Gemalto Authentication and Hardware Security Module
Total Page:16
File Type:pdf, Size:1020Kb
Securing F5 solutions: Gemalto Authentication and Hardware Security Module Marko Bobinac, PreSales Manager, Enterprise and Cybersecurity Bucharest, 20.3.2019 ENCRYPTION=DIGITAL CEMENT Why is Encryption Secure? Example: AES128 = 3,4 x 1038 Keys Assuming a Super Computer can calculate ~ 1 Billion Keys / second, we have 100 Super Computers, we find the key in the 1%. Finding the Key takes 1022 years. Universe is 1011 years old. Cryptography as an IT Service ProtectFile Server/Desktop Agent Hardware Security Modules Appliance Certificate Infrastructures AMI Metering Network Share Encryption Proxy Nat. IDs E-Signatures Tape BacKups Protect File Shares Protect E-Passports File Shares Infrastructure Authentication Management Protect V Manager (On-Premise or Virtual Appliance Cloud) Virtual Instances L2 HighSpeed Virtual Storage Encryptors Key Secure Appliance Protect Identities Protect Cloud & **##** Virtual Infrastructure Ethernet ToKenization FiberChanel Applications (.NET, JAVA, 3rd party solutions Protect Protect KMIP, XML) (e.g. Self-encrypting drives via KMIP) Data Centers Databases Data Transfer 4 Gemalto Enterprise & Cybersecurity CONFIDENTIAL File encryption 26/03/2019 400+ Authentication Integrations 400+ HSM Integrations 35+ Crypto Integrations 30+ KeySecure Integrations 5 Gemalto Enterprise & Cybersecurity CONFIDENTIAL 26/03/2019 400+ +300Authentication IntegrationsHSM Integrations 400+ HSM Integrations 35+ Crypto Integrations 30+ KeySecure Integrations 6 Gemalto Enterprise & Cybersecurity CONFIDENTIAL 26/03/2019 400+ +300Authentication IntegrationsHSM Integrations 400+ HSM Integrations 35+ Crypto Integrations 30+ KeySecure Integrations 7 Gemalto Enterprise & Cybersecurity CONFIDENTIAL 26/03/2019 400+ Authentication Integrations 400+ HSM Integrations 35+ Crypto Integrations 30+ KeySecure Integrations 8 Gemalto Enterprise & Cybersecurity CONFIDENTIAL 26/03/2019 HSM, a Root of Trust for PKI 30+ years of experience Highest performance on the market FIPS, CC & PCI-HSM Security Certifications Multiple Enterprise features Integrations (F5 and other use-cases) Remote Management (with 2FA) Single client Remote Backup Secure Audit top class HA Custom code (inside FW) Fastest HSM on the market Gemalto PKI Solution Management VSEC – Card Management Middleware SafeNet Authentication Client SafeNet Minidriver SafeNet eToken 5110 SafeNet eToken 5300 PKI Tokens Authenticators IDPrime MD 830/831* IDPrime MD 3840 IDPrime MD 840/841* IDPrime PIV 2.0 PKI Smart Cards IDPrime MD 3810/3811 IDPrime MD 940 Smart Card Readers IDBridge CT30* IDBridge CT 700 IDBridge CT31 IDBridge K30 IDBridge CT40 IDBridge K50 HSM SafeNet Luna HSM 7 Root of Trust SafeNet Trusted Access Network Legacy Cloud IT logon Web VDI Orchestration / Business Logic Policy Management Risk Assessment Geo fencing SSO Session Management AUTHENTICATION DEVICES CONTEXT Windows OTP Push Password Kerberos FIDO 3rd Party PKI Hello F5 NETWORKS AND GEMALTO Securing Application Delivery with Encryption and Authentication Getting the Most from Your Investment Next- Gen Next-Gen Malware Secure Web UX Firewall IPS Protection Gateway Monitoring Other… BIG-IP Platform Apps User STRATEGIC POINT OF CONTROL FOR POLICY ENFORCEMENT SSL Proxies: Protection Through Visibility and Control SSL proxies, like F5 Networks BIG-IP Load Balancer, protect network traffic and the remote delivery of enterprise applications. TraFFic can be decrypted for inspection and classification, and tied to a specific user. This makes the SSL proxy the trusted authority For all SSL communications related to the enterprise. Encrypted Decrypted Encrypted ID:User123 IP: 01.05.04.6 www.google.com Risk Level: Low Filename: corpstuff.zip © Gemalto ConFidential and Proprietary SSL Handshake SSL begins with an exchange of Client Server public keys that will in turn be used Acceptable to encrypt a symmetric key that can Algorithms + Random Number only be decrypted by the other Strongest Algorithm + Random Number + party’s private key. Digital Certificate Validate certificate + Pre-master key Decrypt pre-master This “handshake” is used to pass made with Public key with private key the symmetric encryption key that is Key used to encrypt the data and Create Master Secret Create Master Secret Key Key communications between the two parties. Compare and Compare and Approve HMAC Approve HMAC © Gemalto Confidential and Proprietary Vulnerability: Stolen Private Keys and Certificates An adversary who has stolen a SSL private key can masquerade as that server and proceed with the rest of the handshake. Adversaries could also establish a rogue website or web application using the valid key holder’s identity. © Gemalto Confidential and Proprietary 16 Long cooperation history with SafeNet HSM‘s 17 Title 26.03.19 A complete solution from front to back… SSL SSL Enterprise Applications A complete solution from front to back… SSL Keys are stored in a SafeNet Network Attached HSM SSL SSL Enterprise Applications A complete solution from front to back… SSL Keys are stored in a SafeNet Network Attached HSM SSL SSL Enterprise Applications SafeNet Authentication validates user identities Gemalto or not to Gemalto Should you add Gemalto Authentication and HSM solutions to your F5 ecosystem? 21 Title 26.03.19 Security by Default Security as a choice Gemalto and F5 Strong Authentication with SafeNet Authentication Service & SafeNet Trusted Access and FIPS 140-2 Level 3 SSL Key Storage with the fastest HSM on the market, SafeNet Luna SA7 23 QUESTION TIME What is the name of the world‘s fastest HSM used for SSL security and 399+ other use-cases? 24 Title 26.03.19 World‘s fastest HSM? 14 SafeNet Authentication Service 7 SafeNet Luna HSM 69 SafeNet DataProtection on Demand 25 Title 26.03.19 26 26.03.19 Thank You.