Securing Your Network with Juniper

Securing Your Network with Juniper
Name Date

Agenda Customer Concerns SRX Fundamentals Advanced Security Services
Threat Intelligence Services Network Service Automation Summary

60% 43% $12m Cybercrime Happens Results in… Increased cost
Cybercrime is happening. And it is getting worse. If you look at the stats: - Cybercriminals are getting faster - Increasing number of companies are being attacked – cybercriminals are reaching wider - Cybercrime is expensive, and it goes up about 10% per year In today’s security market environment, these statistics offer a telling story of the need for security. The results of a cyber attack can be devastating to any company. From increased costs to even losing your job. Bottom line, when building a network, security must be considered in the design. That is why it’s so important for Juniper to be focused on security. Results in… Increased cost Lost revenue Reputation damage Performance degradation Heavy fines Career limiting 60% Of initial compromises took 1 minute or less time 43% Of companies experienced a data breach in the past year $12m Average cost due to data breach

Meanwhile, Enterprises are Moving Towards Everything as a Service
To make things even more challenging, a major shift is happening, a move towards network and security as a service . We believe that just like software, compute and storage, network and security services will be available on demand, in a pay-as-you-go model, as well as in a traditional model. In this world, every service is standardized, automated, and available to order through a service catalog. If you’re an enterprise, this is great news for app developers who need to stand up network and security as a routine part of application delivery. For service providers who want to monetize security services, this is a significant differentiator. In either case, security technologies need to keep you from a functional perspective, efficiency perspective, and need to enable business agility. This is where things are going Software as a service Firefly Perimeter addresses the new security challenges required to protect virtualized and cloud environments for enterprises and service providers by leveraging the same advanced security and networking features (IPSec VPN, NAT, QoS, and full routing capabilities) of Branch SRX Services Series Gateway in a virtual machine format. SECURITY Learn More HOME ABOUT US PRODUCTS SERVICES NEWS CONTACTS SEARCH Advanced Voice Services Security Services Connectivity Services Business Applications THE LATEST NEWS AND INFORMATION ON TARGETED ATTACKS AND IT SECURITY THREATS SO YOU CAN STOP ADVANCED ATTACKS FROM COMPROMISING YOUR NETWORK Read More Learn about our NG Virtual Firewall SECURITY SERVICES BUNDLES APPLICATION CONTROL SERVICES NETWORK PROTECTION SERVICES Private Policy Find & Store Support Chat with Agent Contact Us UNIFIED THREAT MANAGEMENT SERVICES Compute and storage as a service Network and security as a service

Our Customers’ Top Concerns
Let’s start with the big picture: as a networking and security company, we focus on three things. All of these are top of mind for our customers, who have lot to protect. Intellectual property, customer data, financial data – today everyone understands how critical information security is. But not every vendor is focused like we are on these three things. 1) Operational efficiency: security operations is usually a small staff of people that have an enormous amount of responsibility (read quote). You’ll see that we address this with Centralized management and control Service provider and enterprise scale capabilities Technology that’s design to be open and programmable 2) Security efficacy is all about having the right security capabilities, at the right place, for the right reason. Because (read quote). That’s why we provide Advanced security services, like layer 7 visibility Integrated threat intelligence platform, and Fine-grained policy controls, so that you can manage these services across your enterprise 3) Support for the agile business, because businesses are fluid (read quote), so you need to be able to Scale up easily Scale out quickly Choice of deployment models These set the context for the security technology that we develop, and why. 1 Operational efficiency “I have a small team covering 30 locations and hundreds of apps…” 2 Security efficacy “Keeping up with all these new threats and all the new security products is impossible.” 3 Business agility “I’m building out a fourth data center—I need a smart, automated approach.”

Operational Efficiency
Operational Efficiency is the first The first step in operational efficiency is centralized policy management. It is critical to have control over what might be hundreds or thousands of firewalls. The next is scale. The SRX firewall was built for large, distributed environments. Service providers and large enterprises need carrier-class capabilities. This includes scale, performance and depth of security. Lastly, open and programmable: Especially with the trend towards network services automation, following the trends for cloud computing where orchestration is so important, our technology is used in DIY (Do It Yourself) environments (like Web 2.0 or other scale-out, automated environments) as well as environments that want a combination of ease of use and CLI (command line interface) capabilities. The goal: operational efficiency, which really matters in security because when a threat or attack is underway, you need to be able to execute with command and control ease. Operational efficiency is about improving the human interaction and experience with security Centralized management and control Service provider and enterprise scale capabilities Open and programmable

Security Efficacy Security efficacy is the second concern. This means having the right kind of security protection at the right place in your network, for the right reasons, at the right time. It is about how you use different detection and prevention techniques and technologies for different parts of your network. A branch might have one set of requirements, and the data center another. First let’s discuss advanced security services. These include: application visibility and control, deep packet inspection (IDP or IPS), anti-virus, anti-malware, anti-spam and content filtering (aka UTM) Secondly, we recently announced a powerful threat intelligence platform, capable of distributing threat intelligence to pre-defined enforcement points. Lastly we have fine-grained policy controls that allow the network or security operator to be very specific about what services are executed where. You might have a location or function that’s targeted by hacktavists in one place, and a customer database in another. Fine-grain policy controls let you be as specific or general as you want with alerts and blocks. Security efficacy is about having the right security where you need it, when you need it, and doing the job for which it was intended. Advanced security services Integrated threat intelligence platform Fine-grained policy controls

Security Efficacy The last concern is about supporting an agile business. Businesses move and change quickly; decisions to use cloud or 3rd party applications and services don’t come only from IT, they come from the business side as well. Shadow IT continues to be problematic… the last thing you want is for security to slow things down. How do we address this concern? First, we provide scale up capabilities, which includes in-service software upgrades (ISSU) and chassis that can grow incrementally with no downtime. This lets you spend as you grow, using your money wisely. Secondly, we scale out quickly, in particular with our virtual firewall (Firefly). Either alone or combined with our SDN controller, security services can be provisioned in a matter of minutes, and policy controlled centrally Lastly, choice of deployment models support an agile enterprise: Virtual or Physical, appliance or chassis, software or hardware. In fact the same policies on virtual or physical can be applied with the same management system (looping us back to operational efficiency. Supporting the agile business is all about the flexibility and speed to meet your customer’s needs, when they need it. Business Agility Scale up easily Scale out quickly Virtual or physical

Strength from a Common DNA
Across security, switching and routing Part of the value of Juniper security solutions is that they come from the same DNA as our routers and switches. That gives our customers all kinds of benefits. Starting at the bottom… Architecture: Robust, scalable architecture supports thousands of nodes and firewalls, physical and virtual. as well as leveraging engineering resources with powerful ASICs chips in the hardware. Manage network and security under the Junos management platform – helps reduce training time, helps promote administrative efficiencies Network Service Automation: Our technology is heralded as the most open, programmable technology in the network and security arena. We significantly reduce errors related to the “human touch” – simple errors that can turn into colossal problems Intelligence, logging and reporting shared allowing deep level analysis and triage Intelligence and analytics Intelligence sharing Logging & reporting Network Service Automation Programmable Open APIs Management Single operating environment Architecture Silicon, systems and hardware

Juniper Delivers Security Value
In closing, Juniper is focusing on security. We address the top customer concerns by focusing on products and architectures that improve: Operational efficiency Centralized management and control Service provider and enterprise scale capabilities Open and programmable Security efficacy Advanced security services Integrated threat intelligence platform Fine-grained policy controls Supporting an agile business Scale up easily Scale out quickly Choice of deployment models 1 Operational efficiency Centralized management and control Service provider and enterprise scale capabilities Open and programmable 2 Security efficacy Advanced security services Integrated threat intelligence platform Fine-grained policy controls 3 Business agility Scale up easily Scale out quickly Choice of deployment models

SRX Series Fundamentals
So let’s talk about the 5 key characteristics you’ll find with the SRX platform, and that taken together, deliver more value to customers, and differentiates us from the competitors. SRX Series Fundamentals

Performance and Availability
Carrier-class performance First to 100GbE port High availability: Six 9s 450k connections per second 60m concurrent user sessions We start with performance and availability. This is table stakes. The reason most service providers use SRX is because over the years we consistently deliver to the rigorous standards, with Carrier class performance First to get to 100GbE per port – and still the only one shipping this capability In security, time matters. We’re the only vendor with 6-9s tested. This equals 1) core system downtime of .4 min/year (20 seconds) a year, and Individual Interface a down time of 12 minutes per year SRX can run 450k cps (connections per second). We are targeting 650cps as our next metric, a near-term goal. (We’re also working on advanced services offload: offloads form SPC to an I/O card (to the trio). This doesn’t = increase session perfo and sys throughput (Services offload gets us to 25m PPS/IOC) The SRX platform is a lean, mean firewall machine – from a performance availability perspective, it delivers on the “agile” requirement… our customers need security that keeps up with the speed of business change. SECURITY THAT KEEPS UP WITH THE SPEED OF BUSINESS CHANGE

Scale Scale up easily Scale out quickly Physical, virtual or both
The next characteristic is scale. Juniper makes it easy to scale up – if you need more performance, you can add a line card. If you need a major upgrade, you can do it without interruption, thru in-service software upgrades. Other vendors require that you have a fail-over or second system…expensive. We make scale-up easy If you need to scale out, you can do it super quickly and consistently with Juniper’s Firefly solution. Either with our SDN controller, or right from Virtual Director (our management platform) you can spin up a virtual security system in minutes (not hours, not days, not weeks), and manage that in consort with your physical firewalls. Juniper gives you choice: physical, virtual or both In our experience, no 2 enterprises or service providers are alike, and new use cases and expansion requirements happen all the time. So we want to enable organizations to grow and flex without security holding them back. This is part of being efficient and supporting business agility. Scale up easily Scale out quickly Physical, virtual or both Organizations can grow and flex without security holding them back.

Integrated Security Services
The 3rd characteristic is having a broad set of integrated security services that can be selectively deployed at various points across your network. For example, we have advance security services that you might use in an office environment for layer 7 visibility and control Or threat Intelligence services, which identify things like command & control servers and quickly stops any traffic going to or from these servers Our cloud based malware detection and enforcement technology watches for malicious code trying to get into your network, and enforces policy you create to stop it from entering, or quarantining it at the network level. This is all about efficacy… having the right security technology, at the right place on your network, to detect or stop certain traffic from touching your network. Advanced security services Threat intelligence services Cloud-based malware detection Have the right security service at the right place for the right reason.

Choice in Deployment Options
Choice in deployment option is the 4th characteristic. Because form factor matters – in some use cases, you need all the power of an carrier-class ASICs firewall. In other use cases, like in a branch, you might need a secure router with UTM… or 5000 of them for your worldwide branch deployment. Virtual security is coming on strong – both for the data center, cloud, and for branch deployments. Right up to service provider edge and core, we enable you to right-size every firewall deployment based on what you need, based on each use case. This means you have a better total cost of ownership because you can right-size your investment and you can scale it as needed. Agility… operational efficiency… again, we play back to our core focus areas. Chassis, appliance, virtual Branch office, enterprise edge and data center Service provider edge and core Right-size every firewall deployment based on use case

Centralized Management
The last characteristic is centralized management. Our customers tend to have many firewalls… some have literally thousands that they manage all from our single point of management, called Security Director. Some customers think this is the most important element of an efficient security organization. Because when bad things happen, they tend to happen very quickly. And you want a central security manager that is ready to take action, and coordinate that action across what might be a very complex and distributed environment. We know that a single point of control reduces the risk of a successful attack. Across physical and virtual devices, across data centers and office environments and the cloud. Policy control for hundreds or thousands Intelligent enforcement Physical and virtual Single point of control reduces the risk of a successful attack.

Advanced Security Services
Now let’s talk in more detail about our advanced security services We’ll start with some of the capabilities you’d find in next gen firewalls Advanced Security Services

Juniper Covers Multiple Use Cases for Security
Enterprise Branch Offices Enterprise Regional Offices Data Centers and Cloud Secure Connected Branch Fewer local knowledgeable resources Managing local device Eavesdropping Secure Enterprise Edge Application visibility/control User visibility and control Growing data breaches DC Edge, DC Core, Private Cloud, Hybrid Cloud Increased cyber attacks Unpredictable traffic volumes Managing

Juniper Security Services Overview
Next Generation Firewall Services Unified Threat Management (Known Threats) Threat Intelligence Platform Advanced Threat Prevention (Zero Day) For office environments, like branches, campus etc., we have a number of advanced services that you can deploy. Application visibility and control, which delivers layer 7 capabilities. Intrusion prevention services, also called IDP or IPS. User-based controls, which involves integration with active directory, so that you can develop policies based on groups or individuals. UTM…unified threat management services, which are often deployed in smaller organizations All of these are controlled through Security Director, our centralized management. And they all contribute to security efficacy. Application Control & Visibility Anti-virus Botnets/C&C Sandboxing Intrusion Prevention Anti-spam GEO-IP Evasive Malware User-based Firewall Web Filtering Custom Feeds, APT Rich Reporting & Analytics SRX Foundation Services Firewall NAT VPN Routing Management Reporting Analytics Automation

Juniper Security Services Products Overview
Next Generation Firewall Services Unified Threat Management (Known Threats) Threat Intelligence Platform Advanced Threat Prevention (Zero Day) Application Control & Visibility App Secure Anti-virus UTM Spotlight Secure Botnets/C&C Sky Advanced Threat Prevention (ATP) Sandboxing Intrusion Prevention Anti-spam GEO-IP Evasive Malware SRX, vSRX User-based Firewall Web Filtering Custom Feeds, APT Rich Reporting & Analytics SRX Foundation Services Firewall SRX Series Firewalls vSRX Virtual Firewall NAT VPN Routing Management Reporting Analytics Automation

Application Visibility and Control
Heuristics for evasive and tunneled apps More application signatures Open signature language App Tracking AppID provides us a complete view into payload New engine supports 3000 unique apps and sub-components; open signature platform Understanding security risks Address new user behavior App Firewall Block access to risky apps Allow user tailored policies Ingress Egress App QoS Prioritize important apps Rate-limit less important apps SSL Proxy SSL packet inspection IPS Block security threats

Intrusion Prevention System
Decrypt Inspect Report Block IPS Capabilities Juniper Networks IPS capabilities offer several unique features that assure the highest level of network security. Stateful signature inspection Signatures are applied only to relevant portions of the network traffic determined by the appropriate protocol context. Minimize false positives and offer flexible signature development. Protocol decodes More than 65 protocol decodes are supported along with more than 500 contexts to enforce proper usage of protocols. Accuracy of signatures are improved through precise contexts of protocols. Signatures There are more than 8,500 signatures for identifying anomalies, attacks, spyware, and applications. Attacks are accurately identified and attempts to exploit a known vulnerability are detected. Traffic normalization Reassembly, normalization, and protocol decoding are provided. Overcome attempts to bypass other IPS detections by using obfuscation methods. Zero-day protection Protocol anomaly detection and same-day coverage for newly found vulnerabilities are provided. Your network is already protected against any new exploits. Recommended policy Group of attack signatures are identified by Juniper Networks Security Team as critical for the typical enterprise to protect against. Installation and maintenance are simplified while ensuring the highest network security. Active/active traffic monitoring IPS monitoring on active/active SRX5000 line chassis clusters. Support for active/active IPS monitoring including advanced features such as in-service software upgrade. Packet capture IPS policy supports packet capture logging per rule. Conduct further analysis of surrounding traffic and determine further steps to protect target. Ingress Egress Detect vulnerabilities Among leaders in detection efficacy Improved overall branch SRX performance

User Firewall Controls
P2P apps blocked YouTube allowed Anti-virus applied User firewall controls allows different users to have different application policies based on their role and group Some people or groups might need restrictions on things like YouTube. It might be for productivity reasons, it might be for bandwidth reason. Or in some cases even compliance. Whatever the reason, we have controls in place that you define your policies with automated integration to active directory. Finance P2P, YouTube blocked Anti-virus applied Sales Internet No apps blocked Anti-virus applied CEO 23 Allows different users to have different application policies based on their role and group

Unified Threat Management Services
We also provide UTM services, like Anti-Virus, and Anti spam For these services, we partner with best-of-breed providers, like Sophos for Anti-virus. And WebSense for Web filtering. These are deployed as software modules for SRX or add-in for Firefly – easy to install and of course centrally managed through Security Director. And all of these services are optional, so you can pick and choose the ones you want, and have them execute in specific firewalls. This gives our customers a lot of flexibility, and they pay only for what they use. Anti-Virus Protection from top-tier AV partner Reputation-enhanced capabilities Anti-Spam Multilayered spam protection Protection against APTs Web Filtering Block malicious URLs Prevent lost productivity

Spotlight Secure Threat Intelligence
Threat Defense Intelligence Actionable threat intelligence: Command and control threats GeoIP location information Open Scalable High capacity Effective Adaptive Open platform delivers more value Scalable to ensure full enterprise or service provider deployment Built for expansive data capacity Improved efficacy through threat scores and tuning Adaptive: from the data source, to data normalization, to enforcement at the firewall Spotlight Secure Cloud Other threat intelligence Command & control GeoIP feed Junos Space Security Director SRX

Sky Advanced Threat Prevention
Advanced Anti-malware Service in the Cloud Advanced Threat Prevention is a new cloud-based advanced Anti-Malware service for the SRX Firewall that is scheduled for release in Q4’15. Advanced Threat Prevention will delivers protection against sophisticated “0-day” threats and it does this by watches both ingress and egress traffic for malware and indicators of compromise. The Advanced Threat Prevention service delivers deep inspection – scanning file contents for signs of malicious intent – and actionable reporting. Our goal is to not just report on malware that came across the perimeter, but to offer inline blocking when possible as well. There are three key differentiators for Advanced Threat Prevention: First, Advanced Threat Prevention’s integration with the SRX that allows both detection and prevention of threats Second, we are making a big investment in ensuring that our efficacy against sophisticated malware is world class. To accomplish this, we will be leveraging some Juniper techniques that utilize “deception” to trick malware into identifying itself and, therefore, raising our confidence in alerts that are generated. Much like security intelligence, minimizing false positives is essential as we incorporate this type of technology into an inline device like the SRX. Finally, we will leverage our SecIntel service to push actionable intelligence of compromised hosts to the SRX so that customers can implement quarantine policies when infected clients are detected on the network. Cloud-based Advanced Anti-malware Service With SRX Series Delivers protection against sophisticated “Zero-day” threats Watches ingress/egress traffic for malware and indicators of compromise Delivers deep inspection, actionable reporting, inline malware blocking Advanced Threat Prevention Integration with SRX Series enables detection and prevention of threats Efficacy against sophisticated malware leveraging deception techniques Actionable output (compromised host quarantine, rich reporting) Augments sandboxing with additional analysis to detect evasive malware

The Software-Defined Secure Network
Operate network as single enforcement domain, every element becomes a policy enforcement point Create and centrally manage intent based policy directly aligned to business objectives Gather & distribute threat intelligence, from multiple sources – know who the bad guys are faster Leverage cloud economics for real time analysis – find the bad guys faster Enforce policy to the threat feed information, real time across the network – adapt the network real-time Detection Policy Enforcement Our goal is to offer customers the most comprehensive secure network solution embedded within and throughout the network. A solution that can adapt using real-time threat information to gain awareness and knowledge of activities and traffic traversing the network and the unique ability to create and distribute policy across the network adaptively, and dynamically. The Juniper Software Defined Secure Network allows you to operate the entire network as a single enforcement domain where every element is a policy enforcement point. The SD-SN is built upon these attributes: Policy: Policy is “dictated” in a natural language and centrally managed. In this paradigm, policy can dynamically adapt as the threat landscape evolves. Detection: Start by gathering and distributing threat intelligence from multiple sources including 3rd party. This threat intelligence is aggregated into a single, common cloud-based feed. Analyzing threat intelligence data allows us to make sense of it by identifying patterns and behaviors of what’s acceptable and what’s not normal. Enforcement: Based on the threat feed intelligence, adapt and enforce policy in real time. Distribute this policy to all network elements, each which are capable of enforcing the policy. 27

Software Defined Secure Networks (SDSN) Unified Security Platform
Third Party Threat Intel Security Director + Policy Enforcer Policy Enforcement, Visibility, Automation SRX Physical Firewall vSRX Virtual Firewall Juniper Cloud Sky Advanced Threat Prevention (ATP) Spotlight Secure Threat Intelligence MX Routers* EX & QFX Switches Third Party Elements* DETECTION POLICY ENFORCEMENT Detection Fast, effective protection from advanced threats Integrated threat intelligence Policy Adaptive enforcement to firewalls and switches (third party devices and routers in the future) Robust visibility and management Enforcement Consistent protection across physical/virtual Open and programmable environment Announcing on October 4th *Roadmap, subject to change Network as a single enforcement domain - Every element is a policy enforcement point

New Announcements for the SDSN Platform (Q4 CY16)
Transform your network into a unified defense domain Get cloud based malware prevention on the best virtual firewall Secure your hybrid cloud environment Policy Detection Enforcement Security Director Policy Enforcer Sky ATP on vSRX SRX4100 / SRX4200 Smart policy deployment that integrates with Sky ATP advanced malware prevention Orchestrates detection and quarantine of infection points across firewalls and switches Custom, on premise threat intel option Advanced threat prevention from the cloud on the fastest and most capable virtual firewall Uniform capability, policy, and defense across the network Built for securing hybrid cloud with cloud-based malware prevention, using common enforcement “Single pane of glass” management across physical and virtual when combined with vSRX

Addressing our Customers’ Top Concerns
We’ve talked about how SRX delivers operational efficiency, security efficacy and support for an agile business When you take these three concerns, and consider how we deliver technology that address them, you can understand why Juniper is such a strong player in security. 1 Operational efficiency Centralized management and control Service provider and enterprise scale Open and programmable technology 2 Security efficacy Advanced security services Integrated threat intelligence platform Fine-grained policy controls 3 Business agility Scale up easily Scale out quickly Choice of deployment models

Let’s summarize… Thank you

Securing Your Network with Juniper

Similar presentations

Presentation on theme: "Securing Your Network with Juniper"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Securing Your Network with Juniper

Similar presentations

Presentation on theme: "Securing Your Network with Juniper"— Presentation transcript:

Similar presentations

About project

Feedback