THE EXPERIENCE EDGE. People Move. Networks Must Follow Kim Filtenborg & Allan Højberg

Transkript

1 THE EXPERIENCE EDGE People Move. Networks Must Follow Kim Filtenborg & Allan Højberg

2 Fra statisk til dynamisk tale, video og data kører på én device

3 THE PERFECT STORM IS COMING: MOBILE, IoT og CLOUD

4 Udfordringer og ønsker til netværket idag Mobilitet IOT Håndtering Øge sikkerheden rundt om den enkelte bruger/enhed Ensartet rollebaseret politik på tværs af LAN/WLAN for brugere og devices Bedre og nemmere segmentering Zero touch deployment Fra statisk setup til dynamisk setup

5 Eliminating the blind spots! Secure the Edge: Secure the Experience

6 ClearPass VISIBILITY Overblik, hvad der er tilsluttet i dit kablede og trådløse multivendor-miljø CONTROL Reducer risiko og arbejdsbyrde gennem Automation Alle enheder er godkendt eller autoriseret - INGEN UBEKENDTE ENHEDER RESPONSE Adaptiv responseudveksling til 3 part, best of breed security løsning

7 Device Visibility: ClearPass Policy Manager An easy start to regaining control Visibility of what s on the network up to approx. 5K devices Includes install guide and specific report generation Visibility of what s changing on the network TACACS to secure and monitor network config changes + reporting RADIUS and/or Guest services for up to 100 concurrent users

8 Device Visibility: ClearPass Policy Manager An easy start to regaining control

9 TRADITIONAL PROFILING TECHNIQUES LACK DEVICE CONTEXT STATIC ATTRIBUTES NMAP SNMP WMI GENERIC WINDOWS OR LINUX DEVICE

10 CLEARPASS DEVICE INSIGHT ELIMINATES BLIND SPOTS Delivers automated, ML powered device classification to enhance policy-based access control

11 MAC / Vendor info Port/Protocol Static Attributes (DHCP, User agent, SNMP info) MACHINE LEARNING- BASED CLUSTERING USING DPI Destination IP Communication Frequency Application Communications

12 CLEARPASS DEVICE INSIGHT: FROM GENERIC TO GRANULAR DEVICE VIEW STATIC ATTRIBUTES NMAP SNMP WMI WINDOWS DEVICE AXIS DEVICE AXIS SECURITY CAMERA DEEP PACKET INSPECTION (DPI) AXIS Q35 NETWORK CAMERA STATIC + BEHAVIORAL ATTRIBUTES APPLICATIONS WEB SITES PORTS PROTOCOLS MACHINE LEARNING CROWD- SOURCING

13 ARCHITECTURE OVERVIEW DEVICE INSIGHT ANALYZER CLOUD PLATFORM Combination of on-premises data collector (appliance or virtual) and cloud-based analyzer Through Deep Packet Inspection (DPI), device attributes are are extracted and metadata is sent to the cloud for analysis Device Insight Hardware Collector Campus V Device Insight Virtual Collector V Branch Device Insight Virtual Collector Gateway Switch

14 CLOUD-ENABLED COMMUNITY CROWDSOURCING Aruba receives the signature Signature is made available for use by all customers Customer labels a device using clusters or rules Signature is tested and validated

15 DEVICE CLASSIFICATION Device Identified and Labeled Static Rules Discovered Devices Classify known devices with established patterns ML-based Classification Classification based on static, flow and behavior based attributes

16 ClearPass Device Insight Accurate Classification 16

17 ClearPass Device Insight Accurate Classification 17

18 ML-ENABLED DETERMINE THE UNKNOWN DEVICES Static Attributes: Operating System, Hardware Vendor Active and Passive techniques such as MAC OUI, NMAP, etc. Dynamic Attributes: Understanding Behavioral Attributes Deep Packet Inspection (DPI) and Machine Learning to leverage communication patterns, applications, etc. Comparative Attributes: Finding Commonality Continuous monitoring of device traffic and crowdsourced intelligence to refine and update device fingerprints

19 ClearPass Device Insight Generic to Granular 19

20 ClearPass Device Insight Generic to Granular 20

21 ClearPass Device Insight Generic to Granular 21

22 CLEARPASS POLICY MANAGER AUTOMATES SECURE ACCESS ClearPass Device Insight ENHANCED DISCOVERY / PROFILING ClearPass Policy Manager AUTOMATED SEGMENTATION AND ENFORCEMENT Aruba Security Exchange INTELLIGENCE SHARING AND AUTOMATION WITH OVER 140 PARTNERS Bi-Directional Data Exchange Bi-Directional Data Exchange

23 ClearPass Device Insight Enhancing Policy 23

24 ClearPass Device Insight Enhancing Policy 24

25 ClearPass Device Insight Enhancing Policy 25

26 ClearPass Device Insight Enhancing Policy 26

27 ClearPass Device Insight Enhancing Policy 27

28 Creating Access Policy Control ClearPass Policy Manager Integrations EMM / MDM PMS / IoT Firewall Network Services AuthN / MFA Open, Multi-Vendor Security Framework Messaging Social Media Logging Deception Endpoint UEBA

29 Byggesten til Dynamic User Roles ClearPass: End to End profiling and control REST API, Syslog Security monitoring and threat prevention Internet of Things (IoT) Multi-vendor switching Device management and multi-factor authentication BYOD and corporate owned Multi-vendor WLANs Aruba ClearPass with Exchange Ecosystem Helpdesk and voice/sms service in the cloud

30 Role Based Polices for LAN/WLAN & Security Users Devices App finger-printing Aruba AP Aruba Mobility Controller BYOD Tunnels Laptop ArubaOS-Switch Core switch User roles Polices på tværs af LAN/WLAN En sted politikker håndteres Sikkerhed håndhævet på kanten med forskellige roller Security Policies Sikker og fleksibel mulighed for at enforce rundt om bruger/device DPI, FW regler, QoS Firewall ude på kanten

31 Byggesten til Dynamisk Segmentation ARUBA Controller/Gateway ARUBA Switch ARUBA AP WIRED ACCESS

32 Fordele ved Dynamic Segmentation? Åbent økosystem 3 parts integration Leader Gartner 5/6 + integration med leaders TCO du ejer hvad du køber og baseret på standard komponenter + LTW Layer 7 løsning application aware Ingen begræsninger på antal af devices i samme managementplatform

33 THE EXPERIENCE EDGE Technology Partners 360 Security Ecosystem Alliances Airheads and Developers BEST-IN-CLASS ECOSYSTEM MANAGEMENT SECURITY LOCATION ANALYTICS AND ASSURANCE SOFTWARE PLATFORM Aruba AirWave Aruba Central ClearPass IntroSpect Meridian NetInsight Cape Networks VIA CLIENT SECURE INFRASTRUCTURE Wi-Fi BLE TAGS WAN REMOTE ACCESS WIRED ACCESS WIRED CORE/AGG EDGE COMPUTE Open and Designed for Flexibility

34 Gartner recommendation: Aruba s wired and wireless LAN solutions are suitable for consideration globally for all access layer opportunities.

35 MARKET LEADERS 13 YEARS RUNNING Leader Magic Quadrant for Wired and WLAN Access Infrastructure. Gartner, August 2018 Unified Wired and Wireless LAN WLAN Only Refresh/New Build Performance Stringent Applications Multivendor Network Environment Remote Branch Office With Corporate HQ Wired Only Refresh/New Build Aruba 4.13 Aruba 4.13 Aruba 4.10 Aruba 3.82 Aruba 4.13 Cisco 4.11 Cisco 4.10 Mist Systems 4.03 Cisco 4.09 Extreme Networks 3.76 Cisco 4.12 Extreme Networks 4.05 Extreme Networks 4.02 Cisco 3.96 Extreme Networks 3.92 New H3C 3.57 Extreme Networks 3.97 Aruba 4.03 Huawei 3.80 Extreme Networks 3.95 Huawei 3.81 Huawei 3.51 Huawei 3.80 Huawei 3.83 New H3C 3.73 Aerohive 3.84 Aerohive 3.76 Cisco 3.48 Aerohive 3.76 New H3C 3.81

36

37 Enkelt, effektivt og sikkert netværk

38 Tak for jeres opmærksomhed!