Seminar Program Guide
Total Page：16
File Type：pdf, Size：1020Kb
TRUSTED COMPUTING: BILLIONS OF SECURE ENDPOINTS IN 10 YEARS RSA® CONFERENCE 2013 10:00AM Welcome and Opening Remarks 10:05AM Keynote Session: Top 10 Priorities in IT SEMINAR AGENDA Security for the County of Los Angeles and the Importance of Industry Standards 10:30AM Panel Session: Advanced Persistent Threats and NIST SP 800-147 and NIST SP 800-155 11:15AM Networking Break and Demonstration Showcase 11:30AM Panel Session: Network Security, Critical Infrastructure and BYOD 12:15PM Lunch and Demonstration Showcase 1:00PM Panel Session: Protecting Content from Unauthorized Access 1:45PM Closing Remarks and Raffle Drawing 1:55PM Networking Break and Demonstration Showcase Securing Mobility TRUSTED COMPUTING: DEMONSTRATION SHOWCASE Absolute Software specializes in endpoint security, providing organizations with the ability to track, manage and secure devices regardless of user and location. Absolute Secure Drive allows organizations to control all of the OPAL SEDs in their deployment. IT administrators can use a central administration console to remotely configure SEDs by device – administering users, authentication methods, policies, and system maintenance through to end-of-life. Absolute Computrace provides a cloud-based console for IT administrators to remotely track and secure IT assets. Computrace persistence technology provides a consistent connection with each device so that IT can enforce compliance policies, identify computers that might be at risk, and take preemptive and reactive measures if a security incident occurs. Computrace includes Investigations and Recovery services for forensic intelligence relating to non-compliant or criminal activities. Absolute Manage delivers authentic cross-platform IT asset management capabilities for PC, Mac, iOS, Android, and Windows Phone devices, all from a single console. Absolute Software is recognized as a Visionary Vendor by Gartner in the Client Management Tools Magic Quadran Practical Network Segmentation for Security for Dynamic and Manageable Industrial Control Ad-Hoc Networks Systems Security Mobile ad-hoc networks (MANETs) security faces various Industrial Control Systems devices often make poor challenges different from other types of networks. Even in network citizens due to the lack of modern network security mobile networks the core infrastructure with all main nodes is capabilities and poor integration with enterprise network static and only devices are mobile. In contrast, MANETs have configurations (lack of DHCP, non-standard protocols, etc.). no static core and all devices also take on the role of network There is a need to isolate the connectivity for these systems nodes. Therefore, nodes can join the network without yet allow them to leverage common network infrastructure. interaction with any central control entity and MANETs are Simplifying the full lifecycle management of multiple subject to special attack vectors on several levels of the independent private isolated networks is a primary concern network infrastructure. for enterprises with distributed ICS systems, including critical infrastructure. The SimpleConnect product line by The presented approach uses TPM-based attestation for Asguard Networks provides such a capability. SimpleConnect mutual checks between network nodes. The status and also implements the IF-MAP Metadata for Industrial Control the identity of a node can be verified via remote attestation Systems Security specification, using IF-MAP 2.0 clients, whenever the node joins the network and then in regular to bring a new level of security automation to private intervals. Failure of attestation results in removing the link connectivity. Juniper Networks MAG Series Junos Pulse between the two nodes. Thus, links to a manipulated node Gateway running Junos Pulse Access Control Service acts as will one by one be removed and similar to an immunological the Metadata Access Point (MAP) Server, which provides a reaction the node will finally be removed from the network. centralized coordination service for the SimpleConnect The approach has been implemented using a secure version MAP Clients. of the B.A.T.M.A.N. routing protocol for MANETs. TPM- based attestation is integrated into the exchange of routing information in the B.A.T.M.A.N. protocol. The prototype shows that the integration of TPM-based attestation in MANET infrastructure can efficiently be done. Further, in the running prototype the status of the network and the security associations are visualized as meta-data graph, using the IF-MAP TCG standard for meta-data access and the open-source IF-MAP server irond developed by University of Applied Science Hannover. The visualization nicely shows how infected nodes are excluded from the network link by link. • The Juniper Networks Junos Pulse Gateway, the policy management server at the heart of Juniper’s Junos Pulse Access Control Service, acts as a TNC Policy Decision Plugging the Leaks: Security Automation Point (PDP), providing user authentication and endpoint health checking, and provisioning policy to the network Enterprise and Government environments require a high devices acting as Policy Enforcement Points (PEPs). degree of control over user access to critical applications and information resources. Integration of traditional network • The Infoblox Orchestration Server provides a highly access control (NAC) with other security technologies, such secure and scalable Metadata Access Point (MAP) Server as network leak discovery, can ensure protection of not only that acts as an active, real-time repository and distribution the network itself, but of the data the network contains and point for information to and from IF-MAP enabled devices transports. and systems. The problem of unauthorized, rogue, and insecure connections The TNC IF-MAP interface enables integration of between the enterprise and the Internet continues to plague network intelligence from additional security systems to network and security managers. These “backdoors” provide a add a behavioral consideration to the access decision. method by which the transport of critical data can circumvent security controls and “escape” the network. They also provide a method for outside entities to gain access to networks and their sensitive data. This demonstration presents the automated enforcement Physical/Access Control Integration of a network policy. Through the discovery of rogue or through IF-MAP unauthorized network connections and the dynamic change of access privileges, attendees will see how TNC technologies The Hirsch Identive Velocity™ physical security management can help protect the enterprise from these “backdoors”. system publishes physical access control events to an IF-MAP metadata server. IF-MAP compliant systems may subscribe TNC interfaces underlie this integration of network leak to these events and use a person’s physical presence in a prevention and network access control: building or area as a factor in that systems’ operation. The initial use case is network access control, in which presence • Lumeta IPsonar acts as a TNC Metadata Access Point in a defined area becomes one factor the NAC system uses to (MAP) Client, detecting network leaks and publishing grant or deny access to network resources. Since we publish that information to the TNC MAP Server; other network these events in accordance with IF-MAP standards, any IF- devices can use that information to prevent unauthorized MAP compliant device or system may subscribe to our events “backdoor” Internet connections that bypass network and transactions. access controls. devices can use that information to apply appropriate resource and network access controls. Data Protection in a BYOD World: Security • The Microsoft SharePoint server acts as a resource Automation provider, consuming SAML information and providing Organizations are increasingly seeing staff using their appropriate access to resources. laptops, smartphones, and tablets in the office, at home, • The Juniper Networks Junos Pulse Gateway, the policy and on the road. The traditional desktop is no longer at the management server at the heart of Juniper’s Junos Pulse center of the end-user’s universe. With the trend toward Access Control Service, acts as a TNC Policy Decision Point employees bringing their own devices to work and accessing (PDP), consuming the user session information from the corporate resources, data protection in a BYOD world means MAP Server, and provisioning policy to the network devices organizations must manage access to corporate networks to acting as Policy Enforcement Points (PEPs). minimize risk to the organization while maximizing value to employees, contractors, and even guests. The TNC IF-MAP interface enables integration of network intelligence among disparate security systems to enable The problem of an organization’s data residing on unmanaged automated enforcement of enterprise security policies. or less-trusted devices presents a set of risks, both in terms of data protection as well as for compliance with business, regulatory, and audit policies. In order to make the trust decisions that provide users access to corporate resources needed to get their jobs done, IT must find simple, low-impact ways to gather required information about these devices. This demonstration presents a multi-layered approach to creating a profile of an unmanaged device that a user brings to the corporate network. Through the use of TNC standards- based technology enabling multi-vendor interoperability, this solution presents