Medium Enterprise Design Profile (MEDP)—Network Security Design
Total Page:16
File Type:pdf, Size:1020Kb
Medium Enterprise Design Profile (MEDP)—Network Security Design Security Design Protecting the infrastructure and its services requires implementation of security controls capable of mitigating both well-known and new forms of threats. Common threats to As medium enterprises embrace new communication and collaboration tools, transitioning to more Internet-based, media-rich applications, a whole new set of network enterprise environments include the following: security challenges arise. Medium enterprise network infrastructures must be adequately • Service disruption—Disruption to the infrastructure, applications, and other business secured to protect employees from harmful content, to guarantee confidentiality of resources caused by botnets, worms, malware, adware, spyware, viruses, private data, and to ensure the availability and integrity of the systems and data. Providing denial-of-service (DoS) attacks, and Layer 2 attacks a safe and secure network environment is a top responsibility for enterprise • Network abuse—Use of non-approved applications by employees, peer-to-peer file administrators. sharing and instant messaging abuse, and access to non-business related content This chapter describes how the Medium Enterprise Design Profile sets the foundation for • Unauthorized access—Intrusions, unauthorized users, escalation of privileges, IP safe and secure enterprise networks by leveraging the proven design and deployment spoofing, and unauthorized access to restricted resources guidelines of the Cisco SAFE Security Architecture. The Medium Enterprise Design • Data loss—Loss or leakage of private data from servers and endpoints while in transit Profile is a well-designed and validated network reference design that enables medium or as a result of spyware, malware, key-loggers, viruses, and so on enterprises to deliver all of the services required for an enhanced business environment. • Identity theft and fraud—Theft of personal identity or fraud on servers and end users Within the Cisco Medium Enterprise Design Profile, the service fabric network provides through phishing and E-mail spam the foundation on which all solutions and services are built to solve the business challenges facing medium enterprises. These business challenges include borderless The Medium Enterprise Design Profile accommodates a main site and one or more access, secure mobile workforce, operational efficiencies, and user experience. remote sites of various sizes, interconnected over a metro Ethernet or managed WAN service. Each of these sites may contain one or more buildings of varying sizes, as shown The network fabric consists of four distinct components: LAN/WAN, security, mobility, and in Figure 2. unified communications, as shown in Figure 1. Figure 1 Service Fabric Design Model Service Fabric Design Model Unified Mobility Security Communications Local Area Wide Area Network (LAN) Network (WAN) 228538 The Medium Enterprise Design Profile includes security to protect the infrastructure and its services to provide a safe and secure online business environment. This design profile leverages the proven design and deployment guidelines of the Cisco SAFE Security Reference Architecture to secure the service fabric by deploying security technologies throughout the entire network solution to protect employees from harmful non-business content, to guarantee the confidentiality of the enterprise and employees private data, and to ensure the availability and integrity of the systems and data. Medium Enterprise Design Profile (MEDP)—Network Security Design Figure 2 Medium Enterprise Design Profile Network Overview Large Building Medium Building Small Building Extra Small Building Services Block Data Center Internet QFP QFP Main Site Edge WAN PSTN Internet Services Services Block Block Services Block Data Data Center Center Data Center Remote Small Site Large Building Medium Building Small Building Medium Building Small Building Remote Large Site Remote Medium Site 229404 Medium Enterprise Design Profile (MEDP)—Network Security Design Operating on top of this network are all the services used within the enterprise The security design uses a defense-in-depth approach where multiple layers of security environment, such as safety and security systems, voice communications, business protection are integrated into the architecture. Various security products and databases, ordering systems, payroll, accounting and customer relationship management technologies are combined to provide enhanced security visibility and control, as shown (CRM) applications, and so on. The core of these services are deployed and managed at in Figure 3. the main site, allowing the enterprise to reduce the need for separate services to be operated and maintained at various remote locations. These centralized systems and applications are served by a data center at the main site. Figure 3 Medium Enterprise Design Profile Network Security Design Overview Main Large Site Large Building Medium Building Small Building Extra Small Building IP IP IP IP Secure Service Block Mobility Wireless LAN NAC QFP Internet WAE Controller Server Data Center www SensorBase Cisco Security V Web Intelligence M Security Operation SRST/Video Cisco ACS NAC Video Surveillance Email Web Cisco Security Email UCM Gateway Appliance Manager Media Server Core QFP Server Server Internet Edge MetroE HDLC Service Block Core Core Service Block Small Data Center Small Data Center Service Block Serverfarm IP IP IP IP IP IP Large Building Medium Building Small Building Medium Building Small Building Small Building Remote Large Site Remote Medium Site Remote Small Site 229405 The following security elements may be included in the Medium Enterprise Security • Internet access—E-mail and web security, stateful firewall inspection, intrusion design as shown in Figure 3: prevention and global correlation, and granular Internet access control • Endpoint security—Desktop and server endpoint protection for day-zero attack • Cisco Video Surveillance—Monitor activities throughout the enterprise environment protection, data loss prevention, and signature-based antivirus to prevent and deter safety incidents • Network foundation protection (NFP)—Device hardening, control plane, and • Enhanced availability and resiliency—Hardened devices and high availability design management plane protection throughout the entire infrastructure to maximize to ensure optimal service availability, and system and interface-based redundancy availability and resiliency • Unified communications—Security and emergency services, enhanced 911 • Catalyst Integrated Security Features—Access layer protection provided by port support, conferencing and collaboration for planning and emergency response security, Dynamic ARP inspection, IP Source Guard, and DHCP Snooping • Network access control—Authentication and policy enforcement via Cisco • Threat detection and mitigation—Intrusion prevention and infrastructure based Identity-Based Networking Services (IBNS), and role-based access control and network telemetry to identify and mitigate threats device security compliance via Cisco Network Admission Control (NAC) Appliance Medium Enterprise Design Profile (MEDP)—Network Security Design • Secure mobility – Making sure systems comply with corporate policies and have up-to-date – Always-on VPN protection for PC-based and smartphone mobile users security – Persistent and consistent policy enforcement independently from user location Together, these key security areas create a defense-in-depth solution for protecting medium enterprises from common security threats such as service disruption, network Enforcement of client firewall policies – abuse, unauthorized access, data loss, and identity theft and fraud. The design guidelines – Optimal gateway selection to ensure best connectivity and best practices for each of the above security focus areas are detailed in the following – Integration with web security and malware threat defense systems deployed at sections. For more detailed information on each of these areas, see the Cisco SAFE the enterprise premises Reference Guide at the following URL: http://www.cisco.com/go/safe. – Consolidated SaaS access control Network Foundation Protection The Medium Enterprise Design Profile recognizes that cost and limited resources may be common limiting factors. Therefore, architecture topologies and platforms are carefully Medium enterprise networks are built with routers, switches, and other infrastructure selected to increase productivity while minimizing the overall cost and operational network devices that keep the applications and services running. These infrastructure complexities. In certain cases, tradeoffs are made to simplify operations and reduce costs devices must be properly hardened and secured to maintain continued operation and where needed. access to these services. The Medium Enterprise Design Profile focuses on the following key areas for securing the To ensure the availability of the medium enterprise network infrastructure, the Medium service fabric within medium enterprises: Enterprise Design Profile leverages the Network Foundation Protection best practices for the following areas: • Network foundation protection (NFP)—Ensuring the availability and integrity of the network infrastructure by protecting the control and management planes to prevent • Infrastructure device access service disruptions network abuse, unauthorized access, and data loss – Restrict management device access to authorized parties and via