WIXLIB

Solution BriefJUNIPER CONNECTED SECURITYIN ACTIONEnabling automated threat remediation without impacting business continuityChallengeBusinesses need to continuouslyevolve to fight the increasinglysophisticated attacks threateningtheir networks. However, this focuson security is often at the expenseof other important activities,triggering an on-going internalbattle that pits business continuityagainst network security.SolutionBusinesses must take a synergisticapproach that leverages networkand security elements equally inan open, multivendor ecosystemwith centralized policy, analytics,and management—to transformtheir traditional network into athreat-aware network.Benefits Automate security coveragefrom endpoint to edge and everycloud in between See who and what is on yournetwork and enforce policiesacross all connection points Employ granular quarantinecapabilities enabled by a greaternumber of security enforcementpoints in the network Perform rapid and automatedthreat remediation Gain best-in-class networkingNetwork deployments have significantly changed over the pastdecade. Businesses are rapidly moving to the cloud and adoptingnew technologies such as Internet of Things (IoT) that are heavilydependent on the network.These same enterprises are also increasing their spending onsecurity to protect new and existing infrastructure, but thebreaches continue unabated. Internal records and customerinformation are still being stolen and sold to the highest bidder,causing irreparable damage to corporate reputations. This begsthe question—are these businesses missing something veryfundamental in their approach to network security?The ChallengeA number of highly effective security technologies and solutions are available today:next-generation firewalls, dynamic and static malware analysis, cloud access securitybrokers (CASB), security event and information management (SIEM), and endpointprotection, to name a few. However, a network is only as secure as its weakest link,and without deep collaboration and synchronization between all network elements,enterprises still have a gaping security hole that leaves them vulnerable to attack.Key stakeholders are faced with the realization that their considerable investmentsin popular security products have still not yielded the promised protection.Threat Propagation in an Enterprise with Typical Infrastructure andSecurity ProductsLet’s take a look at a typical enterprise with clients, endpoints, access switches,and wireless access points. A next-generation firewall connected to an antimalwareservice is used at the enterprise perimeter to defend against threats in a northsouth direction, as well as support security between internal segments acrossmany clouds. Endpoint protection software may be available on clients, dependingon their type or model. For IoT, network printers, or new types of endpoints, thisprotection is not available.Network Compromise WorkflowFigure 1 shows a compromised network. These breaches typically follow apredictable pattern:1. Client attempts to download an unknown malware.2. The file is scanned at the perimeter firewall.3. The firewall sends the file to an anti-malware service for analysis, which notifies1

Juniper Connected Security in ActionHacker/MalwareSiteLegitimate ext-Generation FirewallManagement(Firewall Only)Aggregate SwitchesAccessSwitches5Enterprise NetworkFigure 1: Network compromised in an agency with typical infrastructure and security productsthe firewall that the file is malware.4. The firewall blocks the file, preventing it from beingdownloaded.5. However, if the client was compromised outside thecorporate network (a “non-enterprise” environment) or bymanual means, it will continue to infect all other reachablehosts in the network (based on the type of threat).As a result:a. Simply preventing the client from reaching outside thecorporate network is ineffective and does not protectagainst lateral threat propagation.b. The inability of security solutions to communicate with andleverage networking components reduces visibility andrestricts the number of enforcement points.c. Failure to aggregate reports of abnormal behavior fromdifferent knowledge sources such as logging servers,endpoints, and other network elements is a significantweakness in the security strategy.d. Since the security strategy is heavily firewall focused,the complexity of firewall policies can easily overwhelmsecurity teams; this problem is amplified when theenterprise has a global footprint.Juniper Networks Connected SecurityJuniper Networks Connected Security helps organizationssafeguard users, applications, and infrastructure by extendingsecurity to all connection points across the network andproviding the ability to even use other vendors’ technologies.Juniper Connected Security combines policy, detection, andenforcement with a comprehensive product portfolio thatcentralizes and automates security.Juniper Connected Security Building BlocksJuniper Connected Security is built on the following components:1. Sophisticated threat detection engine:a. Juniper Advanced Threat Prevention (ATP) cloud-basedmalware detection solution is used to accurately detectknown and unknown threats.b. Juniper Networks Advanced Threat Prevention Applianceis an on-premises analytics platform that detectssophisticated threats.c. Known threats are detected by consolidating threat feedinformation from a variety of sources—command and control(C&C) servers, GeoIP, third-party devices via REST APIs—aswell as information acquired from in-house log servers.d. Unknown threats are identified by Juniper ATP Cloud orATP Appliance using technologies such as dynamic andstatic malware analysis, machine learning, and threatdeception techniques.2

Juniper Connected Security in ActionOrchestration and Management SoftwareOn PremisesSecurity SoftwareAdvancedTheat RXMist Wi-FiMX Series Security ServiceEX/QFX SeriesNFX SeriesSRX300SRX1500SRX5400SRX5400SRX5800Advance Security Acceleration(IOC4/SPC3)SRX4000Alliance PartnersFigure 2: Connected Security Portfolio2. Centralized management, policy, and analytics:a. Juniper Networks Junos Space Security Director deliversa scalable and responsive security management applicationthat improves security policy administration through asingle pane of glass. b. Policy Enforcer, a component of Security Director, is acentral intelligence module that provides:– Communication with multivendor network elements andsecurity products such as next-generation firewalls toglobally enforce security policies and provide analytics– Consolidation of threat intelligence from differentsources within the premises3. Enforce security everywhere:a. Leverages any network element as an enforcement point.b. Adopts an open, multivendor ecosystem to detect andenforce security across Juniper solutions, cloud, and thirdpartyecosystems.c. Delivers the ability to rapidly block or quarantine threats toprevent north-south or east-west threat propagation.Secure Network Deployment with JuniperConnected SecurityLet’s take a look at a Juniper Connected Security network thatuses Juniper Networks SRX Series Services Gateways deployedas perimeter firewalls connected to Juniper ATP Cloud orATP Appliance for anti-malware services. Security DirectorPolicy Enforcer is the central intelligence component thatcommunicates with different network elements, including nextgeneration firewalls, to globally enforce security policies.Policy Enforcer’s Feed Collector module consolidates threatfeeds from the cloud and on-premises devices along withlogging and in-house threat feeds. Clients/endpoints areconnected to access switches or wireless access points withendpoint protection software. While IoT devices, printers, andnew types of endpoints would not have this protection, PolicyEnforcer can communicate with the access devices to shareintelligence and enforce security where necessary.Juniper Connected Security alters the security breach landscapeconsiderably. Here’s how two different scenarios play out whena Juniper Connected Security network is attacked.3

Juniper Connected Security in ActionAdvanced imeter NGFWAggregate Switches6Juniper andThird-PartySwitchesSupportedRADIUS Server Neededfor Third-Party Switches7AccessSwitchesSecurity Director/Policy EnforcerWi-FiEnterprise NetworkFigure 3: Secure network deployment with Juniper Connected Security and Juniper ATP CloudWorkflow 1: Malware DownloadWorkflow 2: IoT Malware Detection1. A client attempts to download unknown malware.1. An infected IoT device attached to the network attempts todownload a restricted file or launches an attack on a criticalinfrastructure.2. The file is scanned by the perimeter SRX Series firewall.3. The SRX Series firewall sends the file to Juniper ATP Cloud orATP Appliance.4. Juniper ATP Cloud or ATP Appliance determines the fileis malware and notifies the SRX Series firewall and PolicyEnforcer.5. The SRX Series firewall blocks the file from being downloaded.6. Policy Enforcer quarantines the host to a special VLAN (at theswitch) until further investigation is possible. Policy Enforcercan also optionally disable the switch port or Wi-Fi accesspoint that the client is connected to.7. The targeted client is now prevented from infecting otherhosts in the network. East-west and north-south malwarepropagation is halted. Policy Enforcer remembers the client, soeven if it moves to another switch or Wi-Fi access point, PolicyEnforcer recognizes the threat and blocks it from the network.2. The unauthorized download attempt is detected by anSRX Series firewall, which sends the file to the Juniper ATPAppliance for further analysis.3. If an IoT device tries to connect to a C&C server, the SRXSeries firewall will detect the attempt and block the device.4. Policy Enforcer automatically blocks or quarantines the host atthe switch port or Wi-Fi access points.If this attack on the network had happened in a differenttype of network security environment, the IoT device couldhave continued to access additional information; a traditionalnextgeneration firewall would simply have prevented the IoTdevice from communicating outside the organization. If thiswere an internal attack where the attacker had physical accessto the device, damage could be extremely high.4