Security Automation
Connecting Your Silos
Lisa Lorenzin
Principal Solutions ArchitectJuniper Network

What We Have

9/29/2014

Copyright 2014 Trusted Computing Group2

Drowning in Information

9/29/2014

Copyright 2014 Trusted Computing Group3

What We Could Be Doing

9/29/2014

Copyright 2014 Trusted Computing Group4

What We’re Currently Doing

9/29/2014

Copyright 2014 Trusted Computing Group

5

Why?

9/29/2014

Copyright 2014 Trusted Computing Group6

What We Have Here…

9/29/2014

Copyright 2014 Trusted Computing Group7

What If You Could…

9/29/2014

Copyright 2014 Trusted Computing Group8

What We Need

9/29/2014

Copyright 2014 Trusted Computing Group

9ERP

SIEM
Smart
Grid
SupplyChain
Mgmt

IF-MAPInterface

CMDB

AAA

Switches
Routers

Building
Controls
Factory
Controls

Network
Location

Network
Security
DNS,
DHCP

Asset
Mgmt

InfrastructureManagement

CRM
IPAM

HR

Applications(Publish, Subscribe,Search)

MAP Server

XML > SOAP > HTTPS
9/29/2014

Copyright 2014 Trusted Computing Group10

Where We’re Going

Security Policy

Logs

vCenter
IPS

NGFW

real-time
intelligence

Information Bus

Security
Admin

SIEM

Pure Info-Bus
Policy Server

ActiveDirectory

ServerLogs

Reputation
Feeds
Application
Logs

UTM

SOC

Other Data
SourcesLogs
Security Policy

9/29/2014

Copyright 2014 Trusted Computing Group11

How Did We Get Here?

9/29/2014

Copyright 2014 Trusted Computing Group12

Crank Up the Wayback Machine

9/29/2014

Copyright 2014 Trusted Computing Group13

NetworkAccessControl
Enforcement
Endpoint
Point

PolicyServerVPN

9/29/2014

Copyright 2014 Trusted Computing Group14

Compliance
Check
Endpoint
Enforcement
Point

PolicyServerNon-compliant System
Windows 7x Self -Encrypting DriveAV - McAfee VirusScan 8.0
Firewall

Full Access

Security Policy
Windows 7•Self Encrypting Drive•AV (one of)•Symantec Endpoint
Protection 11.x
•McAfee VirusScan 8.x•Firewall

Compliant System
Windows 7
Self-Encrypting DriveAV - Symantec Endpoint
Protection 11.0

Firewall

9/29/2014

Copyright 2014 Trusted Computing Group

15

SecurityAutomation
Metadata
PolicyEndpoint Enforcement
PointServer

AccessPoint(MAP)

IF-MAP

9/29/2014

Copyright 2014 Trusted Computing Group

MAP
Clients

IF-MAP

16

Security
Automation
PolicyMAP
Endpoint Enforcement
Point!

Remediation
Network!

9/29/2014

Server!

MAP
Clients!

Security Policy•No P2P file sharing•No spamming•No attacking others

Copyright 2014 Trusted Computing Group17

NAC Is Not Dead

9/29/2014

Copyright 2014 Trusted Computing Group18

Robert Smith
Funniest video
ever! Checkout the link!
Click Here

Connect toMALWARE
CorporateSITENetwork

9/29/2014

Copyright 2014 Trusted Computing Group

Intranet

Quarter End EmailSales Results
Corporate
Financial Data

19!

Often Infected

Doesn’t have Intelligenceto detect Malware on Client

Robert Smith
Funniest video
ever! Checkout the link!
Click Here

Connected To
MALWARE
Corporate
SITE
NetworkIntranet

9/29/2014

EmailCorporate
Financial Data!

!

Can’t inspect content
in network!

Can’t control
access tosensitive data

Can’t protect user fromcloud-based threats

Copyright 2014 Trusted Computing Group20!

CAN detect malware
on the client!
Robert Smith
Funniest video
ever! Checkout the link!
Click HereMALWARESITEX

CAN enforce access via user,
location and device context

Intranet

EmailCorporate
Financial DataX!

!

CAN coordinate security
to provide access control
to sensitive information
9/29/2014

Copyright 2014 Trusted Computing GroupCAN enable Client traffic
directed to Cloud, CAN
scrub and detect malware
21

What’s Under the Hood?

9/29/2014

Copyright 2014 Trusted Computing Group22

macaddress=
00:11:22:3
3:44:55

Standard Metadata

identity =john.smith

ip-macrole=financeand employee

access-request-mac

authenticated-aslayer2-information
VLAN=978
Port=12device =111:0

device-ip

device-ip

ip-address= 10.0.0.5

ip-address= 10.0.0.6

9/29/2014

ip-address=
10.99.99.32

accessrequest =111:33authenticated-by
device =111:3

ip-macip-address=
192.168.0.7

location = HQ
device-attribute =av-signatures-outof-date
access-requestdevice

Copyright 2014 Trusted Computing Groupdevice =111:5523

Extensibility

9/29/2014

Copyright 2014 Trusted Computing Group24

Industrial Control System Security

9/29/2014

Copyright 2014 Trusted Computing Group25

Provisioning
ClientEnforcement Point

Enforcement PointIn Production Today

9/29/2014

Copyright 2014 Trusted Computing Group

27

!

! !

!
IF-MAP
Event Messages

Endpoint

Enforcement
Point

PolicyServer!

9/29/2014

MAP

MAP
Clients!
Copyright 2014 Trusted Computing Group

28

!
!

!

!
IF-MAP
Event Messages

Endpoint

Enforcement
Point

PolicyServer!

9/29/2014

MAP!
Copyright 2014 Trusted Computing Group

MAP
Clients!

29

Proprietary > Standard

9/29/2014

Copyright 2014 Trusted Computing Group30

What Happens Next?

9/29/2014

Copyright 2014 Trusted Computing Group31

Join the Conversation

9/29/2014

Copyright 2014 Trusted Computing Group32

What Would YOU Do?

9/29/2014

Copyright 2014 Trusted Computing Group33

Questions?

9/29/2014

Copyright 2014 Trusted Computing Group34

• TNC & IF-MAP– IF-MAP Standards & FAQ• http://www.trustedcomputinggroup.org/community/2014/03/ifmap_22__learning_from_experience• http://www.trustedcomputinggroup.org/resources/tnc_if
map_binding_for_soap_specification• http://bit.ly/KKpdDx– Mobile Security Architects Guide• http://www.trustedcomputinggroup.org/resources/archite
cts_guide_mobile_security_using_tnc_technology– Security Automation Architects Guide• http://www.trustedcomputinggroup.org/resources/tcg_se
curity_automation_architects_guide
9/29/2014

Copyright 2014 Trusted Computing Group35

Lisa Lorenzin
llorenzin@juniper.net

9/29/2014

Copyright 2014 Trusted Computing Group36