自防御网络和可信网络

1 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 自防御网络和可信网络 思科系统（中国）网络技术有限公司 2006 2 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 议程 聚焦安全 思科的安全承诺 3 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential RSA Conference 2006 概况 2月 14日 18日，在美国旧金山举行 2006 RSA大会 2006年的 RSA会议规模空前，大约有 14000名安全领域专业人士参加了这一盛会，比 2004年增长了约 30 全球 275家安全领域的领先厂商，包括思科、微软、 IBM、SUN、 HP、赛门铁克、 CA等主流大型 IT厂商 200多场分会议 安全领域的分工非常之细，一些公司专攻一项安全技术 多位引领 IT发展的超重量级人物出席 覆盖的安全技术： applied security, compliance, government and policy, hackers and threats, identity management and wireless security 4 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential RSA Conference 2006 Keynote Speech John Chambers, president and CEO, Cisco Systems, Inc. Bill Gates, chairman and chief software architect, Microsoft Corp. Scott McNealy, chairman and CEO, Sun Microsystems, Inc. John Thompson, chairman and CEO, Symantec, and Art Coviello, CEO and president, RSA Security Inc. . 5 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential RSA Conference 2006 主旋律 开放的安全架构 “应用安全”唱主角 安全技术并购行为，小公司为被收购做准备 大公司强力进军安全 信息安全，这一几年前还略显边缘的 IT技术，正变得越来越主流 网络安全从 2003年的第 12位，跃升为 2004年的第一名，超越了“降低成本”项目 6 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 对安全标准的思考 TCG模式： 设备身份 Intel Pentium III CPU 标识符 (1999) 设备与用户身份的关联涉及消费者隐私 TCPA (1999) TPM 硬件模块与协议 为解决知识产权 (IPR)问题设立 TCG (2003) 设计被内部采纳后再公开方案细则 （会员优先） 缴费会员制度 , 开源界表示担忧 重新定向于支持 DRM (与微软的 Palladium 结合 ) IETF模式 7 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 来自 VeriSign公司的信息 眼下安全行业应当一改专利性方案，转而接受开放式、能够协同工作的验证标准 VeriSign - 开放式验证参考体系结构（ OATH）：为验证提供了一个参考体系结构，所用的通用密钥能够为应用程序、多个设备以及内外网络所识别 8 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 来自 SUN公司的信息 开放的架构和共享代码 Sun 的开放架构 从 Java到开放源代码 Solaris 10，能够很好地解决安全问题 9 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 来自 Cisco的信息 标准是网络安全的必经之路 安全必须是面向整个架构的技术和方案 安全与网络的融合是发展的必然 思科公司的安全战略 自防御网络（ Self-Defending Network）进入了新阶段 ATD（自适应威胁防御） 应用安全 智能控制 反间谍软件和反广告软件 重视网络的 4 7层的应用安全上 2004年全球网络安全市场的规模达到了 41亿美元，其中思科公司占据了近 30的市场份额，牢牢占据了第一的位置。 10 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 安全需要开放标准 网络开放标准是为能互相协作而制定的 广泛参与性（公司，政府，开源界，个人） 开放标准参与者在用户功能与通用功能之间权衡 多种重叠标准会制造困难 与互相协作冲突 长远来讲维护分立市场需付出更高代价 11 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 议程 2006 RSA Conference 聚焦安全 思科的安全承诺 安全无忧 12 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential Business Processes Applications and Services Networked Infrastructure Active participation in application and service delivery A systems approach integrates technology layers to reduce complexity Flexible policy controls adapt this intelligent system to your business though business rules 智能化信息网络支撑网络安全 Connectivity Intelligent Networking Utilize the network to unite isolated layers and domains to enable business processes Cisco Network Strategy Resilient Integrated Adaptive 14 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 自防御网络对安全的承诺 利用网络发现、防范和消除威胁 整个网络中的服务和设备通过协作制止威胁 协作 让每个组件都成为一个防御和策略实施点 集成 可以自动防范威胁的 主动安全技术 适应 15 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential VPN Concentrator Cisco Firewall IPS Cisco ASA 行业领先的安全技术 最丰富的安全防护技术 Cisco IOS VPN 行业领先的网络技术 20多年 Routing & Switching 专业经验 Cisco ISR Cisco Catalyst 集成安全 基础设施安全 Protect the network infrastructure from attacks Control Plane Policing, NBAR, AutoSecure Leverage the network to intelligently protect Endpoints NAC, 802.1x Secure and scalable network connectivity Secure Voice (sRTP, V3PN), DMVPN, MPLS & IPSec Prevent and respond to network attacks and threats such as worms Intrusion Prevention, Netflow, App Firewall, OPS Securing the IP Fabric with Integrated Security 16 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 协作安全 安全超越单一边界 几乎所有设备都是 Multi-homed 网络真正的起止点在那里？ 许多设备不由企业控制，但公司需要给咨询顾问或客人等等提供上网权利 怎样为某一特定边界提供保护？ 怎样符合法规？ Multi-Homed Mobile Devices Peer-2-Peer 802.11 VoIP Content 17 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 思科 NAC网络准入控制架构 Cisco Clean Access AUTHENTICATION POLICY ENFORCEMENT DISCOVERY REMEDIATION Clean Access Agent The best technological approach for Enterprise Begin Long-Term Enterprise Solution with integrated product and services CCA on top of NAC framework provides future proofing The best turnkey appliance product for all vericals Address immediate pain-points with CCA 1 2 3 NAC Framework REMEDIATION (VENDOR) Cisco Trust Agent AUTHENTICATION POLICY DISCOVERY AAA (ACS) POLICY ENFORCEMENT NAC Convergence = Future Proof 18 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential ANTI VIRUS CLIENT SECURITY 安全需要合作 -思科与业界的合作 AUDIT REMEDIATION 19 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential MAC IP TCP Application Protocol Payload SECURED UN-SECURED 思科网络安全的下一个重点 -应用安全 Policy match must include major application protocol and payload data: HTTP, SIP, Email, FTP, DNS Full complement of security services at the application protocol and payload level: encryption, logging, intrusion prevention, access control, rewrite, QoS Result: Security services once only available through software coding are now core network services SECURED 20 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 思科的 “Anti-X” 技术 -Multi-Vector Attack Mitigation Heuristicstatistically based algorithms to rate limit alarms produced by sensing engine Anomalytraffic and protocol anomaly detection to complement signature based analysis Policytraffic filtering based on security policy Exploit-specific protection from unknown threats and quickly mutating viruses Vulnerability encoding signatures to the underlying vulnerability for day-zero protection Multiple techniques utilized to block broad classes of attacks Fast Signature extraction Viruses/Worms Anti-Spam DoS/DDoS Spyware/Adware Trojans/Backdoors Bots/Zombies P2P/IM Abuse Port 80 Misuse Anti-X 21 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 自适应安全 Cisco ASA 提供全面的安全保护 THREAT TYPES PROTECTION Viruses Spyware Malware Phishing Spam Inappropriate URLs Identity Theft Offensive Content Unauthorized Access Intrusions & Attacks Insecure Comms. NEW Anti-X Service Extensions Resource & Information Access Protection Hacker Protection Client Protection DDoS Protection Protected Email Communication Protected Web Browsing Protected File Exchange Unwanted Visitor Control Audit & Regulatory Assistance Non-work Related Web Sites Identity Protection Granular Policy Controls Comprehensive Malware Protection Advanced Content Filtering Integrated Message Security Easy to Use ASA 5500 with CSC-SSM 22 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 思科安全管理体系 Integration to Cisco Secure Access Control Server Role Based access control Privileged based access to management functionality With the Context of Auditing Services Cisco Security Mars Rapid Threat Identification and Mitigation Topology Awareness Data Correlation Simplified Policy Administration End-to-End Configuration Network wide or Device Specific Cisco Security Manager FABRIC 23 2006 Cisco Sy stems, Inc. All rights reserv ed. 205524.A Cisco Confidential 思科 MARS安全分析、监控与响应中心 多厂商 Powerful monitoring, analysis, response system Multivendor support Correlate events from m