1.-ConceptElectronics

Insight.

The Avatars of the Network Perimeter Gabriel Nicolaescu CISO & Security Architect Concept Electronics

Agora Technology Conferences: “Securitate�

Bucharest , 18 November 2009

Applications Have Changed – Firewalls Have Not • The gateway at the trust

border is the right place to enforce policy control 9

Sees all traffic

9

Defines trust boundary

Need to Restore Visibility and Control in the Firewall Page 2 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Application Control Efforts are Failing • Palo Alto Networks’ Application Usage & Risk Report highlights actual

behavior of cca. 900,000 users across more than 60 organizations 9

Applications are built for accessibility and used for complex B2B collaboration

9

Controls are failing – All had Firewalls, many had IPS, proxies, & URL filtering

Page 3 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Application Control Efforts are Failing

• Palo Alto Networks’ Application Usage & Risk Report highlights actual

behavior of cca. 900,000 users across more than 60 organizations 9

P2P and browser-based file sharing usage is rampant

9

More and more business use of convergent multi-media content delivery

9

Controls are failing – All had Firewalls, many had IPS, proxies, & URL filtering

Page 4 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Application Control Efforts are Failing • Palo Alto Networks’ Application Usage & Risk Report highlights actual

behavior of cca. 900,000 users across more than 60 organizations 9

Tools that enable users to circumvent security are common

9

Controls are failing – All had Firewalls, many had IPS, proxies, & URL filtering

Page 5 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Next-Generation Firewall Agenda New Requirements for the Firewall 1. Identify applications regardless of port, protocol, evasive tactic or SSL 2.

Identify users regardless of dynamic assignation of IP address

3. Fine-grained visibility and policy control over application access / functionality 4. Protect in real-time against threats embedded across applications 5. Multi-gigabit in-line deployment with no performance degradation

Page 6 |

Š 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Palo Alto Networks Solution Overview

About Palo Alto Networks

• Founded in 2005 by security visionary Nir Zuk • World class team with vast security experience, strong

networking and technology expertise • Builds innovative next generation firewalls that control

more than 800 applications • Named Gartner Cool Vendor in 2008

Page 8 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Palo Alto Networks Mature & Trusted Technology

Page 9 |

Š 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Unique Technologies that Transform the Firewall App-ID Identify the application

User-ID Identify the user

Content-ID Scan the content Page 10 |

Š 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Enables Visibility Into Applications, Users, and Content

Page 11 |

Š 2008 2009 Palo Alto Networks. Proprietary and Confidential.

Core PAN-OS Platform Features Visibility and control of applications, users and content are complemented by core firewall features • Strong networking foundation -

Dynamic routing Site-to-site IPSec VPN SSL VPN for remote access Tap mode – connect to SPAN port Virtual wire (“Layer 1”) for true transparent in-line deployment L2 / L3 switching foundation

PA-4060

PA-4050

PA-4020

• QoS traffic shaping Maximum / guaranteed and priority - By user, application, interface, zone, and more -

PA-2050

PA-2020

PA-500

Page 12 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Core PAN-OS Platform Features Visibility and control of applications, users and content are complemented by core firewall features • Zone-based architecture -

All interfaces assigned to security zones for policy enforcement

• High Availability -

Configuration and session synchronization

-

Path, link, and HA monitoring

PA-4060

PA-4050

PA-4020

• Virtual Systems -

Establish multiple virtual firewalls in a single device (PA-4000 Series only)

• Simple, flexible management -

PA-2050

PA-2020

CLI, Web, Panorama, SNMP, Syslog PA-500

Page 13 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Flexible Deployment Options

•

Many work modes - Tap Mode, Virtual Wire, Layer 2, Layer 3 with dynamic routing protocols.

•

Protections work mode adjusted to the requirements – network interfaces in one device can work in any of the different supported modes.

•

Security virtualization – VLAN interfaces in L2 and L3, virtual routers and virtual systems.

Page 14 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Flexible Deployment Options (Examples) Visibility

• Application, user and content visibility without inline deployment

Page 15 |

Transparent In-Line

• IPS with app visibility & control • Consolidation of IPS & URL filtering

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Firewall Replacement

• Firewall replacement with app visibility & control • Firewall + IPS • Firewall + IPS + URL filtering

Flexible Policy Control Responses • Intuitive policy editor enables appropriate usage policies with flexible

policy responses -

Allow or deny individual application usage

-

Control applications by category, subcategory, technology or characteristic

-

Proxy decrypt and inspect SSL

-

Allow or block certain application functions

-

Allow based on schedule policy

-

Allow but apply IPS, scan for viruses, spyware

-

Apply explicit traffic shaping (guaranteed, priority, maximum)

-

Allow for certain users or groups within AD

-

Control excessive web surfing

-

Look for and alert or block file or data transfer

• Consistent and secure local (on device) and remote management

interface; CLI, secure web-based and remote native application Page 16 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.

Enterprise Device and Policy Management • Intuitive and flexible management -

Role-based administration enables delegation of tasks to appropriate person CLI, Web, Panorama, SNMP, Syslog

• Panorama central management agement application -

Shared policies enable consistent application control policies Consolidated management, logging, and monitoring of Palo Alto Networks devices Consistent web interface between Panorama and device UI Network-wide ACC/monitoring views, log collection, and reporting

• All interfaces work on current configuration, avoiding sync issues Page 17 |

© 2009 Palo Alto Networks & Concept Electronics Proprietary and Confidential.