SANS Technology Institute - Candidate for Master of Science Degree
Implementing and AutomatingCritical Control 19: Secure Network Engineering
forNext Generation Data Center Networks
Aron Warren, George Khalil, Michael HoehlFebruary 2012
SANS Technology Institute - Candidate for Master of Science Degree
Objectives
• Introduction
• Secure Network Engineering
• Challenges for Next Generation Networks
• Functional Requirements
• Key Risk Considerations
• High-Level Design and Build Approach
• N-Tier Application and Infrastructure Control Checklist
• Lessons Learned
SANS Technology Institute - Candidate for Master of Science Degree
Introduction
• SANS 20 Critical Security Controls for Effective
Cyber Defense
• Security Control 19 “Secure Network Engineering”
• Technical approaches to advance this control
• Scope is for Web/Mobile App and 40GbE
SANS Technology Institute - Candidate for Master of Science Degree
Secure Network Engineering
• Document Gathering is First Step
• Understand Data Flows
• Log Events and Correlate
• Apply Least Privileged Principles
• Divide and Secure
• Establish Trust and Validate Data Integrity
• Test and Validate Routinely
SANS Technology Institute - Candidate for Master of Science Degree
Challenges for Next Generation Networks
• 40GbE is still early in “hype” cycle for Enterprises
• Throughput speed ≠ Wire speed
• Uncertainty increases relative to speed
• Limited forensic team experience with 40 GbE
• Existing operations resource capacity
SANS Technology Institute - Candidate for Master of Science Degree
Functional Requirements
1. Documentation
2. Data Center Physical Controls
3. Enclaves
4. Firewalls and Security Apps
5. Internet Access
6. DNS
7. Hardening
8. Config and Change Mgt
9. Virtual and Blade Servers
10.Vulnerability and Threat Mgt
11.Log Mgt
12.Asset Mgt
13.Access Mgt
14.Performance Mgt
15.Forensic Mgt
16.Service Mgt
SANS Technology Institute - Candidate for Master of Science Degree
Key Risk Considerations
• Mixing assets of different value
• Integrating security and network controls
• High event volume and Impact of false negatives
• Understanding data flows and security policies
• Performance impact of inspection
• Protecting high authority access
• Configuration errors and product defects
SANS Technology Institute - Candidate for Master of Science Degree
High-level Design and Build Approach
SANS Technology Institute - Candidate for Master of Science Degree
N-Tier ApplicationControl Checklist
Enclave for each app function Dedicated Internet Access Firewall Security Fabric Separate Infrastructure Firewall SSL Accelerator and Proxies Tiered DNS Virtualization and Blade Servers Netflow Network Address Translation Network Monitoring Switch Load Balancers
SANS Technology Institute - Candidate for Master of Science Degree
InfrastructureControl Checklist
Enclave for each function No direct Internet access Infrastructure Firewall Dedicated Enterprise Firewall Customer Authentication Admin Authentication Jump Boxes Network Access Control (NAC) Business-to-Business (B2B) VPN System and Security Event Mgt
SANS Technology Institute - Candidate for Master of Science Degree
Lessons Learned
Promising Solutions
•Security Fabric
•Firewall Policy Mgt
•Virtual Switch Replacement
•IEEE 802.1AE (MACsec)
Pitfalls
•Poor Documentation
•Too many ACLs and Flows
•Netflow “meltdown”
•4 x10 Port Aggregation
•Virtual Switch Overload
•Poorly designed QoS
•Forensic Teams
SANS Technology Institute - Candidate for Master of Science Degree
Benefits
• Improved Security
• Increased Design Credibility
• Better Manageability
• Lower Total Costs
• Faster Response to Threats
Ultimately, adopting these design recommendations will provide a solid foundation for safeguarding infrastructure and data at the highest speeds available today—and tomorrow.
Top Related