1. Software-Defined Secure Networks in Action
Nguyễn Tiến Đức
ASEAN Security Specialist

2. 1 2 3 4 AGENDA IoT Malware Software-Defined Secure Networks
Software-Defined Secure Networks in Action 4
Sumary

3. IoT malware

4. Real world examples of IoT malware/ransomware
Thermostat ransomware1
Amazon cameras malware2
Jeep remote control3

5. Software-Defined Secure Networks

6. Software Defined Secure Networks
Policy, Detection, and Enforcement
Unified and Responsive
Leverage entire network and ecosystem for threat intelligence and detection
Automated Malware Defense
Dynamic, Adaptive Policy Orchestration
Threat Intelligence
DETECTION
POLICY
ENFORCEMENT
Utilize any element of the network as an enforcement point
Dynamically execute policy across all network components including third party devices
DETECTION
ENFORCEMENT

7. Software Defined Secure Networks (SDSN) Unified Security Platform
DETECTION
Third Party Threat Intel
Juniper Security Cloud
Detection
Spotlight Secure
Threat Intelligence
Sky Advanced Threat Prevention (ATP)
Fast, effective protection from advanced threats
Integrated threat intelligence
Policy
POLICY
Security Director + Policy Enforcer
Policy Enforcement, Visibility, Automation
Intelligent enforcement to firewalls, switches, third party devices and routers
Robust visibility and management
DETECTION
SRX
Physical Firewall
vSRX
Virtual Firewall
Enforcement
ENFORCEMENT
Third Party Elements*
Consistent protection across physical/virtual
Open and programmable environment
EX & QFX
Switches MX
Routers*
*Roadmap
Network as a single enforcement domain - Every element is a policy enforcement point

8. The ATP verdict chain
Staged analysis: combining rapid response and deep analysis
Suspect file
Suspect files enter the analysis chain in the cloud
Cache lookup: (~1 second)
Files we’ve seen before are identified and a verdict immediately goes back to SRX 1
Anti-virus scanning: (~5 second)
Multiple AV engines to return a verdict, which is then cached for future reference 2 3
Static analysis: (~30 second)
The static analysis engine does a deeper inspection, with the verdict again cached for future reference
Dynamic analysis: (~7 minutes)
Dynamic analysis in a custom sandbox leverages deception and provocation techniques to identify evasive malware 4

9. Security Director Policy Enforcer Infected Endpoint Scenario
Enables remediation via Policy Enforcer workflows in Security Director
Delivers micro security services to switches such as EX, QFX
Updates enforcement criteria
automatically with new threat data
Tracks infected host/endpoint movement from site to site via MAC address vs IP address
Sky ATP detects malware;
renders verdict 2
Threat Intel
Sky ATP 3
Enforcement policy rendered
vSRX
Firewall 4
Policy Enforcer
Security Director
Switch 4
Enforcement policy automatically deployed
Malware enters 1
5 Infected endpoint quarantined

10. Software-Defined Secure Networks in Action

11. SDSN isolates infected host
State-full filter on Firewall + Access list on the Switch port
Threat Intel
Sky ATP
Infected host =
Firewall
Firewall
Switch
Switch

12. Client is no longer able to browse the internet or local network
Within minutes the
client is isolated from the network preventing proliferation of the malware

13. SDSN tracks host and enforces
Threat Intel
Sky ATP
Infected host =
Firewall
Firewall
Switch
Switch

14. The Right Policy for the Right Job
Different threat levels need
different policies
Anomalous lightbulb?
Quarantine and create new policy for appropriate behavior
Compromised core switch?
Neutralize the threat and shut down the tunnel vs. killing the switch
Software Defined Secure Networks (SDSN) Policy Orchestration + Enforcement
Shut down light bulb OR
Kill illegitimate tunnel

15. Summary

16. Thank you