterpriseKurtis E. Minder Mirage Networksi2- CONFIDENTIAL -AgendaDrivers of NACKey Elements of NAC Solutions Identify Assess Monitor MitigateNAC Landscape3- CONFIDENTIAL -Business Needs Drive Security Adoption3 Ubiquitous Sec
2、urity technologies Anti-virus - Business driver: File sharing Firewalls - Business driver: Interconnecting networks (i.e. Internet) VPNs - Business driver: Remote connectivityTodays top security driver - Mobile PCs and devices Broadband access is everywhere Increased percentage of the time devices s
3、pend on unprotected networks Perimeter security is rendered less effective because mobile devices bypass it and arent protected by itMobility of IP devices is driving the need for Network Access Control solutions Leading source of network infections More unmanaged devices on the network than ever -
4、guest and personal devices4- CONFIDENTIAL -The Traditional Approach to Network Security Isnt Enough5- CONFIDENTIAL -The Problem NAC Should AddressToday, endpoint devices represent the greatest risk to network security by propagating threats or being vulnerable to them.Infected DevicesUnknown Devices
5、Out-of-Policy Devicespropagate threats, resulting in loss of productivity & hours of cleanuplike home PCs, contractor PCs, & WiFi phones can introduce new threats or compromise data securityare more vulnerable to malware attacks, while running services that could jeopardize security“Because of worms
6、 and other threats, you can no longer leave your networks open to unscreened devices and users. By year-end 2007, 80 percent of enterprises will have implemented network access control policies and procedures.”Gartner, Protect Your Resources With a Network Access Control Process6- CONFIDENTIAL -The
7、Cost1 mi2g Intelligence Unit, Malware Damage in 20042 ICSA Labs, 9th Annual Computer Virus Prevalence Survey7- CONFIDENTIAL -The Numbers Tell the Story“Protection” is in place98% use firewalls197% of companies protect machines with antivirus software 1 79% use anti-spyware 1 61% use email monitoring
8、 software 1 But its not enough!Cost of malware: $14.2B 280% of companies experienced 1 or more successful attacks, 30% had more than 10 3Average net loss for malware incidents in US companies is nearly $168,000 per year1Worldwide, 32% of companies experience attacks involving business partners43% of
9、 those were infections, while 27% were unauthorized access475% of enterprises will be infected with malware that evaded traditional defenses5 1 Computer Security Institute/FBIs 2006 Computer Crime and Security Survey2 Computer Economics, 20063 ICSA Labs, 9th Annual Computer Virus Prevalence Survey4
10、Cybertrust, Risky Business, September 20065 Gartner, Gartners Top Predictions for IT Organizations and Users, 2007 & Beyond, December 20068- CONFIDENTIAL -The Problem is Expected to Get Worse2006 StatisticsSteep increase in the number of software security vulnerabilities discovered by researchers an
11、d actively exploited by criminals Microsoft Corp issued fixes for 97 (versus 37 in 2005) security holes assigned critical label14 of of the critical became zero day threats.Experts worry that businesses will be slow to switch to Vista. Pre-Vista MS Office is expected to remain in widespread use for
12、the next 5-10 years.Source: Washington Post, Dec 2006, Cyber Crime Hits the Big Time in 20069- CONFIDENTIAL -NAC Market ExpectationsNAC Appliance vendors will sell $660m worldwide in 2008NAC Appliances will gain 17% worldwide share of the NAC market by 2008, up from 6% in 2005Research reveals World
13、Network Access Control (NAC) Products and Architectures Markets earned revenues of over $85 million in 2006 and estimates this to reach over $600 million in 2013Gartner estimates that the NAC market was $100M in 2006 and will grow by over 100% by YE 200710- CONFIDENTIAL -Increasing Number of Targets
14、 to ProtectOperating SystemsInternet ExplorerWindows LibrariesMicrosoft OfficeWindows ServicesWindows Configuration WeaknessesMac OSXLinux Configuration WeaknessesNetwork DevicesVoIP Phones & ServersNetwork & Other Devices Common Configuration Weaknesses* SANS Institute Top 20 Internet Security Atta
15、ck Targets (2006 Annual Update), v7.0, 11.15.06Cross Platform ApplicationsWeb ApplicationsDatabase SoftwareP2P File Sharing ApplicationsInstant MessagingMedia PlayersDNS ServersBackup SoftwareSecurity, Enterprise, and Directory Management ServersSecurity Policy & PersonnelExcessive User Rights & Una
16、uthorized DevicesUsers (Phishing/Spear Phishing)Sans Institute 2006 Top Attack Targets*11- CONFIDENTIAL -What Class of NAC Solutions to Deploy?Aberdeen Research, 200612- CONFIDENTIAL -Top Drivers Influencing NAC SolutionsAberdeen Research, 200613- CONFIDENTIAL -Top Features Required in a NAC Solutio
17、nAberdeen Research, 200614- CONFIDENTIAL -Key Elements of NAC SolutionsCommon NAC ElementsNAC is an evolving space with evolving capabilitiesNAC solution elements - some or all Identify - Detect & authenticate new devices Assess - Endpoint integrity checks to determine levels of risk and adherence t
18、o security policy Monitor - Watch the devices activity for change of assessed state with respect to policy and threat status Mitigate - Take appropriate action upon any device that is identified as a security risk by previous three elements 16- CONFIDENTIAL -Identify - Find/Authenticate New DevicesQ
19、uestion - How do you know when a new device comes on the network? Is it a known or unknown device? Is it an authenticated user?Common approaches Leverage 802.1x or network infrastructure OS Authenticate through existing EAP infrastructure to pass credentials to authentication server Special purpose
20、DHCP server Authentication usually web based and tied to authentication server Authentication proxy NAC solution serves as a proxy between device and authentication server Inline security appliances (i.e. security switches) Serve as a proxy between device and authentication server Real time network
21、awareness Authentication usually web based and tied to authentication serverAll approaches trigger off entry on the network by a new IP device17- CONFIDENTIAL -Identify - Pros & Cons of Various Approaches802.1x approach Pros: Device detected and authenticated prior to IP address assignment Cons: Oft
22、en is a costly and time consuming installation Requires switch upgrade/reconfiguration Endpoints must be 802.1x enabled - requires supplicant software Must create guest/remediation VLANsDHCP approach Pros: Easier to deploy, independent of network infrastructure, covers both managed and unmanaged dev
23、ices Cons: Bypassed by static IP address assignment, remediation typically to a broadcast VLAN (cross infection risk)18- CONFIDENTIAL -Identify - Pros & Cons of Various Approaches cont.Authentication proxy Pros: Good hook for checking managed devices Cons: Unknown devices may never authenticate, but
24、 still could have network access; may not check all IP devicesIn-line security appliance/switch Pros: Sees all devices both managed and unmanaged and doesnt require agent based software Cons: If it is not inline with, or does not replace the access switch then it will not see the device as it comes
25、on the networkOut of band appliances with network awareness Pros: Sees all devices as they enter the network both managed and unmanaged; easier to implement than many of the other approaches Cons: May require switch integration for mitigation of problems19- CONFIDENTIAL -AssessAssess Endpoint Integr
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- 家中 职业教育 改革 发展 示范 学校