From Enterprise Perimeter to Distributed, Virtual Enterprise Security Ed Amoroso SVP, CSO – AT&T eamoroso@att.com Page 1
Sandbags Piled in Front of AT&T Building – 12/15/41 Page 2
Original Perimeter Objective (Circa 1995) Enterprise Perimeter Untrusted External Actor “Inside the “Outside the Firewall” Firewall” Page 3
Enabling Browser Access to Enterprise Website Web (External) Untrusted External Actor Page 4
Rule Added to Firewall to Allow Inbound Access to TCP/Port 80 (http) Web (External) Untrusted External Actor “Off the Shelf” Web Software Packets from Browsers and Tools with Potentially “Anywhere” Enter the Exploitable Vulnerabilities Perimeter Page 5
Perimeter Design Scan UTM PKI Firewall Router Enterprise DLP SIEM IPS Access to Web Server “Allowed” A/V Proxy A/S Web (External) Admin Access to 2FA Log RBAC FW Web Server Page 6
Web (External) Page 7
Enabling External VPN Access to Enterprise Web (External) VPN Designed for VPN/RA Client Page 8
Perimeter Design Scan UTM PKI Firewall Router Enterprise DLP SIEM IPS Access to Web Server “Allowed” A/V Proxy A/S Web (External) Admin Access to 2FA Log RBAC FW Web Server Integrate into Common Physical Perimeter VPN Admin FW Access to 2FA Log RBAC VPN Server Firewall Scan UTM PKI Router Enterprise Access to DLP SIEM IPS VPN Server “Allowed” A/V Proxy A/S Page 9
Web (External) VPN Page 10
Adding Third Party Gateway Access to Enterprise Web (External) Third Party Gateway VPN Designed for Third Party Care, Contact, Support, etc. Page 11
Perimeter Design Admin Scan UTM PKI Access to Third Party Gateways DLP SIEM IPS 2FA A/V Proxy A/S Web (External) Log Typically FW RBAC Source IP-Based Authentication Integrate into Common Physical Third Party Perimeter Gateway VPN FW FW Scan UTM PKI Scan UTM PKI “Allowed” DLP SIEM IPS DLP SIEM IPS Enterprise Access to A/V Proxy A/S A/V Proxy A/S Third Party Gateways Integrate into Common Physical Perimeter Page 12
Enterprise Assets Web (External) Third Party Gateway VPN Page 13
Adding Inbound Email to Enterprise Enterprise Assets Email Web (External) Third Party Gateway VPN Page 14
Perimeter Design Scan UTM PKI Scan UTM PKI DLP SIEM IPS DLP SIEM IPS A/V Proxy A/S A/V Proxy A/S Email Web (External) FW FW Allow Integrate into Exchange with Common Physical Third Party any Sender or Perimeter Gateway VPN Receiver FW FW “Allowed” Integrate into Enterprise Scan UTM PKI Scan UTM PKI Common Physical Access to Perimeter Mail DLP SIEM IPS DLP SIEM IPS A/V Proxy A/S A/V Proxy A/S Integrate into Common Physical Perimeter Page 15
Enterprise Assets Email Web (External) Third Party Gateway VPN Page 16
“Hundreds” to “Millions” of Rules (1995 – 2015) Enterprise Assets Additional Firewall Rule Email Web Exceptions (External) Additional Firewall Rule Third Party Exceptions Gateway VPN Page 17
Expanded Third Party Gateways Enterprise Assets Additional Firewall Rule Email Web Exceptions (External) Additional Firewall Rule Third Party Exceptions VPN Additional Third Parties, Retail Dealers, Outsourcing, Offshoring Page 18
Expanded Employee Remote Access Enterprise Assets Additional Firewall Rule Email Web Exceptions (External) Additional Firewall Rule Third Party VPN Exceptions Additional Third Parties, Additional Remote Access, Retail Dealers, Outsourcing, Employee Telework, Offshoring Road Warriors Page 19
Network Vulnerabilities Network Unauthorized Network Misconfigurations Connections (Internet Exposing) (Internet Exposing) Enterprise Assets Additional Firewall Rule Email Web Exceptions (External) Additional Firewall Rule Third Party VPN Exceptions Additional Third Parties, Additional Remote Access, Retail Dealers, Outsourcing, Employee Telework, Offshoring Road Warriors Page 20
Employee Use of Mobile Network Unauthorized Network Misconfigurations Connections (Internet Exposing) (Internet Exposing) Enterprise Assets Additional Firewall Rule Email Web Exceptions (External) Additional Firewall Rule Third Party VPN Exceptions Additional Third Parties, Additional Remote Access, Retail Dealers, Outsourcing, Employee Telework, Offshoring Enterprise Use of Mobility Road Warriors Page 21
Typical State of the Practice Enterprise Design Network Unauthorized Network Misconfigurations Connections (Internet Exposing) (Internet Exposing) Enterprise Assets Additional Firewall Rule Email Web Exceptions (External) Additional Firewall Rule Third Party VPN Exceptions Additional Third Parties, Additional Remote Access, Retail Dealers, Outsourcing, Employee Telework, Offshoring Enterprise Use of Mobility Road Warriors Page 22
Enterprise Perimeter Reality (Circa 2015) Enterprise Perimeter Outside Page 23
Nation State Exfiltration Attacks North/South Exploit (Perimeter) East/West Exploit (Enterprise) Phishing Attack Data Exfiltration Successfully attack this . . . and gain access to this . . . Page 24
Nation State Exfiltration Attacks North/South Exploit (Perimeter) Inbound Outbound Filtering Filtering Many Solutions Many Solutions Exist to Reduce Risk Exist to Reduce Risk East/West Inbound Outbound Exploit (Enterprise) No Good Solutions Exist to Reduce Traversal Risk Page 25
Baseline Perimeter Page 26
Enabling Browser Access to Web Server Web Page 27
Micro-Perimeter Design (Web Server) Virtual Micro Perimeter Web Page 28
Micro-Perimeter Provisioning to Cloud Scan UTM PKI Step 2: Provision Virtual Micro-Perimeter DLP SIEM IPS into Run Time System A/V Proxy A/S Web Step 1: Provision Web Server into FW Integrated Cloud Page 29
East-West Protection for Web Cloud Tenant Hypervisor Security Orchestration . . . Web FW FW A/S Proxy Virtual Appliances Virtual Perimeter Sampling of Vendors with Virtual Appliances Page 30
Virtual Micro Perimeter Web Page 31
Adding Security Command & Control – Virtual Virtual Micro Perimeter Web Security C&C Virtual Micro Perimeter Page 32
Micro-Perimeter Provisioning to Cloud Scan UTM PKI DLP SIEM IPS A/V Proxy A/S Web FW Integrate into Common Virtual Perimeter Scan UTM PKI Security C&C Step 1: Provision DLP SIEM IPS Security Cmd/Ctrl into Virtual Data Center A/V Proxy A/S Step 2: Provision FW Virtual Micro-Perimeter into Run Time System Page 33
East-West Protection for Web and C&C Cloud Tenant Hypervisor Security Orchestration . . . Web FW FW A/S Proxy Server Virtual Appliances Security APIs Tenant Risk Compliance Security Reporting Security Alerting SIEM Security APIs Tenant Hypervisor Security Orchestration . . . C&C FW FW A/S Proxy Virtual Appliances Page 34
Virtual Micro Perimeter Enterprise Assets Web SOC Virtual Micro Perimeter Page 35
Adding Gateway – Virtual Virtual Micro Perimeter Enterprise Assets Web Virtual Micro Perimeter Gateway SOC Virtual Micro Perimeter Page 36
Cloud Tenant Hypervisor Security Orchestration . . . Gate FW FW A/S Proxy way Virtual Appliances Tenant Hypervisor Security Orchestration . . . Web FW FW Proxy A/S Server Virtual Appliances East-West Security APIs Tenant Protection for Risk Compliance Security Alerting Security Reporting SIEM Web, C&C, and Gateway Security APIs Tenant Hypervisor Security Orchestration . . . FW SOC FW A/S Proxy Virtual Appliances Page 37
Virtual Micro Perimeter Enterprise Assets Web Virtual Micro Perimeter Gateway SOC Virtual Micro Perimeter Page 38
East-West Traversal Mitigated by Virtual Perimeter North/South Exploit (Perimeter) East/West Exploit (Enterprise) Successfully attack this . . . and gain NO access to this . . . Page 39
Legacy Assets Dependent on Existing Perimeter Virtual Micro Legacy Perimeter Assets Enterprise Assets Web Virtual Micro Perimeter Gateway SOC Virtual Micro Perimeter Page 40
Legacy Assets Dependent on Existing Perimeter Enterprise Perimeter (Legacy Assets) Legacy Web Gateway SOC Page 41
Enterprise Perimeter Has Less to Defend Legacy Web Gateway SOC Page 42
Legacy Web Gateway SOC Page 43
Web Back-End Legacy Web Gateway SOC Page 44
Web Back-End Legacy Web Gateway SOC SOC (Primary) (Backup) Page 45
Web Back-End Legacy Web Gateway SOC SOC (Primary) (Backup) Page 46
Web Web Back-End Legacy Gateway SOC SOC (Primary) (Backup) Page 47
Legacy Web Web Back-End Gateway SOC SOC (Primary) (Backup) Page 48
Legacy Gateway Web Web Back-End SOC SOC (Primary) (Backup) Page 49
Legacy Gateway Web Web Back-End SOC SOC (Primary) (Backup) Page 50
Ring Ring Ring Ring (Gateway) (Legacy) (Back-End) (Web Server) SOC SOC (Primary) (Backup) Page 51
SOC SOC (Primary) (Backup) Page 52
Page 53
Page 54
Recommend
More recommend
