Palo Alto Networks. Simplify your security

Transkript

1 Palo Alto Networks Simplify your security

2 Agenda 1. Komplexität Risiken und Probleme 2. Wie sieht eine Security-Umgebung heute aus? 3. Wie geht Palo Alto Networks dieses Problem an? 4. Unsere Lösung im Detail , Palo Alto Networks. Confidential and Proprietary.

3 Complexity is the Worst Enemy of Security - Bruce Schneier , Palo Alto Networks. Confidential and Proprietary.

4 Komplexität Risiken und Nebenwirkungen For starters, the global survey of 2,400 IT security administrators found that more than half of their organizations work with at least seven security vendors. Not coincidentally, in every country surveyed the complexity of managing security operations ranked as the No. 1 information security challenge. In the U.S., complexity (the main challenge for 33% of survey respondents) ranked well ahead of data theft by insiders (21%), compliance (19%), security policy enforcement (15%), and data theft by outsiders (12%). That's right: Security groups aren't spending most of their energy battling malicious insiders, hackers, or the latest malware. Rather, they're combating the complexity of their own security programs. Furthermore, organizations report that they're loathe to cut vendors, fearing that they'll have to settle for higher prices, greater total cost of ownership, and fewer capabilities. - Ponemon Institute (sponsored by Checkpoint) , Palo Alto Networks. Confidential and Proprietary.

5 Komplexität Risiken und Nebenwirkungen Die Komplexität des Betriebs ist die TOP-Herausforderung für die IT-Sicherheit , Palo Alto Networks. Confidential and Proprietary.

6 Komplexität Risiken und Nebenwirkungen Security-Teams verbringen mehr Zeit im Kampf mit der eigenen Infrastruktur anstatt gegen externe und interne Angriffs-Vektoren , Palo Alto Networks. Confidential and Proprietary.

7 Komplexität Risiken und Nebenwirkungen Think about this for a minute. In our attempts to defend the network and critical assets from cyber threats, we have fallen into the trap of bolting on more and more security layers and policies. The result is that we ve increased the level of complexity within the environment to the point where we have actually created risk because of human errors, misconfigurations, etc. - Wired , Palo Alto Networks. Confidential and Proprietary.

8 8 2012, Palo Alto Networks. Confidential and Proprietary.

9 9 2012, Palo Alto Networks. Confidential and Proprietary.

10 Wie sieht eine Security-Umgebung heute aus? Viel hilft viel? , Palo Alto Networks. Confidential and Proprietary.

11 Derzeitig verwendete Ansätze Internet Enterprise Network Am Anfang war die Firewall , Palo Alto Networks. Confidential and Proprietary.

12 Derzeitig verwendete Ansätze Internet IPS Enterprise Network Ergänzung um ein IPS-System , Palo Alto Networks. Confidential and Proprietary.

13 Derzeitig verwendete Ansätze Internet IPS DLP Enterprise Network Ergänzung um ein Data-Loss-Prevention-System , Palo Alto Networks. Confidential and Proprietary.

14 Derzeitig verwendete Ansätze Internet IPS DLP QoS Enterprise Network Eventuell noch Quality of Service? , Palo Alto Networks. Confidential and Proprietary.

15 Derzeitig verwendete Ansätze Internet IPS DLP QoS AV Enterprise Network Netzwerk-Antivirus , Palo Alto Networks. Confidential and Proprietary.

16 Derzeitig verwendete Ansätze Internet IPS DLP QoS AV URL Enterprise Network URL-Filter dediziert oder integriert mit Proxy , Palo Alto Networks. Confidential and Proprietary.

17 Derzeitig verwendete Ansätze Internet IPS DLP QoS AV URL Proxy Enterprise Network Proxy , Palo Alto Networks. Confidential and Proprietary.

18 Derzeitig verwendete Ansätze Mehr nicht unbedingt mehr gut Jedes Gerät sieht lediglich einen Traffic-Ausschnitt Komplex teuer intensive Wartung Legacy -Architektur Keine integrierte Applikations-Kenntnis je Modul Internet UTM Enterprise Network , Palo Alto Networks. Confidential and Proprietary.

19 UTM-Architektur einer geht noch IPS Antiviren URL IPS Signatures AV Signatures Firewall HTTP Decoder IPS Decoder AV Decoder & Proxy Port/Protocol-based ID Port/Protocol-based ID Port/Protocol-based ID Port/Protocol-based ID L2/3 Networking L2/3 Networking L2/3 Networking L2/3 Networking Page Palo Alto Networks. Proprietary and Confidential

20 Wie geht Palo Alto Networks dieses Problem an? , Palo Alto Networks. Confidential and Proprietary.

21 Firewall Security Plattform ganzheitliche Lösung , Palo Alto Networks. Confidential and Proprietary.

22 Enterprise Security Plattform Next-Generation Firewall Analysiert alle Daten Blockiert bekannte Threats lässt unbekannte analysieren Erweiterbar (mobil/virtuell) , Palo Alto Networks. Confidential and Proprietary.

23 Enterprise Security Plattform Next-Generation Threat Cloud Potentielle Netzwerk- und Endpunkt- Threats werden gesammelt Analyse der Daten auf Schadhaftigkeit Stellt Ergebnisse den Netzwerk- und Endpunkt-Systemen zur Verfügung , Palo Alto Networks. Confidential and Proprietary.

24 Enterprise Security Plattform Next-Generation Endpoint Inspiziert alle Prozesse und Dateien Verhindert bekannte & unbekannte Exploits Integriert mit Cloud-Analyse zur Malware- Erkennung (unbekannte) , Palo Alto Networks. Confidential and Proprietary.

25 Enterprise Security Plattform Unbekannte Bekannte & zero-day- Funde , Palo Alto Networks. Confidential and Proprietary.

26 Enterprise Security Plattform Real-time signatures , Palo Alto Networks. Confidential and Proprietary.

27 Enterprise Security Plattform Integriertes Reporting Bestätigt Gefahrenfund , Palo Alto Networks. Confidential and Proprietary.

28 Enterprise Security Plattform 1 Schützt vor Angriffen auch neuartige/unbekannte 2 Schützt alle Anwender und Applikatinen inkl. mobile und virtuelle! 3 Nahtlose Integration von Netzwerk- und Endpunkt-Security - nutzt Stärken beider 4 Ermöglicht schnelle Analyse neuer Threats , Palo Alto Networks. Confidential and Proprietary.

29 Unsere Lösung im Detail Let the Firewall do its job! , Palo Alto Networks. Confidential and Proprietary.

30 Heutige Firewalls noch zeitgemäß? , Palo Alto Networks. Confidential and Proprietary.

31 Applikationen - Angriffsvektor und Ziel zugleich , Palo Alto Networks. Confidential and Proprietary.

32 Verschlüsselte Applikationen Unsichtbare Gefahren , Palo Alto Networks. Confidential and Proprietary.

33 Enabling Applications, Users and Content Safely , Palo Alto Networks. Confidential and Proprietary.

34 Making the Firewall a Business Enablement Tool Applikationen: Akkurate Klassifizierung des Traffics mit App-ID. Anwender: Einbinden von Usern und Gruppen mit User-ID und GlobalProtect. Inhalte: Analyse und Schutz vor Schadinhalten, bekannter oder unbekannter Natur mit Content-ID und WildFire , Palo Alto Networks. Confidential and Proprietary.

35 , Palo Alto Networks. Confidential and Proprietary. Wildfire?

36 Malware-Angriffsversuche Verbreitung von 0-Day Malware Analyse von 50 0-Day malware -Proben Mit WildFire abgefangen in einem Kundennetz Zeigt die Infektionsrate neuer Malware über Stunden Stunden , Palo Alto Networks. Confidential and Proprietary.

37 Abeckungsrate in Prozent Abdeckung der Gefahr durch AV-Signaturen 100% 90% 80% Abdeckungsrate durch AV-Anbieter von neuer Malware (50 Proben) 70% 60% 50% 40% 30% 5 vendors 4 vendors 3 vendors 2 vendors 1 vendor 0 vendors 20% 10% 0% Day-0 Day-1 Day-2 Day-3 Day-4 Day-5 Day-6 Abeckungsrate der Top 5 AV-Hersteller (vendor) nach Tagen , Palo Alto Networks. Confidential and Proprietary.

38 Malware-Angriffsversuche Verbreitung von 0-Day Malware WildFire-Kunden Erfolgreiche Eindämmung und Schutz erlaubt keine Wartezeit! Stunden 95% der Opfer neuer Malware werden innerhalb von 24 Stunden infiziert! , Palo Alto Networks. Confidential and Proprietary.

39 WildFire-Architektur , Palo Alto Networks. Confidential and Proprietary.

40 WildFire-Architektur 10 Gbps Durchsatz für Threat Prevention Jeglicher Traffic, alle Ports Web, , FTP, SMB, etc , Palo Alto Networks. Confidential and Proprietary.

41 WildFire-Architektur Malware kann sich frei entfalten in unserer Sandbox. Updates an den Sandbox- Systemen ohne Einfluß auf Kunden/Anwender , Palo Alto Networks. Confidential and Proprietary.

42 WildFire-Architektur Signaturen werden erstellt und getestet basierend auf dem Binary selber. Stream-basierte Analyselogik für echtes Inline-Scanning , Palo Alto Networks. Confidential and Proprietary.

43 Welche Dateien werden analysiert? Mobile Malware Android APK Simultane Analyse auf verschiedenen Plattformen , Palo Alto Networks. Confidential and Proprietary.

44 , Palo Alto Networks. Confidential and Proprietary. Die Hardware

45 PAN-OS Core Firewall Features Visibility and control of applications, users and content complement core firewall features PA-7050 Strong networking foundation Dynamic routing (BGP, OSPF, RIPv2) Tap mode connect to SPAN port Virtual wire ( Layer 1 ) for true transparent in-line deployment L2/L3 switching foundation Policy-based forwarding VPN Site-to-site IPSec VPN Remote Access (SSL) VPN QoS traffic shaping Max/guaranteed and priority By user, app, interface, zone, & more Real-time bandwidth monitor Zone-based architecture All interfaces assigned to security zones for policy enforcement High Availability Active/active, active/passive Configuration and session synchronization Path, link, and HA monitoring Virtual Systems Establish multiple virtual firewalls in a single device (PA-7050, PA-5000, PA- 4000, PA-3000, and PA-2000 Series) Simple, flexible management CLI, Web, Panorama, SNMP, Syslog PA-5000 Series PA-5060, PA-5050 PA-5020 PA-4000 Series PA-4060, PA-4050 PA-4020 PA-3000 Series PA-3050, PA-3020 PA-2000 Series PA-2050, PA-2020 PA-500 PA , 2014 Palo Alto Networks. Confidential and Proprietary. VM-Series VM-300, VM-200, VM-100

46 Single Pass Platform Architecture , Palo Alto Networks. Confidential and Proprietary.

47 Flexibel einsetzbar Tap Mode Transparent In-Line Firewall Replacement Within The Host Application, user and content visibility without inline deployment IPS with app visibility & control Consolidation of IPS & URL filtering Firewall replacement with app visibility & control Firewall + IPS Firewall + IPS + URL filtering VM-Series introduces the ability for secure segmentation to be done within the host 2012 Palo Alto Networks. Proprietary and Confidential.

48 NGFW as a VM, versus as a Service VM-Series as a Guest VM Virtual Networking configured to pass traffic through Firewall Requires vswitch and Port Group Configuration Connects as L3, L2, V-wire, or Tap VM-Series NSX Edition as a Service NGFW is an NSX Service Resides below the vswitch and above vnic NSX steers traffic to and from VM before Networking Page Palo Alto Networks. Proprietary and Confidential.

49 VM-Series support for Citrix NetScaler SDX VM-100, VM-200, VM-300 deployed as guest VMs Citrix NetScaler SDX is an open service-delivery platform that consolidates ADC (application delivery controller) and best-in-class network and security services VM-Series is now supported on Citrix SDX and Series Key use cases: Multi-tenant cloud deployments to meet individual needs of business unit, application owners, service provider customers Integrated solution for Citrix XenApp/XenDesktop deployments , Palo Alto Networks. Confidential and Proprietary.

50 Sicherheit durch Vereinfachung QoS IPS Proxy Alle Funktionen vereint Zentrales Logging Drastisch reduzierter administrativer Aufwand AV URL DLP APT/zero-day Einheitliche Policies Performance , Palo Alto Networks. Confidential and Proprietary.

51 Simplicity is power (Citrix) [ ] half of the survey respondents [ ] stated that complex policies ultimately led to a security breach, system outage or both , Palo Alto Networks. Confidential and Proprietary.

52