Daily Archives: August 1, 2012

What happens when a user with an untrusted device tries to access my network?

Posted on by
Reply

Tiho Strabc, Wireless Specialist, Juniper Networks

From time to time we thought we could use this blog to post answers to questions submitted via our webinars. For starters please see below a response from Tiho Strabc, Wireless Specialist, Juniper Networks in answer to a question submitted via our latest webinar ‘BYOD & Mobile Threats – Is Your Network Simply Connected?’

What happens when a user with an untrusted device tries to access my network?

There are a few aspects to consider here: security, protection of the network and user experience. In short if a user tries to access a network that is simply connected with an untrusted device their access will be denied. However, what is equally important here is that this unauthorised access attempt is recorded and stored for any potential auditing purposes.  It’s important to assess what kind of access this is and also to review if anyone is continually trying to access the network illegally, as this may affect the bandwidth performance for authorised users. There should be counter measures in place to ensure bandwidth is not wasted and that continual unauthorised access attempts don’t affect the network experience for the rest of your wireless users.

For more please visit the recorded webinar here.

Do your virtualised data centre and cloud deployments take the gold (medal) on security and compliance?

Posted on by
Reply

By Malcolm Orekoya, Senior Technical Consultant, Netutils

This post contains original thoughts posted by Malcolm Orekoya, Senior Technical Consultant, Network (Utilities) Systems Ltd. These views are his own.

Ready for the future – Virtualisation wins the race

Data centres have been around for a long time and “Cloud” has been the buzz word for several years now, but what has been the major driver over the years in the exponential growth in the services provided by these two giants? The answer is virtualisation.

Virtualisation is hardly a new concept and now almost all data centres and cloud deployments rely on virtualised infrastructure in one way or the other. This allows for maximum utilisation of space, resources and reduces costs, by being able to run multiple virtual machines (VMs or guests) on a single physical server (host), which can run server and client operating systems.

Historically communications between machines had to traverse physical appliances such as switches, routers and firewalls, where security measures and controls could be enforced. But now within a host machine all guests can communicate within the same system, via the hypervisor (virtual machine manager), virtual network cards and virtual switches, without having to leave that system. Therefore the question of secure communications between the various guests (Inter-VM traffic) had to be answered and in time so did the question of compliance, especially when dealing with sensitive customer information such as credit card details.

Inter-VM traffic security can be achieved in a number of ways, such as via VLAN segmentation or agent based solutions, but these can affect performance, can be costly and are not as granular or scalable. Juniper Networks Virtual Gateway (vGW) series allows data centres and cloud providers to take back control of their virtual infrastructure security and compliance, by allowing comprehensive monitoring of all guest traffic via a hypervisor-based high performance stateful firewall.

Set in the heart of it – The Hypervisor

The vGW engine is integrated directly into the hypervisor, which essentially means we get visibility of all traffic within the virtual environment, because all guest traffic has to go via the hypervisor, meaning there is no requirement to install any agent on the guest virtual machines.

In addition all processing is done at the hypervisor level, so traffic is processed in-line between the guests through the hypervisor with no proxies, caching, content switches or memory copies required. This provides wire line performance, in comparison to other solutions that do a lot of the processing outside the hypervisor, thereby generating a lot of traffic back and forth between the guests, hypervisor and the processing VM or system.

Each guest VM also has an independent firewall instance through the hypervisor, meaning packets from one guest to another are independently evaluated based on individually defined policies for the communicating guests. However, vGW allows the use of defined global and group policies, which cover wider groups of guests and are processed pre and post the individual guest VM policy; allowing incredible granularity with security policies not common with competing products.

Go the extra mile – vGW on top step of podium

There are several additional benefits to the vGW solution that put it on the top step of the podium in this market and it is not possible for me to provide in-depth details of these here, so I’ll simply provide brief summaries:

Introspection visibility; gives vGW a deep knowledge of VM states, including network settings, installed applications, operating systems, hotfixes and patch levels. Alerts can be generated based on this information as well as dynamic security actions. For example you can decide to dynamically apply an internet block policy to a guest VM with bit torrent applications installed.

Integrated Intrusion detection protection (IDP); allows all packets (Windows and Linux only) to be scanned for malware or malicious traffic and alerts sent to designated administrators as appropriate.

Integrated anti-virus (AV) protection; allows on-access and on-demand scanning of guest disks and files for viruses and configurable quarantine actions to be taken on infected guests.

Compliance; functionality includes the use of smart groups, which integrate with vCentre and vGW attributes, as well as smart group policies to dynamically secure certain types of guests with the required internal or regulatory policy. In addition VM “gold” image templates for ideal VM images or configuration and VMware security hardening guide enforcement can be configured to trigger alerts or quarantine a guest that has deviated from the required configuration or image.

Summary

Gartner predicted in 2008 that “virtualisation will be the highest-impact trend changing infrastructure and operations through 2012”* and “The number of virtualized PCs is expected to grow from less than 5 million in 2007 to 660 million by 2011”*. Now that we’re half way through the 2012 year we can see the proof of this, as most enterprises, data centres and cloud deployments already have a virtualisation program or project in the pipeline.

The tools, technologies and vendors that were available in the market five years ago, to plug the security gaps with virtualisation, have evolved and matured dramatically. Now it’s more a question of who takes first place and the overall gold in the summer of 2012, the clue is in the name; vG(old)w.

(* sourced from Gartner newsroom press releases http://www.gartner.com/it/page.jsp?id=638207)

Your BYOD Strategy – Where is the trust? – Juniper has the NAC

Posted on by
Reply

By Toby Makepeace, Technical Director, Netutils

This post contains original thoughts posted by Toby Makepeace, Technical Director, Network (Utilities) Systems Ltd. These views are his own.

More and more enterprises faced with pressure from guests to supply secure network access are deploying network access control (NAC) solutions. In today’s digital society there is an increasing expectation from your guests, contractors and staff that they will be able to quickly, easily and securely connect to the internet wherever they are on your premises.  Again, this places pressure on your IT department and brings challenges with regard to deploying solutions that are easily scalable, fast to install and compatible with your existing IT infrastructure.Juniper’s recent White Paper on Network Access Control shares some interesting findings:

‘According to Gartner, Inc., 80 percent of NAC deployments are installed initially to address guest access control. Some enterprises have already installed gear from different vendors to meet individual use cases; for example, deploying one NAC solution for the visitor waiting in the lobby, and another for contractors, partners, or other non-employees who may need broader access.

 …Gartner recommends that enterprises plan for the long term and deploy NAC solutions that not only meet their immediate needs, but also take into consideration their future access control needs and plans.’*

In my experience a good network access control policy and solution mean that things like BYOD should not be a challenge for a business. Your BYOD Strategy should simply start with the fundamentals about who you want to grant access to and what they should be allowed to access based on a number of factors.

  • User classification (staff, contractor, guest)
  • Device type (PC, MAC, PDA, Tablet, Mobile)
  • Device health (Anti-Virus, Patches, Restricted applications)

So once you have a robust BYOD policy in place a “Network Access Control” solution becomes your tool of enforcement. If you do not deploy a NAC solution you will have to consider deploying lots of different networks and trust people to only connect to the network they should be on. Consider though; can you really trust people to connect to the network they should be on rather than the network they want to be on?

By employing a robust BYOD strategy you remove the element of uncertainty and implement an assured method of control. So In my opinion an 802.1x based network access control solution that supports multiple and different EAP-protocols is a must. You should implement a solution that not only caters for the devices you have the ability to control, the “Access Control Client” but also a solution that can still support any 802.1x supplicant a user might have on their own personal device.

This way you make the user access from trusted devices and untrusted devices the same, and allow the solution to determine which network the connection should be terminated on. If the user is on a trusted device, and has a trusted identity (Username and Password) then they should be allowed onto the corporate network. If the user is on an untrusted device (a machine that is not owned by the organisation or fails to meet a security policy requirement) then they should be placed on a separate network with limited access to resources. And finally if it’s the user themselves who is un-trusted, then the question is – do you actually want them on the network at all?

If there are users you do not want on the network (contractors, vendors or guests), they should be on a separate network from your trusted users, irrelevant of the device they are on, trusted or untrusted. A trusted device can fall into one of two categories:

  • A corporate machine that meets a required security policy
  • A personal device that meets a required security policy.

In my view despite the fact that both devices are ‘trusted’ they should be granted different levels of access, and therefore you may want to consider directing them to different networks. For example a full corporate device should be granted full access to the network as if they were on a wired connection. Whereas a BYOD (PC) device would only gain access to resources like the internet, email and intranet (all those web based services users want access to that made you consider BYOD in the first place!)

Now we get into the detail regarding levels of access and control. What I like most about the Juniper UAC solution is its’ ability to integrate with a firewall; to act as a dynamic “user” based firewall. Most firewalls have policies based on Source IP/Destination IP, with the Juniper UAC the firewall rules are based on the User / Destination IP. This allows you to grant network access to an untrusted device to only the resources you consider to be permissible / safe. In addition, as the solution is focused on the user, as that user moves throughout the building and the IP address changes the rules of access are still granted.

The levels of flexibility you have with a good NAC solution should allow you to safely consider BYOD as a benefit to your business. Juniper Unified Access Control (UAC) solutions solve a wide variety of business and technology issues, addressing authentication, end point security and access control capabilities.

‘Enterprises benefit from a single, comprehensive NAC solution that can accommodate onetime guests, repeat visitors such as contractors and partners, employees, and future use cases as they emerge. Juniper Networks Unified Access Control is an integrated, easy-to-use solution that enables enterprises to cost-effectively turn on the right level of access control for their guests today and be well positioned to meet tomorrow’s access control challenges.’

Suggested further reading Juniper Networks, White Paper ‘Guest Access Made Easy‘

* Source Juniper Networks, White Paper ‘GUEST ACCESS MADE EASY, Juniper Networks Unified Access Control and EX Series Ethernet Switches Solve Today’s NAC Problems