1、Risk Management using Network Access Control and Endpoint Control for the EnterpriseKurtis E. Minder Mirage Networksi2- CONFIDENTIAL -AgendaDrivers of NACKey Elements of NAC Solutions Identify Assess Monitor MitigateNAC Landscape3- CONFIDENTIAL -Business Needs Drive Security Adoption3 Ubiquitous Sec
2、urity technologies Anti-virus - Business driver: File sharing Firewalls - Business driver: Interconnecting networks (i.e. Internet) VPNs - Business driver: Remote connectivityTodays top security driver - Mobile PCs and devices Broadband access is everywhere Increased percentage of the time devices s
3、pend on unprotected networks Perimeter security is rendered less effective because mobile devices bypass it and arent protected by itMobility of IP devices is driving the need for Network Access Control solutions Leading source of network infections More unmanaged devices on the network than ever -
4、guest and personal devices4- CONFIDENTIAL -The Traditional Approach to Network Security Isnt Enough5- CONFIDENTIAL -The Problem NAC Should AddressToday, endpoint devices represent the greatest risk to network security by propagating threats or being vulnerable to them.Infected DevicesUnknown Devices
5、Out-of-Policy Devicespropagate threats, resulting in loss of productivity & hours of cleanuplike home PCs, contractor PCs, & WiFi phones can introduce new threats or compromise data securityare more vulnerable to malware attacks, while running services that could jeopardize security“Because of worms
6、 and other threats, you can no longer leave your networks open to unscreened devices and users. By year-end 2007, 80 percent of enterprises will have implemented network access control policies and procedures.”Gartner, Protect Your Resources With a Network Access Control Process6- CONFIDENTIAL -The
7、Cost1 mi2g Intelligence Unit, Malware Damage in 20042 ICSA Labs, 9th Annual Computer Virus Prevalence Survey7- CONFIDENTIAL -The Numbers Tell the Story“Protection” is in place98% use firewalls197% of companies protect machines with antivirus software 1 79% use anti-spyware 1 61% use email monitoring
8、 software 1 But its not enough!Cost of malware: $14.2B 280% of companies experienced 1 or more successful attacks, 30% had more than 10 3Average net loss for malware incidents in US companies is nearly $168,000 per year1Worldwide, 32% of companies experience attacks involving business partners43% of
9、 those were infections, while 27% were unauthorized access475% of enterprises will be infected with malware that evaded traditional defenses5 1 Computer Security Institute/FBIs 2006 Computer Crime and Security Survey2 Computer Economics, 20063 ICSA Labs, 9th Annual Computer Virus Prevalence Survey4
10、Cybertrust, Risky Business, September 20065 Gartner, Gartners Top Predictions for IT Organizations and Users, 2007 & Beyond, December 20068- CONFIDENTIAL -The Problem is Expected to Get Worse2006 StatisticsSteep increase in the number of software security vulnerabilities discovered by researchers an
11、d actively exploited by criminals Microsoft Corp issued fixes for 97 (versus 37 in 2005) security holes assigned critical label14 of of the critical became zero day threats.Experts worry that businesses will be slow to switch to Vista. Pre-Vista MS Office is expected to remain in widespread use for
12、the next 5-10 years.Source: Washington Post, Dec 2006, Cyber Crime Hits the Big Time in 20069- CONFIDENTIAL -NAC Market ExpectationsNAC Appliance vendors will sell $660m worldwide in 2008NAC Appliances will gain 17% worldwide share of the NAC market by 2008, up from 6% in 2005Research reveals World
13、Network Access Control (NAC) Products and Architectures Markets earned revenues of over $85 million in 2006 and estimates this to reach over $600 million in 2013Gartner estimates that the NAC market was $100M in 2006 and will grow by over 100% by YE 200710- CONFIDENTIAL -Increasing Number of Targets
14、 to ProtectOperating SystemsInternet ExplorerWindows LibrariesMicrosoft OfficeWindows ServicesWindows Configuration WeaknessesMac OSXLinux Configuration WeaknessesNetwork DevicesVoIP Phones & ServersNetwork & Other Devices Common Configuration Weaknesses* SANS Institute Top 20 Internet Security Atta
15、ck Targets (2006 Annual Update), v7.0, 11.15.06Cross Platform ApplicationsWeb ApplicationsDatabase SoftwareP2P File Sharing ApplicationsInstant MessagingMedia PlayersDNS ServersBackup SoftwareSecurity, Enterprise, and Directory Management ServersSecurity Policy & PersonnelExcessive User Rights & Una
16、uthorized DevicesUsers (Phishing/Spear Phishing)Sans Institute 2006 Top Attack Targets*11- CONFIDENTIAL -What Class of NAC Solutions to Deploy?Aberdeen Research, 200612- CONFIDENTIAL -Top Drivers Influencing NAC SolutionsAberdeen Research, 200613- CONFIDENTIAL -Top Features Required in a NAC Solutio
17、nAberdeen Research, 200614- CONFIDENTIAL -Key Elements of NAC SolutionsCommon NAC ElementsNAC is an evolving space with evolving capabilitiesNAC solution elements - some or all Identify - Detect & authenticate new devices Assess - Endpoint integrity checks to determine levels of risk and adherence t
18、o security policy Monitor - Watch the devices activity for change of assessed state with respect to policy and threat status Mitigate - Take appropriate action upon any device that is identified as a security risk by previous three elements 16- CONFIDENTIAL -Identify - Find/Authenticate New DevicesQ
19、uestion - How do you know when a new device comes on the network? Is it a known or unknown device? Is it an authenticated user?Common approaches Leverage 802.1x or network infrastructure OS Authenticate through existing EAP infrastructure to pass credentials to authentication server Special purpose
20、DHCP server Authentication usually web based and tied to authentication server Authentication proxy NAC solution serves as a proxy between device and authentication server Inline security appliances (i.e. security switches) Serve as a proxy between device and authentication server Real time network
21、awareness Authentication usually web based and tied to authentication serverAll approaches trigger off entry on the network by a new IP device17- CONFIDENTIAL -Identify - Pros & Cons of Various Approaches802.1x approach Pros: Device detected and authenticated prior to IP address assignment Cons: Oft
22、en is a costly and time consuming installation Requires switch upgrade/reconfiguration Endpoints must be 802.1x enabled - requires supplicant software Must create guest/remediation VLANsDHCP approach Pros: Easier to deploy, independent of network infrastructure, covers both managed and unmanaged dev
23、ices Cons: Bypassed by static IP address assignment, remediation typically to a broadcast VLAN (cross infection risk)18- CONFIDENTIAL -Identify - Pros & Cons of Various Approaches cont.Authentication proxy Pros: Good hook for checking managed devices Cons: Unknown devices may never authenticate, but
24、 still could have network access; may not check all IP devicesIn-line security appliance/switch Pros: Sees all devices both managed and unmanaged and doesnt require agent based software Cons: If it is not inline with, or does not replace the access switch then it will not see the device as it comes
25、on the networkOut of band appliances with network awareness Pros: Sees all devices as they enter the network both managed and unmanaged; easier to implement than many of the other approaches Cons: May require switch integration for mitigation of problems19- CONFIDENTIAL -AssessAssess Endpoint Integr
26、ityQuestion: Even if a device is allowed on my network, how do I ensure it meets my security policies and risk tolerance?Answer: Endpoint integrity checks Operating system identification and validation checks Typically requires an agent Must establish a policy relating to acceptable patch level (lat
27、est patch on company SMS server, no older than X months, most recent patch available from software vendor) What do you do for unknown devices? Usually requires an agent for these checks Security software checks - AV, personal firewall, spyware, etc. Is it up and running Is it in the right configurat
28、ion Is it up to date - both the software and the database Usually requires an agent for these checks21- CONFIDENTIAL -Assess Endpoint Integrity cont.Endpoint integrity checks cont. Endpoint configuration - find unauthorized servers and services Web servers, FTP servers, mail servers, etc. Vulnerable
29、 or high risk ports, i.e. port 445 exploited by Zotob These checks can be done from the network or with an agent Threat detection Scan the device for active infections or backdoors Not commonly implemented on entry to the network Too much latency Risk profile substituted for deep scans (i.e. AV is u
30、p to date and had a current scan)Elements for endpoint integrity checks Network scanning server (Optional) Endpoint software - permanent or transient (Optional) Policy server (Required) - must have somewhere to define what is allowed/disallowed22- CONFIDENTIAL -MonitorMonitoring Post Network EntryTh
31、e forgotten element of Network Access Control Why is monitoring a critical element of NAC? Cant effectively check for all threats on entry - takes too long Security policy state can change post entry - users initiate FTP after access is granted Infection can occur post entry - e-mail and web threats
32、 can change security state of the device What Gartner says in their paper “Protect Your Resources With a Network Access Control Process” “The network traffic and security state of systems that are connected to the network must be monitored for anomalous behavior or system changes that bring them out
33、 of compliance with security policies.”Why isnt this simply another network security function? Monitoring is both for threats and policy adherence - takes advantage of policy definition of NAC solution Works hand in hand with NAC quarantine services 24- CONFIDENTIAL -Traditional Approach to Network
34、Security Traditional Approach Firewall/IPS at the Perimeter AV, HIDS/HIPS on the EndpointThis approach leaves a soft underbelly through which unmanaged, out-of-policy and infected endpoints can easily gain access.External Environment New technologies New threats Regulatory requirements 25- CONFIDENT
35、IAL -Exploiting the Networks WeaknessInfected endpoints bypass the perimetergenerating rapidly propagating threats that take over a network in minutesbringing business to a halt and creating costly cleanup.26- CONFIDENTIAL -Monitoring ApproachesAgent based approaches Host Intrusion Prevention System
36、s Personal firewalls Both require integration with a network policy server to be an element of NAC Doesnt cover unknown/unmanaged/unmanageable devicesNetwork based approaches In-line: Typically evolution of IPS vendors into NAC capabilities; also includes Network Based Anomaly Detection (NBAD) vendo
37、rs Out-of-band: Most commonly NBAD and old Distributed Denial of Service (DDoS) security vendorsKey considerations Does the security device watch for policy violations as well as threats? Does it see devices as they enter the network? Can they work across both voice and data networks without negativ
38、ely impacting quality and performance? What is the management overhead associated with both approaches? 27- CONFIDENTIAL -MitigateMitigation Approaches for NACTwo elements for NAC mitigation Quarantine capabilities (required) On-entry restrict access for devices not meeting requirements Post-entry t
39、ake a device off the network and send to quarantine zone if they violate policy or propagate a threat Ideally should be able to assign to different quarantine server based on problem, i.e. registration server for guests, AV scanner for infected devices, etc. Remediation services for identified probl
40、ems (optional) Additional diagnostic tools for deeper checks - Vulnerability scanners AV scanners, etc. Tools for fixing identified problems OS patch links AV signature update and malware removal tools Registration pages for unknown devices29- CONFIDENTIAL -Quarantine ApproachesDHCP integration Uses
41、 DHCP process for identification and endpoint integrity checks on entry to the network. Pros: Assigns appropriate IP and VLAN according to their risk level Cons: After IP address is assigned they dont have an independent quarantine capability; Static IPs bypass their enforcementSwitch integration Us
42、es either ACLs or 802.1x ACLs - not commonly used because of negative performance impact and access requirements in the network 802.1x - forces device to re-authenticate and assigns new VLAN Pros: Effective both pre and post admission, uses standards based approach in 802.1x Cons: Can negatively imp
43、act switch performance; Usually not granular in quarantine server assignment; If using broadcast quarantine VLAN there is a cross-infection risk30- CONFIDENTIAL -Quarantine Approaches cont.In-line blocking with web redirect Pros: Improved performance over ACLs; Can granularly block suspect traffic;
44、has the capability of sending web traffic to appropriate quarantine server based on problem Cons: Doesnt see downstream traffic so can only block and redirect traffic that comes through it; May require additional integration with network for mitigation because of thisARP management Security applianc
45、e selectively goes inline for a single host and becomes its default gateway by ARP manipulation Pros: No network integration required for full quarantine capabilities; enables surgical, problem specific quarantine without cross-infection risk; effective both pre and post admission Cons: If implement
46、ed improperly network equipment can misidentify this as an attack and drop this traffic31- CONFIDENTIAL -Todays NAC LandscapeEvolving proprietary standards Cisco Network Admission Control (CNAC) Three critical elements - Cisco Trust Agent (CTA), updated Network Access Device (NAD), Cisco Access Cont
47、rol Server (ACS) Integration with endpoint agents to communicate with ACS regarding appropriate access level to the network Microsoft Network Access Protection (NAP) Available in Vista Endpoint needs System Health Agent (SHA) SHA reports to System Health Validator (SHV) to do policy checks Network i
48、solation through enforcement integrations DHCP Quarantine Enforcement Server (QES) VPN QES 802.1xTrusted Network Connect open standard TNC compliant client required on endpoints Policy Decision Point (PDP) for security policy comparisons Policy Enforcement Point (PEP) for quarantining32- CONFIDENTIA
49、L -SummaryNAC is an evolving technology spaceKnow what problems are most important to address Unknown/unauthenticated user control Policy enforcement for endpoints Preventing threats on your networkUnderstand implementation tradeoffs Quarantine flexibility Performance impact Cost of solution IT effo
50、rt to implementKeep track of early evolving standards33- CONFIDENTIAL -About MirageBackground & Key AccomplishmentsCompany HighlightsFirst GA Product: January, 2004, V3 Launched in July, 2006 Acquisition of WholePoint Corporation - Dec 041 NAC Patent Granted; 10 PendingCustomer/Partner Momentum1100+
