Date post: | 03-Aug-2015 |
Category: |
Technology |
Upload: | tibco-software-inc |
View: | 349 times |
Download: | 1 times |
Cybersecurity: Identity and Access Control
Federal Identity and Access
What is Cisco’s Role?
Disciplines of Security: Identity Is the Base
Information Sharing
Encryption
Threat Migration
Policy/Governance
Access Control
Forensics
Data Leakage
Non-Repudiation
Audit
Threat Mitigation
Availability
Inventory
Customer Challenge in Building an Access Policy in a Borderless Network
Authorized Access
How can I restrict access to my network?
Can I manage the risk of using personal PCs?
Common access rights when on-prem, at home, on the road?
Endpoints are healthy?
Guest
Access Can I allow guests
Internet-only access?
How do I manage guest access
Can this work in wireless and wired?
How do I monitor guest activities?
Non-User Devices
How do I discover non-user devices?
Can I determine what they are?
Can I control their access?
Are they being spoofed?
Common questions organizations ask
Five Aspects of Identity
Who are you? What is on your Network?
Are you compliant?
What service level do you receive?
What are you doing?
Where can you go?
Federal Government Requirements
DISA STIG on access control in Support of Information Systems (Dec 2008)
(AC34.025: CAT 1) The IAO/NSO will ensure either MAC security with profiling) or 802.1X port authentication is used on all network access ports and configured in accordance with the Network Infrastructure STIG.
Recommended Security Controls for Federal Information Systems (NIST 800-53)
“The information system typically uses either shared known information … or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol (EAP) or a Radius server with EAP-Transport Layer Security (TLS) authentication)”
Why 802.1X?
15
Industry-standard
approach to identity
Most secure user/machine authentication
solution
Complements other switch
security features
Easier to deploy
Provides foundation for
additional services (e.g., posture)
Request for Service(Connectivity)
Back-End AuthenticationSupport
Identity StoreIntegration
AuthenticatorSwitch, router, WAP
Layer 2
How Does 802.1X Work?
Layer 3
Identity Store/ManagementActive directory, LDAP
Supplicant
Authentication ServerRADIUS server
Cisco Identity Differentiators Cisco-only Features
Open Mode – Wake-on-LAN support, PXE boot, Ease of Deployment Flexible Authentication (Flex-Auth) – Legacy Device Support Multi-Domain Authentication (MDA) – Securely daisy-chain systems
behind VoIP phones ACS 5 Scalability - Top-Down Visibility & Centralized Reporting for
Authentication and Authorization TrustSec – Security Group Tags
Other Enhancements 802.1AE – Hop-by-hop encryption included in TrustSec More Robust Supplicant than built-in Windows supplicant Identity-Aware Product Roadmaps – more to come! HBSS support and provides a layered-approach to endpoint
security
Identity Deployment Phases
Monitor Mode Low Impact Mode High Security Mode
Primary Features
Traditional Closed Mode
Dynamic VLANs
Benefits
Strict Access Control
Primary Features
Open mode
Multi-Auth
Flex Auth (Optional)
Benefits
Unobstructed Access
No Impact on Productivity
Gain Visibility AAA Logs
Primary Features
Open mode
Multi-Domain
Port & dACLs
Benefits
Maintain Basic Connectivity
Increased Access Security
Differentiated Access
Building on the Foundation of Identity
Identity-Enabled
Networks
Network Admission
Control
TrustSec
Role-Based Access Control
Network topology-independent
Scalability via tagging
Data Integrity and Confidentiality
Hop-to-hop data protection Preserves network L4–L7
service value
Network Virtualization
Path Isolation Central Policy Enforcement
Profiling Services
Device profiling Behavioral monitoring Device reporting
Guest and sponsor portals Role-based AUP Provisioning and reporting
Managed device posture Unmanaged device scanning Remediation
Guest Services Posture Services
User and device authentication Control network access (L2 and L3)
Device mobility in the network
Identity Infrastructure