©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Комплексные решения безопасности масштаба предприятия. Решения от компании Check.

Slides:

Advertisements

Similar presentations

Stonesoft Roadmap WHAT FEATURES WILL COME IN

Advertisements

© 2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 1 High-performance Gigabit Ethernet ports rapidly transfer large files supporting.

Integration of PAP site 17 th July 10. Requirements of PAP SITE  Bandwidth drop  Router  RJ45 cables  Switch  Gateway  Nodes  Ups  9urack.

Setting Up a Virtual Private Network Chapter 9. Learning Objectives Understand the components and essential operations of virtual private networks (VPNs)

The Cable Guys Inc. Drew Leach Tom McLoughlin Philip Mauldin Bill Smith.

©2005 Check Point Software Technologies Ltd. Proprietary & Confidential Концепция информационной безопасности Check Point Антон Разумов Check Point Software.

Building Your Own Firewall Chapter 10. Learning Objectives List and define the two categories of firewalls Explain why desktop firewalls are used Explain.

IS Network and Telecommunications Risks

1 Version 3.0 Module 8 Virtual LANs. 2 Version 3.0.

INTRANET SECURITY Catherine Alexis CMPT 585 Computer and Data Security Dr Stefan Robila.

1 SharePoint Momentum 17K+ Customers, 100M Licenses Leader in Gartner ® Magic Quadrants, Forrester Wave TM Continued Platform and Application Innovation.

SESSION 9 THE INTERNET AND THE NEW INFORMATION NEW INFORMATIONTECHNOLOGYINFRASTRUCTURE.

Topics 1.Security options and settings 2.Layer 2 vs. Layer 3 connection types 3.Advanced network and routing options 4.Local connections 5.Offline mode.

MIGRATION FROM SCREENOS TO JUNOS based firewall

Network Topology. Cisco 2921 Integrated Services Router Security Embedded hardware-accelerated VPN encryption Secure collaborative communications with.

CISCO CONFIDENTIAL – DO NOT DUPLICATE OR COPY Protecting the Business Network and Resources with CiscoWorks VMS Security Management Software Girish Patel,

ITGS Networks Based on the textbook “Information Technology in a Global Society for the IB Diploma” by Stuart Gray.

Barracuda Networks Steve Scheidegger Commercial Account Manager

©2010 Check Point Software Technologies Ltd. | [Unrestricted] For everyone Endpoint Security Current portfolio and looking forward October 2010.

Course 201 – Administration, Content Inspection and SSL VPN

Partnering For Profitability Growing your business with Microsoft Forefront Security Solutions Mark Hassall Director Security & Access BG Microsoft Corporation.

Copyright © 2004 Juniper Networks, Inc. Proprietary and Confidentialwww.juniper.net 1 IPSec or SSL VPN? Decision Criteria.

©2010 Check Point Software Technologies Ltd. | [Unrestricted] For everyone Что нового появилось после выхода R70 Антон Разумов

©2010 Check Point Software Technologies Ltd. | [Confidential] For Check Point users and approved third parties MORE, BETTER, SIMPLER Security Oded Gonda.

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Новинки Check Point Антон Разумов Check Point Software Technologies.

CS426Fall 2010/Lecture 361 Computer Security CS 426 Lecture 36 Perimeter Defense and Firewalls.

000000_1 Confidential and proprietary information of Ingram Micro Inc. — Do not distribute or duplicate without Ingram Micro's express written permission.

PURE SECURITY Check Point UTM-1 Luděk Hrdina Marketing Manager, Eastern Europe Check Point Software Technologies Kongres bezpečnosti sítí 11. dubna 2007,

Chapter 2 Information Security Overview The Executive Guide to Information Security manual.

Lecture 5 Title: Networks and Businesses

©2010 Check Point Software Technologies Ltd. | [Unrestricted] For everyone Новый VPN клиент – Discovery Антон Разумов Консультант.

CHAPTER 2 PCs on the Internet Suraya Alias. The TCP/IP Suite of Protocols Internet applications – client/server applications The client requested data.

© 2006 Cisco Systems, Inc. All rights reserved.Cisco ConfidentialPresentation_ID 1 Welcome to the Human Network Matt Duke 11/29/06.

Asif Jinnah Microsoft IT – United Kingdom. Security Challenges in an ever changing landscape Evolution of Security Controls: Microsoft’s Secure Anywhere.

OV Copyright © 2013 Logical Operations, Inc. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention.

Repeaters and Hubs Repeaters: simplest type of connectivity devices that regenerate a digital signal Operate in Physical layer Cannot improve or correct.

OV Copyright © 2011 Element K Content LLC. All rights reserved. Network Security  Network Perimeter Security  Intrusion Detection and Prevention.

Safeguarding OECD Information Assets Frédéric CHALLAL Head, Systems Engineering Team OECD.

Network Fundamentals. Network Devices Routers (Layer 3)

Cyberoam - Unified Threat Management Unified Threat Management Cyberoam Copyright 2010 Elitecore Technologies Ltd. All rights reserved.

Network and Perimeter Security Paula Kiernan Senior Consultant Ward Solutions.

How to create DNS rule that allow internal network clients DNS access Right click on Firewall Policy ->New- >Access Rule Right click on Firewall.

© Copyright 2011 Elitecore Technologies Pvt. Ltd. All Rights Reserved. Securing You Centralized Security Management with Cyberoam Central.

Data Security Overview. Data Security Periphery –Firewalls –Web Filtering –Intrusion Detection & Prevention Internal –Virus Protection –Anti Spy-ware.

Switch Features Most enterprise-capable switches have a number of features that make the switch attractive for large organizations. The following is a.

Module 11: Designing Security for Network Perimeters.

Fundamentals of Information Systems, Second Edition 1 Telecommunications, the Internet, Intranets, and Extranets.

Lesson 2a © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—2-1 Firewall Technologies and the Cisco Security Appliance.

IS3220 Information Technology Infrastructure Security

©2013 Check Point Software Technologies Ltd. Small Business. Big Security New SMB Appliances Clinton Cutajar Team Leader – Information Security Computime.

Microsoft TMG End of Life. Who is Barracuda? Barracuda Networks Established: 2003 Headquarter: Campell, CA Employees: Customers: Market:

Juniper Networks Mobile Security Solution Nosipho Masilela COSC 356.

©2004 Check Point Software Technologies Ltd. Proprietary & Confidential Moving Beyond the Perimeter with Intelligent Security Alfredo Cusin Channel Mgr.

Network Security Solution. 2 Security Gateway Switch Network Security Products  Multi-Homing  VPN/Firewall  SPI Firewall  Anti-Virus  Anti-Spam 

KAPLAN SCHOOL OF INFORMATION SYSTEMS AND TECHNOLOGY Intrusion Detection and Incidence Response Course Name – IT Intrusion Detection and Incidence.

Agenda Current Network Limitations New Network Requirements About Enterasys Security Branch Office Routers Overall Enterprise Requirements Proposed Solution.

Barracuda NG Firewall ™

CompTIA Security+ Study Guide (SY0-401)

Network Security Solution

Barracuda Web Security Flex

PCNSE7 Palo Alto Networks Certified Network Security Engineer

Securing the Network Perimeter with ISA 2004

CompTIA Security+ Study Guide (SY0-401)

ISMS Information Security Management System

Check Point Connectra NGX R60

Firewalls Routers, Switches, Hubs VPNs

VPN: Virtual Private Network

AT&T Firewall Battlecard

LM 5. Wireless Network Security

Presentation transcript:

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Комплексные решения безопасности масштаба предприятия. Решения от компании Check Point Антон Разумов Check Point Software Technologies Консультант по безопасности

2 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Компании развиваются 2 Tele- working Application sharing Connecting branch offices ing with outsiders on PDAs Web applications Extranets Instant messaging IP Telephony Mobile workers

3 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. IPS UTM VPN Firewall Развитие интегрированных шлюзов

4 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. IPS UTM VPN Firewall Personal firewall Disk Encryption Anti-Virus VPN Client Защита в едином агенте на конечных точках

5 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. SMART Security Management Architecture Management Compliance Reporting Monitoring IPS Personal firewall UTM Disk Encryption VPNAnti-Virus FirewallVPN Client Единая консоль управления

6 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Perimetrix: Самые популярные средства ИБ Самые популярные средства ИБ

7 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

8 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

9 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

10 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

11 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

12 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

13 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Защита периметра

15 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point Next Generation with Application Intelligence Проверка на соответствие стандартам Проверка на ожидаемое использование протоколов Блокирование злонамеренных данных Контроль над опасными операциями Соответствует ли приложение стандартам? Нет ли двоичных данных в HTTP заголовках Обычное ли использование протокола? Избыточная длина HTTP заголовка или Обход Директорий Вводятся ли опасные данные или команды? Cross Site Scripting или обнаружены сигнатуры атак Не выполняются ли запрещенные команды? FTP команды

16 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Pro-active Protection (ex: 2007)

17 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Механизмы защиты Total Security Intrusion prevention subscription Anti spyware subscription Web application firewall expansion SSL VPN expansion Web Filtering subscription VPN (site-to-site, remote access) standard Antivirus (at the gateway) subscription The best Firewall in the market HTTPFTP Instant Msg P2P VoIPSQL standard * End of Q Messaging security subscription NEW!

18 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Gateway security landscape Point product providersRequirementsPure security Firewall IDS/IPS Messaging Security Remote access Content Security Firewall Vendors VPN Vendors IDS/IPS Vendors Msg Sec Vendors Content Vendors Market leading firewall with Application Intelligence™ IPS/IDS – dedicated and integrated VPN: site-to-site, access, client/clientless, IPSEC/SSL Unified, managed, integrated into the gateway Content & Messaging Security Data Leak Prevention* Any scale, size, performance, virtualization, availability Firewall with application awareness IDS/IPS VPN Site-to-site / remote access Data, content, messaging security Virtualization, availability, scalability Unified, managed, integrated with endpoint * planned Check Point is only company to integrate these security components into single gateway Scaleable for any size with Unified Management

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Предотвращение атак

20 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point IPS-1 NGX R65 SmartCenter IPS-1 Mgmt  Новый IPS-1 Management Dashboard  Sensor работает на SPLAT  IPS-1 Management Server работает на SPLAT  SmartCenter + IPS-1 Management Server устанавливаются на один сервер под управлением SPLAT (общие администраторы)

21 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Основные компоненты IPS-1  IPS-1 – выделенное решение IDS/IPS масштаба крупного предприятия: –Hybrid Detection Engine (HDE) –N-Code language –Central Management VPN-1IPS-1 Central Management Stateful Inspection HDE INSPECT language N-Code language

22 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Application Intelligence  HDE комбинирует лучшие техники обнаружения и анализа Hybrid Detection Engine Protocol Analysis Context Based Protocol Anomaly Detection OS Fingerprinting Application Fingerprinting SMART IP Reassembly Alert Flood Suppression Dynamic Worm Mitigation Confidence Indexing Advanced Signature Based Detection Dynamic Shielding Unique

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Защита WEB и безопасный удаленный доступ

24 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Бизнес зависит от Web Internet Web серверы Серверы приложений Данные заказчиков Заказчики Партнеры Сотрудники Базы данных  75% кибератак происходит через Internet приложения

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. SQL Injection Web Intelligence

26 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. SQL Injection Допустим, на сервере имеется такой код: myCommand = new SqlDataAdapter( "SELECT * FROM Users WHERE UserName ='" + txtuid.Text + "'", conn); Пользователь ввел в поле txtuid : '*; DROP TABLE Customers " SELECT * FROM Users WHERE UserName=*''; DROP TABLE Customers This will delete your user table !!!

27 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Атаки на Web приложения  SSL не защитит –SSL защищает конфиденциальность (от чужих глаз) –Атаки могут веститсь и внутри SSL –МСЭ и IDS не могут читать такие данные  Традиционные МСЭ не спасают –Атаки идут по разрешенным портам HTTP и HTTPS –Более того, МСЭ «слепо» пропускают HTTPS

28 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. SQL Injection: Есть надежда на IPS? Предположим такой запрос на сервере myCommand = new SqlDataAdapter( "SELECT * FROM Users WHERE UserName =‘ " + txtuid.Text + “ ‘ AND Password= ‘ " + Pass.Text + “ ‘ “,conn); Атакующий может ввести (Pass, имя неважно ): pass‘ OR ‘1’=‘1 Получается: SELECT * FROM Users WHERE UserName=‘user’ AND password=‘pass’ OR ‘1’=‘1’

29 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Итак, IPS бессильны IPS работает с сигнатурами. Мы можем добавить ‘1’=‘1’ в шаблоны Но с точки зрения SQL также валидны:  ‘2’=‘2’  ‘1’ Like ‘1’  9>8  7 IN (7)  3 BETWEEN 1 AND 5 Невозможно сформировать сигнатуры, прокрывающие все богатство языка SQL

30 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Безопасное подключение через Web Connectra Web Portal Файловые ресурсы Доступ к почте через Web Приложения client/server через plug-in к броузеру Web сайты и приложения

31 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Connectra

32 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Защищенные программы Защищенные документы Интегрирована с Program Advisor! Check Point Secure Workspace

33 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Единая система управления для контроля всей системы ИБ

34 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Check Point PURE Security

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Provider-1

36 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Управление множеством доменов безопасности Multi-Domain Server

37 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Одновременная работа

38 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Иерархия политик безопасности Global SmartDashboard CMA SmartDashboard

39 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Иерархия политик безопасности CMA SmartDashboard CMA SmartDashboard with Global Policy

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. VSX

41 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Virtual Routing and Firewalling Виртуальная среда VPN-1 VSX NGX состоит из нескольких виртуальных устройств Virtual System (VS) VPN-1 Firewall Module Virtual System In Bridge Mode IP Router Virtual Cable (warp link) Network Cable VPN-1 Firewall Module In Bridge Mode Virtual Router (VR) Switch Virtual Switch (V-SW)

42 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Динамическая маршрутизация  Поддержка протоколов динамической маршрутизации –Unicast Routing – RIPv1/2, OSPFv2 & BGP-4 –Multicast Routing – IGMPv2, PIM-DM & PIM-SM  Каждое устройство обеспечивает взаимодействие »Virtual Device to Virtual Device »Virtual Device to external router 802.1q Virtual Switch Virtual Router OSPF PIM-SM Marketing IGMPv2 BGP-4 OSPF

43 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Использование технологии VLAN Floor L-2 Access Switches Finance Networks Main Building Hybrid networks R&D Networks Distribution Switches 802.1q connectivity matrix Routed Core 802.1q Trunks Vlan IP interface – Inter Vlan connectivity

44 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Пример виртуальной среды  Интеграция с MPLS Косвенная интеграция с MPLS Компоненты MPLS преобразуют метки MPLS в VLAN tags Разные политики VS в зависимости от метки MPLS

45 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Пример виртуальной среды  VS в ЦОД Интерфейс VLAN Каждая VS защищает свой набор приложений и сервисов Специфические настройки SmartDefense для каждой VS (каждого сервера/сервиса)

46 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Управление с Provider-1 VSX Gateway Customer Management Add-On (CMA) Customer B Customer A Customer C Customer Management Add-On (“Main CMA”)

47 [Public]—For everyone ©2003–2008 Check Point Software Technologies Ltd. All rights reserved. ENDPOINT One single security client GATEWAY One unified product line MANAGEMENT One single console totalsecurity from Check Point

©2003–2008 Check Point Software Technologies Ltd. All rights reserved. Антон Разумов Check Point Software Technologies Консультант по безопасности