View
1
Download
0
Category
Preview:
Citation preview
Managing Security in the Age of DevOps
Taiwan InfoSec Conference 2016
Andy Leung
Security Architect, Centre of Excellence
aleung@juniper.net
Agenda
DevOps Framework
Security Framework 傳統安全架構
Security Trends and Challenges 安全趨勢及挑戰
SD SN: Software-Defined Secure Network
軟體定義網絡安全架構
Juniper’s SDSN Building Blocks 安全工具組合和配搭
開發以及營運團隊緊密架構
The DevOps Framework
DevOps success case studies
Large enterprises like Amazon, Facebook, Netflix, Sony Pictures, … all gain efficiency and report success after building the Devops culture.
Breaking down the walls
What is DevOps?
Source: http://techtalk.e-conomic.com/devops-from-developing-to-delivery/
• Software or systems development methodology
• Stresses communication, collaboration, and integration between developers, implementers and operators.
• Encourage rapid development and Automation
• Minimize detrimental effects of change through Automation and Orchestration
• Change in Mindset as in Methods
DevOps Cycle vs Security Cycle TEAMING UP TO REVOLUTIONIZE SERVICE DELIVERY
• Changes (software) functionality frequently to quickly move improvements into production • Iterative, repetitive and requires frequent changes but still allows high availability • Minimize detrimental effects of change through Automation and Orchestration
Development cycle
Operations cycle
Traditional Security Framework
Source: NIST Cyber Security Framework http://www.nist.gov/cyberframework/
鑑定
保護
偵察
對應
Network Director
Bare Metal
Leaf
Spine
Hypervisor
Server
VM VM VM VM VM VM VM VM VM VM VM VM VM VM VM
vRouter vRouter vRouter vRouter vRouter
DLE
CA
NDA
NDA NDA NDA
Security Challenges for Cloud Services Multi-vendors cloud network makes threat detection harder
CA CA CA
• Delivery end-to-end network
performance and application
security
• Multiple physical and virtual layers
for deployment
• Need co-ordination between teams
for better application security and
user experience
Challenges
IDENTIFY
鑑定
Most network security strategies focus on security at the perimeter only– outside in. Is securing the perimeter really enough?
Today’s Enterprise: Perimeter security model
Trust model: trust what’s inside the network
Visibility relies mostly on perimeter firewalls
Evolving threats requires adaptability
Security layered on top of network
Inline
Anti-Malware
Inline
Intrusion
Prevention
Unified Threat
Management
Application
Security
Data Loss
Prevention
PROTECT 保護
Everything on Your Network is a Potential Threat
Normal and Abnormal Behavior
Normal operation: call home beacons, energy utilization
Is this normal? How to mitigate risk?
Aberrant behavior: bursting traffic, abnormal high data download rate
DETECT 偵察
Data Breach Trends
Source: Verizon 2015 Data Breach Investigations Report
RESPONSE 對應
Challenges to Security Sector
“Security platforms are a good first step but we need more, we need a holistic security ecosystem — my challenge to the security industry.”
Hug Tatton-Brown, General manager, security portfolio at BT
Why the security sector needs collaboration to stay ahead?
SD SN
軟體定義網絡安全架構
15
Stop talking about Network Security. Start talking about Secure Networks.
A Change in Mindset
Realize threats are everywhere. They are already inside. They walked in your front door
Recognize perimeter security isn’t enough
Detection and Enforcement should be enabled anywhere
Acknowledge security is everyone’s problem – horizontal and vertical
Definition
• SDSN 1. Software-Defined Secure Networks
2. A new Security Solution allows you to operate the entire network as a single enforcement domain where every element is a policy enforcement point.
The Software Defined Secure Network
17
Create and centrally manage intent based policy directly aligned to business objectives
Gather & distribute threat intelligence, from multiple sources – know who the bad guys are faster
Leverage cloud economics for real time analysis – find the bad guys faster
Enforce policy to the threat feed information, real time across the network – adapt the network real-time
Operate network as single enforcement domain, every element becomes a policy enforcement point
Detection 檢測
Policy 政策
Enforcement 執行
Software Defined Secure Network: Policy, Detection & Enforcement 政策,檢測及執行
Your Enterprise Network
Leverage entire network and ecosystem for threat intelligence and detection
Utilize any point of the network as a point of enforcement
Dynamically execute policy across all network elements including third party devices
Threat Intelligence
Enforcement
Detection
Enforcement
Detection
Bottoms Up and Tops Down Approach – Cloud-based
Threat Defense
Dynamic and Adaptive Policy Engine
Policy
SOFTWARE DEFINED SECURE NETWORK
BUILDING BLOCKS
安全工具組合和配搭
Your Enterprise Network
Where to Start – Modernize Your Perimeter
Upgrade your perimeter to make it adaptable
Next Generation Firewall is Current Generation Firewall – simplify and remove niche security appliances
Utilize Cloud Economics for Instant Intelligence that Leads to More Effective Detection
Juniper Cloud Security
Sky Advanced Threat Prevention
Spotlight Secure
Threat Intelligence
SRX Series
Physical Firewall
vSRX
Virtual Firewall
Your Enterprise Network
Converse With Your Network Deploy Policy Engine that Communicates with Your Network Analytics Capability Based on Network Data
Juniper Cloud Security
Sky Advanced Threat Prevention
Spotlight Secure
Threat Intelligence
Customizable UI Provides Data Correlation
Utilize All Network Elements as Detection & Enforcement Points
Future: Intent Based Policy Engine to Communicate Across Any Network Element
Security Director
Mgmt/UI: Policy, App Visibility, Threat Map, Events
Security Policy Controller
Third Party Network Elements
Juniper Network Elements
Automation Framework
SECURITY
DEVICES
PARTNERS
POLICY ENGINE
Standardized Interfaces
CONTROL PLANE
DATA PLANE
CONTROL PLANE
DATA PLANE
CONTROL PLANE
DATA PLANE
CONTROL PLANE
DATA PLANE
NETCONF YANG RESTful Thrift
Open Convergence Framework (OCF)
Automation and Orchestration
"BEFORE" SNAPSHOT
"AFTER" SNAPSHOT
"COMPARE" SNAPSHOTS
ospf-int-checks { command show ospf interface; iterate ospf-interface { is-gt neighbor-count, 0 { info OSPF interfaces must have at least 1 neighbor; err "OSPF interface %s does not have any neighbors", interface-name; } } }
bsmith@server$ jsnap --snap preupgrade -l bsmith -t ABC ABCsnapshot.conf bsmith password: Connecting to bsmith@ABC ... CONNECTED. EXEC: 'show ospf interface' ... SAVE: 'ABC__ospf-int-checks__preupgrade.xml' ...
bsmith@server$ jsnap --check preupgrade, postupgrade -t ABC ABCsnapshot.conf --------------------------------------------------------------- CHECKING SECTION: ospf-int-checks --------------------------------------------------------------- + TEST PASSED: OSPF interfaces must have at least 1 neighbor
Network Testing Automation
Juniper’s Security Vision From Network Security to Secure Networks
Only one in the industry with building blocks for tomorrow’s Software Defined Secure Network
Simplified Policy and Management across all network elements
Adaptable Security Solution based on real time threat intelligence information
Cost Effective Detection and Enforcement utilizing the entire network to protect you
The Juniper Software Defined Secure Network dynamically adapts to changing threat landscape…so
you don’t have to!
Thank You
Recommended