BYOD с точки зрения ИБ. Подводные и надводные камни внедрения

Editor's Notes

• #5: BYODWhat if you could solve all these challenges at the same time? What if you could speed innovation by opening the network to customers and partners….WHILE lowering IT cost and complexity?What if you could let employees have greater freedom and choice… WHILE protecting your intellectual property.And what if your employees could work their way… without compromising the way your business works?
• #6: Now that we have the high-level vision out there, let’s pivot back to the specific customer issue.Many customers are looking to solve the BYOD problem: i.e. “I need to allow iPads on my network”. This is a genuine customer concern, but may be a bit too narrow of a way to look at the problem. Connectivity is only the first part of the overall solution.Use the statements below the line to start customer conversations – Ask open ended questions too. There may be other specific customer uses-cases or concerns not listed here.The goal of this slide is to persuade the customer that a more strategic, broad based approach should prove more effective in the long term, rather than a band-aid approach that solves for only one portion of the overall problem.
• #11: 20 кратный рост вредоносного ПО на моб. Источники – каталоги приложений,мобильный веб-серфинг.Усугубляется – отсутствие обновлений и антивирусов 20% - быстрый заработок платные смс, спам .Воровство конфиденциальных и персональных данных, многофункциональные трояны
• #16: Policy is construct to tackle this problemBYOD multiple components – have to bring a broader policy solution set to cover this market to differentiateWhat’s going on in the market (Aruba buying Avenda would be a last decade solution) – hodge-podgeStitch it in a common domain – NAC framework orig vision – ubiquitous way for common policy centralized, distributed deployment
• #38: Another key to making the experience seamless is by ensuring that the scanning elements are distributed throughout the network and not just at HQ—pressing out to the capillaries of the network through ISR integration; as well as in the cloud.The recent ScanSafe acquisition accelerates Cisco’s ability to deliver security services in the cloud. Over time, Cisco is planning to build a hybrid hosted model in which users will be able to attach to either a company-owned head-end or a cloud enforcement point—whichever provides the best user experience—while getting consistent policy enforcement and security.In the interim, customers have the choice of on-prem or cloud enforcement for their mobile users. For the cloud-based solution, the Anywhere+ client will re-direct web traffic to the Cisco-ScanSafe cloud for scanning and enforcement. In the near future, this client will converge with the AnyConnect client for a unified client footprint.Alternatively, customers can use the AnyConnect Secure Mobility client to connect to on-premise equipment for security. We’ll dig into this solution in more detail on the next slide.
• #66: Business BenefitsScalable and Consistent Policy Enforcement- Highly scalable segmentation through context-aware network devices- Centralized distribution of policy controlsConsistent enforcement across wired, wireless, physical and virtualIncreased Business Agility- Reduced Interlock between server, network and security administration- Resource moves can be handled automaticallyReduced Operational Expense- Reduction in access control entries- Keep existing logical designs- Simplified audits of firewall and datacenter policies
• #72: Business BenefitsScalable and Consistent Policy Enforcement- Highly scalable segmentation through context-aware network devices- Centralized distribution of policy controlsConsistent enforcement across wired, wireless, physical and virtualIncreased Business Agility- Reduced Interlock between server, network and security administration- Resource moves can be handled automaticallyReduced Operational Expense- Reduction in access control entries- Keep existing logical designs- Simplified audits of firewall and datacenter policies
• #75: Cisco’s Resiliency Framework is a methodology for prioritizing IT Services and Applications for fail-over / recovery purposes.This framework is defined by 5 Criticality Levels – each describing the impact to the business when a service or application is not behaving as expected.In essence the criticality matrix consists of 5 tiers, starting with the most important or “mission imperative”, C1 business processes all the way down to non-mission critical “business adminstrative” C5 business processes. C1, C2 and C3 all have varying levels of revenue, brand and/or customer satisfaction impact, while C4 and C5 typically do not impact revenue, brand or customer satisfaction.The appropriate criticalities are assigned to each business process by the process owner(s) via a Business Impact Analysis (BIA). In addition to identifying the criticality of the business process, the BIA also lists the process dependencies, which include IT services or applications.
• #81: Basic Business Policies: 1) Guest Access 2) restricted access based on user, device, or location (i.e. provide a subset of access, relative what the user would have access to from a corporate-managed device)Basic, Enhanced What are the salient points for WAN… how does WAN infrastructure apply to BYOD? (Routing features, video optimization, Application performance????)
• #82: Technologies802.1X, ProfilingSolution ComponentsCisco Switches + WLCsISENCS PrimeCisco How (or Why) we implement or why we are better…High-performance 802.11n WLAN solutions by Cisco provide a foundation for enabling collaboration and deploying business-transformative applications that can’t be matched by pure-play vendors or other integrated network solution vendors.Cisco switches offer differentiated features such as monitor mode, FlexAuth and Security Group Access (SGA) enabling IT to enforce the business policy requirements for a secure BYOD deploymentCisco Identity Services Engine (ISE) is a next-generation identity and access control policy platform that enables enterprises to enforce compliance, enhance infrastructure security, and streamline their service operations. A first-of-its-kind platform, Cisco Prime NCS is the only solution to deliver comprehensive visibility to wired, wireless, and policy metrics in a single, unified view, providing faster troubleshooting and more efficient network operations. This unified view is critical for any BYOD deployment as more devices are introduced to the network at an increasing rate. It also provides complete visibility into endpoint connectivity, regardless of device, network, or location.
• #84: Technologies802.1X, ProfilingSolution ComponentsCisco Switches + WLCsISENCS PrimeCisco How (or Why) we implement or why we are better…High-performance 802.11n WLAN solutions by Cisco provide a foundation for enabling collaboration and deploying business-transformative applications that can’t be matched by pure-play vendors or other integrated network solution vendors.Cisco switches offer differentiated features such as monitor mode, FlexAuth and Security Group Access (SGA) enabling IT to enforce the business policy requirements for a secure BYOD deploymentCisco Identity Services Engine (ISE) is a next-generation identity and access control policy platform that enables enterprises to enforce compliance, enhance infrastructure security, and streamline their service operations. A first-of-its-kind platform, Cisco Prime NCS is the only solution to deliver comprehensive visibility to wired, wireless, and policy metrics in a single, unified view, providing faster troubleshooting and more efficient network operations. This unified view is critical for any BYOD deployment as more devices are introduced to the network at an increasing rate. It also provides complete visibility into endpoint connectivity, regardless of device, network, or location.
• #86: The key component of the TrustSec architecture is ISE. It converges NAC and ACS functionality from AAA functions to security services like guest, profiling and posture into one appliance, making the choice of deploying either a “overlay mode” or “infrastructure integrated mode” a lot simpler for customers.Current NAC and ACS hardware platform is software upgradeable to ISELicense migration program for all software licensesData and Configurations migration tools available*
• #87: Technologies802.1X, ProfilingSolution ComponentsCisco Switches + WLCsISENCS PrimeCisco How (or Why) we implement or why we are better…High-performance 802.11n WLAN solutions by Cisco provide a foundation for enabling collaboration and deploying business-transformative applications that can’t be matched by pure-play vendors or other integrated network solution vendors.Cisco switches offer differentiated features such as monitor mode, FlexAuth and Security Group Access (SGA) enabling IT to enforce the business policy requirements for a secure BYOD deploymentCisco Identity Services Engine (ISE) is a next-generation identity and access control policy platform that enables enterprises to enforce compliance, enhance infrastructure security, and streamline their service operations. A first-of-its-kind platform, Cisco Prime NCS is the only solution to deliver comprehensive visibility to wired, wireless, and policy metrics in a single, unified view, providing faster troubleshooting and more efficient network operations. This unified view is critical for any BYOD deployment as more devices are introduced to the network at an increasing rate. It also provides complete visibility into endpoint connectivity, regardless of device, network, or location.
• #88: Cisco’s Secure BYOD offers a complementary solution to the MDM vendors.MDM deliver a great set of functionalities for smartphones and tablets only. They can: Do a device inventory Provision & de-provision devices Deliver data security Deliver device application security Cost management And enable full or selective wipeOne of the key element to know is that MDM solutions take full control of an employees owned to device to put it under managementCisco’s solution are complementary as they bring additional functionalities such as : User and device authentication, posture assessment, policy enforcement, contact aware controls with ISE Advanced web security and threat device with WSA and ScanSafe Secure Remote access with AnyConnectThe major difference is that we will address all kind of devices from printer, fax machines, laptops, smartphones, tablets…As you can see, Cisco Secure BYOD and MDM solutions are complementary and we are working on integration between the major MDM vendors and ISE to complete our storyTransition: Let’s now, put all the pieces together in a simple network diagram to show an example of how this blocks could be implemented
• #89: Building layers to support All the Devices. Taking an architectural approach. Not building out Point solutions.
• #99: Cisco’s industry-leading portfolio of wireless, switching, routing, and security products delivers comprehensive policy enforcement capabilities Cisco provides a comprehensive BYOD solution architecture, combining elements across the network for a unified approach to secure device access, visibility, and policy control. To solve the many challenges described earlier, a BYOD implementation is not a single product, but must be integrated into the intelligent network.