OOB NetworkFortify Your Management Network Against Security Threats

Sachin Mhankal – Sales Engineer, India

Predictions and Priorities CIO/CTOAIAutomation

CyberSecurity

The Number and Sophistication of Cyber Attacks Will Increase

Top 10 Cybersecurity Threats in 2024
Extract from https://www.embroker.com/blog/top-cybersecurity-threats/§ We’re likely to see security threats become more sophisticated and therefore more expensive over time: experts predictthat the global costs of cybercrime will reach $10.5 trillion by 2025, up 15% from $3 trillion in 2015. ://www.embroker.com/blog/topcybersecurity-threats/

Challenges during Cyber Security Attacks

Legacy Network, Legacy Out-of-Band Management Network
DataCenter
Devices

CampusDevices

Admin
VPN

Core
Switches

WAN
Distribution
Switches

WAN
Edge
Routers

Production
NetworkBranch
WAN

Firewalls

ConsoleServerConsoleServerOut-of-Band
Management

CSM

Admin
HostNACManager

NTP
Server

CS-ACS

CS-MARSThe problem(s)Limitations
A major pain point associated with traditional
management network is that it does not extend
well to remote locations with IT infrastructure. It
does not enable proper “bootstrapping” of remote
IT infrastructure.
When it does, it is often times limited to serial
connectivity or static methods to reach IP
endpoints.

Capitalist forces apply pressures to reduce
cost of infrastructure management.
Infrastructure management organizations arebeing asked to do more with less.
“What more can the solution do, since its
is already there?”How Remote Access Starts§ Started off by using an analogue modem and a console cable.

§ A console server (also referred to as terminal server) is a device or service that provides access to the system
console of a computing device via networking technologies.
§ An in-band management involves managing devices through the protocols such as telnet/SSH, RDP/VNC. Whennetwork is down and traffic is not flowing, an alternate path is required to reach the network nodes (especially criticalnetworks). Here we need a secure remote emergency network access path to manage and troubleshoot the device
when network traffic is down. Thus, out-of-band management as in-band management tools are not enough.
§ Most users used in-band management to access to their endpoint devices.
§ So how about NOW, where networking had evolved, and security had become a major concern?

Modern Network
Modern Out-of-Band Management Network – Smart Management FabricOverlay Production Network
VNF

Overlay OOB Management Network

Smart Management Fabric

VNF
VNF

Underlay Production Network

Underlay OOB Management Network

Network Isolation & Emergency Access:
OOB's Dedicated Pathwayx

Problem Statement: Networks face threats not justexternally but also from within; reliance on a single
network for management can be a significant
vulnerability.

Remote Site

Current Practices: Organizations often use complex, multilayered security measures, yet some deployments sharethe same infrastructure for both production andmanagement traffic.
OOB Solution:
Everyday: OOB provides a separate, secure network,enhancing defenses by isolating management traffic.
Worst day: Offers a reliable, alternative access routewith distinct credentials for emergencies, reducingrisk.

Head Quarters

Plant Area

Secure Deployment and Recovery with OOB Centralized
Management
Problem Statement: Cybersecurity threats requires a secure,resilient network architecture capable of rapid recovery andsecure redeployment.
Current Practices: Regular patching and secure deployment
practices are essential, but often not enough to quickly
recover from sophisticated Cybersecurity attacks.
OOB Advantage:Everyday: Ensure continuous, secure patching processes
via OOB, unaffected by primary network vulnerabilities.
segregated environment to limit access as needed.
Worst day: Rebuild and re-deploy your production
environment securely through OOB, even during anetwork compromise.

OOB for Enhanced Monitoring, Compliance, and Stealthy
Security
Problem Statement: Continuous monitoring andcompliance are crucial, yet visible security activities cantip off unauthorized users, including potential attackers.
Current Practices: Security teams implement port
logging and maintain playbooks for incident response
but typically within the primary network, risking
exposure and interference.
OOB Solution:
Everyday: OOB networks offer a secure, hidden
channel for monitoring and logging, away fromprying eyes.
Worst Day: Automated playbooks can react toincidents outside the primary network, ensuring
responses are discreet and effective.

OOB as the Foundation of Trustworthy Operations
Problem Statement: Maintaining a reliable source of truth for network configurations and data
integrity is challenging amidst evolving security threats.
Current Practices: Organizations rely on Trusted Platform Modules (TPM), secure copy protocols(scp), and data gathering solutions, yet often within the same network as their operating
environments. Encrypting data at rest secures files and documents, ensuring that only those withthe key can access them.
OOB Integration:
First day: Establishes OOB as a secure path for 'source of truth’ of configurations and data,
independent of the primary network.
Everyday: Enhances data gathering and secure configuration storage through isolated,
protected pathways.
Everyday: Expands the reach of security tools while ensuring their operations are
safeguarded from network threats.

End User – Real Life case
Customer A - ransomware attack on one of theirsites in the network.
••••

The Network was built with traditional access to thedevices.
When the attack occurred, the onsite engineer was
not able to take any action.
With no remote access to the device, the admin was
unable to take any immediate action.
They had to run from post to pillar to reach the site
and take evasive actions.

After this attack – Introduced Smart OOB solution•••

OOB Operates independently from the in-band
network (Cellular Connectivity)
The OOB Solution helps them to access any devices
from any site remotely via a secured path.
The entire network is managed remotely.

Customer B – Preconfigures the OOB device andsends in the racks.
•••This is a Multinational customer with lot of remotesites, where they do not have engineers on site.
Customer pre-configures the OOB device and thenfixes the OOB into the rack that is shipped to theremote site.
Once the rack & devices are mounted and powered
on, Admin takes control remotely and configures thesite.

With OOB solution••••Necessity of remote site engineer is reduced.
OOB Operates independently from the in-bandnetwork (Cellular Connectivity)
The OOB Solution helps them to access any devices
from any site remotely via a secured path.
The entire network is managed remotely, andreports are sent to leadership team regularly.

Closing – Smart OOB is must to have for Networks• Cybersecurity is an on-going daily activity• Organization must have alternative access route with distinct credentials
for emergencies, reducing risk.
• It applies to all layers of the network infrastructure, from Core to Access.
• Do not use your network to manage your network.

Thank Youwww.opengear.com