1. Complete Network Security for Banks
Cyberoam
Complete Network Security for Banks 1

2. Cyberoam for Security in Banks
Dimensions of Banking Security
Cyberoam Solution
User Identity in Security
Solution Range 2 2

3. Dimension - 1 – External threats
External Threats – Attackers are after financial gain
Targeting the Internal User
Blended threats over multiple protocol
Over 90 % mail is spam carrying spyware, phishing, viruses, worm
HTTP - Drive-by downloads, Pharming, Spyware via P2P sites
IM: Malicious links and attachments
FTP – Malicious uploads & downloads
Q1: Point Solutions? A combination? or UTM? 3

4. Dimension - 2 – Insider Threats
Insider Threats – Over 50% threats are from insiders
Most attackers are current or former employees
Majority of insiders plan their activities in advance using remote access
Methods –Using someone else’s computer, Social engineering, Unattended terminal
Malicious Intent: Selling corporate/customer data for financial gain
User Ignorance: Indiscriminate surfing = Malware, Spyware
Q.2. Would you settle for Plain Security if you had the choice of Identity-based security?
Attacks are for financial gain – particularly in banks where vast amounts of money or personal data is handled
Dimension – 2 – Insider Threats
In 87% cases insiders employed simple, legitimate
user commands to carry out the incidents In only a small number of
cases was a more technical knowledge of network security required.
For example, very few cases were carried out via a script or program
(9%), and only slightly more involved spoofing13 or flooding14 (13%).
There was no evidence that any insider scanned computer systems to
discover vulnerabilities prior to the incident.
• In 70% of cases studied, the insiders exploited or attempted to exploit
systemic vulnerabilities in applications and/or processes or procedures
(e.g., business rule checks, authorized overrides) to carry out the
incidents. In 61% of the cases, the insiders exploited vulnerabilities
inherent in the design of the hardware, software, or network.
• In 78% of the incidents, the insiders were authorized users with active
computer accounts at the time of the incident. In 43% of the cases, the
insider used his or her own username and password to carry out the
incident.15
• However, there were some cases in which the insider used other
means beyond his or her user account to perpetrate the harm. Twentysix
percent of the cases involved the use of someone else’s computer
account, physical use of an unattended terminal with an open user
account, or social engineering (i.e., gaining access through
manipulation of a person or persons who can permit or facilitate
access to a system or data).16
• Only 23% of the insiders were employed in technical positions17, with
17% of the insiders possessing system administrator/root access
within the organization.
• Thirty-nine percent of the insiders were unaware of the organizations’
technical security measures.18 4

5. Dimension – 3 – Remote Office Security
Remote Office Security – Greater Granularity and Control over system resources
High Security Levels at par with Head Office
External threats
Internal threats
Limited Technical Resources at Remote Office
Centralized control and visibility required
Regulatory Compliance: BS 7799/ ISO 27001, Basel II Norms, PCI-DSS
Q. 3. Are your remote offices as secure as the Head Office? At what cost?

6. 60% corporate data lies unprotected on endpoints
Dimension – 4 – Safe Guarding Your EndPoints
60% corporate data lies unprotected on endpoints
Lost USBs
Medical records of 741 patients lost by a hospital
9000 USB sticks found in people's pockets at the local dry cleaners in UK
Lost Multimedia Discs
Personal information of 11.1mn customers of leading oil refinery (USA) found on streets
Wrong Attachment
Bank employee accidentally sent sensitive
customer details to wrong address
Lost iPods
12,500 handheld devices forgotten at the back of taxis every 6 months in UK

7. Data At Risk Dimension – 4 –Safe Guarding Your Network EndPoints
What Places Data At Risk?
Removable Devices
USBs, CDs/DVDs, MP3, Digital cameras
Unintentional
Malicious
Applications
Insiders
Web, Mail, IM, P2P, Printing, FTP
Unauthorized transfer of sensitive data;
Malware-laden for information access;
Sensitive data sent to wrong person
Data At Risk
• Intellectual property related to R&D
• Business plans, RFP / Tender quotes
• Product launch dates and roadmap
• Customer data

8. Core Banking System Components
Datacenter
Branches
Application Developers
Desktops, Branch Servers
Core-Banking Application
WAN, Internet
OS, Database
Alternative Channels
Internet-Banking
ATM
Branch User/Admins
System Administrators
Network Administrators

9. Bank X– Case Study Challenges
Existing Firewall inadequate for 1500 users. To be replaced or not?
Limitations of IP-based security – No tracing of malicious users, No reporting on Net use
No Anti-Malware / Content Filtering / Bandwidth Management / Multiple link management
No Endpoint Security
Cyberoam Solution
2 Cyberoam CR 1500i appliances act as Proxy. Active-Active, High Availability mode.
Firewall, IPS, Anti-Virus & Anti-Spam, Content Filtering
SSL-VPN Secure Remote Clientless, Access
Threat Free Tunnelling prevents malware
CR Protects Customer data in DMZ and LAN, does Load Balancing for 2 ISP’s
On-appliance reporting and Identity-based Surfing policies
Protection in dynamic and Wi-fi environments
When Port 80 allowed – all traffic allowed
1500 users and protection from Cisco PIX
Faced limitations of IP-based policies - blanket policies for blocking or allowing access (Check Notes for implication)
No anti-malware / content filtering / bandwidth management / multiple link management
Faced issues of inappropriate Internet and Bandwidth usage
No reporting to show –
Internet usage pattern
Bandwidth usage pattern
VLAN reports
Unable to trace activity to user
Hence no change in policies based on activity

11. Cyberoam Security to X Bank
Confidentiality – Only Authorized users may access
Restricted Zonal access –User Identity, VLAN
Incident Management – Identity-based logging & reporting
Device Control – Block unauthorized file copies, USBs etc.
Application Control – Authorized use of Applications Only
Summary of Benefits
Prevents unauthorized access, leakage / damage to information
Reduces the risk of human error, theft, fraud, misuse of infrastructure
Zero-hour threat detection and alerts with username
Ensures Quick and Suitable Response
Ongoing monitoring with username reports

12. Cyberoam Unified Threat Management

13. What is Cyberoam? Comprehensive Security with
Performance-Effectiveness-Granularity
Firewall-VPN-IPS
Gateway Anti-virus & Antispam
Content Filtering & Bandwidth Management
High-Availability &
Multiple Link Management
On-Appliance Reporting
2. Identity-based Security
3. Comprehensive Branch Office Security 13 13

14. Dimension 1
Firewall-VPN-IPS 14 14

15. Why Cyberoam Firewall-VPN-IPS?
Dimension 1
Why Cyberoam Firewall-VPN-IPS?
Enterprise-class performance
6 Gbps Firewall Throughput, 2.5 Gbps IPS Throughput
Certifications
ICSA certified Firewall
Checkmark certified Enterprise UTM
Interoperability with 3rd party VPN - VPNC certified
Benefits
Prevents file uploads and data leakage via IM
IPS signatures to prevent abnormal activity
Works on Layer 8 – The Human layer
Allows users to carry their access rights anywhere in the network

16. Anti-virus & Anti-Spam
Dimension 1
Anti-virus & Anti-Spam 16 16

17. Why Cyberoam Anti-Virus and Anti-Spam?
Dimension 1
Why Cyberoam Anti-Virus and Anti-Spam?
Anti-Virus:
99 % Anti-Virus detection rate; Zero-hour protection
Virus Outbreak Detection – Zero-hour protection
Anti-Spam:
98 % Spam detection rate – Low False Positive
Scans SMTP, POP3, IMAP with Recurrent Pattern Detection (RPDTM)
Content-agnostic and language independent – Image spam and emerging spam
Benefits in detail:
Instant user identification for zero-hour protection
Less load on sys admin
Ease to user
Data Loss Protection
Differing levels of Control
Low False Positives
Certification
Checkmark certified Anti-virus and Anti-spam

18. Dimension 1
Content Filtering 18 18

19. Why Cyberoam Content Filtering?
Database of millions of sites – 82 + categories
HTTP upload control
Categorizes Google cached pages with dynamic URLs
Prevents Proxy surfing eg: tunnel proxy utility, open proxy, web proxy.
Dimension 1
Certifications
Checkmark certified Content Filtering
Network Products Guide award
Benefits
Prevents entry of malware through unrestricted surfing
Policies based on user identity
Prevents Data Leakage
Other Benefits:
Local database reduces latency and dependence on network connectivity
Category wise customized denied messages

20. Multiple Link Management
Bandwidth Management
&
Multiple Link Management 20 20

21. Why Cyberoam? Bandwidth Management
Dimension 1
Why Cyberoam? Bandwidth Management
Committed and burstable bandwidth
Restricts bandwidth usage by proper allocation on requirements basis
Prevents Bandwidth Choking
Controls cost – prevents excessive bandwidth usage
User Identity in Security
Assigns bandwidth to critical users and applications – supports business agility
Application and Identity-based bandwidth allocation 21

22. Advanced Multiple Gateway Features
Dimension 1
Advanced Multiple Gateway Features
Auto gateway failover
Weighted round robin load balancing
Policy routing per application, user, source and destination
Gateway status on dashboard
No restriction on number of WAN Ports
Schedule based bandwidth assignment
What does it solve?
Provides continuous connectivity
Security over multiple ISP links 22

23. Identity-based Security
Why Cyberoam?
Dimension - 2
Identity-based Security 23 23

24. Why Identity? – AAA through Cyberoam UTM Security
Authentication by Username – including Wi-Fi
Authorization - Access Rights based on pre-defined corporate policies
Username – Not IP Addresses
Need-to-Use basis
Across distributed locations
Accounting – Centralized Logging and Reporting with Username
Shows Who is Doing What even in Dynamic Environments
DHCP - Wi-Fi - Shared Machine Scenarios
Eg. Land Records
User

25. 25

26. Data Leakage Control & Reporting (HTTP Upload)

27. Branch Office Security
Why Cyberoam?
Dimension - 3
Branch Office Security 27 27

28. Why Cyberoam? Dimension 3 Branch Office Security
Comprehensive security
Branch user visibility and controls at HQ
Proven interoperability with 3rd party VPNs – VPNC certified
WAN optimization at branches
Bandwidth efficiency
Simplified Operations – No need for technical resource
Remote web-GUI management

29. Dimension 3
Secure Remote Access
IPSec & SSL VPN on UTM Appliance
Anywhere Secure Access to telecommuters, road warriors, partners
Threat Free Tunneling Technology – Scans endpoint for malware
Clientless VPN
Full or limited access based on user work profile
High scalability
Easy to use and manage