Software-Defined Secure Networks in Action Nguyễn Tiến Đức ASEAN Security Specialist

1 2 3 4 AGENDA IoT Malware Software-Defined Secure Networks Software-Defined Secure Networks in Action 4 Sumary

IoT malware

Real world examples of IoT malware/ransomware Thermostat ransomware1 Amazon cameras malware2 Jeep remote control3 http://motherboard.vice.com/read/internet-of-things-ransomware-smart-thermostat http://www.securityweek.com/malware-found-iot-cameras-sold-amazon https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/

Software-Defined Secure Networks

Software Defined Secure Networks Policy, Detection, and Enforcement Unified and Responsive Leverage entire network and ecosystem for threat intelligence and detection Automated Malware Defense Dynamic, Adaptive Policy Orchestration Threat Intelligence DETECTION POLICY ENFORCEMENT Utilize any element of the network as an enforcement point Dynamically execute policy across all network components including third party devices DETECTION ENFORCEMENT

Software Defined Secure Networks (SDSN) Unified Security Platform DETECTION Third Party Threat Intel Juniper Security Cloud Detection Spotlight Secure Threat Intelligence Sky Advanced Threat Prevention (ATP) Fast, effective protection from advanced threats Integrated threat intelligence Policy POLICY Security Director + Policy Enforcer Policy Enforcement, Visibility, Automation Intelligent enforcement to firewalls, switches, third party devices and routers Robust visibility and management DETECTION SRX Physical Firewall vSRX Virtual Firewall Enforcement ENFORCEMENT Third Party Elements* Consistent protection across physical/virtual Open and programmable environment EX & QFX Switches MX Routers* *Roadmap Network as a single enforcement domain - Every element is a policy enforcement point

The ATP verdict chain Staged analysis: combining rapid response and deep analysis Suspect file Suspect files enter the analysis chain in the cloud Cache lookup: (~1 second) Files we’ve seen before are identified and a verdict immediately goes back to SRX 1 Anti-virus scanning: (~5 second) Multiple AV engines to return a verdict, which is then cached for future reference 2 3 Static analysis: (~30 second) The static analysis engine does a deeper inspection, with the verdict again cached for future reference Dynamic analysis: (~7 minutes) Dynamic analysis in a custom sandbox leverages deception and provocation techniques to identify evasive malware 4

Security Director Policy Enforcer Infected Endpoint Scenario Enables remediation via Policy Enforcer workflows in Security Director Delivers micro security services to switches such as EX, QFX Updates enforcement criteria automatically with new threat data Tracks infected host/endpoint movement from site to site via MAC address vs IP address Sky ATP detects malware; renders verdict 2 Threat Intel Sky ATP 3 Enforcement policy rendered vSRX Firewall 4 Policy Enforcer Security Director Switch 4 Enforcement policy automatically deployed Malware enters 1 5 Infected endpoint quarantined

Software-Defined Secure Networks in Action

SDSN isolates infected host State-full filter on Firewall + Access list on the Switch port Threat Intel Sky ATP Infected host = 192168.10.225 Firewall Firewall Switch Switch 192.168.10.225

Client is no longer able to browse the internet or local network Within minutes the client is isolated from the network preventing proliferation of the malware

SDSN tracks host and enforces Threat Intel Sky ATP Infected host = 192168.10.225 Firewall Firewall Switch Switch 192.168.10.225 192.168.10.225

The Right Policy for the Right Job Different threat levels need different policies Anomalous lightbulb? Quarantine and create new policy for appropriate behavior Compromised core switch? Neutralize the threat and shut down the tunnel vs. killing the switch Software Defined Secure Networks (SDSN) Policy Orchestration + Enforcement Shut down light bulb OR Kill illegitimate tunnel

Summary

Thank you