WIXLIB

SD-WAN Security and SASECharuhas GhatgeProduct Marketing, Nuage Networks1 2020 Nokia 2020Nokia

Agenda Security for SD-WANs Branch Security Requirements SD-WAN Security Paradigm – Prevent-Detect-Respond Security Functions – IPS/IDS/Web Filtering, Security Monitoring and automated Response to threats SD-WAN Security – Customer Verticals and Use Cases Secured Access Service Edge (SASE) What is SASE? Why is it needed? Components of SASE Deployment Considerations A SASE Implementation2 2020 Nokia

Enterprise Network EvolutionUniversal Security FrameworkPerimeter SecurityBusiness PoliciesManagementPortalSecurity PoliciesApplication PoliciesEnterprise AppsData udSaaSInternetPrivateCloudSP HostedServicesBranchSecure Enterprise Network Hub-spoke Branch-DC Centralized SecurityMobile3 2020 NokiaSo-HoOfficesFactoriesIoT

Branch Security Needs to Evolve with Threat LandscapeRequires Automated, End-to-end approach based on AnalyticsPreventNeed to secure localinternet breakout accessfrom branch (e.g., L3-7Firewall, URL Filtering,IDS/IPS)Prevent lateral malwarespread from branch to DC4 2020 NokiaDetectNeed real-time visibility andmonitoring for all trafficentering or leaving branch todetect emerging threatsRespondNeed to automate response tomitigate security threats innear real-time

Branch Edge Security RequirementsAdvanced Security FeaturesStateful Firewall Protect branch network access from outside Restrict branch user access to corporate network and internet using protocol/portsL7 ApplicationControl Restrict branch user access to select applications (e.g., allow Skype for Business, block Facebook)URL/Web Filtering Limit branch user access to internet content, block malware White list access to cloud services Regulatory ComplianceThreat Prevention(IDP, Anti-Virus) Detect/block known threats from outside to branch as well as from branch to DC/internet Protect branch users from network based virus/malware (e.g. via Web, Email, File downloads)Real-Time SecurityAnalytics andAutomation Visibility into all traffic from branch to internet and DC/cloud Detect new zero day threats Automate response based on analytics to limit malware spread5 2020 Nokia

Nuage SD-WAN SecurityKey BenefitsKey Features End to End Security Policy L3-L7 Application FirewallInternet SaaS Application Control Web/URL Filtering Threat Prevention (IDP) Hosted Third-PartyVNFs/Cloud SecurityPrevent Visibility and SecurityMonitoring Dynamic SecurityAutomation Automated PoliciesBased on NetworkSecurity Analytics Contextual FlowVisualization Near Real-time AlertsBased on NetworkAnalytics6 2020 NokiaRespondDetect Dynamic ServiceInsertion for ThreatMitigation Secure branch user tolocal internet breakoutaccessPrevent unauthorizedaccess to malicious webcontentEnd-to-End Segmentationand Security Policy forThreat Prevention and toprevent lateral spread ofmalwareFast Detection and RapidResponse based onSecurity Analytics

Embedded L3-L7 Firewall and SaaS Access ControlAdvanced Security FeaturesL3-L4 StatefulDistributed FirewallL7 ApplicationControlSaaS ApplicationControl7 2020 Nokia Limit branch access to/from internet using statefulL3-4 security Validated by 3rd party for PCI-DSS v3.2 networkfirewall requirements Logging of ACL actions for compliance and auditing Restricts branch user access for specific applicationusing L7 DPI Supports 1900 application signatures L7 application classification for TLS traffic based oncname in certificates Visibility and logging L7 application information.Supports pre-defined SaaS services –Office365, Webex, Salesforce, Github,JIRA, Azure, AWS, Google

Web/URL FilteringBlock user access to inappropriate or malicious internet contentUse Cases Restrict local internet access from branch to cloud services/white listedwebsites Block branch user access to inappropriate or malicious contentKey Features DNS based enforcement based on filtering DNS queries to the websites Content/Website Category based filtering (block malware, block adultcontent, block streaming media) Support for over 180 website categories Supports daily update of pre-defined website categories Filtering based on custom website list (e.g., allow www.salesforce.com) Logging of blocked websites/categories Supported on all NSG physical form-factors as well as NSG-V8 2020 Nokia

Threat Prevention – IDP (IDS/IPS)Detect and Block Known ThreatsUse Cases Detect/block known threats from outside to branch as well as frombranch to HQ/DC/internet Targeted for medium/small sites with 100s Mbps connectivityKey Features Embedded security capability in NSG Uses signatures of known attacks to match traffic that passes throughthe NSG in order to prevent attacks Signatures are divided into different groups containing relevantsignatures - based on use case IDS/IPS policies defined and managed centrally by VSD GUI, API Stats/Reports on intrusion event details and rule hit count logging ofblocked websites/categories Signatures updated dynamically from cloud and applied to NSG9 2020 Nokia

Contextual Flow VisibilityOverlay and Underlay 10 2020 NokiaNetwork security monitoring forcompliance and auditDelivered as a managed cloud service toenterprisesShift from traditional box heavy branch(NGFW, Branch Routers) to a thin branch(with SD-WAN) and heavy cloud modelThreat huntingNetwork forensics and troubleshooting

Real-Time Network Security MonitoringThreshold based Alerts and Security eventReports based on near-real time flow andACL analytics to detect and alert on varioussecurity events: Port Scan Detection Port Sweep Detection Security Policy violations (ACL deny) TCP SYN/RST flood (TCP flag count) Volumetric DoS attack (Byte/Pkt count) Anti spoof11 2020 Nokia

Automated ResponseFIREWALL / IPSBare MetalOverlayEXTRANETSEGMENTSD-WANX-86 CPEHyper-VBare MetalSD-WANX-86 CPEBare MetalHyper-VKVMKVMDATA CENTER Leverage network security analytics to identifysuspect end-points based on threshold alerts Dynamically insert security services (e.g., NGFW,IPS) for suspect traffic Security services can be hosted in the data centeror the branchBranch 1PRIVATE IPESXiESXiPrevent malware from infected branch device fromentering corporate networkPartnersINTERNETContainer ContainerSD-WANX-86 CPEHQ12 2020 NokiaIntel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries

Flexible Deployment with Partner Eco-SystemSecurity across entire IT landscape delivered as cloud-managed serviceInternetbreakoutCloud Security ServicesProtect branch user access to internetvia local breakout Limit access to specific cloudservices via local breakout3rd Party Hosted VNF and Service Chaining toHQ/DC (For example, Checkpoint) 13Hosting 3rd party VNF(s) on the branch CPEService chaining to CSP Cloud VNFs or HQ/DCappliancesAn eco-system of security partners (NGFW/UTM) 2020 NokiaIntel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries

SD-WAN Security – Customer Use casesHealthcareFinancial/BankingManaged ServiceProvider Identification of malwareactivity at branch site(doctor’s office) based onNuage embeddednetwork traffic analytics14 2020 NokiaSecuring guest useraccess to internet from abank branch office usingL3-7 firewall andembedded URL filteringValue added securityservices for SD-WANusing Nuage embeddedsecurity capabilities orusing partner securityVNF

Secured Access Service Edge (SASE)15 Nokia 2020 Nokia 2020

The SASE Story Why SASE - What Problem isbeing solved Evolution of EnterpriseNetworking & Security NeedsWhy SASE Description, Status andKey Requirements What is SASE, Where is it onHype Cycle, No Standards, 5-10year Journey vs. a defineddestination, majorrequirements (Gartner)What Deployment Considerations Consider the state of Industry, SDWAN technology, Securitytechnology, Enterprise. Need for flexibility: Rip and replacevs. evolution – undefinedstandards, dynamic and evolvingthreats, vendor lock-in, dynamicneeds, flexibility.When16 2020 Nokia Nuage does SASE How we meet keyrequirements Incremental Options andBenefitsHow Nuage does SASE in detail SASE at the end points SASE at service edge and cloudWho

A new architecture is required to deal with both Security andConnectivityConnect to Datacenter/HQConnect to Clouds (Private, SaaS, Public) Traditional Security (VPN) is overwhelmedConnectivity from AnywhereSource: Gartner17 2020 Nokia IT Operations are stretched Growing Network performance and costs

Migration of Enterprise to Cloud requires Cloud-CentricConnectivity & SecurityEnterprise Applications Migrate to CloudSD-WAN architecture is evolvingEnterprise ApplicationsDatacenterSD-WANBranch OfficeBranch OfficeModern ApplicationsCloudBranch Office18 2020 NokiaBranch OfficeLegacy ApplicationsSD-WANBranch OfficeDatacenterBranch Office

What is SASE Framework and what are its potential Use CasesSASE Use CasesConnect user from anywherePOP-centric Cloud access with assured SLASecure WAN access with end-to-end security protectionEnhanced Application experienceEnterprise Digital TransformationSimplification of Security & Network OperationsMigration and adoption of CloudNetworking for IoT and Industry 4.019 2020 Nokia

High level SASE requirements & recommended approachNetworking 20Performance based POPselectionApplication aware routingand traffic steeringFull MPLS support forlegacy Datacenter access 2020 NokiaSecurity Access privileges areenforced at endpoint bypolicies includingnetworking firewall andURL filteringSWG, CASB, NGFW, ZTNA,DLP and others arehandled at the serviceedgeManagement Easy provisioning andfull visibility reports at allthe networking levels.Multi-platformprovisioning supportVendor Strategy Multi security vendorssupportMulti Cloud vendorssupport

SASE Networking Requirements & vendor Implementation21Networking RequirementsDescriptionComprehensive Routing capabilitiesFull stack of routing protocols to support switching and routing personalitiesAccess and Connectivity to and from AnywhereSeamless connectivity and policy management across fixed (internet, L2 andL3) and mobile WANsPerformance based POP selectionSupport for multiple paths and PoPs and performance-based selection abilityApplication aware routing and traffic steeringProviding optimal application experience based on application typesHybrid WAN support (e.g. Full MPLS/Ethernet) forlegacy Datacenter accessSeamless integration of existing networking to access data center and appsMulti-Cloud & Hybrid Cloud connectivityPolicy based access to and across applications in private cloud and multiplepublic cloudsConnectivity Security – VPN, IPSecEmbedded encryption and end point securityWAN Optimization & Bandwidth AggregationOptimizing the use of available network for availability and performanceSD-WAN Service PortalMulti-tenant SD-WAN portal hosted by CSP for the visibility and control.Enabling co-management with enterprise 2020 NokiaVendor