Cisco Talks Security
February 29, 2012, RSA Conference, San Francisco—Christopher Young from Cisco described the security focus at Cisco. The changing nature of the various networks means that Cisco is in the middle of the disruption. Now, they have to solve today’s and tomorrow’s security challenges.
First some statistics: 70 percent of all users break IT policies; 1 in 5 users need access to the Web; 1/2 of the users send company emails on their personal address; 64 percent use risky behavior on the Web; and 67 percent of al IT policies need changing.
The trends are towards seamless integration of technology across all lives, but everyone wants seamless integration of security so it is not cumbersome for the users. These drivers mean that the IT organizations need to do a lot of work. Their problem is to free up the devices or lock them down.
Users want to bring their own devices and use third party apps for their work, but the IT people want to protect privacy, their network, and secure critical data. The conflicts are creating counterproductive results. Virtual machines free up resources and allow moving the virtual desktop infrastructure into the call centers to get customer information to the operators. Unfortunately, those operators have no understanding of operations and functions. For example, at the start of a shift, all the VDI do a scan of the machines at the same time. This scan storm overloads the network and prevents the operators from doing their work for a while. This is one area where a change could help productivity and security.
Security gives people a false choice, free or locked down. Users actually need both modes. For instance, health care requires security to cover the new technologies and accept BYOD, especially for distance collaboration. The new technologies enable advances in care, telecare, electronic health records, and remote monitoring. These technologies also change the end points for the data streams, lead by BYOD and apps.
Doctors and specialists have to work together, calling for diverse and dispersed collaboration over a global platform and network. Long distance collaboration needs desktop virtualization. Today, most medium and large organizations are about 50 percent virtualized. The next generation network will need higher network speeds, the ability to scale, and an increased level of integration in the equipment. These requirements will call for a fundamental change in businesses to address the increased need for much more and better security.
By 2016, these changes will result in practitioners using 8 B smart, hand-held devices, generating about 18 times today’s data volumes. Consumer-type apps are proliferating in all areas and industries, so the desktop has to evolve to match the newer use paradigms. The desktop needs to be delivered over the network. IPv6 will enable m2m communications that the IT administration has to track and manage.
One way to improve security is to use the capabilities within the network to supply security services to the BYOD, the IPv6 m2m traffic, and everything that touches the net. The net can deliver more capabilities and can be the source for security, by tracking what is happening, where, by whom, etc because it sees all people, devices, and traffic.
By seeing and controlling traffic, in front of and behind the firewalls, the network can provide context for policies. Secure remote access is through VPN and mobile devices can operate in a secure wireless mode. Multiple networks can increase the capabilities, and become a universal source of visibility and control. Unlocking the power of the net enables global threat intelligence and the net can scale to anticipate the next threats and define the next actors.
Cloud security addressed 5 zero day attacks per day and blocked all of them. The systems need scale and speed to use its knowledge to enable defenses. The strategy is to use working data streams and behave as an outside observer to watch open ports, export data volume, etc. Study the reputations of the sites and devices on the Web and automatically block the suspect ones with hardware.
Take a global view and the visibility at the packet level to monitor net traffic to permit free access to all net-attached devices. By monitoring the devices and points on the net, you can spot traffic anomalies. Combine intelligence and net flow monitoring to manage all the personal, connected devices. Use aggregation and cross correlation of factors to gain insight into edge-data center-cloud mode of operation.
Control access through the context that only the net knows. Shift smart authentication into smart access solutions because the power is the knowledge of who, what, when, where connections get to the network. Automate the policy enforcements to determine proper privileges and prevent users from bypassing the policies. A policy device can determine users and combine that data with other network information to enable privileges. If the user or device is unknown, then it is blocked until it can be verified. All of these steps will deliver increased granularity through context-aware authorizations.
Apps have to be analyzed and curated. All data are tied together, so the data functions and permissions have to be segmented. Some apps are ok in the break room, but not in an operating room or other sensitive areas. Visibility and context into the apps and there permissions will allow better control of data access. Again, leverage the value of the net.
For example, at the enterprise level, the net can block most malware and provides a single control point as well as being the source of information. As the net evolves from IPv4 to IPv6, the security has to respond. Most nets tunnel IPv6 through their existing IPv4 systems, so the network becomes the source of power to deliver security, especially as the equipment transitions from standard hardware to BYOD and new protocols.
Moving the security function into the network lets workers do as they wish. Security visibility and context aware enforcement is only available with a strong network security infrastructure.
