Secure Mobility (2012 San Diego)

Secure Mobility ? Security for all my mobile devices Any asset that moves is mobile and has to be secured Ensure device status before granting access Protect my employees, partners and vendors Protect my company data Authorization and Access control Protect from MalwareBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 2

Secure MobilityBRKSEC-2050Kiran Sirupa, Technical Marketing Engineer

What we will not cover  Mobile Device Management  DLP Technologies – BRKSEC-2101  Site-to-Site VPN – BRKSEC-4054  Wireless or Wired Access – BRKSEC-2022  ISE – BRKSEC-3040  Licensing - TECSEC-2091  Troubleshooting – BRKSEC-3050  RoadmapBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 6

Challenges 5 Billion mobile users HIPAA - $50,000 /violation by 2016 PCI - $100,000 /violation CIO Productivity Policy Employees, Compliance Vendors, Guests Loss of $200k per breach Hackers Devices ThreatsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 7

Cisco AnyConnect Secure Mobility Solution Clientless Host Scan Dynamic SSL VPN Access Policies AnyConnect WSA Secure Mobility Client Web Security Cisco ASA VPN GatewayBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 9

AnyConnect   Full Tunnel VPN Client   SSL and IPSec   IPv6   Broad OS and Device Support   Optimal User Experience   Security ModulesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 10

Clientless SSL VPN   Browser-based   Non-company assets   Web Apps and Plug-ins   Smart Tunnel   Secure Vault   Virtual DesktopsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 11

Dynamic Access Policies (DAP) Employee Applications Partner Data Customer Resources Guest Who? What? Where? How? Home Client-based Corporate Premises Clientless Kiosk Mobile Secured/UnsecuredBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 13

Web Security On-Premise Cloud WSA   Malware Protection   Acceptable Use Policies   Application Visibility and Control   HTTPS Decryption   ReportsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 14

Get Well Hospitals Medical Records Bills and Insurance Hospital Health Portal Internet Access Records Doctors Staff Patients and GuestsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 16

Get Well Hospitals – Access Rules Medical Records Bills and Insurance Hospital Health Portal Internet Access Records Doctors Staff Patients and GuestsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 17

Get Well Hospitals – Posture Device Posture Requirements Laptops: Anti-Virus, Personal Firewall and Registry If posture fails, restrict access to browser based VPN iOS and Android: Distinguish based on corporate or personal deviceBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 18

Get Well Hospitals – Authentication Authentication Requirements Laptops: Secure Tokens AD Credentials iOS and Android: CertificatesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 19

Get Well Hospitals – Internet Access Internet Access Requirements Security: Prevent Malware Avoid Phishing attacks Liability: Prevent adult, gambling sites Productivity: Prevent games, chatBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 20

Get Well Hospitals – System System Requirements   Scalability   Back-Up   Availability   Reports   Disaster Recovery   Support   Load Balancing   ComplianceBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 21

Get Well Hospitals – Test Plan User Corporate/ Device Auth. Medical Billing Portal Type of Group Personal Type Method Records Records and Access Asset Internet (Client/ Browser) Guest Pers. Any AD ✔ Browser Staff Corp. Laptop AD + ✔ ✔ Client Token Doctor Corp. Laptop AD + ✔ ✔ Client Token iPad Cert ✔ ✔ Client Pers. Laptop AD + ✔ ✔ Browser TokenBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 22

Solution Topology WSA ASA Corp FW Certificate Authority Corporate Devices Phone Factor (Token) and ASA Corp VPN Active Directory Medical Records Personal Devices Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 24

WSA Pho ne c all fo Use ASArCorp FW req Certificate Authority rnam ues ting Corporate Devices e: d P IN avid , pw d: c is co1 Phone Factor (Token) 23 and ASA Corp VPN Active Directory Uname , pwd Medical Records Personal Devices Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 26

WSA Use r en $a1 tere ax# dP 6% IN ASA:Corp FW Certificate Authority 3^f 061 51& 2 Corporate Devices 10( g*:$ 11f1 0&1 9(a Phone Factor (Token) p)1 and ASA Corp VPN Auth Success Active Directory Medical Records Personal Devices Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 27

WSA $a1 ax# ASA Corp FW Certificate Authority 6% 3^f 51& Corporate Devices 10( g*:$ 11f1 0&1 9(a Phone Factor (Token) p)1 and ASA Corp VPN Active Directory Medical Records Personal Devices Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 30

WSA Enc ryp ASA Corp FW Certificate Authority ted Cer t Re Corporate Devices que st Phone Factor (Token) and ASA Corp VPN Active Directory Medical Records Personal Devices Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 31

WSA ASA Corp FW Certificate Authority Corporate Devices Phone Factor (Token) and ASA Corp VPN Active Directory Medical Records Personal Devices Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 32

For Your Reference WSA ASA Corp FW Certificate Authority Corporate Devices Phone Factor (Token) Username: david, pwd: cisco123 Uname , pwd and ASA Corp VPN Active Directory P IN ng sti ue req Medical Records for c all ne Personal Devices P ho Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 35

For Your Reference WSA ASA Corp FW Certificate Authority Corporate Devices Phone Factor (Token) Auth Success and $a1ax#6%3^f51&10(g*:$11f10&19(ap)1 ASA Corp VPN Active Directory 2 Medical Records 1 : 06 IN Personal Devices e dP ter en er Us Hospital ServicesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 36

Process Overview•  Asset Identification •  Active Directory •  AAA Criteria•  Host Scan •  Radius •  Endpoint Assessment •  Local Criteria•  Advanced Endpoint Assessment •  Certificates •  Group Policies•  Vault or Cache Cleaner •  Connection Profiles •  DAPPre-Auth Auth Post-Auth BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 40

Asset Identification – Prelogin Policies Pre-Auth Additional Options For Your File Check Reference IP address check SubsequenceBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 44

AuthAuthentication Proves Who you are  Static Passwords (local to ASA, Active Directory, LDAP) Connection Profile   OTP (One-Time-Passwords, RADIUS)   CertificatesBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 50

AuthPhone Factor   Voice Call with PIN   Two-Way SMS This is PhoneFactor. To complete your login, please reply to this message with the following   Mobile App passcode: 675532   Self-Service Portal Text “ecollateral” to 75309 http://bit.ly/ecollateralBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 55

AuthPhone Factor For Your Reference   Voice Call with PIN   Two-Way SMS   Mobile App   Self-Service Portal Text “ecollateral” to 75309 http://bit.ly/ecollateralBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 56

AuthCertificate Authentication   Install Root Certificate   Generate Identity Certificate for ASA   Use the Identity CertificateBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 57

AuthConnection Profiles   Aliases in Alphabetical Order   Hide Cert-Auth from Users   Secure-Access uses PhoneFactor Authentication and AD AuthorizationBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 62

Authorization Post-Auth Determines What you can do   IP address, DNS server Group Policies   ACL   Split Tunnelling etc. AnyConnect behavior AnyConnect   Always On Client Profiles   Certificate Selection etc. BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 63

Policy Inheritance Post-Auth DAP User •  Radius, LDAP, Local User Radius, LDAP, Local Group Policy •  Class 25, LDAP Attribute map Group Policy Class 25, LDAP Attrib Map Connection Profile Tunnel Group / Connection Profile Default Group Policy Default Group PolicyBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 64

Dynamic Access Policies Post-Auth  User Identity and Device Posture  DAP grows on you (DAP accumulates)  Not a first-match  Lua scripts for advanced logicBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 70

Dynamic Access Policies Post-AuthLUA to verify device serial number against AD If not equal, deny Enrolled Device access UUID Device UUID CheckAndMsg (EVAL (endpoint.anyconnect.deviceuniqueid, "NE", aaa.ldap.physicalDeliveryOfficeName,"caseless"), ”This is not your company issued device,"")BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 81

Dynamic Access Policies For Your Reference Post-AuthDoctors using certificates on corporate iPad can access medical recordsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 82

Dynamic Access Policies For Your Reference Post-AuthStaff using Phone Factor on Corporate laptops can access Billing RecordsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 83

Dynamic Access Policies Post-Auth Only Corporate Assets are allowed access to AnyConnect Personal Assets are limited to Clientless PortalBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 90

Dynamic Access Policies Post-Auth  Doctor on corporate laptop – Doctors-DAP, Common-Access-DAP  Doctor on corporate iPad – Corporate-iPad-For-Doctors, Common-Access-DAP  Guest Access – Common-Access-DAP, Enforce-Client-RestrictionsBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 94

Security Policy Summary•  Asset Identification •  Active Directory •  AAA Criteria•  Host Scan •  Radius •  Endpoint Assessment •  Local Criteria•  Advanced Endpoint Assessment •  Certificates •  Group Policies•  Vault or Cache Cleaner •  Connection Profiles •  DAPPre-Auth Auth Post-Auth BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 95

Optimize User Experience Session Clientless Persisten- SSO ce Trusted SCEP Network Detection On- Optimal Demand Gateway VPN for Selection iOS BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 98

Session Persistence   Auto Reconnect   Wired-WiFi, WiFi-3G   No Re-authentication   Suspended on Head-end   Idle Timeout BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 99

Trusted Network Detection   Auto disconnect inside office Trusted Network   Auto connect when out of office   Based on Default Domain Name or DNS server IP UnTrusted Network BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 101

On-Demand VPN for iOS   Auto Launch VPN   Based on domain   Certificate auth only   Actions –  Always-Connect –  Connect-if-Needed –  Never-Connect   Wild-card support –  *.edu, *.net, *.com BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 103

Optimal Gateway Selection London Boston Time = 33ms Los Angeles Time = 35ms Time = 25ms Time = 26ms Time = 28ms Time = 23ms Time = 27ms Time = 25ms Time = 24ms New York Connects to the Most Op2mum Head-‐end HTTPS Request Approximated by Fastest Round Trip Time BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 105

SCEP   Simple Cert Enrollment   CA must be in Auto Grant mode   Auto Renewal   Win2K8 need specific settings   Validate Machine Cert   Practical PKI for VPN Break-out SCEP request encrypted ASA forwards the request to CA server in PKCS7 CA issues the certificate Client ASA CA Server Device Certificate delivered to the Client BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 106

Clientless SSO   Submits credentials to   Basic, NTLM, CIFS –  Web Servers   Bookmarks with POST parameters –  CIFS/FTP Servers   Microsoft KCD –  Plug-ins –  Windows OS/IE Smart Tunnel Apps   SAML ls entia Cred Web Server Credentials Crede ntials ASA FTP Server BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 107

Web Security with ScanSafe Internet bound web communications Internal communications AnyConnect Secure Mobility Client ASA VPN Gateway BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 111

Web Security with ScanSafe   Filters based on URL categories, applications and file type   Centrally managed via the ScanSafe cloud web portal BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 112

Web Security with ScanSafe For Your Reference   Trusted Network Detection –  Based on connectivity to any internal https server   Optimal ScanSafe Tower Selection –  Based on round-trip latency –  Fail-Open if tower not reachable   Exception List –  IP address, Domain and Host –  Wild-card (*.cisco.com) BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 114

Web Security with WSA Trusted Network User Identity News Email User ASA Authenticates WCCP WSA Corporate AD Untrusted Network Social Enterprise Networking SaaS BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 115

Web Security with WSA Malware Acceptable Use Data Loss Protection Policies Prevention •  Web Reputation •  URL Categories •  On-box •  Cisco SIO •  App. Visibility •  Off-box and Control •  Anti-X scan •  Bandwidth Controls BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 116

Web Security with WSA – Traffic Redirection For Your ReferenceWCCP in router or switchWCCP in ASA •  Caveat: proxy must be on same interface as clientsExplicit Proxy Settings in Browsers •  Configured by ASA or AnyConnect, GPOs, DNS, DHCP •  Caveat: some applications may not follow proxy settings BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 117

Network Access Manager   Enterprise-focused connection management   Wired (802.3) and wireless (802.11)   Layer-2 user and device authentication – 802.1X, 802.1X-REV (wired key establishment) – 802.1AE (MACsec: wired encryption) – Supports numerous EAP types – 802.11i (Robust Security Network) BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 119

DART (Windows and MAC)   Can be installed with Client   Similar to“show tech”on the client   Gathers OS Data, App Data and Log files BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 120

Host Scan Module   Ensures timely support for new AV, Anti Spyware and Pers. Firewall releases   Independent Host Scan takes precedence over the Host Scan in CSD CSD Package AnyConnect Package IndependentHost Scan Host Scan Host ScanVault (Secure Desktop) Network Access ManagerKey stroke logger detection Web SecurityCache Cleaner DART BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 121

High Availability Ac2ve   Active/Standby   Session Failover Internet   Requires Identical hardware Medical   Licenses Failover (ASA 8.3 +) Records Standby   Cluster of Active/Standby devices BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 124

Management Adaptive Security Device Cisco Security Manager (CSM) Manager (ASDM) for ASA Single device management  Scalable multi-device management Included with the ASA  Manage FW, IPS, VPN and IOS Browser-launched, Java-based tool Threat ID and resolution Configuration Reporting Event management Configuration Health and performance Event management License management Health and performance Monitoring License management BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 125

Scalability Concurrent VPN VPN ASA Platform Sessions Throughput 5505 25 100 Mbps 5515 250 250 Mbps 5525 750 300 Mbps 5545 2500 400 Mbps 5555 5000 700 Mbps 5585-X SSP-10 5000 1 Gbps 5585-X SSP-20 10000 2 Gbps 5585-X SSP-40 10000 3 Gbps 5585-X SSP-60 10000 5 Gbps BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 126

Summary  Develop a test plan  Build the policy bottom up  Enhance UE later User Experience Security  Remember - DAP grows on youBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 127

For YourDebug Commands Reference   DAP: debug dap trace   RADIUS: debug aaa common 5   LDAP: debug ldap 255   Cert: debug crypto caBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 129

For YourReferences Reference  DAP http://www.cisco.com/en/US/products/ps6120/products_white_paper09186a00809fcf38.shtml  ASA VPN Deployment Guide http://www.cisco.com/en/US/docs/security/asa/asa80/asdm60/ssl_vpn_deployment_guide/ deploy.pdf  AnyConnect Deployment Guide http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/administration/ guide/ac02asaconfig.html  ScanSafe Configuration Guide http://www.cisco.com/en/US/products/ps11720/ products_installation_and_configuration_guides_list.html  Web Security with WSA http://www.cisco.com/en/US/docs/security/wsa/wsa7.0/user_guide/ AnyConnect_Secure_Mobility_SolutionGuide.pdfBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 130

For YourReferences Reference  AnyConnect Administration for iOS devices http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/administration/ guide/ac09_admin_mobile.html  Licensing http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ overview_c78-527488.html  AnyConnect Troubleshooting Guide http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00809b4754.shtml  Clientless Customization Guide http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a008094abcb.shtml  VMWare View and Cisco ASA http://www.vmware.com/files/pdf/partners/cisco/cisco-vmware-view-adaptive-security-appliances- asa-sslvpn-sb-en.pdfBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 131

Next Steps   Meet-the-Engineer   Visit demo booth at Expo   Try the Walk-in Labs (WISP)   Attend Practical PKI for VPN – BRKSEC-2053   Attend Securing Tele-Commuters and CVO – BRKSEC-2055BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 132

Complete Your OnlineSession Evaluation  Give us your feedback and you could win fabulous prizes. Winners announced daily.  Receive 20 Passport points for each session evaluation you complete.  Complete your session evaluation online now (open a browser through our wireless network to access our Don’t forget to activate your portal) or visit one of the Internet Cisco Live Virtual account for access to all session material, communities, and stations throughout the Convention on-demand and live activities throughout Center. the year. Activate your account at the Cisco booth in the World of Solutions or visit www.ciscolive.com.BRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 133 133

Final Thoughts  Get hands-on experience with the Walk-in Labs located in World of Solutions, booth 1042  Come see demos of many key solutions and products in the main Cisco booth 2924  Visit www.ciscoLive365.com after the event for updated PDFs, on- demand session videos, networking, and more!  Follow Cisco Live! using social media: – Facebook: https://www.facebook.com/ciscoliveus – Twitter: https://twitter.com/#!/CiscoLive – LinkedIn Group: http://linkd.in/CiscoLIBRKSEC-2050 © 2012 Cisco and/or its affiliates. All rights reserved. Cisco Public 134 134

Secure Mobility (2012 San Diego)

by Cisco Security on Jun 19, 2012

Statistics

Views

Actions

0 Embeds 0

Accessibility

Categories

Upload Details

Usage Rights

Report content

Secure Mobility (2012 San Diego) Presentation Transcript